Threat
Hugging Face GPU Cryptomining Campaign 2026 | AI Supply-Chain Threat Analysis
First reported · Discovered aviatrix.ai
Page published · Page updated
Earliest dated coverage: 30 Oct 2026 · First observed: 1 Nov 2026 · Latest dated coverage: 30 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The Hugging Face campaign demonstrates how enabling trust_remote_code for untrusted models can expose GPU servers to attacker-controlled execution despite clean platform and antivirus scans.
A reported Hugging Face supply-chain campaign distributed 31 malicious model repositories that abused trust_remote_code to execute attacker-controlled Python on GPU inference servers. Disguised as Qwen2 test checkpoints, the models installed cryptominers and reverse shells; the most-downloaded repository accumulated 28,412 downloads, and a subsequent wave included a container-escape script.
Summary
Aviatrix reports a recurring AI supply-chain campaign in which an unnamed operator published 31 malicious Hugging Face model repositories across seven accounts in two waves since September 2026. Disguised as Qwen2 test checkpoints, the repositories used trust_remote_code=True to execute attacker-controlled Python when loaded by GPU inference software such as Xinference or GPUStack. The article attributes discovery to Pluto Security in late October 2026.[0]
The reported payload installed a cryptocurrency miner, established persistence, and opened reverse shells. MENXIANGYU/qwen2-tiny reportedly accumulated 28,412 downloads, while the operator's wallet received approximately $5,000 in Pearl cryptocurrency. Downloads should not be interpreted as confirmed compromised hosts, and cryptocurrency receipts should not be treated as a measurement of total victim losses. Following an initial takedown, another repository wave reportedly appeared within days; one repository introduced a container-escape script, without establishing successful host escape.[0]
This assessment rests on a single supplied incident account: the Aviatrix article. Its linked underlying research and news reports were not supplied as evidence and therefore do not provide independent corroboration here. The article reports that platform and partner scans returned clean results, underscoring the distinction between a scanner verdict and the behavior of Python executed during model loading. It does not establish a named actor, version-specific product vulnerability, or concrete mining and command-and-control network indicators.[0]
Attack chain
- Malicious repository publication: The operator reportedly published malicious Hugging Face repositories under seven accounts, presenting them as Qwen2 test checkpoints. The article describes 31 repositories across two coordinated waves.[0]
- Execution during model loading: When a consumer loaded an affected repository with trust_remote_code=True, attacker-controlled Python executed on the GPU inference host. Xinference and GPUStack are cited as example inference environments; the described trigger did not require exploitation of a CVE.[0]
- Payload installation and continued access: The executed code reportedly installed a cryptocurrency miner, established persistence, and opened reverse shells. The supplied account does not identify the exact persistence implementation or establish an order among these payload actions.[0]
- GPU resource monetization: Compromised compute resources were reportedly used to mine Pearl cryptocurrency, with approximately $5,000 received by the operator's wallet. The report does not establish a corresponding number of compromised hosts or total compute costs incurred by victims.[0]
- Reintroduction after takedown: A second repository wave reportedly appeared within days of the initial takedown. One repository introduced a container-escape script, indicating an added host-access capability in the campaign's delivery material, but not proving successful container breakout.[0]
Disclosure timeline
| Date | Event |
|---|---|
| Since September 2026 | The article places the recurring campaign in this period and describes two coordinated waves involving 31 malicious repositories across seven accounts.[0] |
| Late October 2026 | Aviatrix reports that Pluto Security uncovered the recurring Hugging Face campaign.[0] |
| 2026-10-30 | Aviatrix published the supplied incident article, reporting an initial takedown followed within days by another repository wave. Exact takedown and reappearance dates are not supplied.[0] |
How it works
The execution mechanism is abuse of trust_remote_code=True, not a disclosed version-specific vulnerability. The repositories contain attacker-controlled Python that is permitted to run when the consumer loads the model. Presenting the repositories as Qwen2 test checkpoints supplies the model-distribution pretext for that execution.[0]
The reported runtime payload combines resource hijacking with remote access: a cryptocurrency miner consumes GPU compute, while reverse shells provide direct server access and persistence sustains the intrusion. The supplied article does not provide enough implementation detail to identify a persistence service, scheduled task, executable path, or shell destination.[0]
The article contrasts clean platform and partner scanning results with malicious behavior at model-load time. This supports treating scan results as insufficient assurance about repository Python behavior; it does not establish that the scanners were disabled or that a particular scanner vulnerability was exploited.[0]
One repository in the returning wave reportedly included a container-escape script. The evidence establishes the script's reported presence, but does not identify an escape vulnerability, its prerequisites, or a confirmed successful transition from a container to its host.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Attacker-published Qwen2-labeled Hugging Face model repositories | The reported scope is 31 malicious repositories across seven accounts, including MENXIANGYU/qwen2-tiny. Exposure occurs when attacker-controlled repository Python is executed through trust_remote_code=True. Xinference and GPUStack are cited as example inference environments; no affected software-version ranges are supplied. | The article reports an initial repository takedown followed by another wave within days. It provides no versioned vendor fix and describes legitimate-feature abuse rather than a CVE requiring a software patch.[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| other | MENXIANGYU/qwen2-tiny | Hugging Face repository identifier reported as the campaign's most downloaded malicious model, with 28,412 downloads. Use it to search model inventories, download records, and loading configurations. A download record alone does not establish execution or compromise.[0] |
Key takeaways
- The relevant security boundary is permission to execute repository-supplied Python. The reported campaign did not need a CVE to turn model loading into server-side code execution.[0]
- Clean platform scans did not establish runtime safety in this account. Repository code review, behavioral validation, and model-load-time monitoring are directly relevant to the described execution pathway.[0]
- The second wave makes repository takedown an incomplete campaign-level response. Persistent access on already affected hosts and replacement malicious repositories require separate attention.[0]
- Keep the evidence boundaries explicit: all incident-specific claims here are single-source; no named actor is established; downloads are not confirmed infections; and a reported container-escape script is not proof of successful breakout or lateral movement.[0]
Defensive actions
- Review repository Python before approving model loads that require trust_remote_code=True.: The reported initial execution occurs through this legitimate feature when a malicious model is loaded. Pre-execution code review and behavioral validation address the specific trust boundary crossed by the campaign.[0]
- Search model inventories and loading records for MENXIANGYU/qwen2-tiny, and investigate whether its remote code was executed.: The article identifies this repository as malicious. Distinguishing acquisition from execution avoids equating its reported download count with confirmed infections.[0]
- Restrict GPU inference workload egress to approved destinations and inspect unauthorized mining or remote-access traffic.: The reported monetization and reverse-shell behavior depend on outbound connectivity. The article specifically recommends destination allowlisting and inspection of mining and command-and-control traffic, although it supplies no concrete network indicators for blocking.[0]
- Correlate model-loading events with unexpected outbound connections and subsequent mining or reverse-shell activity.: The payload executes at model-load time, and the article identifies anomalous load-time network calls as a potential early signal. Runtime visibility addresses behavior that the reported static and partner scans did not flag.[0]
- Apply least-privilege execution and workload isolation to GPU inference processes, with restricted inter-workload communication.: The reported reverse shells and second-wave container-escape script justify limiting what an inference workload can access after code execution. These are proposed containment measures, not evidence that host escape or lateral movement succeeded.[0]
- For a confirmed malicious model execution, investigate persistence and reverse-shell access as well as the miner; do not treat repository takedown or miner removal alone as complete remediation.: The article reports persistent backdoor access in addition to mining, and repositories reportedly returned after takedown. Removing the distribution artifact or monetization component does not by itself address the other reported payload functions.[0]