\n<\/p>\n
Late Friday afternoon, a time window companies usually reserve for unflattering disclosures, AI startup Hugging Face said that its security team earlier this week detected \u201cunauthorized access\u201d to Spaces, Hugging Face\u2019s platform for creating, sharing and hosting AI models and resources.<\/p>\n
In a blog post<\/a>, Hugging Face said that the intrusion related to Spaces secrets, or the private pieces of information that act as keys to unlock protected resources like accounts, tools and dev environments, and that it has \u201csuspicions\u201d some secrets could\u2019ve been accessed by a third party without authorization. <\/p>\n As a precaution, Hugging Face has revoked a number of tokens in those secrets. (Tokens are used to verify identities.) Hugging Face says that users whose tokens have been revoked have already received an email notice and is recommending that all users \u201crefresh any key or token\u201d and consider switching to fine-grained access tokens, which Hugging Face claims are more secure.<\/p>\n It wasn\u2019t immediately clear how many users or apps were impacted by the potential breach.<\/p>\n \u201cWe are working with outside cyber security forensic specialists, to investigate the issue as well as review our security policies and procedures. We have also reported this incident to law enforcement agencies and Data [sic] protection authorities,\u201d Hugging Face wrote in the post. \u201cWe deeply regret the disruption this incident may have caused and understand the inconvenience it may have posed to you. We pledge to use this as an opportunity to strengthen the security of our entire infrastructure.\u201d<\/p>\n In an emailed statement, a Hugging Face spokesperson told TechCrunch: <\/p>\n \u201cWe\u2019ve been seeing the number of cyberattacks increase significantly in the past few months, probably because our usage has been growing significantly and AI is becoming more mainstream. It\u2019s technically difficult to know how many spaces secrets have been compromised.\u201d<\/p>\n The possible hack of Spaces comes as Hugging Face, which is among the largest platforms for collaborative AI and data science projects with over one million models, data sets and AI-powered apps, faces increasing scrutiny over its security practices. <\/p>\n In April, researchers at cloud security firm Wiz found a vulnerability<\/a> \u2014 since fixed \u2014 that would allow attackers to execute arbitrary code during a Hugging Face-hosted app\u2019s build time that\u2019d let them examine network connections from their machines. Earlier in the year, security firm JFrog uncovered<\/a> evidence that code uploaded to Hugging Face covertly installed backdoors and other types of malware on end-user machines. And security startup HiddenLayer identified ways Hugging Face\u2019s ostensibly safer serialization format, Safetensors, could be abused<\/a> to create sabotaged AI models.<\/p>\n