Endpoint findingView consolidated app (3 findings) →
← Findings by source

Hugging Face

Endpoint Hugging Face · Model hub · network: huggingface.co

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
20
Low
People
1
Accounts seen on devices
Devices
1
1 account · 30 days
Last seen
6 d ago
First seen Sep 8, 2026
endpoint
Next steps

Recommended actions

  1. 01Device telemetry names the exact machines and accounts reaching huggingface.co. Use it to target coaching rather than blanket blocks.
  2. 02Hugging Face was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps.
Endpoint

What Defender for Endpoint saw

Device connections · 1
Devices
  • LT-FRANK
Device connections
huggingface.co1
Same app, other lanes

Related findings

Who

People

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

PersonDepartmentSourceSign-ins · 30 dGranted
[email protected]
[email protected]
n/aDevice telemetry0No direct grant
Why

Evidence

  1. endpoint_telemetry · Sep 8, 2026
    Defender for Endpoint saw Hugging Face on 1 device (1 account) in 30 days: device connections to huggingface.co
    Detail
    {
  "domains": [
    {
      "host": "huggingface.co",
      "count": 1
    }
  ],
  "signals": {
    "network": 1,
    "process": 0,
    "software": 0,
    "extension": 0,
    "model_file": 0,
    "local_server": 0
  },
  "software": [],
  "processes": [],
  "extensions": [],
  "deviceNames": [
    "LT-FRANK"
  ]
}