Hugging Face
huggingface.co · involved in 2 incidents
Roles
As deployer (1)
- AID-2026-0064Jul 2025
Qwen2.5-Coder-32B-InstructAPT28-attributed malware LAMEHUG/PROMPTSTEAL used Qwen2.5-Coder via Hugging Face to write data-theft commands in Ukraine
As affected party (1)
- AID-2026-0006Jul 2026
GPT-5.6 SolOpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks