The Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using an autonomous AI agent system.

Hugging Face is an open-source AI and machine learning platform that provides access to over 45,000 models from leading AI providers and is used by more than 50,000 organizations.

The company is still investigating whether partner or customer data was affected and said it would contact any affected parties directly. Hugging Face said it has found no evidence of tampering with public-facing models, datasets, or Spaces to date, and that its software supply chain has been “verified clean.”

The intrusion began in Hugging Face’s data-processing pipeline, with the attackers using a malicious dataset to exploit two code-execution vulnerabilities and run code on a processing worker. This allowed them to steal cloud and cluster credentials and move laterally across several internal clusters.

“The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness – used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services,” Hugging Face said in an incident disclosure published Thursday. “This matches the ‘agentic attacker’ scenario the industry has been forecasting.”

In response to the breach, Hugging Face has closed the vulnerable code execution paths (a template injection in a dataset configuration and a remote code dataset loader), evicted the attacker, rebuilt the compromised nodes, and revoked and rotated all affected credentials.

It also deployed improved malicious activity detection systems, reported the incident to law enforcement, and is now working with external forensic experts to assess the breach’s impact.

“We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” Hugging Face added.

“The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment.”

Hugging Face advised users to rotate access tokens and review recent account activity for signs of suspicious behavior and said it would continue sharing findings on defending against AI-driven attacks.

While this is the first security incident affecting the platform that has been linked to an AI agent, it’s not the first breach disclosed by Hugging Face in recent years.

The company also revoked some members’ authentication secrets and advised them to switch to fine-grained access tokens two years ago after hackers breached its Spaces platform.

Threat actors have also been abusing the platform in recent years to push malicious AI/ML models and infostealer malware, and to spread thousands of Android malware variants.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

• NordStellar reports 2,581 ransomware attacks in Q2 2026, with Qilin (299) and The Gentlemen (284) leading activity, far ahead of DragonForce (147)
• US SMBs were hit hardest, suffering 769 incidents; Canada (97), Germany (83), and the UK (74) followed, while attacks on billion‑dollar enterprises surged 74%
• Experts say rivalry between Qilin and The Gentlemen is driving the spike, with major corporate hits seen as reputation‑boosting trophies in the cybercriminal underground

Two ransomware gangs are battling for dominance, and US-based SMBs are the ones suffering most for it, experts have claimed.

Fresh data about the state of ransomware in 2026, compiled by security experts from NordStellar, shows two groups – Qilin and The Gentlemen – being by far the most active ones.

In Obsession, an awkward young man gets more than he bargained for when he wishes for his crush to love him back with the help of a gag gift from a novelty store. After a rocky start, Bear gets what he wanted… sort of… before his relationship with Nikki takes a series of increasingly bizarre turns and goes completely off the rails.

In his feature film debut, writer, director, and editor Curry Barker demonstrates one of those uniquely original voices that makes us rethink what a horror movie can be, shocking even genre buffs and video reviewers who think they have seen it all. With tips of the cap to The Twilight Zone and Get Out, the script takes us places we have never been, growing deeper and darker while maintaining a surprising amount of humor in perfect balance.

The performances help tremendously, with the lead actors bringing a naturalistic edginess that ensures we never quite know what to expect next. Props to newcomer Inde Navarrette as Nikki, who is so terrifying that she reportedly made her costars, and herself, quite uncomfortable.

The movie is presented in the unusual 1.5:1 aspect ratio, with vertical black bars on the left and right and occasional elements within the frame that add to the sense of claustrophobia, as though the characters are trapped in their predicament. Director of photography Taylor Clemons often backlights the actors to creepy effect, but the high dynamic range preserves ample facial detail, while the precise image reveals haphazard shaving stubble, the fine fibers of a sweater, and the uneven degrees of focus within the frame.

You could call the sonic jolts in Obsession’s Dolby Atmos mix “jump scares,” but not in the same way as in, say, a Freddy or Jason style slasher. Instead, an abrupt beat might trigger the question, “What the hell is she going to do next?” The answer: Nothing good. Hard offscreen cues do a good job of establishing three-dimensional space, while Rock Burwell’s musical score envelops us but also bludgeons us from time to time, leaving us exhausted by the end credits.

Barker’s audio commentary track is definitely worth a listen for the infectious energy of a filmmaker at the top of his game. In a hurry? Check out the 19-minute “Obsession Unleashed” featurette, which also brings in the principal actors to share their own behind-the-scenes tidbits. The two-disc set includes an HD Blu-ray of the movie with the same extras, plus a 4K Movies Anywhere digital copy code.

