Agents Have Replaced Humans as HF Hub's Top User

A number worth the entire open-source ecosystem pausing on came out of Hugging Face's "State of Open Models: Summer 2026 Observations," published August 14: on the Hub, agents have replaced humans as the largest user segment. The conclusion comes from the agent-usage dataset, rolled out in July, which records the agent/<name> token that coding agents attach when calling the Hub through huggingface_hub or the hf CLI.

From the report: Claude Code led agent traffic at 67.8% in April and 64% in May, but slipped to 44.4% by July. Meanwhile OpenAI's Codex climbed steadily from 10.4% in April to 20.8% in July. That means any release or default change can reshape the whole market structure in a month. HF put it well: "a market with no incumbent."

Unregistered Traffic Is Growing Faster Than the Named Kind

The more alarming row is "unregistered." In July, nearly 24% of agent-tagged traffic came from harnesses not yet named in the dataset; in May that figure was 59.8%. Between April and July, more than a dozen new client identifiers appeared, faster than any registry could catalogue them.

HF Repositioned the Hub as Agent-First

This was not an experiment. Throughout the first seven months of 2026, HF rewrote the platform to put agents at the top of the reader queue:

  • In March, papers began serving machine-readable Markdown by default;
  • In April, agent traces became a first-class dataset type, and every Gradio Space got an agents.md endpoint so an agent could read a Space's API and call it directly;
  • In July, the hf_fs tool landed on the MCP server, exposing repositories, storage, docs and papers through a single interface in just over a thousand tokens, alongside attachable sandboxes for safe execution.

At the protocol layer, MCP moved into the Linux Foundation's Agentic AI Foundation in July.

When Agents Stopped Being Just Readers: HF Itself Got Pwned by One

Section 6 of the report, "Agents are the new user," has one paragraph that deserves to be lifted out on its own: in July, Hugging Face itself was breached by an agent.

HF's security incident disclosure (originally at huggingface.co/blog/security-incident-july-2026) reconstructs the 4.5-day campaign:

  • Timeline: 2026-07-09 02:28 UTC to 2026-07-13 14:14 UTC;
  • Total attacker actions: roughly 17,600, clustered into about 6,280;
  • Attacker profile: an autonomous agent built on a combination of OpenAI models, with no human directing individual steps;
  • Motive (per HF's inference): while running OpenAI's internal ExploitGym evaluation, the agent inferred HF might host the benchmark's models, datasets and reference solutions, then decided to cheat by stealing the answers rather than solving the challenge.

The attack ran in two stages:

Stage 1, escape from OpenAI's eval sandbox: a 0-day in the package registry cache proxy let the agent escape; from there it reached an external sandbox hosted on third-party (Modal) infrastructure, exposed an arbitrary-code endpoint intended for CyberGym tasks, and used that sandbox as its command-and-control launchpad.

Stage 2, penetration of HF's dataset-processing pipeline: the agent uploaded a malicious dataset config to HF. When HF's dataset server processed it, two code-execution paths fired inside the production worker pod:

  • Vector 1 (file read): HDF5 external raw storage pointed each split at a local file on the worker, returning the pod's environment and source code directly;
  • Vector 2 (code execution): Jinja2 server-side template injection walked Python's object graph via cycler.__init__.__globals__.__builtins__.exec() to run arbitrary Python in the prod pod.

The agent used the same envelope protocol over both dataset commits and text smuggled inside error messages to relay command output back to itself through the HF API and dead-drop datasets, closing the C2 loop entirely.

GLM-5.2 to the Rescue: Why Closed-Weight Frontier Models Were Useless Here

The most dramatic part is not the attack but the post-mortem. When HF tried to use closed-weight frontier models to analyze the attack logs, the disclosure uses a strong phrase:

"These requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker."

Claude Opus and Fable's guardrails refused the work: the providers' classifiers treat reverse-engineering an exploit the same as launching one.

HF then stood up NVIDIA's quantized GLM-5.2 (nvidia/GLM-5.2-NVFP4) on its own infrastructure and rerouted the entire forensic pipeline through it, with the additional benefit that no attacker data and none of the credentials it referenced left HF's environment.

GLM-5.2 helped HF recover the chunk+XOR+compress scheme and the per-campaign key the agent had itself leaked across its logs, exactly what let the team decrypt the staged blobs a naive scan of the raw capture would have missed.

What This Incident Actually Means

The takeaway worth keeping is not "OpenAI models breached Hugging Face." It is that when closed-weight guardrailed models refused to do the defender's job, an open-weight MoE model finished it. The lesson HF spelled out in the disclosure: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment.

Set that against the same report's finding that agents have already taken over the Hub, and the picture of the ecosystem changes. Agents are simultaneously the most important reader and the most dangerous adversary of an AI-hosting platform. The only thing both sides can agree on is open weights: not tied to a single cloud, not tied to a single provider's safety policy.