Following Hugging Face's disclosure this month of a cyberattack driven by autonomous AI, the incident quickly sparked discussions about the "AI hacking era." TechCrunch, citing multiple security experts, stated that while the attack did demonstrate AI's new capabilities in speed and persistence, it does not mean that traditional defense methods have become ineffective.
Many interviewees believed that the exploitation, lateral movement, and credential theft methods used by the attackers did not deviate from common human hacker paths. Hugging Face also mentioned in its incident report that the vulnerabilities exploited were not unfamiliar, and experienced human attackers could also discover and exploit these issues.
17,600 operations lasting four and a half days
According to information disclosed by Hugging Face, the attack model executed 17,600 operations over four and a half days, including intrusion, reconnaissance, password and code theft, and movement within the company's infrastructure.
Security experts generally believe that the real difference lies in the intensity of AI's execution. It can continuously advance tasks for extended periods and attempt them repeatedly over a wide range, without requiring rotations or pauses like human teams.
- Duration: Approximately four and a half days
- Number of operations: 17,600
- Activities involved: reconnaissance, espionage, lateral movement
The attack was not covert.
However, the experts interviewed also pointed out that this attack was far from quiet. Due to the sheer volume of operations, the system should have left behind numerous anomalous signals. Compared to human attackers who prioritize stealth, these AI agents are more like high-frequency probing and advancing, theoretically making them more likely to trigger s.
Some security professionals believe the problem isn't that the system is completely "invisible" to attacks, but rather that after anomalies are detected, the identification results aren't translated into manual intervention and blocking actions quickly enough. This exposes a break in the monitoring, upgrading, and response chain.
Traditional defenses remain effective
Several experts have pointed out that layered defense, least privilege, network segmentation, detection and ing, and continuous attack and defense testing remain fundamental methods for dealing with such incidents. In other words, whether the attacker is AI or not does not change these defense principles themselves.
One recurring issue was access control. Respondents stated that a significant oversight by Hugging Face was that a single set of stolen credentials allowed attackers to gain high privileges across multiple systems, amplifying the potential for subsequent lateral movement.
Some argue that Hugging Face, given its understanding of the model's capabilities at the time, had taken relatively reasonable measures. The practical challenge lies in the fact that many malicious actions are not always easy to distinguish from normal workflows, and simply having a large volume of operations is not necessarily sufficient to constitute a clear red flag.
AI was also used in the post-incident investigation.
TechCrunch reports that Hugging Face needed to process massive amounts of activity logs using AI tools to reconstruct the attack timeline. Because security limitations of cutting-edge models hindered the analysis, the company ultimately used GLM 5.2, an open-source model from the Chinese company Z.AI, to assist in the investigation.
This introduces a new characteristic to the incident: AI launched the attack, AI participated in attribution, and humans were responsible for judgment and handling. For the security industry, this is more like pushing the existing attack and defense system to a higher level of intensity, rather than the complete obsolescence of old methods.
Overall, this incident did not rewrite the basic logic of cybersecurity, but it amplified a real-world problem: when attack speed and noise increase simultaneously, it becomes more critical for companies to effectively utilize their existing detection and response mechanisms.