This is definitely one I’ll be watching again, which is another reason physical media rocks. There are plenty of clues and little Easter eggs waiting to be discovered and dissected, a testament to the thoroughly smart script and the clever way Barker executes his twisty vision.

Movie Details

• STUDIO: Universal Pictures Home Entertainment
• FORMAT: Ultra HD 4K Blu-ray (July 14, 2026)
• THEATRICAL RELEASE YEAR: 2026
• ASPECT RATIO: 1.50:1
• HDR FORMATS: Dolby Vision, HDR10
• AUDIO FORMAT: Dolby Atmos with TrueHD 7.1 core
• LENGTH: 109 mins.
• MPAA RATING: R
• DIRECTOR: Curry Barker
• STARRING: Inde Navarrette, Michael Johnston, Cooper Tomlinson, Megan Lawless, Andy Richter, Darin Toonder

Our Ratings

★★★★★★★★★★ Movie

★★★★★★★★★★ Picture

★★★★★★★★★★ Sound

★★★★★★★★★★ Extras

Where to buy:

Related Reading:

More Family Board Games

Photograph: Simon Hill

There are so many family board games. Here are a few more we liked.

In a World for $28: Someone reads out an “In a World,” card which might say “where we are setting up a colony on a distant planet,” and then the players read out “We want” cards like “a lifetime supply of bananas” or “a thriving coffee shop.” It’s a family-friendly twist on Cards Against Humanity (with similar weaknesses), but players also try to sell their card as the best pick which adds a nice twist.

Cat in the Box Deluxe Edition for $31: There are a few mechanics at play here, including bidding on how many tricks you think you’ll win before play begins, but what makes this game different is that you must also decide on your card’s color. It seems complex at first, but younger kids used to card games will be able to grasp this.

Wingspan for $55: This might be the pinnacle of nature-themed board games and will appeal to anyone who loves our feathered friends. It blends authentic knowledge about different bird species and their needs, habitats, and abilities, with a healthy dose of strategic depth.

Dorfromantik: The Duel for $41: Based on the video game Dorfromantik, which spawned a cooperative board game, this spin-off pits you against another player as you draw tiles to build a landscape and try to complete tasks along the way. With identical sets in red and blue, it’s all about who builds a better environment to satisfy their villagers and score the most points. Play time is under an hour. You could play with two teams, but it works best as a two-player game.

Hey Hey Relay for $15: This super silly dice game is a race between two teams with challenge cards prompting silly voices and physical actions before you can proceed. It’s fast and chaotic to play, but probably best for younger kids (the makers suggest 6 years and up). My kids didn’t like it much, but this could be a fun party game.

Ship Show for $30: This cooperative game casts players as stockers and shippers and challenges them to correctly ship orders by guessing the correct tiles based on clues provided by the way they have been grouped. The time limit adds pressure, and this can be fun for the right group (you need to be on the same wavelength), but we found the wait for the stockers to set up was dull for shippers, and the scoring was laborious.

Flip 7 for $8: The thrill of pushing your luck is the draw for this hybrid card game, as you hit or stick Blackjack-style, trying to get seven different face-up cards. Special action cards and modifiers mix things up, allowing for some tactical play. Suitable for three or more players aged 8 and up, it only takes 20 minutes to play.

Tension: The Top 10 Naming Game for $30: Topic cards have 10 items within a category, and the opposing team has 60 seconds to guess as many as they can. Cards are divided into two colors (easy and harder), making it easy to play with kids or adjust the difficulty on the fly. This works well with any age or team size, but be prepared for lots of shouting and laughing.

You Gotta Be Kitten Me! for $26: A simple twist on liar’s dice that focuses on bluffing and calling bluffs; I am of two minds about this game. On the one hand, the game is nothing special, but on the other, cute cats! My moggy-obsessed daughter immediately wanted to play, and we had a few laughs with outrageous bluffs on the number of glasses, hats, and bow ties on these felines.

Poetry for Neanderthals for $20: Every card has a word, and your seemingly simple task is to get your team to correctly guess it within the time limit by speaking in single syllables only. If you break the rules, the opposition can hit you with the inflatable “No” stick. Suitable for two to eight players aged 7 and up, it’s loud, silly, and usually makes everyone laugh.

Danger Danger for $9: Fast and frenetic, this simple card game for two teams is about trying to have high-scoring cards showing at the end of each round. There are no turns, you can cover the other team’s cards, and rounds are timed, but you must guess when the round will end. Super simple and very quick to play, this game can get chaotic.

