Huggingface Hotfix

Recommendation: High

Problem

Huggingface got hacked by an autonomous agent from OpenAI:

• https://huggingface.co/blog/security-incident-july-2026
• https://openai.com/index/hugging-face-model-evaluation-security-incident/

And as a result, Huggingface seems to have invalidated all of their tokens--even the ones that are supposed to be valid.

This resulted in anything related to huggingface silently failing: they would say something like "repository not found", which normally means the repo actually doesn't exist, or more often, that you're not logged in when the repo requires you to be logged in. This even happened for PUBLIC repos, the ones that normally do not need you to login.

What made it worse is, it looked as if the token is valid because the token technically IS valid, but just invalidated on the huggingface side.

Solution

To fix this, and also fix similar potential situations in the future, now Pinokio actually checks for the token validity and if there's something wrong, it treats the rest of the session as NOT logged in.

What to do

You don't have to do anything for most cases. Most apps on pinokio do not require you to log into huggingface. It should just work.

But if you ever logged into huggingface, or if you want huggingface downloads to work faster, you are recommended to log in, which means you will need to log in again, even if you logged in previously. That's all!

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.