Security incident disclosure — July 2026

Hugging Face's July 16, 2026 incident disclosure describes a defensive problem with hosted AI: the company says commercial model APIs blocked its forensic requests because analyzing an AI-driven intrusion meant submitting real attack commands and exploit material. Its responders instead ran an open-weight model, GLM-5.2, on their own infrastructure to analyze the intrusion logs, which also kept attacker data and the credentials it referenced inside their environment. The company draws the lesson that defenders should have a capable self-hosted model vetted before an incident, while saying this is not an argument against safety measures on hosted models. At publication, it was still assessing whether partner or customer data had been affected. Incident disclosure