Kimi
huggingface.co
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
Kimi scores 45/100 (D): do not approve on the current evidence. The main issue: the vendor's own answer to "What happens in a security incident?" is unfavourable. No certification could be independently confirmed.
Scanned Jul 23, 2026 · Public evidence · Point-in-time
Before you sign
What to ask for: Resolve this directly with the vendor before proceeding — this is a confirmed disclosure, not a gap to fill in.
Why it matters, and the evidence
Hugging Face disclosed that an intrusion into part of its production infrastructure resulted in unauthorized access to a limited set of internal datasets and to several credentials used by its services.
“Contact: [email protected] Expires: 2030-07-01T08:42:00.000Z Preferred-Languages: en Hiring: https://huggingface.co/careers”
“We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services.”
“A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.”
“We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.”
“Fixed the root vulnerability: the dataset code-execution paths used for initial access are closed. Eradicated the attacker's foothold across the affected clusters and rebuilt the compromised nodes. Revoked and rotated the affected credentials and tokens, and began a broader precautionary rotation of secrets. Deployed additional guardrails and stricter admission controls on our clusters. Improved our detection and alerting so a high-severity signal pages a responder in minutes, any day of the week.”
“We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies.”
“To understand what a swarm of tens of thousands of automated actions did, we ran LLM-driven analysis agents over the full attacker action log, comprised of more than 17,000 recorded events. This allowed us to reconstruct the timeline, extract indicators of compromise, map the credentials touched, and separate genuine impact from decoy activity. Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary's speed.”
“We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.”
What to ask for: Get a no-training clause covering first- and third-party models into the DPA/order form.
Why it matters, and the evidence
The public sources scanned do not clearly state that customer prompts, files, and outputs are excluded from training or fine-tuning of first- or third-party models.
What to ask for: Get retention periods in writing for inputs, outputs, logs and backups, including any provider that runs the model.
Why it matters, and the evidence
The sources describe retention ("Hugging Face retains personal information for as long as necessary to deliver the Services, comply with legal requirements, maintain security, and pursue its legitimate interests, with no fixed retention period stated; users may request account cancellation or erasure of their personal information at any time.") but not a complete window for every data type.
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] .”
Australian Government checksclick a check for the detail, directions checked Nov 1, 2026
PSPF directionsNone apply
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
IRAP assessmentNot collected
Not found in the sources this scan collected, which is not evidence the vendor has none. IRAP is an assessment, not a certificate, and there has been no public register since 2020. Ask the vendor for its IRAP assessment report and check its date, classification level and the services in scope.
Hosting Certification FrameworkNot collected
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
Data held in AustraliaNot collected
No Australian data residency commitment was found in the sources this scan collected. Ask where inputs, outputs, logs and backups are processed and stored, and whether processing can be kept in Australia.
What your organisation still has to do (7)
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
What to ask the vendor
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
Not found in the public sources scanned — ask the vendor directly.
!How long do they keep your data?Ask the vendor
Hugging Face retains personal information for as long as necessary to deliver the Services, comply with legal requirements, maintain security, and pursue its legitimate interests, with no fixed retention period stated; users may request account cancellation or erasure of their personal information at any time.
Requires written confirmation, see Before you sign ↓
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] .”
✓Who else can access your data?Clear
Hugging Face publishes a specific list of named third-party service providers (subprocessors) it shares information with, including the type of processing and location for each: Discourse (forum, US), AWS SES (email, US), Amazon Web Services (hosting/infrastructure, US), Metronome (billing, US), Stripe (payment, US), MongoDB Atlas (hosting/infrastructure, US), Google Cloud Platform (hosting/infrastructure, US/EMEA), GitHub (code hosting, US), OVHCloud (hosting/infrastructure, France), and Slack Technologies (communication, US).
“10. LIST OF THIRD-PARTY SERVICE PROVIDERS We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing . Discourse | Forum | United States AWS SES | Emails | United States Amazon Web Services, Inc. | Hosting/Infrastructure | United States Metronome | Billing | United States Stripe | Payment | United States MongoDB Atlas | Hosting/Infrastructure | United States Google Cloud Platform | Hosting/Infrastructure | United States/EMEA GitHub | Hosting code | United States OVHCloud | Hosting/Infrastructure | France Slack Technologies | Communication | United States Hugging Face SAS | All of the above | France”
!Where is your data processed?Ask the vendor
Hugging Face and its servers are located in the United States, and personal information may be stored and processed in the United States or any other country where the Company, its affiliates, subsidiaries, or agents maintain facilities; using the Services is treated as consent to such international transfer.
