Hugging Face Model Repositories Weaponized to Hijack GPU Servers for Crypto‑Mining
What Happened — Researchers at Pluto Security identified a recurring malicious‑model campaign on the Hugging Face hub. Over two waves (September 2025 – October 2026) 31 repositories across seven accounts offered “Qwen2” test checkpoints that, when downloaded with the trust_remote_code flag enabled, executed hidden Python payloads. The payload installs a cryptocurrency miner as a Linux system process, restarts it if killed, and removes competing miners. Some variants also open a reverse shell, giving the attacker direct server access, and one script can break out of a container to take over the host. The flagship model alone was downloaded >28 000 times; total downloads exceed 32 000. Hugging Face’s automated scans flagged the files as clean because they inspected only the model artifact, not the embedded code. As of 28 Oct 2026 the original malicious model was disabled, but a near‑identical copy remains live under a new account.
Why It Matters for Trust & Control Assurance — The incident demonstrates how unchecked third‑party code (model repositories) can bypass traditional malware defenses and compromise GPU‑focused workloads, highlighting the need for robust supply‑chain risk controls and continuous monitoring of external code assets.
Who Is Affected — Cloud‑infrastructure providers, AI/ML platform operators, enterprises running self‑hosted inference servers (e.g., Xinference, GPUStack), and any organization that pulls models from public repositories.
Recommended Actions
- Enforce a policy that disables
trust_remote_codeunless the model source is verified and the code is reviewed. - Integrate static‑code scanning of downloaded model scripts into CI/CD pipelines.
- Maintain an inventory of third‑party model dependencies and apply continuous monitoring for anomalous behavior (unexpected CPU/GPU usage, outbound connections).
- Conduct a supply‑chain risk assessment aligned with the NIST CSF 2.0 “Supply Chain Risk Management” practice.
Technical Notes
- Attack vector: abuse of Hugging Face’s
trust_remote_codeoption (third‑party dependency). - Payload: Linux‑based crypto miner, reverse shell, container‑escape script.
- No CVE; the weakness is a functional feature that permits execution of arbitrary code.
- Downloads: >32 k total; confirmed infections not disclosed.