- Pluto Security found 31 malicious Hugging Face repositories posing as small Qwen2 models. They ran miners and backdoors through the trust_remote_code setting, not poisoned weights.
- Pluto says the flagship model scanned clean and collected 28,412 downloads. Those are downloads, not confirmed infections.
- Teams should find where that setting is used, review the Python files before enabling it, and run model code on hosts without valuable credentials.
A familiar model name feels safe. A campaign documented by Pluto Security shows why that feeling is a weak control. The danger was not in the model's weights. It sat in a setting people are used to switching on.
What Pluto found
Pluto Security found 31 malicious repositories on Hugging Face. They sat under seven accounts and arrived in two waves. All posed as small Qwen2 test models.
Pluto counts more than 32,000 downloads once linked models are included. It stresses that these are downloads, not confirmed infections or unique victims.
The most popular fake was MENXIANGYU/qwen2-tiny. By October 28 the Hub showed 28,412 downloads for it. Pluto says its weights file was 42 bytes and held no tensors. No real model was inside.
How a model can run code before it runs
Some models need Python code that the Transformers library lacks. To load them, a user sets trust_remote_code=True. That setting lets the repository run its own code.
The repository's config file names a Python module. The library downloads it and imports it. Importing a Python file runs any call placed beside its class definitions. So the attacker needs no poisoned weights and no exploit. The attacker uses a documented permission.
What the payload did
Pluto describes a payload built to stay quiet. It leaves a watchdog process that restarts the miner every 120 seconds if someone kills it. It starts the miner from memory, so the first launch leaves no executable file for antivirus to inspect. The process is named like a Linux kernel worker.
A fallback copy does stay on disk, so evidence exists for anyone who looks. The code also removes rival miners to free up compute.
Three builds go further. They connect a remote shell back to the attacker. That gives the attacker hands-on access to whatever files and credentials the infected process can reach.
The person who loaded the model sees nothing wrong. Pluto says the first sign is usually a busy GPU or a bigger cloud bill.
Why the scanners said clean
Hugging Face says it runs every file under 2 GB through the ClamAV antivirus at each commit. Partner scanners from Protect AI and JFrog cover model file formats. Pluto's point is that nothing analyzes what a plain Python file does.
In Pluto's checks, the flagship's Python file passed every scanner that ran. JFrog's verdict, as Pluto reports it, was that the file is "not a machine-learning model."
The lesson is a mismatch. Scanners hunt for known malware signatures and risky model formats. A short Python file asking to be imported is neither.
Takedowns did not end it
Pluto told Hugging Face and ModelScope about the first wave. Both platforms took the accounts down. A second wave of 19 repositories showed up within days.
One new script was published 8.5 hours after Pluto's disclosure email. Pluto says it escapes a privileged container and gives the attacker root on the host.
BleepingComputer reports that Hugging Face has since disabled the flagship model. It also confirmed that a near-identical copy from a newer account, htt0118, was still live. That copy held the same miner and reverse shell.
The money is real. Pluto says the first-wave wallet took in about 2,276 PRL over 716 transactions. BleepingComputer, citing Pluto, puts the operator's main wallet at roughly $5,000.
While Pluto watched, nine machines with names like a shared research cluster began mining together. About six minutes later they stopped submitting work. Pluto says that fits an administrator ending the jobs.
Pluto assesses the operator as financially motivated and Chinese-speaking. That is the company's attribution. Pluto also sells security products for AI environments, so treat its view of the threat's size as one vendor's assessment.
What to ask your teams
Start by finding where the setting is used. Ask who can turn on trust_remote_code in notebooks, CI jobs and serving hosts. Ask what credentials those machines can reach. Pluto says shared clusters and pipelines hold access worth far more than the compute.
Next, require a code review before anyone enables it. Pluto says a review of the Python files named in a model's config would have caught every payload here. Pin approved models to a reviewed version. Run model code on hosts without production credentials and with tight outbound rules.
Network rules matter most here. Pluto notes the downloader skips configured proxy settings. It cannot get around a network that enforces proxy use. So enforce outbound limits on the network, not in environment variables.
If anyone loaded one of these models with the setting on, treat the machine as compromised. Check it against Pluto's indicators and rotate reachable credentials. Pluto warns that the backdoors can remain after mining stops.
A model name tells you what a repository claims to be. Only reading the code tells you what it does.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Pluto Security.
