HuggingFace security incident report: "the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails"

Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of