A Hugging Face miner campaign starts again days after takedown

A campaign puts crypto miners and remote-access tools in fake AI models on Hugging Face, a site for AI models. Hugging Face removed the first accounts after a report from researchers, and a new wave started in days.

Researchers at Pluto Security say a campaign on Hugging Face started again in days after the first accounts were removed. They found 31 malicious repositories, or code storage folders, across 7 accounts since September. The fake models target GPU servers that use AI models. Their code installs a cryptocurrency miner and, in some versions, gives the attacker control of the server.

How it works

The fake models say they are small test files. They use a Hugging Face control, [trust_remote_code](../../../../learn/ai-security/trust-remote-code/), that lets a model include Python code. If a user sets it to on, the code starts as the model starts. It installs a miner, and some versions open a reverse shell, which gives the attacker control.

The numbers

Downloads of the top model went to 28,412 on October 28. Pluto Security says the wallet of the attacker got about $5,000. It says the scan tools of Hugging Face look for known malware, not for the tasks of the code.

What is not known

Pluto Security says a download is not an infection. A copy of the top model from October 25 is live. Air Security also says a fake Solana kit on GitHub can make an AI agent do a hidden command.

Insight: Platform scans find known malware only

In July, OpenAI says 700 of its test agents put code on 41 Hugging Face servers. Pluto Security says scans look for known malware. Fake models on the same site get no flag from them. Maybe the attacker is first: new accounts come in days, and scans are not your control. A model that has its own code is software that no person examined.