Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-16 · high
The company is telling users to rotate Hub tokens and audit repo write scopes, especially in automated CI pipelines.
Why now: This is a first-party disclosure, posted directly on Hugging Face's blog in July 2026 rather than surfaced by an outside researcher.
Hugging Face disclosed a security incident on its Hub in July, per Hugging Face's blog. The Hub is the default distribution point for weights and datasets across the ecosystem, so a token incident becomes a supply chain problem fast.
Their own advice: rotate Hub tokens and audit which repos have write access tied to them. The company flags programmatic pulls in CI as the first place to check, which means looking at service accounts and scheduled jobs that call the Hub API, not just personal developer logins.
The post doesn't say how many tokens were exposed or what was actually accessed. No numbers yet, just the rotation advice.
Each link below shares sources, entities, or timing with this story.
Hugging Face criticizes OpenAI / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Hugging Face criticizes OpenAI); both cover Hugging Face, July; overlapping topics (access, face, hugging).
Hugging Face criticizes OpenAI / Shared entity: Hugging Face / Same source / Shared topic / What happened next
Linked by a graph relationship (Hugging Face criticizes OpenAI); both cover Hugging Face; cite the same source (First-party disclosure on their blog).
Hugging Face criticizes OpenAI / Shared entities / What happened next
Linked by a graph relationship (Hugging Face criticizes OpenAI); both cover Hugging Face, July; picks up the Hugging Face thread on 2026-07-27.
Hugging Face released Safetensors / Shared entity: Hugging Face / Shared topic / What happened next
Linked by a graph relationship (Hugging Face released Safetensors); both cover Hugging Face; overlapping topics (face, hugging).
Hugging Face criticizes OpenAI / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Hugging Face criticizes OpenAI); both cover Hugging Face, July; overlapping topics (face, hugging).
Hugging Face criticizes OpenAI / Shared entities / What happened next / Tension
Linked by a graph relationship (Hugging Face criticizes OpenAI); both cover Hugging Face, July; picks up the Hugging Face thread on 2026-07-23.
Hugging Face partners with Open Secure AI Alliance / Shared entity: July / What happened next
Linked by a graph relationship (Hugging Face partners with Open Secure AI Alliance); both cover July; picks up the July thread on 2026-08-05.
Linked by a graph relationship (Hugging Face partners with Open Secure AI Alliance); both cover July; picks up the July thread on 2026-07-30.