Confirm in writing: Ask the vendor to state this in writing before signing.
“The Company and its servers are located in the United States. Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country.”
✗What happens in a security incident?Concern / gap
Hugging Face disclosed that an intrusion into part of its production infrastructure resulted in unauthorized access to a limited set of internal datasets and to several credentials used by its services.
Requires written confirmation, see Before you sign ↓
“Contact: [email protected] Expires: 2030-07-01T08:42:00.000Z Preferred-Languages: en Hiring: https://huggingface.co/careers”
“We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services.”
“A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.”
“We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.”
“Fixed the root vulnerability: the dataset code-execution paths used for initial access are closed. Eradicated the attacker's foothold across the affected clusters and rebuilt the compromised nodes. Revoked and rotated the affected credentials and tokens, and began a broader precautionary rotation of secrets. Deployed additional guardrails and stricter admission controls on our clusters. Improved our detection and alerting so a high-severity signal pages a responder in minutes, any day of the week.”
“We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies.”
“To understand what a swarm of tens of thousands of automated actions did, we ran LLM-driven analysis agents over the full attacker action log, comprised of more than 17,000 recorded events. This allowed us to reconstruct the timeline, extract indicators of compromise, map the credentials touched, and separate genuine impact from decoy activity. Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary's speed.”
“We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.”
Email to send the vendor4 items to confirm in writing
Hello Hugging Face team, We are assessing Kimi (Hugging Face) as part of our supplier review. Before we proceed, please confirm the following in writing: 1. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 2. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 3. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 4. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
How the score is built
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the scoreorganisation-level evidence40
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“At Hugging Face, we are dedicated to helping the entire AI Community work together to advance Open, Collaborative, and Responsible Machine Learning.”
AI system15% of the score40
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Long-Horizon Coding : Operating with minimal human oversight, Kimi K3 sustains long engineering sessions, navigates massive repositories, and orchestrates terminal tools”
The vendor’s own evaluation of its AI features before and after release, evals, red-teaming, monitoring. A model supplier’s testing of its own model counts only in part.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“Kimi Code Bench 2.0 (in-house). Kimi K3 is evaluated with the Kimi Code harness (it attains 73.7 with the Claude Code harness);”
“All K2-Instruct-0905 numbers are reported as mean ± std over five independent, full-test-set runs.”
How changes to models and AI features, including a change of underlying model, are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“We further modified our chat template to improve its robustness. The default system prompt has also been updated.”
“Kimi K2-Instruct-0905 is the latest, most capable version of Kimi K2.”
Model10% of the score60
Which foundation models and model providers power the product. How model changes are disclosed is judged under change management.
Assessed against NIST GenAI · ISO 42001
“Kimi K3 is an open-weight, native multimodal agentic model and our most capable model to date. It is a 2.8T-parameter model built on Kimi Delta Attention (KDA) and Attention Residuals (AttnRes), with native vision capabilities and a 1-million-token context window.”
“Moonshot's MoE LLMs with 1 trillion parameters, exceptional on agentic intellegence”
Model provider transparency: vendor-evidenced, not yet independently corroborated.
Customer data15% of the scoreorganisation-level evidence40
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Whether customer data trains models, how long it is retained, and where it is processed.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“The Company and its servers are located in the United States. Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country.”
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] .”
“We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.”
“to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services,”
AI supply chain10% of the scoreorganisation-level evidence60
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“10. LIST OF THIRD-PARTY SERVICE PROVIDERS We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing . Discourse | Forum | United States AWS SES | Emails | United States Amazon Web Services, Inc. | Hosting/Infrastructure | United States Metronome | Billing | United States Stripe | Payment | United States MongoDB Atlas | Hosting/Infrastructure | United States Google Cloud Platform | Hosting/Infrastructure | United States/EMEA GitHub | Hosting code | United States OVHCloud | Hosting/Infrastructure | France Slack Technologies | Communication | United States Hugging Face SAS | All of the above | France”
Subprocessors & supply chain: vendor-evidenced, not yet independently corroborated.
Security foundation15% of the scoreorganisation-level evidence60
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Contact: [email protected] Expires: 2030-07-01T08:42:00.000Z Preferred-Languages: en Hiring: https://huggingface.co/careers”
“We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.”
“We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services.”
“A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.”
