We spent years teaching teams that model weights can hide code. This campaign didn’t bother with the weights. It shipped the code openly and waited for someone to tick the box that runs it.

On 29 October, Pluto Security’s research team published its tracking of a cryptomining and backdoor campaign spread through 31 malicious repositories across seven Hugging Face accounts, in two waves since September. The repositories posed as small Qwen2 test checkpoints and targeted GPU hosts running self-hosted inference servers, especially Xinference and GPUStack. There was no poisoned model: the flagship’s weights file was 42 bytes and held no tensors. The payload sat in a Python file that Transformers imports when a user loads the model with trust_remote_code=True, and it runs before any weights load. It installed a miner disguised as a kernel worker, a watchdog, shell startup hooks and, in some builds, a reverse shell. Pluto reported the first wave to Hugging Face and ModelScope, both removed it, and a second wave of 19 repositories appeared within days. BleepingComputer reports that downloads of the flagship model rose from 7,354 at the time of Pluto’s report to 28,412 by 28 October, and that a near-identical copy uploaded on 25 October was still live when it published. Pluto stresses that downloads are not confirmed infections. As The Next Web notes, the payload came back safe from every scanner that ran on it, because those scanners look for known malware signatures and unsafe weight formats, not at what a Python file does.

This isn’t an exploit. It’s a documented feature working as designed. The Transformers security policy already says to “please always verify the content of the modeling files” when using the flag, and recommends pinning a revision. The trouble is that tutorials and model cards copy the flag around until it reads like boilerplate, and the one setting it is often a data scientist, a shared research notebook or a CI job, not someone in the security review path. Meanwhile, the hosts it lands on are GPU servers and shared notebooks holding cloud credentials, tokens and data worth far more than the compute. Pluto’s attribution points to a financially motivated, Chinese-speaking operator using Alibaba Cloud infrastructure and mirroring binaries on ModelScope. For APAC teams standing up self-hosted inference on regional clouds, that is close to home. And the miner is the visible part: the backdoors stay when it stops.

What security leaders should do:

• Treat model repositories as third-party code. Put any model that needs trust_remote_code through the same review as a new software dependency.
• Pin reviewed revisions, and block unreviewed custom-code models in CI and shared notebooks.
• Run model loading with least privilege, restricted egress and no production secrets on the box.
• Require authentication on inference APIs such as Xinference and keep them off the internet.
• If an affected model was loaded, treat the host as compromised: check Pluto’s indicators, remove persistence and rotate every credential the process could reach.

A clean scan tells you the file isn’t known malware. It doesn’t tell you what the file will do when you run it.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #AISupplyChain #MLOps #APAC #CyberSecurity

Sources: Pluto Security research · BleepingComputer · The Next Web · Hugging Face Transformers security policy