Load/Mine — Malicious Model Repositories, GPU Mining & Backdoor Execution — AI Security
PASSNot recorded
Date
1 Nov 2026
Domain
AI Security
Topic
Load/Mine — Malicious Model Repositories, GPU Mining & Backdoor Execution
Status
PASS
Verified Findings
None
Contradictions / Caveats
UNKNOWN: Pluto Security tracked malicious Hugging Face/ModelScope model repositories posing as Qwen2 test models. Custom repository Python executed during trusted remote-code loading to install GPU miners and, in variants, SSH/reverse-shell persistence; the campaign returned after takedowns.
Evidence boundary: Does not prove download count equals infections, universal scanner failure, successful backdoor on every loader or definitive actor identity.
UNKNOWN: BleepingComputer independently verified a near-identical live Hugging Face copy containing the miner and reverse shell, and reported second-wave reappearance, a container-escape script and observed mining activity while preserving downloads as exposure rather than confirmed infections.
Evidence boundary: Does not independently prove ownership of all linked repositories, victim count or definitive attribution.
UNKNOWN: Hugging Face documents that trust_remote_code allows custom model-repository code to execute locally and should be enabled only for repositories whose code has been reviewed; revision pinning is recommended.
Evidence boundary: Does not prove a flaw in intended opt-in semantics or automatic enablement by all downstream tooling.
UNKNOWN: Independent current-state review summarized campaign mechanics, distinguished safetensors weights from adjacent executable Python, reported one copy still listed on Nov 1 and found no public Hugging Face campaign statement at review time.
Evidence boundary: Does not prove payload execution from every listed copy, complete campaign inventory or that no Hugging Face statement exists elsewhere.
Open Follow-up
OPEN [HIGH]: EXECUTION_VICTIM_DENOMINATOR — Authoritative counts of unique loaders, malicious-code executions, miner installs, persistence/backdoor success, container escapes and affected organizations are unknown.
OPEN [HIGH]: CURRENT_REPOSITORY_INFRASTRUCTURE_STATE — Complete authoritative inventory of remaining copies, replacement accounts, mirrors and current C2/mining infrastructure is not established.
OPEN [MEDIUM-HIGH]: ACTOR_IDENTITY — Operator identity and whether all campaign waves/linked repositories share one actor remain unproven.
OPEN [MEDIUM]: SCANNER_COVERAGE_BASELINE — No controlled ecosystem-wide baseline quantifies which executable model-repository behaviors are detected or missed by current hub/partner scanners.