Fake AI models carrying malware reappeared on Hugging Face, an AI model-sharing platform, in October, days after earlier accounts were removed. Pluto Security, an AI security company, documented the campaign in an Oct. 29 investigation. The files contained code designed to secretly mine cryptocurrency or give attackers remote access to computers running AI models.
Pluto’s researchers identified 31 malicious repositories across seven Hugging Face accounts. Together with 13 other linked repositories, they recorded 32,376 downloads by Oct. 28. That figure counts downloads, not confirmed infections or individual victims.
According to Pluto, many of the repositories presented themselves as small test versions of Qwen2, an existing family of AI models. Developers can download models like these to test software or run AI applications on their own servers. But the researchers found that these particular repositories contained code designed to install unwanted software.
Some AI models rely on custom code supplied by their developers. Hugging Face’s Transformers software lets developers run code supplied by a model’s publisher through an option called trust_remote_code=True. As Hugging Face’s security guidance explains, users should inspect that code before allowing it to run. Pluto found that enabling the option for the fake models could execute the malicious code before the model had finished loading. Downloading a repository alone did not establish that a computer was infected.
The most downloaded fake model contained no usable AI model weights at all, Pluto found. Its accompanying code installed a cryptocurrency miner, a program that uses a computer’s processing power to earn money for an attacker. The researchers said the miner disguised itself as a normal system task and could restart if stopped. Some versions also opened a hidden connection that could let attackers send commands to an infected server.
New accounts carried the same attack
Pluto said it alerted Hugging Face and ModelScope, another AI model-sharing service, to the first group of malicious repositories. Both platforms removed the accounts. Within days, however, 19 new repositories appeared under other accounts. The researchers said those listings were still available eight days after they reported them and had recorded 29,090 downloads by Oct. 28.
Pluto found that the most downloaded malicious model returned clean results from the scanners that checked it. Hugging Face says it scans repository files for malware, but Pluto reported that these checks did not identify what the accompanying Python code would do when executed. A clean scan therefore did not establish that the model was safe to run.
Pluto also traced cryptocurrency receipts worth about $5,000 to a wallet linked to the mining operation. Its researchers observed active workers on mining-pool dashboards, providing further evidence that the mining operation was running.
For companies running AI on their own servers, Pluto’s findings show how the malware could use computing power intended for legitimate work. The researchers also found that some versions installed backdoors that could allow attackers to access infected systems remotely.
On Oct. 29, BleepingComputer, a cybersecurity news website, independently confirmed that a near-identical copy uploaded on Oct. 25 remained accessible, even after Hugging Face had disabled the most downloaded listing. The copy contained the same miner and remote-access code.