Hugging Face Tokenizer.json Vulnerability: A New AI Supply Chain Threat
In May 2026, security researchers identified a vulnerability in Hugging Face's AI models, specifically within the 'tokenizer.json' file. Attackers can manipulate this file to intercept and redirect model outputs, potentially exfiltrating sensitive data such as API parameters and credentials. This supply chain attack affects models run locally using formats like SafeTensors, ONNX, and GGUF, but does not impact models executed through Hugging Face's Inference API. The compromised 'tokenizer.json' file allows threat actors to gain visibility into every URL the model accesses, posing significant security risks. This incident underscores the growing threat of supply chain attacks targeting AI infrastructure. As organizations increasingly rely on open-source AI models, ensuring the integrity of all components, including configuration files like 'tokenizer.json', becomes critical. The attack highlights the need for robust validation mechanisms and heightened vigilance when integrating third-party AI models into production environments.
Kill Chain
