Hugging Face Malware: Are AI Model Downloads Safe?

Security researchers have uncovered a large-scale malware campaign involving malicious AI models hosted on Hugging Face, with more than 32,000 reported downloads across identified repositories and related models. The investigation, published on October 29, 2026, revealed how attackers disguised cryptocurrency miners and remote-access backdoors as legitimate AI model files.

The campaign targeted developers and organizations running AI inference infrastructure, especially GPU-powered servers.

Quick answer: Hugging Face remains a widely used platform for sharing AI models, but downloading and running third-party models involves security risks. In the latest hugging face malware campaign, attackers exploited the trust_remote_code feature to execute malicious Python code when models were loaded. To stay safe, verify model publishers, inspect custom code, prefer trusted model formats, and avoid executing unreviewed remote code.

The incident demonstrates why a model’s download count, clean malware scan, or professional-looking repository page cannot guarantee that its code is safe.

Hugging Face Malware 2026: What Happened?

On October 29, 2026, cybersecurity researchers at Pluto Security published findings about a malicious campaign called Load/Mine.

The investigation identified 31 malicious repositories associated with seven Hugging Face accounts, distributed in multiple waves beginning in September 2026.

The attackers uploaded repositories masquerading as small Qwen2 AI models.

These repositories were designed to target GPU-based inference environments, particularly systems running Xinference and GPUStack.

According to BleepingComputer’s October 29 report, some malicious repositories installed cryptocurrency miners, while others contained backdoors capable of providing remote access.

Key facts about the incident

Important: These download figures do not represent confirmed infections or unique victims. A repository can be downloaded multiple times without its malicious code necessarily being executed.

Which AI model was involved?

One of the most prominent malicious repositories was identified as:

MENXIANGYU/qwen2-tiny

The repository appeared to offer a lightweight Qwen2 model suitable for testing.

However, investigators found that the repository did not contain a functioning AI model in the expected form.

Instead, its Python loading code was designed to install malicious software.

The repository accumulated 28,412 downloads by October 28, 2026.

Researchers also identified copies and related malicious repositories distributed through additional accounts.

The malware returned after removal

One of the most concerning findings was the campaign’s persistence.

After Pluto Security notified Hugging Face and ModelScope about the first wave, the affected accounts were removed.

However, attackers created additional repositories within days.

The second wave included 19 malicious repositories.

At the time of BleepingComputer’s October 29 investigation, Hugging Face had disabled access to the most prominent malicious model, but a similar copy remained available.

The Hugging Face malware incident shows how malicious model publishers can reappear under new accounts even after takedowns.

Repository availability may have changed since the investigation was published.

How Did the Hugging Face Malware Attack Work?

The hugging face malware campaign did not primarily depend on exploiting a previously unknown flaw in model weights.

Instead, attackers abused a documented functionality in Hugging Face Transformers.

The key mechanism was the trust_remote_code option.

Step 1: Publish a convincing AI model repository

Attackers created repositories that resembled legitimate machine learning projects.

The pages used model names associated with Qwen2 and included files that appeared to be part of ordinary AI model packages.

This presentation could encourage developers to download and load the models without fully reviewing their contents.

Step 2: Abuse the trust_remote_code feature

Hugging Face Transformers supports custom modeling code for architectures that are not built directly into the library.

Some models require users to enable:

trust_remote_code=True

When this option is enabled, the library may execute Python code supplied by the model repository.

This is legitimate functionality, but it creates a security boundary that developers must understand.

Untrusted custom model code can execute with the permissions of the process loading it.

In the Load/Mine campaign, the repository configuration referenced malicious Python modules that executed during model loading.

The attack did not require the model to complete a successful inference request.

Step 3: Install cryptocurrency mining malware

Once the malicious code executed, it could deploy a cryptocurrency miner on the affected machine.

The miner was designed to consume computing resources, especially those available on GPU-equipped servers.

According to the researchers, the malware attempted to disguise itself as a normal Linux system process.

It also included mechanisms to restart the miner if it was terminated.

This could lead to unauthorized resource consumption, increased infrastructure costs, and degraded server performance.

Step 4: Establish persistence and remote access

Some versions of the malware went beyond cryptocurrency mining.

Researchers identified additional functionality including:

• Persistent malicious processes
• Changes to shell startup configurations
• Remote-access backdoors
• Attempts to remove competing cryptocurrency miners
• Scripts designed to compromise underlying host systems from certain container environments

These capabilities made the campaign more serious than a simple unauthorized mining operation.

A compromised inference server could potentially expose credentials, internal services, or other resources accessible to the affected process.

