What is the official website of Hugging Face ?

The official website of Hugging Face is https://huggingface.co.

What is Hugging Face's cybersecurity risk score?

Hugging Face has an AI-generated cybersecurity risk score of 524 out of 1000, indicating a Critical security posture according to Rankiteo's assessment.

How many security incidents has Hugging Face experienced?

According to Rankiteo, Hugging Face currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Hugging Face been affected by any supply chain cyber incidents ?

According to Rankiteo, Hugging Face has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: OpenAI (Incident ID: CHE1784787889) OpenAI (Incident ID: HUGOPE1784680106) OpenAI (Incident ID: HUG1784399023) marimo (Incident ID: MARHUG1779193669) OpenAI (Incident ID: OPEHUG1784831064)

Does Hugging Face have SOC 2 Type 1 certification ?

According to Rankiteo, Hugging Face is not certified under SOC 2 Type 1.

Does Hugging Face have SOC 2 Type 2 certification ?

According to Rankiteo, Hugging Face does not hold a SOC 2 Type 2 certification.

Does Hugging Face comply with GDPR ?

According to Rankiteo, Hugging Face is not listed as GDPR compliant.

Does Hugging Face have PCI DSS certification ?

According to Rankiteo, Hugging Face does not currently maintain PCI DSS compliance.

Does Hugging Face comply with HIPAA ?

According to Rankiteo, Hugging Face is not compliant with HIPAA regulations.

Does Hugging Face have ISO 27001 certification ?

According to Rankiteo,Hugging Face is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Hugging Face operate in ?

Hugging Face operates primarily in the Software Development industry.

How many employees does Hugging Face have ?

Hugging Face employs approximately 726 people worldwide.

Does Hugging Face own any subsidiaries ?

Hugging Face presently has no subsidiaries across any sectors.

How many LinkedIn followers does Hugging Face have ?

Hugging Face's official LinkedIn profile has approximately 35,000 followers.

What is the NAICS classification code for Hugging Face ?

Hugging Face is classified under the NAICS code 5112, which corresponds to Software Publishers.

Does Hugging Face have a Crunchbase profile ?

Yes, Hugging Face has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/hugging-face.

Does Hugging Face have a LinkedIn profile ?

Yes, Hugging Face maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/huggingface.

How many cybersecurity incidents has Hugging Face experienced ?

As of August 3, 2026, Rankiteo reports that Hugging Face has experienced 9 cybersecurity incidents.

How many peer or competitor companies does Hugging Face have ?

Hugging Face has an estimated 30,524 peer or competitor companies worldwide.

What types of cybersecurity incidents has Hugging Face faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Breach and Vulnerability.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Hugging Face

Boost Score +25 with badge (5 left)

524

/1000

Critical

549

/1000

Critical

Hugging Face Vendor Cyber Rating & Cyber Score

huggingface.co

cb in

Add Your Compliance Badge

The AI community building the future.

Hugging Face A.I CyberSecurity Scoring

Scoring History

Hugging Face

Hugging Face CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Hugging Face

Vulnerability

100

7/2026

OpenAI

CHE1784787889

Hugging Face

Breach

7/2026

OpenAI

HUGOPE178468010...

Hugging Face

Breach

7/2026

OpenAI

HUG1784399023

Hugging Face

Cyber Attack

5/2026

marimo

MARHUG177919366...

Hugging Face

Vulnerability

100

4/2026

HUG1777387852

Hugging Face

Vulnerability

100

3/2026

HUG1780734439

Hugging Face

Cyber Attack

100

1/2026

OpenAI

OPEHUG178483106...

Hugging Face

Cyber Attack

7/2025

OPEKNOHUGZIMCHE...

Hugging Face

Breach

1/2025

HUG1784566495

Loading…

A.I.

Hugging Face Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Hugging Face

Incidents vs Software Development Industry Avg (This Year)

Hugging Face has 560.38% more incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

Hugging Face has 573.08% more incidents than the average of all companies with at least one recorded incident.

