Hugging Face malware campaign returned within days of takedown, targeting self-hosted inference servers
Pluto Security reported that a Hugging Face malware campaign returned within days of takedown. The payloads abused Hugging Face's trust remote code option, a d…
Published on MyPrivateClaw
Oct 31, 2026, 6:33 PM UTC
Coverage date
Oct 29, 2026
Last updated
Oct 31, 2026, 6:33 PM UTC
News summary
Pluto Security documented that the malicious models abused Hugging Face's trust remote code=True option, which imports the repository's own Python code with the caller's privileges before any model weights load. It is a documented feature, not a default, and applies only to repositories that ship executable Python and are loaded with the flag enabled. Attacker code executes at load time without poisoned weights or a pickle exploit. Pluto Security tracked 31 malicious repositories across seven Hugging Face accounts, posing as small Qwen2 test checkpoints, with linked models recording more than 32,000 downloads. Pluto explicitly states this figure measures downloads, not confirmed infections or unique victims. The payloads targeted GPU hosts running self hosted inference servers, especially Xinference and GPUStack, along with rented GPU machines, shared research notebooks, and CI jobs tha…