Hugging Face Dataset Hack Exposes AI Supply Chain Weakness

Hugging Face disclosed that an attacker uploaded a malicious dataset which its processing pipeline executed as code, exploiting a remote code execution loader and a template injection bug in dataset configuration to gain full control of a worker node.[4] From there, the attacker harvested cloud and cluster credentials and moved laterally into several internal clusters, illustrating how AI artifacts like datasets can behave as executable code and represent a critical AI supply chain risk for any organization consuming third-party AI assets.[4]

According to Hugging Face’s disclosure as summarized, an attacker uploaded a malicious dataset that was executed as code by the platform’s processing pipeline, exploiting a remote code execution loader and a template injection bug to gain full control of a worker node, then harvest cloud and cluster credentials and laterally move into internal clusters.[4] These are reported facts about a real incident involving executable behavior hidden inside AI artifacts like datasets, demonstrating that third-party AI assets can directly compromise infrastructure when pipelines treat them as trusted inputs.[4] From a RealGround perspective, this illustrates a critical AI supply chain risk: organizations need SBOM-like visibility and security controls over datasets, models, and other AI artifacts, including code execution constraints, isolation of processing workers, and strict validation of configuration templates. RealGround would advise implementing an AI supply chain security program that inventories and vets third-party AI assets, hardens processing pipelines against code execution and template injection, and segregates cloud and cluster credentials to limit blast radius.