Incident Types Hugging Face vs Software Development Industry Avg (This Year)

Hugging Face reported 7 incidents this year: 2 cyber attacks, 0 ransomware, 3 vulnerabilities, 2 data breaches, compared to industry peers with at least 1 incident.

Incident History - Hugging Face (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Hugging Face Subsidiaries

Parent Company

Hugging Face

Software Development

Website: https://huggingface.co

Company Size: 51-200 employees

No subsidiary data available for this company.

Loading…

Hugging Face Similar Companies

Nielsen

cb nlsn.co

Nielsen shapes the world’s media and content as a global leader in audience insights, data and analytics. Through our understanding of people and their behaviors across all channels and platforms, we empower our clients with independent and actionable intelligence so they can connect and engage with their audiences—now and into the future. Nielsen operates around the world in more than 55 countries. Learn more at http://nlsn.co/6006JMfty and connect with us on social media (LinkedIn, Twitter, Facebook and Instagram).

Microsoft

cb microsoft.com

Every company has a mission. What's ours? To empower every person and every organization to achieve more. We believe technology can and should be a force for good and that meaningful innovation contributes to a brighter world in the future and today. Our culture doesn’t just encourage curiosity; it embraces it. Each day we make progress together by showing up as our authentic selves. We show up with a learn-it-all mentality. We show up cheering on others, knowing their success doesn't diminish our own. We show up every day open to learning our own biases, changing our behavior, and inviting in differences. Because impact matters. Microsoft operates in 190 countries and is made up of approximately 228,000 passionate employees worldwide.

Daraz

cb daraz.com

Founded in 2015, Daraz is the leading e-commerce platform in South Asia with operations in Pakistan, Bangladesh, Sri Lanka, Nepal, and Myanmar. It provides sellers and consumers with cutting-edge marketplace technology, targeting a rapidly growing region of over 500 million people. By building an integrated infrastructure covering e-commerce, logistics, payment and financial services, the company aims to deliver an immersive, personalized shopping experience and uplift South Asian communities through the power of commerce. Daraz has consistently invested in building an e-commerce ecosystem in South Asia through advancements in technology, logistics and digital payments. As digital penetration and consumer awareness have surged, the region is now ready for a transformative leap. Leveraging new-age advancements such as AI, Daraz is poised to further enhance the platform’s efficiency to enable a seamless experience for its consumers and sellers. Visit https://www.daraz.com/ to learn more.

TOTVS

cb totvs.com

Olá, somos a TOTVS! A maior empresa de tecnologia do Brasil. 🤓 Líder absoluta em sistemas e plataformas para empresas, a TOTVS possui mais de 70 mil clientes. Indo muito além do ERP, oferece tecnologia completa para digitalização dos negócios por meio de 3 unidades de negócio: - Gestão: ERPs, soluções cross e sistemas especializados visando garantir mais produtividade, eficiência e governança para os negócios; 💻 - Techfin: ERP Banking que oferece soluções de crédito B2B e pagamento, integrados a sistemas de gestão; 💸 - RD Station: Ferramentas digitais de marketing, vendas e relacionamento, para empresas de todos os portes e segmentos. 🚀 Nos últimos 5 anos, a companhia investiu R$3 bilhões em pesquisa e desenvolvimento para atender de maneira cada vez mais especializada empresas de 12 segmentos da economia, tornando-se um trusted advisor de seus clientes. A TOTVS é uma potência tecnológica que apoia a evolução de empresas de norte a sul do país. O Brasil, que faz, faz com TOTVS.

