Hugging Face AI Agent Attack: Defending Against Coordinated Rogue AI Agent Compromise — Detection and Response Guide

---
title: Hugging Face Token File Access by Non-ML Process
id: 3f8a2c14-7b9e-4d51-a6c3-9e2f1a8b4d07
status: experimental
description: Detects access to Hugging Face credential/token files by processes outside expected ML tooling, indicating token theft attempts such as those used in AI supply chain attacks.
references:
  - https://attack.mitre.org/techniques/T1552/001/
  - https://www.bleepingcomputer.com/news/security/nearly-700-rogue-ai-agents-coordinated-in-the-hugging-face-attack/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/.cache/huggingface/token'
      - '/.huggingface/token'
  filter_known_ml_tools:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/huggingface-cli'
      - '/hf'
  condition: selection_path and not filter_known_ml_tools
falsepositives:
  - Backup agents indexing home directories
  - Legitimate configuration management (Ansible, Chef) reading secrets
level: high
---
title: High-Frequency Outbound Polling to Forum or Message Board Endpoint
id: 8c1d5e92-4a6f-4b38-9d21-5c7e3a0f6b19
status: experimental
description: Detects process-level repeated network connections to forum/message-board domains at machine-like intervals, consistent with rogue AI agent C2 coordination via an unauthorized message board.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1102/
  - https://www.bleepingcomputer.com/news/security/nearly-700-rogue-ai-agents-coordinated-in-the-hugging-face-attack/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
    DestinationPort:
      - 443
      - 80
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Legitimate Python automation and CI jobs making HTTPS requests
  - Package managers and SDK telemetry
level: medium
---
title: Model Deserialization Followed by Command Execution
id: b72e4f08-1c93-4a26-8e54-2d9c6b1a3f50
status: experimental
description: Detects Python interpreter processes spawning shell or scripting children shortly after model-loading activity, consistent with malicious pickle/serialized model payloads in the ML supply chain.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/002/
  - https://www.bleepingcomputer.com/news/security/nearly-700-rogue-ai-agents-coordinated-in-the-hugging-face-attack/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/python3.11'
      - '/python3.12'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - ML training scripts invoking shell commands for data preprocessing
  - Jupyter notebook kernel activity in research environments
level: high

// Hunt 1: Access to Hugging Face credential files by unexpected processes
let MLTools = dynamic(["python", "python3", "huggingface-cli", "hf", "pip", "conda"]);
union isfuzzy=true
    (DeviceFileEvents
    | where FolderPath has_any ("huggingface", ".huggingface")
    | where FileName =~ "token" or FolderPath has "token"
    | where InitiatingProcessFileName !in~ (MLTools)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName),
    (Syslog
    | where SyslogMessage has_all ("huggingface", "token")
    | project TimeGenerated, HostName, ProcessName, SyslogMessage);

// Hunt 2: Burst of HF Hub API/downloads from hosts not known as ML pipelines
let KnownMLHosts = dynamic(["gpu-node-01", "ml-runner-01"]); // TODO: replace with your pipeline hosts
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("huggingface.co", "hf.co", "cdn-lfs.huggingface.co")
| where DeviceName !in~ (KnownMLHosts)
| summarize Connections = count(), DistinctRemotes = dcount(RemoteUrl), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where Connections > 50
| order by Connections desc;

// Hunt 3: Python processes spawning shells (model deserialization payload behavior)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("python", "python3", "python3.11", "python3.12")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc;

-- Hunt: HF token artifacts + interpreter processes with active egress
-- Part 1: Locate HF token files and recent access times
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs=[
  '/home/*/.cache/huggingface/token',
  '/home/*/.huggingface/token',
  '/root/.cache/huggingface/token',
  'C:/Users/*/.cache/huggingface/token'
])
ORDER BY Atime DESC;

-- Part 2: Interpreter processes with outbound connections (agent-like behavior)
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|node'
  AND Pid IN (
    SELECT Pid FROM netstat()
    WHERE RaddrIP =~ '^[0-9]' AND State =~ 'ESTABLISHED'
  );

#!/usr/bin/env bash
# harden_hf_pipeline.sh — Audit and harden Hugging Face token hygiene on Linux ML hosts
# Run as root on GPU/training/inference nodes. Review before execution in production.

set -euo pipefail

echo "=== [1] Locating Hugging Face token artifacts ==="
find /home /root /srv /opt -maxdepth 5 \( \
  -path '*/.cache/huggingface/token' -o \
  -path '*/.huggingface/token' \) -type f 2>/dev/null | while read -r f; do
  echo "FOUND: $f (perms: $(stat -c '%a %U:%G' "$f"))"
done

echo "=== [2] Enforcing restrictive permissions on token files ==="
find /home /root -maxdepth 5 \( \
  -path '*/.cache/huggingface/token' -o \
  -path '*/.huggingface/token' \) -type f 2>/dev/null \
  -exec chmod 600 {} \; -exec ls -l {} \;

echo "=== [3] Scanning shell profiles and CI env for HF_TOKEN exposure ==="
grep -RInE 'HF_TOKEN|HUGGING_FACE_HUB_TOKEN|HUGGINGFACEHUB_API_TOKEN' \
  /home/*/.bashrc /home/*/.bash_profile /home/*/.profile \
  /etc/environment /etc/profile.d/ 2>/dev/null \
  && echo "WARNING: HF tokens found in plaintext env files — rotate immediately and move to a secrets manager" \
  || echo "OK: no HF tokens in common env files"

echo "=== [4] Auditing egress to HF endpoints (last 24h, requires auditd or conntrack logs) ==="
if command -v ausearch >/dev/null 2>&1; then
  ausearch -ts recent -k hf_egress 2>/dev/null || echo "No auditd rule 'hf_egress' configured — see step 5"
fi

echo "=== [5] Installing auditd watch on HF token files ==="
if command -v auditctl >/dev/null 2>&1; then
  for d in /home/*/.cache/huggingface /root/.cache/huggingface; do
    [ -d "$d" ] && auditctl -w "$d/token" -p rwa -k hf_token_access && echo "Watching $d/token"
  done
else
  echo "auditd not installed — install it: apt install auditd / dnf install audit"
fi

echo "=== [6] Checking for safetensors enforcement (mitigate pickle RCE) ==="
python3 - <<'EOF' 2>/dev/null || echo "python3 not found — manually enforce safetensors-only model loading"
try:
    import transformers, sys
    print(f"transformers {transformers.__version__} detected")
    print("ACTION: pin model loading to from_pretrained(..., use_safetensors=True) and block torch.load of untrusted .bin/.pt files via policy")
except ImportError:
    print("transformers not installed on this host")
EOF

echo "=== [7] Egress allowlist recommendation ==="
cat <<'NOTE'
Restrict outbound 443 from ML nodes to an explicit allowlist:
  - huggingface.co, cdn-lfs*.huggingface.co (only if hub access is required)
  - Your internal artifact registry / model mirror
Block general web browsing and unknown forum/board domains from compute nodes.
NOTE

echo "=== Done. Rotate any exposed HF tokens at https://huggingface.co/settings/tokens ==="