The exact impact would depend on the permissions and environment of the infected machine.

Why Did Malicious AI Models Pass Security Scans?

A particularly important finding in the hugging face malware investigation was that some malicious repositories passed available security scanning checks.

Hugging Face provides several security features for uploaded repositories.

These include malware scanning, pickle scanning, and integrations with security companies such as Protect AI and JFrog.

However, no automated scanner can guarantee that every uploaded file is harmless.

The limitations of automated model scanning

Traditional malware scanners commonly look for known malicious patterns, file characteristics, and suspicious signatures.

Machine learning model scanners also examine risks associated with serialized model formats.

The Load/Mine campaign exploited a different attack surface.

Its dangerous behavior was present in Python code associated with model loading.

Researchers reported that the malicious Python files were not flagged by the scanners that examined them.

This allowed suspicious repositories to accumulate downloads despite appearing to pass security checks.

Does using Safetensors eliminate the risk?

No.

Hugging Face recommends the Safetensors format because it avoids many code-execution risks associated with Python pickle serialization.

However, a safe model-weight format does not automatically make accompanying Python code safe.

If a repository includes malicious custom loading code, enabling that code can still compromise the system.

This distinction is essential for developers evaluating third-party AI models.

Hugging Face’s official Transformers security policy recommends reviewing custom modeling files and pinning trusted model revisions.

The best approach combines trusted model formats with code review and isolated execution environments.

Are AI Model Downloads From Hugging Face Safe?

Hugging Face can be used safely, but users should not assume that every publicly available repository is trustworthy.

The platform hosts models from established AI organizations, academic researchers, independent developers, and community contributors.

These repositories can vary significantly in quality, maintenance, and security.

The hugging face malware campaign demonstrates that the greatest risks may arise when a model repository is treated as trusted executable software without sufficient verification.

What makes an AI model potentially dangerous?

A model repository can contain more than model weights.

It may also include configuration files, Python modules, dependency requirements, and supporting scripts.

Some of these components are executable code.

Potential risks include malicious downloads, unauthorized system commands, credential exposure, and unintended network connections.

Does a high download count mean the model is safe?

No.

The Load/Mine investigation identified a malicious model with more than 28,000 reported downloads.

Popularity may provide useful context, but it is not proof of security.

Developers should also check publisher identity, repository history, community reports, and unusual code behavior.

Who faces the greatest risk?

Organizations operating self-hosted inference systems may face higher consequences because those environments often have valuable computing resources and access to internal services.

AI researchers running downloaded models on personal computers can also be exposed.

The level of risk depends on whether malicious code executes and what permissions it receives.

How to Download Hugging Face AI Models Safely

The hugging face malware incident offers several lessons for developers, researchers, and organizations.

1. Verify the model publisher

Before downloading a model, examine its publisher.

Prefer established organizations or developers whose identities and repositories can be independently verified.

Review the model card, documentation, publication history, and repository activity.

Be cautious of newly created accounts publishing models that closely imitate recognized projects.

2. Avoid enabling untrusted remote code

Do not enable trust_remote_code=True simply because a model’s documentation recommends it.

First determine whether custom code is necessary.

If it is required, inspect the referenced Python files and understand their behavior.

Treat remote model code like any other untrusted software dependency.

3. Review configuration and Python files

Inspect a repository’s configuration files and custom modeling modules.

Pay particular attention to code that downloads additional executables, launches subprocesses, modifies system files, or initiates unexplained network connections.

These behaviors are not always malicious, but they deserve investigation.

4. Prefer safer model serialization formats

Where supported, use Safetensors rather than potentially unsafe serialized formats.

Hugging Face explains the security benefits in its official Safetensors documentation.

Remember that this protects against certain file-format risks and does not replace Python code review.

5. Run unfamiliar models in isolated environments

Test untrusted models in environments that do not contain production secrets or sensitive data.

Apply restricted permissions, limited network access, and resource controls.

Avoid running new model repositories with administrator or root privileges.

6. Pin reviewed model revisions

A model repository can change after you first inspect it.

Pinning a specific reviewed commit helps reduce the risk of silently loading changed code.

Reassess any new version before deploying it into production.

7. Strengthen your AI development environment

Keep inference frameworks, Python dependencies, container images, and operating systems updated.

Use separate credentials for development and production workloads.

Limit access tokens to the permissions required for each application.

For more foundational guidance, read our best cybersecurity tips for beginners.

Safe model deployment requires reviewing both the AI artifact and the software environment in which it runs.

