Hugging Face GPU Hijack: How a Malicious AI Model Campaign Stole Cloud Compute at Scale
In late October 2026, researchers at Pluto Security uncovered a recurring supply-chain campaign on Hugging Face in which a financially motivated, Chinese-speaking threat actor published 31 malicious AI model repositories across seven accounts in two coordinated waves since September 2026. The models, disguised as Qwen2 test checkpoints, exploited Hugging Face's trust_remote_code feature to execute malicious Python code at model-load time on GPU inference servers. The most downloaded model, MENXIANGYU/qwen2-tiny, accumulated 28,412 downloads, silently installed a cryptocurrency miner, established persistence, and opened reverse shells granting direct server access. The attacker's wallet collected roughly $5,000 in Pearl (PRL) cryptocurrency, and a second wave of repositories reappeared within days of the initial takedown—one introducing a container-escape script. Traditional AV and partner scanning tools returned clean results throughout the campaign. This incident signals a maturing threat pattern in which adversaries weaponize trusted AI model repositories as a software supply-chain vector, bypassing conventional security controls by abusing legitimate platform features rather than known malware signatures. As enterprises accelerate AI workload adoption on GPU-intensive cloud infrastructure, the attack surface for model-based supply-chain compromise is expanding rapidly, demanding new runtime enforcement and egress control strategies.
Kill Chain
