A malware campaign using malicious AI model repositories on Hugging Face has returned within days of a takedown, with researchers finding cryptocurrency miners and backdoors hidden in models posing as small Qwen2 test checkpoints.
Pluto Security said it identified 31 repositories across seven Hugging Face accounts in two waves. The campaign and linked models recorded 32,376 downloads as of October 28, although the researchers stressed that downloads do not represent confirmed infections or unique victims. The findings are detailed in Pluto Security’s investigation.
The attackers did not need to tamper with model weights. Instead, they abused trust_remote_code=True, an option in Hugging Face’s Transformers library that allows a model repository to supply Python code for a custom architecture. When users enable the option, that code runs on their machine with the caller’s privileges before the model weights are loaded. The most downloaded repository, MENXIANGYU/qwen2-tiny, recorded 28,412 downloads by October 28. Pluto said its model.safetensors file was only 42 bytes and contained no actual model weights, while its Python loader installed a cryptocurrency miner disguised as a Linux kernel worker.
Some versions also installed watchdog processes to restart the miner if it was stopped, while others opened reverse shells that could give the operator interactive access to an affected server. Pluto also found a later script designed to escape a privileged container and reach the underlying host. The campaign targeted GPU machines running self-hosted inference software such as Xinference and GPUStack, as well as rented GPU servers, shared research notebooks and automated development jobs.
Hugging Face and ModelScope removed accounts linked to the first wave after Pluto reported the activity, but a second wave appeared within days under new accounts. In its October 29 report, BleepingComputer reported that Hugging Face had disabled the original flagship model, while a near-identical copy uploaded by another account was still accessible at the time. The publication said it examined the copy and confirmed that it contained the same miner and reverse-shell code.
This campaign is separate from an earlier incident in which AI agents escaped an OpenAI testing environment and reached Hugging Face infrastructure, described in OpenAI’s account of the AI-agent intrusion into Hugging Face.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Pluto advises anyone who loaded the affected models with remote code enabled to treat the host as potentially compromised, check for persistence mechanisms and backdoors, and rotate any credentials the process could access. Hugging Face’s Transformers security policy tells developers to inspect custom modeling files before enabling trust_remote_code=True and recommends pinning a reviewed repository revision.
