News · 2026-11-01

Pluto Security reports a returning model-repository campaign that mines GPUs and opens remote access

Pluto Security reports that a malicious model-repository campaign returned within days after its first accounts were removed from Hugging Face and ModelScope. The campaign used repository code execution to install mining and remote-access payloads, showing why a familiar model name or an apparently safe weights file does not establish that the whole loading process is safe.

Key facts

• Pluto’s October 29 investigation describes 31 malicious repositories across seven accounts and a returning 19-repository wave.
• Its October 28 tally reached 32,376 downloads including linked models; those are not confirmed infections.
• The reported execution path was Python loaded with trust_remote_code=True, before usable model weights were needed.
• The primary source is Pluto Security’s Load/Mine investigation.

The significant update is the return after removal. A takedown can eliminate a known account or repository without eliminating the process used to create replacements. Pluto describes a second wave appearing within days, adapting its access mechanisms and continuing the same basic abuse of an AI developer’s loading workflow.

Pluto Security calls its report “Load/Mine: A Hugging Face Malware Campaign Returns After Takedown.” That title accurately emphasizes the sequence. The user believes they are loading a model; the repository arranges for their machine to begin doing something else. The researchers describe a miner, a watchdog and reverse-shell components, which can support resource theft and remote command access.

The loading flag is the key technical boundary. Some model architectures require custom Python distributed with the repository. Enabling trust_remote_code=True authorizes that code to run. The attacker does not have to make the tensor data itself executable. Code can act before useful weights are loaded, and Pluto says the flagship safetensors file contained no tensors at all.

An everyday analogy is receiving furniture with an instruction booklet and hiring an installer to follow it. The wood can be harmless while the booklet directs the installer to unlock the back door. Inspecting the wood alone does not inspect the instructions. In a model repository, tensor data and executable loading code are different parts of the package.

That distinction explains why a clean badge can be falsely reassuring. The report’s lesson is not that every scanner fails or every model registry is unsafe. It is that a result attached to one file type or scanning layer cannot establish the behavior of all code executed during import. Our model-file-format lesson explains what tensor storage formats protect, while agent sandboxing explains the separate question of limiting a running program’s authority.

The download total needs equally careful interpretation. Pluto explicitly separates downloads from infections and unique victims. Automated fetching, repeated requests and downloads that never reach the malicious execution path can all make those quantities different. The reported 32,376 figure measures distribution activity; it cannot support a headline claiming that many compromised users or graphics cards.

Pluto says it reported the first wave to Hugging Face and ModelScope and that the platforms removed those accounts. It then found the second wave and reported continued availability after notification. Those observations come from the investigating researchers. The dossier found no separate public Hugging Face explanation for this specific campaign, so platform rationale and response completeness remain unknown.

BleepingComputer’s October 29 coverage provides a second reporting layer and describes repository availability at its publication time. That is a dated snapshot, not a live statement about which accounts are accessible now. Repeating a repository’s name should not turn into an invitation to load it for a check.

The strongest qualification is the absence of a confirmed infection count and independent measurement of the entire campaign. A researcher can establish malicious code and observe active workers without proving how many downloads became compromised machines. Those limits do not weaken the central supply-chain finding: a model-loading path can execute attacker-controlled software on a computer that also holds valuable credentials and access to paid computing resources.

For teams, the practical boundary is permission to execute repository code. Review the required files and pin a reviewed revision before authorizing that behavior; separate untrusted evaluation environments from valuable accounts and shared secrets. Those are general defensive implications of the mechanism, not evidence that any single procedure has been tested against every variant in this campaign.

This is an AI-security story because the trusted surface is the model distribution and loading workflow itself. It is distinct from data poisoning, where training examples alter a model’s behavior. Here the immediate risk comes from ordinary software execution attached to something presented as an AI model. Removing one visible repository addresses an instance; controlling that execution boundary addresses the recurring opportunity.

Primary source, verified: read the paper →

Ground Truth. (2026, November 1). Pluto Security reports a returning model-repository campaign that mines GPUs and opens remote access. Ground Truth. https://groundtruth.day/news/hugging-face-load-mine-campaign-second-wave.html

@misc{groundtruth:hugging-face-load-mine-campaign-second-wave,
  title  = {Pluto Security reports a returning model-repository campaign that mines GPUs and opens remote access},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/hugging-face-load-mine-campaign-second-wave.html}
}

Topics: cybersecurity · ai-security · supply-chain · malware · model-registries