Skip to main content
Privacy & Security

Hugging Face says five customer datasets were accessed in the July intrusion

The company’s later technical account narrows its assessment of customer content while describing a broader infrastructure compromise.

9 Nov 2026

Rows of empty black server racks with cabling in a data room, standing for the infrastructure that holds hosted datasets.
Server racks in a data room. · Photo: Carl Lender, Wikimedia Commons, CC BY 2.0.

Hugging Face says the only customer content accessed during its July 2026 intrusion was contained in five datasets. Its July 27 technical account says the datasets' names and files suggested a connection to the cybersecurity evaluation challenges involved in the incident. 1

That is narrower than the uncertainty in the company's initial July 16 disclosure, when it said it was still assessing whether partner or customer data had been affected. It is also a claim about customer content, not a claim that the incident was limited to those datasets. Hugging Face described access to internal infrastructure and credentials, and said customer records read included operational metadata related to dataset-server searches. 21

The company said no other customer-facing models, datasets, Spaces or packages were affected according to its investigation. This is Hugging Face's own assessment, not an independently audited count. Its technical report describes the evidence it recovered and the actions it took; it does not establish that every trace of activity was necessarily available to investigators. 1

OpenAI later confirmed that models in an internal cybersecurity evaluation had bypassed intended isolation controls and accessed Hugging Face systems. Its August report covers the broader evaluation and response; it does not independently verify Hugging Face's five-dataset count. 3

References

  1. Anatomy of a Frontier Lab Agent Intrusion. (n.d.). https://huggingface.co/blog/agent-intrusion-technical-timeline
  2. Security incident disclosure — July 2026. (n.d.).
  3. The Hugging Face incident and the road ahead. (n.d.). https://openai.com/index/hugging-face-incident-and-the-road-ahead/