“Fixed the root vulnerability: the dataset code-execution paths used for initial access are closed. Eradicated the attacker's foothold across the affected clusters and rebuilt the compromised nodes. Revoked and rotated the affected credentials and tokens, and began a broader precautionary rotation of secrets. Deployed additional guardrails and stricter admission controls on our clusters. Improved our detection and alerting so a high-severity signal pages a responder in minutes, any day of the week.”
“We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies.”
“To understand what a swarm of tens of thousands of automated actions did, we ran LLM-driven analysis agents over the full attacker action log, comprised of more than 17,000 recorded events. This allowed us to reconstruct the timeline, extract indicators of compromise, map the credentials touched, and separate genuine impact from decoy activity. Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary's speed.”
Vulnerability & incident handling: vendor-evidenced, not yet independently corroborated.
Independent assurance evidence10% of the scoreorganisation-level evidence15
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Hugging Face is also SOC2 Type 2 certified , meaning we provide security certification to our customers and actively monitor and patch any security weaknesses.”
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score40
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).”
“The Company and its servers are located in the United States. Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country.”
“Hugging Face can also offer Business Associate Addendums or GDPR data processing agreements through an Enterprise Plan .”
“Both the code repository and the model weights are released under the Kimi K3 License .”
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 45 → up to 67 with every identified gap resolved.
The evidence behind the result
Key findingsclick a row for the evidence
✗AI-agent-driven intrusion exposed internal datasets and credentials, with customer/partner impact unresolved at disclosureGap
Hugging Face disclosed a July 2026 intrusion, driven end-to-end by an autonomous AI agent, that gained unauthorized access to a limited set of internal datasets and several service credentials by exploiting code-execution flaws in the dataset processing pipeline. At the time of disclosure, the company had not yet finished determining whether any partner or customer data was affected.
A buyer needs to know whether their own data or account credentials were among those exposed. An intrusion with confirmed unauthorized access to internal data, paired with an incomplete impact assessment, is a genuine unresolved risk regardless of how well the response was executed afterward.
Question for vendor: Has the assessment of partner/customer data impact from the July 2026 incident been completed, and were any customers directly notified as affected?
“We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services.”
“A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.”
“We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required. We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.”
✓Thorough incident disclosure with concrete, verifiable remediation stepsStrong
Hugging Face's public incident write-up names the specific exploited vulnerabilities, lists concrete remediation actions (vulnerability fix, credential rotation, guardrails, improved detection), and states it engaged outside forensic specialists and reported the incident to law enforcement.
Specificity and third-party validation in an incident disclosure are stronger assurance signals than a generic breach notice, and let a buyer independently judge whether the response was adequate.
“A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.”
“Fixed the root vulnerability: the dataset code-execution paths used for initial access are closed. Eradicated the attacker's foothold across the affected clusters and rebuilt the compromised nodes. Revoked and rotated the affected credentials and tokens, and began a broader precautionary rotation of secrets. Deployed additional guardrails and stricter admission controls on our clusters. Improved our detection and alerting so a high-severity signal pages a responder in minutes, any day of the week.”
“We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies.”
✓Transparent, specific subprocessor disclosureStrong
Hugging Face's Privacy Policy names specific third-party subprocessors (e.g. AWS, Stripe, GitHub, MongoDB Atlas, GCP, OVHCloud, Slack) along with the purpose and location of each, rather than describing data sharing only in general terms.
Named subprocessors with purpose and location let a buyer assess their own subprocessor and data-residency exposure directly, rather than relying on vague assurances.
“10. LIST OF THIRD-PARTY SERVICE PROVIDERS We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing . Discourse | Forum | United States AWS SES | Emails | United States Amazon Web Services, Inc. | Hosting/Infrastructure | United States Metronome | Billing | United States Stripe | Payment | United States MongoDB Atlas | Hosting/Infrastructure | United States Google Cloud Platform | Hosting/Infrastructure | United States/EMEA GitHub | Hosting code | United States OVHCloud | Hosting/Infrastructure | France Slack Technologies | Communication | United States Hugging Face SAS | All of the above | France”
!Open-ended data retention period for personal informationGap
The Privacy Policy retains personal information "for as long as necessary" to pursue the Company's legitimate interests, with no fixed retention window disclosed; deletion is only available on written request rather than by default schedule.
Buyers evaluating data minimization commitments cannot rely on an automatic deletion timeline and must proactively request erasure to bound their exposure.
Question for vendor: What is the maximum default retention period for account and content data absent an explicit deletion request?
“We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests. You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to [email protected] .”
Assurance evidence: certifications 1, registry checks and verification ladders, click to view
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesSources and regulation
Sources 17, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.