Baidu, Inc.

cb baidu.com

Baidu is a leading AI company with strong Internet foundation, driven by our mission to “make the complicated world simpler through technology”. Founded in 2000 as a search engine platform, we were an early adopter of artificial intelligence in 2010. Since then, we have established a full AI stack, from deep learning frameworks to models and applications, with industry-leading self-developed technology at every level. Over the past two decades, we have built a diversified portfolio of products and services, spanning an ecosystem of hundreds of millions of users, millions of developers, and hundreds of thousands of enterprises. We have now integrated our leading AI capabilities into our offerings, driving innovative use cases. Join us to shape the future of AI and technology. For media inquiries, contact us at [email protected]. For career opportunities, visit https://talent.baidu.com/static/index.html

Bosch

cb bosch.com

The Bosch Group is a leading global supplier of technology and services. It employs roughly 417,900 associates worldwide (as of December 31, 2024). According to preliminary figures, the company generated sales of 90.5 billion euros in 2024. Its operations are divided into four business sectors: Mobility, Industrial Technology, Consumer Goods, and Energy and Building Technology. With its business activities, the company aims to use technology to help shape universal trends such as automation, electrification, digitalization, connectivity, and an orientation to sustainability. In this context, Bosch’s broad diversification across regions and industries strengthens its innovativeness and robustness. Bosch uses its proven expertise in sensor technology, software, and services to offer customers cross-domain solutions from a single source. It also applies its expertise in connectivity and artificial intelligence in order to develop and manufacture user-friendly, sustainable products. With technology that is “Invented for life,” Bosch wants to help improve quality of life and conserve natural resources. The Bosch Group comprises Robert Bosch GmbH and its roughly 470 subsidiary and regional companies in over 60 countries. Including sales and service partners, Bosch’s global manufacturing, engineering, and sales network covers nearly every country in the world. Bosch’s innovative strength is key to the company’s further development. At 136 locations across the globe, Bosch employs some 86,900 associates in research and development, of which nearly 48,000 are software engineers. Instagram: https://www.instagram.com/boschglobal/ Facebook: https://www.facebook.com/BoschGlobal Glassdoor: https://bit.ly/3raTZnH Imprint: www.bosch.com/corporate-information Privacy statement: https://www.bosch.com/data-protection-notice-bosch-linkedin/

NetSuite

netsuite.com

Founded in 1998, Oracle NetSuite is the world’s first cloud computing company and the leader in AI-powered cloud enterprise resource planning (ERP) and business management software. NetSuite provides an AI-powered, unified cloud business system that helps organizations manage core business functions in a single system. These include financial management, inventory and supply chain management, CRM, field service management, human resources (HR), professional services automation (PSA), and omnichannel commerce. Businesses use NetSuite to gain real-time visibility into operations, automate financial processes, improve reporting and analytics, and make faster, data-driven decisions using built-in AI capabilities. With more than 25 years of experience in cloud software, NetSuite supports over 43,000 organizations in 220 countries and territories, ranging from startups to global enterprises. NetSuite is commonly used by entrepreneurs, executives, finance operations leaders, and more who need scalable, flexible, and integrated business management solutions to drive efficiency and growth.

Thomson Reuters

tr.com

Thomson Reuters (TSX/NDAQ: TRI) informs the way forward by bringing together the trusted content and technology that people and organizations need to make the right decisions. We serve professionals across legal, tax, accounting, compliance, government, and media. Our products combine highly specialized software and insights to empower professionals with the data, intelligence, and solutions needed to make informed decisions, and to help institutions in their pursuit of justice, truth, and transparency. Reuters, part of Thomson Reuters, is a world leading provider of trusted journalism and news. For more information on Thomson Reuters, visit tr.com and for the latest world news, reuters.com.

Instagram

instagram.com

More than one billion people around the world use Instagram, and we’re proud to be bringing them closer to the people and things they love. Instagram inspires people to see the world differently, discover new interests, and express themselves. Since launching in 2010, our community has grown at a rapid pace. Our teams are growing fast, too, and we’re looking for talent across engineering, product management, design, research, analytics, technical program management, operations, and more. In addition to our headquarters in Menlo Park, we have thriving offices in New York City and San Francisco where teams are doing impactful work every day.

