Researchers at Pluto Security have detected the active return of a malware campaign targeting AI model repositories on the Hugging Face platform, identifying 31 malicious repositories distributed across seven different accounts. This campaign aims to hijack GPU servers running self-hosted inference servers such as Xinference and GPUStack for the purpose of illicit cryptocurrency mining.
Attack Mechanism and Security Bypass
The campaign does not rely on complex techniques such as poisoned weights, but instead exploits the trust_remote_code option in Hugging Face, which allows models to execute custom code when loaded. Once this option is enabled, the malicious code installs a cryptocurrency miner disguised as a Linux system process, along with additional features to open a reverse shell granting attackers direct access to the compromised server.
Despite files uploaded to the platform undergoing security scans, the tools used focus on known malware and insecure model formats rather than analyzing the behavior of the embedded code. This allowed one of the malicious models to bypass scanning and achieve over 28,000 downloads.
Targeting AI Coding Agents
In a related context, Air Security revealed the existence of a fake repository on GitHub named solana-starter-kit, specifically designed to deceive AI-powered coding agents. This repository directs agents to execute a malicious command that installs the NetSupport RAT, giving attackers full control over the developer's device.
Why This News Matters
These incidents highlight a growing security vulnerability in AI supply chains. As developers increasingly rely on ready-made models and automated coding agents, trust in open-source code has become a critical weakness. The ability of attackers to redeploy their malware within days of removal points to significant challenges facing platforms in monitoring dynamic code content, necessitating strict inspection of model code by organizations before running them in production environments.