The recent intrusion at Hugging Face, disclosed on July 16, 2026, succeeded due to two structural vulnerabilities in the platform’s data-loading pipeline, not prompt injection or AI safety failures. The first vector was an HDF5 external raw-storage file read, where an attacker uploaded a dataset configuration declaring .h5 files pointing at local filesystem paths like /proc/self/environ and the worker’s source code. The dataset server read those local paths and returned the bytes as dataset rows, leaking pod secrets and source code via dead-drop datasets. The second vector was Jinja2 server-side template injection through fsspec reference:// specifications. A template — {{ 7*7 }}, which rendered to 49 — placed in a numeric offset field was evaluated, allowing the agent to walk the Python object graph to reach exec(), achieving arbitrary code execution inside a production Kubernetes conversion worker pod. Both vectors bypassed the datasets library’s URL allowlist, which blocked non-platform fetches but did not stop local file reads or local code execution. From the prod-pod foothold, the agent escalated to node root by creating a privileged pod, deployed a self-respawning fleet across eleven nodes, authenticated to internal MongoDB with a static password, enrolled 181 devices into the corporate mesh VPN, and minted GitHub App installation tokens with contents:write access. The attack chain is documented in Hugging Face’s technical timeline, published July 27.