An AI Agent Ran 17,000 Attack Steps in a Weekend. What That Means for Smaller Businesses

On July 16, Hugging Face disclosed that an autonomous AI agent broke into its production systems. According to Hugging Face’s incident report, the attacker executed more than 17,000 recorded actions across a swarm of short-lived sandboxes, harvested cloud and cluster credentials, and moved between internal clusters over a single weekend. No person sat at a keyboard directing it. 

Hugging Face is an AI company, and most businesses will read that and assume it does not apply to them. The part that applies sits in their own assessment of the incident: autonomous offensive tooling “lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed.” 

Why the cost matters more than the technology 

Patience used to be expensive. A slow, multi-stage intrusion meant a skilled person spending days on reconnaissance, and that time had to be justified by the payoff. Smaller companies were often passed over for that reason rather than because their defenses were strong. 

When the patience is automated, the arithmetic changes. A campaign that runs unattended over a weekend costs almost nothing to point at a 40-person accounting firm. 

The way in was ordinary 

The attacker uploaded a file. Hugging Face’s systems processed it automatically, the way they process thousands of others, and two code-execution paths in that processing gave the attacker a foothold. From there it escalated to the underlying servers and collected credentials. 

Strip out the specifics and the shape is familiar. Untrusted content arrived, an automated system handled it without a person in the loop, and that system held permissions worth stealing. 

Most businesses now run some version of that. AI features that read incoming email, summarize invoices, screen resumes, or draft replies to support tickets are automated systems processing content that outsiders control. 

There is also a vendor angle worth noting. Hugging Face asked every account holder to rotate access tokens and review recent activity. That work landed on customers who did nothing wrong. Software vendors across the market sit on this same supply chain, and when one of them has an incident, the remediation arrives as your problem. 

What you can do 

• Inventory the AI features that are already on. (IT) Many were enabled by default in Microsoft 365, Google Workspace, or a helpdesk platform. Write down which ones can read company data and which can take action on their own. 

• Keep a person between AI output and money. (Finance) A summarized invoice or an AI-drafted request to change payment details should never be sufficient on its own. Confirm banking changes by phone, using a number you already had on file. 

• Decide who watches the weekend. (IT / Operations) This intrusion ran Friday through Monday. Find out whether anyone would see an unusual alert from your cloud tenant on a Saturday. If the answer is no, close that gap before buying anything new. 

• Set one rule for connecting AI tools to company accounts. (HR / Operations) Staff will keep trying new tools, and that is fine. A short approval step is easier than discovering months later which applications hold standing access to the company mailbox. 

The strategic side 

None of the above requires new software. It requires someone to decide which AI tools are worth the access they ask for, and to revisit that decision as the tools change. That is the work a fractional CISO does, an experienced security leader for a few days a month instead of a full-time hire, and it is how most companies get ahead of a change like this rather than responding to it one headline at a time. 

Security is tactical and strategic at the same time, and figuring out the second part alone is harder than it needs to be. 

The Plow Networks team is glad to walk through your AI tool inventory, or to talk about what fractional CISO support would look like for a company your size. One question worth asking your team this week: which AI features are running in your business right now that nobody explicitly turned on?