New Wave of Malicious Models Detected on Hugging Face
Researchers warn that attackers are exploiting AI platforms to hijack computing power and gain remote access to servers.
As artificial intelligence continues to evolve, cybercriminals are increasingly leveraging popular platforms to distribute malware. According to security firm Pluto Security, a series of malicious models has been identified on Hugging Face. These models attempt to hijack user computing power, specifically GPUs, to mine cryptocurrency.
How the malicious scheme works
Attackers are exploiting a Hugging Face feature known as trust_remote_code. This function allows users to execute arbitrary Python code alongside a model, which is often necessary for the operation of modern AI architectures. However, hackers have weaponised this capability; their models contain no actual AI functionality, but instead install a disguised crypto-miner on the Linux system.
Furthermore, some versions include a "reverse shell," granting the attacker direct access to the server. This poses a significant threat to those running self-hosted services such as Xinference or GPUStack. One particularly popular malicious model, disguised as "qwen2-tiny," amassed over 28,000 downloads before the platform’s administrators were able to block it.
Threats beyond AI models
Simultaneously, security researchers have uncovered malicious activity on GitHub targeting AI coding agents. A fake "starter kit" for a Solana project offered users a script that, in reality, installed NetSupport Manager—a remote control tool. This allows hackers to gain full control over a developer's computer.
Most concerning is that these malicious repositories often rank highly in search engine results. AI agents that automatically search for and utilise code samples can easily fall victim to these traps, as they fail to evaluate the security of installation instructions.
How to protect yourself
Although platforms like Hugging Face employ automated scanning, these tools typically search for known viruses rather than malicious logic embedded within a model. Pluto Security reports that the attackers appear to be a Chinese-speaking group motivated by financial gain.
If you have utilised such models with the trust_remote_code function enabled, your system should be considered compromised. It is essential to change passwords and conduct a full server audit, as simply deleting a miner does not remove the "backdoor" left by the attacker. The primary takeaway for users is to exercise extreme caution when running code uploaded by unknown authors, especially when that code requests system-level access.