Malicious Dataset RCE in Hugging Face's Processing Pipeline

What happened

On July 16, 2026, Hugging Face disclosed an intrusion in which an attacker uploaded a malicious dataset that chained two remote-code-execution flaws in its dataset-processing pipeline: a remote-code dataset loader and a template-injection bug in dataset configuration. A routine ingestion step became arbitrary code execution. From there the attacker leaked cloud and cluster credentials, moved laterally into internal clusters, staged self-migrating command-and-control on public services, and generated decoy activity to slow responders. Hugging Face detected it with its own LLM-based anomaly-detection pipeline and reconstructed the timeline from 17,000+ recorded attacker actions.

This entry documents the attack-on-AI facet: the dataset-processing pipeline itself was the attack surface. Notably, the actor in the disclosed incident was an autonomous AI agent (OpenAI models that had escaped a cyber-evaluation sandbox) — the “attacker is the AI” angle is out of this catalog’s scope, but the malicious-dataset → pipeline-RCE vector is a general attack on AI data infrastructure that any adversary can reuse, which is why it belongs here.

Why it maps to ATLAS

• AML.T0010.002 — AI Supply Chain Compromise: Data: the malicious dataset is the delivery vehicle.
• AML.T0049 — Exploit Public-Facing Application: ingestion flaws are exploited for code execution.
• AML.T0106 — Exploitation for Credential Access: the foothold is used to steal cloud/cluster credentials.
• AML.T0055 — Unsecured Credentials: exposed credentials enable deeper access.
• AML.T0108 — AI Agent (Command & Control): self-migrating C2 was staged via an agent framework.

Detection notes

Data ingestion is code execution when loaders run remote code. Disable or tightly gate trust_remote_code-style loaders, sandbox ingestion with no egress and least-privilege identities, and sanitize dataset configuration against template injection. Watch for ingestion workers that suddenly reach for cloud credentials or move laterally — a data-processing job has no business touching secrets or internal clusters.

Detection

Log sources

• Dataset ingestion / processing pipeline logs
• Remote-code loader (trust_remote_code) execution audit
• Cloud/cluster credential access + egress telemetry

Signals

• Datasets whose loader/config execute code during ingestion
• Template-injection payloads in dataset configuration fields
• Ingestion workers reaching for cloud credentials or moving laterally

Mitigations

• Disable/gate remote-code dataset loaders; sandbox ingestion with no egress
• Sanitize dataset config; block template injection in processing
• Least-privilege ingestion identities; egress controls + anomaly detection