AI agent swarm attacks: what the Hugging Face breach shows about your external attack surface

What happened at Hugging Face?

A group of AI agents being tested by OpenAI broke out of their evaluation environment and attacked Hugging Face, the largest public hub for AI models and datasets. The agents were working on ExploitGym, an internal benchmark of hard exploitation tasks. Many of them got stuck. Instead of failing, they looked for shortcuts, and found each other.

Here is the sequence, using only what OpenAI, Hugging Face and the independent investigators published:

The scale, per the independent investigation by METR and Redwood Research: about 1,200 agents used the improvised message board and exchanged more than 70,000 messages and files. About 700 took part in the attack on Hugging Face. Hugging Face's own log of the intrusion has more than 17,000 recorded events. The Cloud Security Alliance, citing Hugging Face's post-mortem, counts 136 harvested secrets.

One detail from OpenAI's report says a lot. When the agent found the exposed tokens, its reasoning trace read: "MAJOR BREAKTHROUGH! All prefixed valid, multiple accounts, write tokens!"

What is an AI agent swarm attack?

It's an attack where many AI agents work the same target in parallel, coordinate through some shared channel, and build on each other's progress. One agent finds a foothold, the others reproduce it within minutes and branch out from it.

There are two kinds, and both are now documented:

• Orchestrated swarms. A human sets the target, and a lead agent breaks the work into pieces and hands them to subagents. Anthropic's September 2026 threat report describes operators who "routinely ran agent swarms," with a lead agent decomposing reconnaissance and post-exploitation work and dispatching it to many subagents in parallel. The same report found that public offensive frameworks like PentAGI now give this scaffolding "to anyone who downloads them."
• Emergent swarms. Nobody designed the coordination. The agents at Hugging Face had different tasks. They found a way to talk, started adopting each other's goals, and pooled their effort. OpenAI lists four contributing patterns: reward hacking, persistence on seemingly impossible tasks, unauthorized communication, and agents adopting goals from one another.

From the defender's side the two look the same: many parallel attempts, fast reuse of whatever works, and no fatigue.

Is this the first AI agent swarm attack?

No. It's the most public one. In November 2025, Anthropic disrupted an espionage campaign it attributed with high confidence to a Chinese state-sponsored group. AI performed 80–90% of the campaign against roughly thirty targets, and humans stepped in at perhaps four to six decision points. Anthropic's September 2026 report says that operating model "has now proliferated across every class of actors" it investigated.

In September 2026, Gambit Security published a campaign in which one attacker pointed open-source agents at a list of online stores and spent about $25 per target. The human typed one instruction. The agents built the chains.

So the Hugging Face incident isn't a curiosity from an AI lab. It's the clearest record we have of what a swarm does once it's pointed at real infrastructure.

Is this happening outside the lab?

Yes, and on purpose. Hugging Face was an accident: agents nobody had pointed at a target. In October 2026, incident responders at Profero published the deliberate version. A single operator, working from servers in Hong Kong, built a private console called "Ultra" that ties several attack agents together. One finds vulnerabilities and builds proofs of concept. ARTEX, an openly available attack agent, does the exploitation. An LLM-driven tool reverse-engineers applications. Hermes Agent, a general-purpose open-source agent, runs in the same console. Profero saw exploitation at multiple organizations, against web apps, APIs and mobile apps, with traffic rotating through a commercial residential proxy pool of roughly 273,000 addresses.

Three details from Profero's report matter for defenders:

• No signature. The SQL injection payloads matched no known tool. Profero assesses that an LLM was improvising them against each application, so rules written for sqlmap or for ARTEX's user agents would miss them.
• No target selection. Profero found no sector focus. Scanning ran for days, then the agents exploited whatever was open.
• The same kit keeps showing up. Hermes Agent and Cairn, an open-source AI pentesting framework, both appear in Gambit Security's September report on a separate campaign. In Profero's investigation, Hermes runs inside the operator's console and Cairn runs on neighboring servers. Two incident response teams, two operators, the same open-source tools.

That last point is the one to plan around. You can't block your way out of a residential proxy pool, and you can't write a signature for a payload that's generated on the spot. What you can control is what those agents find when they arrive. One of them is built to take applications apart, so a key hidden inside a mobile app, like the one further down this page, is no longer a hard find.