Loading…

NEWS

Hugging Face CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

February 24, 2026 08:00 AM

Threat Actors Weaponized AI Tools to Gain Full Domain Access within 30 Minutes

AI-powered attacks surged 89% in 2025, with breakout times dropping to 29 minutes, accelerating network intrusions globally.

Read Article

February 14, 2026 08:00 AM

Android malware hidden in fake antivirus app

If you use an Android phone, this deserves your attention. Right now, cybersecurity researchers warn that hackers are using Hugging Face,...

Read Article

February 03, 2026 08:00 AM

Hackers Used Hugging Face to Distribute Android Banking Trojans

Cybersecurity researchers uncovered a sophisticated malware campaign that exploited Hugging Face's trusted AI infrastructure to distribute...

Read Article

February 03, 2026 08:00 AM

Hugging Face Repositories Used to Spread Android RAT Malware

Attackers have exploited Hugging Face repositories to distribute Android RAT malware disguised as a security app, hosting thousands of...

Read Article

February 03, 2026 06:00 AM

Android Security Alert: Fake Apps Abuse Hugging Face to Spread Spyware

Cybersecurity researchers are warning that the current AI boom has opened a new and dangerous attack surface on Android devices.

Read Article

February 02, 2026 08:00 AM

Hugging Face Repositories Abused in New Android Malware Campaign

Attackers exploited Hugging Face's trusted infrastructure to spread an Android RAT, using fake security apps and thousands of malware...

Read Article

February 02, 2026 08:00 AM

Cybercriminals hijack AI hosting service to compromise users

Bitdefender researchers have uncovered an Android remote access trojan campaign that highlights how legitimate developer platforms can be...

Read Article

January 31, 2026 08:00 AM

Hugging Face platform abused to spread Android malware variants

An Android RAT (remote access trojan) campaign combines social engineering, the resources of the Hugging Face online platform as staging,...

Read Article

January 30, 2026 08:00 AM

Attackers Using Hugging Face Hosting to Deliver Android RAT Payload

Android malware spreads via fake security alerts, tricking users to install TrustBastion that gives attackers full device control.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18577

SUMMARY

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-10848

SUMMARY

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a " byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access. The primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 7)

cvss3

Base Score: 7.0

Complexity: HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Impact Score

4.7

Exploitability

2.2

REFERENCES

CVE-2026-9856

SUMMARY

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 7.1)

cvss3

Base Score: 7.1

Complexity: LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Impact Score

4.2

Exploitability

2.8

REFERENCES

CVE-2026-65321

SUMMARY

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL syntax causes the parser to terminate the string literal prematurely, enabling data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 9.8)

cvss3

Base Score: 9.8

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

cvss4

Base Score: 9.3

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

5.9

Exploitability

3.9

REFERENCES

CVE-2026-10774

SUMMARY

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keys_destroy() guarded the matching psa_destroy_key() with CONFIG_BT_MESH_V1d1. That Kconfig symbol was removed when explicit Mesh 1.0.1 support was dropped, so the destroy branch became permanently dead code and the import is never balanced by a destroy. The imbalanced teardown is reached every time subnet keys are destroyed: deleting a subnet (Config Server NetKey Delete), completing a Key Refresh Procedure (which retires the old key set), and resetting/re-provisioning the node. The over-the-air triggers are processed only under the node's device key, so they are exercisable by the provisioner or network administrator that owns the node, reachable over the Bluetooth Mesh network. With the default CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT of 16, repeated add/delete or key-refresh cycles exhaust the shared PSA key-slot pool after roughly a dozen rounds. Once exhausted, bt_mesh_private_beacon_key() and thus subnet creation fail: the node can no longer add subnets or complete key refresh, and other PSA crypto consumers on the device may be starved, until the device is rebooted. The fix aligns the destroy guard with the import guard (CONFIG_BT_MESH_PRIV_BEACONS) so each slot is freed.

Published

Date2026-08-02

Updated

Date2026-08-02

RISK INFORMATION (Score: 2.4)

cvss3

Base Score: 2.4

Complexity: LOW

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

0.9

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…