Crypto-mining malware models return to Hugging Face days after takedown

Security firm Pluto identified 31 malicious repositories across seven Hugging Face accounts. They carried crypto-mining payloads and remote-access code disguised as AI models. Hugging Face removed them on October 25, but near-identical copies were live again by October 29, showing how easily attackers re-upload after enforcement.

The attack works through model formats that can execute code when loaded, such as pickle-based weights and custom loading scripts. Developers who download and run an unvetted model can execute an attacker's payload. Re-uploads under fresh accounts get around per-repository takedowns. Hugging Face says it has increased monitoring, and the latest Transformers release hardened its Jinja template sandboxing.

The tension is structural. Hugging Face just passed 20 million builders and 300PB hosted, with 9PB added in a single week according to CEO Clement Delangue, and October was its biggest month on record. CPO Irene Solaiman told TechCrunch that open access is exactly what makes open AI platforms a cyber target, and that defenses could make open-source AI "a little less open."

The security community is alarmed, and the incident adds to a third-party AI vendor risk thread that also includes the Fireworks AI breach affecting Notion customers. Practical advice: prefer safetensors, pin trusted publishers, and scan before loading. Watch whether Hugging Face adds verification requirements that slow uploads.