A prominent AI platform, Hugging Face disclosed a breach on its Spaces platform, exposing authentication secrets to unauthorized access. The Spaces platform is a repository for AI apps developed and shared by the community. The breach was detected earlier this week, prompting the company to act immediately. Authentication tokens linked to compromised secrets were revoked, and affected users were notified via email.
The company urged all Hugging Face Spaces users to refresh their tokens and transition to fine-grained access tokens, providing enhanced control over access to AI models. Hugging Face has intensified security measures in response to the breach, collaborating with cybersecurity experts to investigate and notify relevant authorities.
Additionally, the platform has implemented various security enhancements, including removing org tokens, adopting a key management service for Spaces secrets, and reinforcing token detection systems. Plans are underway to phase out “classic” read-and-write tokens in favor of fine-grained access tokens.
As Hugging Face gains popularity, it has attracted attention from threat actors seeking to exploit its resources for malicious purposes. Recent incidents include the discovery of malicious AI ML models by cybersecurity firm JFrog, which were used to execute harmful code, and a vulnerability identified by security researchers at Wiz, enabling cross-tenant access to customer models through container escapes.
