Hugging Face

Hugging Face · Model hub · Confirmed · catalog huggingface. Seen by 3 lanes through 3 findings.

Policy · none set

Policy changes re-score this app on the next sync, which starts right away.

Combined score

Medium 31 from the strongest lane + 10 for 2 more

People

Distinct identities across every lane

Seen by

Source code, SIEM, Endpoint

First seen

Sep 8, 2026

Last seen 3 d ago

source-codefixturecorroboratedsiemendpoint

Evidence

Where it was seen

Source codeGitHub (demo)

Medium31

2 repos, 3 packages

0 people · 3 d agoOpen finding →

SIEMSplunk (demo)

Medium31

60 events, 1 MB up via Splunk (demo)

1 person · 6 d agoOpen finding →

Endpoint

Low20

1 devices, 1 accounts

1 person · 6 d agoOpen finding →

Next steps

01
Hugging Face SDKs appear in 2 repositories. Decide whether this vendor is approved for engineering, and route calls through one gateway or an Azure OpenAI deployment so keys, logging, and data terms are managed centrally.
Source code
02
Splunk (demo) confirms what Microsoft 365 signals show for Hugging Face. Use the source list here to find the exact devices and network segments involved.
SIEM
03
Device telemetry names the exact machines and accounts reaching huggingface.co. Use it to target coaching rather than blanket blocks.
Endpoint
04
Hugging Face was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps.
Endpoint

Who

Person	Department	Sources	Seen by	Sign-ins · 30 d
[email protected] [email protected]	n/a	SIEM logsDevice telemetry	SIEM · Endpoint	0

Vendor

Model downloads are the signal; large transfers from cdn-lfs hosts mean local model use.

Lanes

Each lane scores its own evidence. The combined score takes the strongest lane and adds five points per additional lane, capped at 100.