Executive Summary
Hugging Face disclosed a malicious dataset that its pipeline executed as code via a remote-code loader and a config template injection bug, giving control of a worker; the attacker took cloud credentials and moved into internal clusters.
What Happened
Hugging Face disclosed that an attacker uploaded a malicious dataset which its processing pipeline executed as code, exploiting a remote code execution loader and a template injection bug in dataset configuration to gain full control of a worker node.[4] From there, the attacker harvested cloud and cluster credentials and moved laterally into several internal clusters, illustrating how AI artifacts like datasets can behave as executable code and represent a critical AI supply chain risk for any organization consuming third-party AI assets.[4]
Affected Products
- Hugging Face
Vulnerability / Attack Technique
Malicious dataset leading to code execution and lateral movement
Technical Mechanism
As reported, unsafe dataset loading executed attacker content.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Datasets can behave like executable code. RealGround analysis: process untrusted data in isolated workers with no credentials.
Recommended Controls
- Disable remote-code dataset loaders
- Run data processing without cloud credentials
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
Rafter Labs via LinkedIn: https://www.linkedin.com/posts/rafterlabs_cybersecurity-aisecurity-appsec-activity-7485385406763642880-En3l
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.