Overview
A malware campaign targeting Hugging Face model repositories has returned with a more persistent approach, abusing AI model-loading functionality to install cryptocurrency miners and backdoors on GPU-powered inference servers. Researchers identified 31 malicious repositories across seven accounts, with linked models receiving more than 32,000 downloads. One malicious model alone exceeded 28,000 downloads. The incident highlights a growing AI security problem: the code surrounding a model can be just as dangerous as the model itself.
The Model Was Not Really the Product
The malicious repositories were presented as small Qwen2 test models, but researchers found that the most popular example contained no meaningful machine-learning model. Instead, it abused Hugging Face’s trust_remote_code option. When enabled, this feature allows Python code supplied with a model to execute when the model is loaded. That functionality can be useful for specialised models, but it also creates a direct execution path from an external repository to the system running the AI workload. The attackers used that path to install cryptocurrency-mining software disguised as a legitimate Linux process. Some versions also deployed a reverse shell, potentially giving the attacker interactive access to the host.
GPU Infrastructure Is Valuable to Attackers
AI infrastructure represents an attractive target because organisations increasingly operate expensive GPU servers for model training and inference. Those GPUs have significant computational capacity. From an attacker’s perspective, compromising an AI server can therefore provide two opportunities: steal access to the environment and monetise its computing resources. The campaign reportedly removed competing miners and configured its malware to restart if terminated, demonstrating that the objective was not simply to execute code once. It was to maintain control of the resource.
“Scanned Clean” Does Not Mean Safe
One of the most concerning aspects of the campaign is that malicious repositories could pass security scanning. Researchers noted that existing scanning mechanisms focus on known malware and unsafe model formats, rather than necessarily analysing what arbitrary Python code supplied alongside a model will actually do. This creates a fundamental security gap. A file can contain a valid model format and still introduce dangerous execution behaviour.
The security question cannot simply be “Is this model malicious?”
It must also be “What code will execute when this model is loaded?”
Removing the Repository Does Not Remove the Compromise
The campaign reportedly returned within days of accounts being taken down, with new repositories and accounts appearing. That makes the repository itself only one part of the attack chain. If a malicious model has already executed on a server, removing the model from the platform does not undo what happened on the machine. Researchers specifically recommend treating affected systems as compromised, investigating persistence and rotating credentials accessible from the host. Simply killing the mining process is not sufficient if a backdoor remains.
AI Coding Agents Add Another Trust Problem
The same report highlights a separate GitHub campaign involving a fake Solana starter kit designed to influence AI coding agents. Instead of providing a legitimate project, the repository’s README instructed users to execute a PowerShell command that downloaded a remote-access payload. This introduces a new dimension to software supply-chain security. An AI coding agent may interpret a README as an instruction rather than as untrusted content. If the repository ranks highly in search results and the agent follows its instructions automatically, the attacker may have effectively turned documentation into an execution mechanism.
Expert in the Cloud Insight
AI security is increasingly becoming a software supply-chain problem. Models, repositories, Python packages, README files and agent instructions can all influence what an AI system executes. Trusting the source of an AI component is not enough. Organisations must also control what code is allowed to execute, what permissions it receives and what resources it can access. In the AI era, the model may be the product — but the surrounding code can be the attack surface.
Leave a Reply