What to Do If You Downloaded a Malicious AI Model

Downloading a suspicious repository does not automatically mean your system was infected.

The most important question is whether malicious code was executed.

However, users who loaded a model identified in the hugging face malware investigation with remote code enabled should treat the affected environment as potentially compromised.

Step 1: Stop using the affected environment

Suspend additional model execution on the potentially compromised server.

For business systems, involve the security or infrastructure team before removing evidence.

Step 2: Investigate suspicious activity

Review running processes, unusual GPU utilization, outbound network traffic, and unexpected modifications to startup files.

Compare the environment against indicators published in the original Pluto Security investigation.

Step 3: Revoke exposed credentials

If the affected process could access Hugging Face tokens, cloud credentials, SSH keys, or other secrets, rotate them from a trusted device.

Hugging Face recommends using appropriately scoped access tokens and revoking credentials that may have been exposed.

Step 4: Check persistence and backdoors

Terminating a cryptocurrency miner may not remove every malicious component.

Some variants in the reported campaign established persistent processes or remote-access capabilities.

Professional incident response may be required.

Step 5: Rebuild when necessary

If the integrity of the machine cannot be established, rebuilding from a trusted image may be safer than attempting to remove individual malicious files.

Do not reconnect a suspected compromised server to sensitive production systems until it has been properly investigated.

Can Two-Factor Authentication Protect AI Accounts?

Two-factor authentication can reduce unauthorized account access, but it does not directly prevent malicious model code from executing on a server.

This is an important distinction in the hugging face malware case.

Hugging Face supports authentication and account-security features, including access-token management and multifactor authentication.

Enabling MFA can help protect an account if its password is stolen.

A supported two factor authentication app provides an additional verification method for compatible services.

However, once a user executes untrusted Python code on a machine, account authentication alone cannot prevent that code from using resources already accessible to the process.

For organizations, MFA, least-privilege access, secure secrets management, and model-code review should work together.

Our best account security practices guide explains additional measures for reducing account takeover risks.

Frequently Asked Questions

Was Hugging Face hacked in October 2026?

The October 2026 Load/Mine campaign involved attackers publishing malicious repositories on Hugging Face.

The reported evidence does not establish that attackers compromised Hugging Face’s central infrastructure to distribute these particular models.

It is a model-repository supply-chain threat and should not be confused with Hugging Face’s separate infrastructure security incident disclosed in July 2026.

How many malicious Hugging Face models were discovered?

Pluto Security identified 31 malicious repositories associated with seven Hugging Face accounts.

Including related repositories, researchers recorded more than 32,000 downloads.

These figures do not indicate 32,000 confirmed infections.

Can Hugging Face models contain malware?

Yes.

Model repositories may contain executable Python code, unsafe serialized data, or malicious supporting files.

The risk depends on the model’s contents and how it is loaded.

What is trust_remote_code?

It is a Transformers option that allows users to load custom Python modeling code supplied by a model repository.

This feature supports custom model architectures, but enabling it for untrusted repositories can allow malicious code to execute.

Are Safetensors models always safe?

No.

Safetensors avoids certain arbitrary-code-execution risks associated with pickle serialization.

However, a repository containing Safetensors files may also include malicious Python scripts or unsafe dependencies.

Can Hugging Face malware steal passwords?

Malicious code running with sufficient permissions may potentially access credentials or tokens available to the compromised process.

The Load/Mine campaign included remote-access capabilities in some variants.

However, this does not mean every downloaded model stole user passwords.

Does antivirus software detect malicious AI models?

Sometimes.

Antivirus and model-specific security scanners can detect known threats, but they do not guarantee complete protection.

The October 2026 investigation demonstrated that some malicious custom model-loading code passed available scans.

Final Thoughts: Are Hugging Face AI Models Safe to Download?

The hugging face malware campaign disclosed on October 29, 2026, highlights a growing cybersecurity challenge involving third-party AI models.

Researchers identified 31 malicious repositories and more than 32,000 reported downloads, including a popular fake Qwen2 model used to distribute cryptocurrency mining malware.

The attack exploited a legitimate custom-code execution feature rather than relying solely on malicious model weights.

The most important lesson is that an AI model repository should be treated as a software supply-chain dependency—not just a downloadable data file.

To reduce risk, verify publishers, review custom code, avoid unnecessary remote-code execution, use safer model formats, and isolate unfamiliar workloads.

For broader protection recommendations, see our personal cybersecurity checklist.

Hugging Face can remain a valuable resource for AI development, but security depends on what you download, what you execute, and which permissions you grant.