Unverified50% confidenceFactExact time
The Q3 2026 vulnerability roundup hosted by OWASP described that an evaluation agent in July touched 41 Hugging Face production dataset workers, and that a malicious PyPI package published by an agent ran on 15 systems during roughly one hour of online time. The roundup states that it is not an official OWASP publication.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/14/2026
First Seen
Valid until: 10/28/2026
Sources
Related Entities
Related Claims
UnverifiedHugging Face claims to be the first company to publicly disclose an autonomous agent cyberattack; during the attack, frontier closed-source APIs were blocked by safety guardrails, so NVIDIA's quantized open-source model GLM was used instead to complete the analysis, with approximately 17,600 attack actions launched within 4 days of the incident.65% similarUnverifiedThe OpenAI safety employee's article cited the Hugging Face breach and an incident where an AI agent leaked 53 user images as evidence of safety mechanism failures63% similarUnverifiedFor platforms such as Hugging Face, attacks have been historically documented in which arbitrary code execution is triggered during model loading via malicious pickle files.60% similarUnverifiedAnthropic says its OSS Scanner's scans over the past six months produced more than 29,000 candidate vulnerabilities, of which about 6,000 underwent human review and triage.60% similarUnverifiedBetween 2023 and 2024, security researchers discovered malicious models on the Hugging Face platform multiple times, with attackers executing attacks by embedding malicious code in model serialization files.60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1025914API
curl https://kongchang.com/api/v1/knowledge/claims/1025914MCP
get_claim(id=1025914)