-
Researchers found 31 harmful repositories on Hugging Face that install crypto miners and backdoors on GPU servers.
-
The top fake model reached 28,412 downloads by October 28, even though security scans reportedly missed its payload.
-
A fake Solana starter kit on GitHub also tricks AI coding agents into installing a remote access trojan on Windows.
A crypto mining campaign has returned to Hugging Face, just days after researchers helped remove its first repositories. The attackers disguised their software as small Qwen2 test models. They used these files to hijack GPU power and open backdoors on infected servers. GPU servers are strong computers that run AI tasks. Crypto miners use that power to earn digital coins for the attacker.
Cybersecurity firm Pluto Security published its report on October 29. It found 31 harmful repositories across seven Hugging Face accounts. The files appeared in two waves, starting in September 2026. They targeted self-hosted AI platforms, including Xinference and GPUStack.
According to the researchers, the campaign and its related models drew more than 32,000 downloads. That number counts repository downloads. It does not show confirmed infections or individual victims.
Fake models run harmful code as soon as they load
The attackers abused a Hugging Face feature called trust_remote_code. This feature lets AI models run Python code supplied by their publishers. It helps people build custom model designs. However, turning it on means users must trust the code that comes with the model.
Pluto found that the harmful repositories used this feature to run their payloads first. The payloads ran before the real model weights loaded. So the attackers spread malware without poisoning model weights or using pickle flaws. Pickle is a file format that people use to save AI models.
The most downloaded repository, MENXIANGYU/qwen2-tiny, held no working AI model. Its Python code installed a crypto miner instead. The miner posed as a normal Linux system process. The malware also included a watchdog that restarted the miner whenever someone stopped it. It even removed rival mining software.
Some versions carried extra backdoors. These opened reverse shells, which let attackers control the servers from far away. A reverse shell is a hidden link that lets attackers send commands to a machine.
Pluto also found that security scanners from Hugging Face partners, including Protect AI and JFrog, missed the top model. The researchers explained that these scans look for known malware and unsafe model formats. They do not check what a repository’s Python scripts actually run.
Attackers return within days of the takedown
Pluto traced the first campaign through backup files left inside a test account. Those files exposed links to the operator’s main repositories. After the report, Hugging Face and ModelScope removed the first wave of malicious accounts.
Still, 19 new repositories appeared under new accounts within days. Researchers also found a later payload. It can escape a container and take control of the server underneath.
The top model had 7,354 downloads when Pluto first reported it. That total rose to 28,412 by October 28. Hugging Face later disabled the model. However, reports say a near-identical copy stayed online under another account at the time of publishing.
Pluto estimated that the operator’s crypto wallet received about $5,000 worth of Pearl (PRL). Researchers also spotted nine machines mining for the operator. They believe these machines belong to a shared GPU research cluster. Their activity stopped about six minutes later.
Fake Solana Kit aims at AI coding agents
In a separate probe, AIR Security exposed a harmful GitHub repository named SolanaUpdateTools/solana-starter-kit. Someone created it in November 2025. It has collected 286 stars, yet it holds only a README file. The promised Solana development framework is missing.
The researchers warned that the repository could trap AI coding agents. These agents search for development tools and follow setup steps automatically. The README tells users to run a PowerShell command. That command downloads a remote script and runs it directly in memory. Researchers have also found that malicious text files can hijack AI coding agents by tricking them into executing harmful instructions.
AIR recovered the archived payload and found NetSupport Manager. This is a legitimate remote access tool. The attackers set it up to give them hidden control of infected Windows machines, which makes it a remote access trojan. The malware stays active through a Windows registry entry. It also connects to a command server at maxwintodaybtc[.]com.
The script also shows a fake error message. It claims developer features are temporarily unavailable. This may lead users to think the install simply failed.
AIR linked the operation to a NetSupport malware operator it had tracked before. That operator is tied to fake TradingView AI signal campaigns. The original payload link returned a 404 error during the investigation. Even so, the GitHub repository stayed online at the time of reporting.
The two investigations show growing risks in AI development setups. Developers should check model code before turning on remote code execution. They should also stop coding agents from running install commands from unverified repositories without approval. Pluto also advises anyone who loaded the affected models to investigate their systems. These users should change any credentials the machines could reach. Removing the miner alone does not remove the backdoors.