That Escalated Quickly for $20: This game is quick, easy, and fun for up to eight players. Featuring scenarios such as “I have invented a new sport, what is it?” players must provide suggestions from least dangerous (1) to most dangerous (10) based on their assigned number for each round. The leader of the round has to try to get them in the correct order. It works best with witty players who know each other well.

Sounds Fishy for $23: Another fun group game from Big Potato, the challenge in Sounds Fishy is to spot fake answers. Each card poses a question, but only one of the answers you get is correct. It’s for four to 10 players, and we found it more fun but tougher with more people.

Cards Against Humanity: Family Edition for $29: You can play this party game with up to 30 players, and it will produce a fair bit of juvenile giggling and chortling. Like the adult version, there isn’t much strategy here, but finding the perfect combination to crack everyone up is satisfying.

Don’t Bother

We were not so keen on these games.

Photograph: Simon Hill

Zilence: As a group of zombie apocalypse survivors atop a skyscraper, you must choose the correct flight path to snag the resources you need, determined by cards. A tight time limit makes it tricky to pick the right routes from the tangled mess on the game board, and it can be assembled differently for replay value. But the backdrop feels incongruous, and we all agreed it wasn’t much fun to play.

Connecto: Connect different symbols on your board with a dry-erase marker based on a randomly drawn challenge card to make a picture of something (like connect the dots). The first one to guess what it’s supposed to be wins the round (some are only vaguely like what they’re meant to be). Longevity takes a hit, as there’s no fun in replaying solved puzzles.

A Game of Cat & Mouth: Incredibly simple, this dexterity game challenges you to fire rubber balls through a cat’s mouth with magnetic paws, but they end up everywhere. Games tend to be very one-sided, and my kids got bored almost immediately. It is also impossible to play with actual cats in the vicinity.

Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

Microsoft is looking to improve the privacy protection of your sensitive PDFs by closing one of the more obvious loopholes in its document protection system. It is also giving businesses another reason to keep Microsoft Edge firmly installed.

Starting next month, OneDrive and SharePoint will block screen captures when users open certain sensitivity-labeled PDFs through their web viewers in Microsoft Edge. The restriction applies to enterprise organizations using Microsoft Purview Information Protection rather than ordinary personal OneDrive accounts.

Your ordinary PDFs will continue as usual

The protection applies specifically to PDFs carrying a sensitivity label without the Copy, also described as EXTRACT, permission. If these conditions are met, screen capture enforcement will activate by default when the document is viewed in Edge. Existing labels and organization policies remain in place.

Unlabeled files and labels without these restrictions continue behaving normally. The feature affects OneDrive for Business and SharePoint Online, so you will not suddenly lose the ability to screenshot a restaurant menu or instruction manual. The company added that the change aims to close a gap between its desktop applications and browser experience.

Purview labels could already prevent actions such as editing, printing, copying, and taking screenshots in supported desktop apps. However, PDFs opened in the browser did not consistently respect the same screen-capture control. Admins can also disable local downloads, preventing users from simply saving a protected document and reopening it elsewhere.

The protection currently ends at Edge

Chrome, Firefox, Safari, and other mobile web browsers will not support the restriction when it reaches general availability. Microsoft warns that users opening protected documents outside Edge may receive inconsistent enforcement, and it recommends that businesses use Conditional Access or browser-management policies to direct employees toward Edge.

Unfortunately, this is exclusive to Microsoft Edge at the moment. The security benefit is easy to understand, especially for companies sharing sensitive documents like financial records, legal material, or unreleased products. Its effectiveness depends heavily on convincing, or requiring, everyone involved to use Microsoft’s browser.

Windows Latest reports that support for additional browsers and mobile apps could arrive later. Microsoft’s current notice does not provide a broader rollout date. Targeted organizations should begin receiving the feature in early August, followed by a worldwide general rollout between the middle and end of the month.

Kapwing is among the best AI video editors today. It allows you to create videos with simple text prompts and generate lively AI characters to build detailed storylines.

Trusted by brands like Google, Dyson, and Spotify and used by thousands of content creators across YouTube, TikTok, and digital marketing platforms, Kapwing has quickly grown to become one of the industry’s favorite video generation and editing software.

If your AI rollout is making people more exhausted, the architecture is wrong. That’s not a provocative claim; it’s the logical conclusion of what the data shows. With 69% of UK businesses implementing AI assistants, these tools have become part of everyday working life.

But deployment without the right operational structure is leaving employees exposed to the harmful effects of ‘AI brain fry’. AI overload is not a failure of the individual, but a failure of system design. And it is the responsibility of technology and business leaders to fix it.