The Hub

As of September 2026

The Hugging Face Hub is the actual product behind the name — the website and the servers where models, datasets and Spaces are stored, browsed and downloaded. Underneath the friendly web pages, it is a very large collection of Git repositories with some extra machinery layered on top, and it was that extra machinery, not the plain file storage, that the July 2026 attackers went after.

Everything is a Git repository

Every model, dataset and Space on the Hub lives in its own Git repository, the same version-control system developers use for source code. That has practical consequences even if you never touch Git directly: every file you see has a full history of earlier versions, uploads are tracked as commits with an author, and a repository can be cloned, forked, or referenced by an exact past version rather than "whatever is there today."

Model cards: the readme that matters

Each repository usually has a model card or dataset card — a README file that documents what the model does, what data it was trained on, its limitations, and how to use it. It's the first thing a reader sees on the repo's page, and on the Hub it also drives search and filtering, so a well-written card is often the difference between a model being found or ignored among three million others.

The dataset viewer: convenience with a cost

When someone uploads a dataset, the Hub doesn't just store the raw files — it processes them automatically so visitors can preview rows of data in a table right in the browser, without downloading anything. That convenience requires the Hub's own servers to open and interpret whatever file format was uploaded.

That dataset-processing pipeline is the part of the Hub the July 2026 attackers targeted. Per Hugging Face's own technical account of the incident, the intruders uploaded dataset configurations crafted to abuse two separate flaws in that pipeline: one that tricked the file-reading step (built around the HDF5 scientific file format) into leaking a worker's environment variables and secrets, and a second involving a templating step (Jinja2, inside an fsspec reference spec) that let them run arbitrary Python code inside the Hub's own production servers. From there they moved on to reading internal credentials and reaching further into Hugging Face's infrastructure. The step-by-step technical chain is covered on how the attack worked.

Tokens and access

Access to the Hub — uploading, downloading private material, or calling the Hub through code rather than a browser — is controlled by access tokens, not just a username and password. A token can be scoped narrowly (read-only) or broadly (read and write), and any script, notebook, or automated agent that touches the Hub on your behalf typically does so by carrying one of your tokens. Tokens that leak, whether posted publicly by mistake or exposed through a compromised server, act as a stand-in for the account they belong to, which is why Hugging Face's own security guidance is to rotate them whenever a leak is possible — advice covered in more detail on how to protect yourself.

Organizations and private repos

Repos don't have to belong to an individual. Organizations let several people, or a whole company, share ownership of a set of models and datasets, manage who can write to which repo, and — on paid plans — add single sign-on and audit logging for larger teams. A repo inside an organization can still be public or kept private; private repos are the default choice for anything a company doesn't want indexed and downloaded by the public, including proprietary models, internal datasets, or work still in progress.