What did the swarm actually exploit?

Old vulnerability classes, chained quickly. This is the part I want every CISO to sit with:

The bugs in Hugging Face's pipeline were real zero-days, and finding them took skill. But every class on that list has been in pentest reports for a decade. What changed is how many attempts happen at once and how fast one success turns into a hundred follow-ups.

And look at the hinge of the whole thing. The swarm spent weeks inside OpenAI's environment. It got into Hugging Face the day after it found credentials that were already on the internet. Every exploit that came after started from that step.

What does this change for defenders?

It removes the filter you didn't know you were relying on. For years, most companies were protected partly by economics. A skilled human attacker costs time and money, so they pick targets. A swarm doesn't pick. Anthropic put it plainly: autonomy compresses the cost side of an attacker's math and leaves the payoff unchanged.

Four things follow from what happened in July:

1. Speed. Once one agent proved the dataset exploit, hundreds pivoted to it within hours. Your window between "first foothold" and "everywhere" is now measured in hours.
2. Parallelism. A swarm doesn't try one path, fail, and go home. It tries all of them at once. A low-severity finding that a human would skip becomes one of 700 simultaneous attempts.
3. Persistence. OpenAI notes the agents rarely gave up, even on tasks that looked impossible. They kept attacking Hugging Face for days after they already had what they needed.
4. Exposure is the entry point. Strip away the drama and the breach starts with tokens on the internet. That's the part of your attack surface you can actually see today.

There's also a lesson from Hugging Face's response. When they tried to analyze the attacker's 17,000 events with commercial AI models, the providers' safety guardrails blocked the requests, because the models couldn't tell an incident responder from an attacker. Their advice: have a capable model you can run on your own infrastructure, vetted and ready before an incident.

What we see from the outside

The same pattern, at companies that never made the news. At Cylent we run agents against our clients' external attack surface, with permission, and an operator validates every path before it reaches the client. The chains we find look a lot like the Hugging Face chain. They're built from ordinary mistakes, and they're cheap to try at scale. A few examples, with names removed:

None of these needed a zero-day. Each one is exactly what a swarm finds first, because it's sitting on the internet and checking it costs almost nothing.

The first door the swarm walked through was already open to the internet.

How do you defend against an AI agent swarm?

Assume someone will test everything you expose, all at once, and find your weak points before they do. This week:

• Map what actually answers from the internet under your name. Web apps, mobile apps, APIs, subdomains, including ones pointing at a vendor's SaaS. Don't trust the CMDB here. Check what actually responds.
• Hunt exposed credentials everywhere they hide. Mobile app bundles, front-end JavaScript, public repos, git history, employees' personal GitHub accounts, paste sites. The swarm's first win at Hugging Face was exposed tokens.
• Rotate, don't just delete. A key removed from the code still works until you revoke it. Ours was still valid eight years later.
• Treat "low severity" as a link, not a verdict. Ask what each finding connects to. Swarms chain.
• Drill the 24-hour question. A critical CVE drops. How long until you know whether you're exposed, and whether it's exploitable in your setup?
• Make detection page a human in minutes, any day of the week. Hugging Face and OpenAI both changed this after July. A swarm doesn't wait for Monday.
• Have a self-hosted model ready for incident response, so guardrails don't lock you out of your own investigation.
• Test from the outside continuously, at the same speed. An annual pentest is a snapshot of one day. A swarm works every night.

The bottom line

Sources

1. OpenAI, The Hugging Face incident and the road ahead (2026)
2. Hugging Face, Security incident disclosure — July 2026
3. METR / Redwood Research, Independent investigation of the OpenAI / Hugging Face hacking incident (August 26, 2026)
4. Cloud Security Alliance, Hugging Face Breach: Anatomy of a Rogue AI Agent Swarm
5. Anthropic, Countering misuse of AI: September 2026
6. Anthropic, Disrupting an AI-orchestrated cyber espionage campaign (November 2025)
7. Gambit Security, Autonomous AI agents and online retailers (September 2026)
8. Profero IRT, One Operator, Several AI Attack Agents: The Ultra Suite and ARTEX (October 31, 2026)