Hugging Face Repositories Abused to Distribute Cryptominers and Backdoors via Remote Code Execution
Frontier AI models · Enterprise AI
Security firm Pluto Security revealed the Load/Mine campaign, where attackers abused the trust_remote_code setting on Hugging Face to deploy malicious models, targeting self-hosted AI inference and GPU infrastructure with miners, reverse shells, and container escape tools.
Cybersecurity firm Pluto Security disclosed a malicious campaign dubbed Load/Mine targeting the AI open-source ecosystem. Threat actors created dozens of repositories on Hugging Face disguised as Qwen2 test models, exploiting the trust_remote_code=True parameter in the Transformers framework. Because custom Python code executes with caller permissions, attackers executed malicious commands before loading model weights. The campaign primarily targeted self-hosted inference setups such as Xinference and GPUStack, rented GPU instances, and research notebooks, aiming to deploy cryptominers, reverse shells, and container escape exploits. Despite initial takedowns, the attackers redeployed new repositories within days.
Key takeaways
- Pluto Security identified 31 malicious repositories across 7 accounts disguised as Qwen2 models, totaling 32,376 downloads.
- The attack leveraged Transformers' trust_remote_code=True option to execute arbitrary Python code with caller privileges prior to model loading.
- Following takedowns, the attackers deployed 19 new repositories featuring reverse shells and container escape exploits targeting host access.
- Targeting focused on GPU hosts using Xinference, GPUStack, and research notebooks, with confirmed pool connections and cryptocurrency gains.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.