# Pluto Security finds 31 malicious Hugging Face model repos with 29K downloads

Digest AI · Society & Work · published 2026-10-29T12:49:30Z

Canonical: https://digestai.news/story/pluto-security-finds-31-malicious-hugging-face-model-repos-with-29k-do

## Summary

Pluto Security disclosed a cryptomining and backdoor campaign distributed via malicious Hugging Face model repositories on October 29, 2026. The campaign involved 31 repositories across seven Hugging Face accounts and one ModelScope mirror, with 29,818 downloads recorded. Pluto notes these figures measure downloads, not confirmed infections or unique victims. The campaign returned within days of takedowns, with 19 second-wave repositories recording over 29,000 downloads and remaining active eight days after Pluto reported them.

The campaign exploited documented Transformers loading behavior, using `trust_remote_code=True` to run malicious Python code before model weights loaded. The payloads included cryptominers disguised as legitimate processes, reverse shells, and kernel-thread-based miners. First-wave payouts totaled about 2,276 PRL (roughly $5,000), and the campaign targeted Xinference and Tencent Cloud environments. Pluto attributes the operation to a financially motivated, Chinese-speaking group, citing Simplified Chinese comments and Alibaba Cloud infrastructure. The report recommends users check for malicious processes, registry entries, and connections to listed servers, and advises rebuilding affected machines from trusted images.

## Key points

- 31 malicious Hugging Face repositories linked to 29,818 downloads, excluding 13 linked repos
- Campaign exploited `trust_remote_code=True` in Transformers to run malicious Python code pre-weight loading
- First-wave payouts totaled ~2,276 PRL ($5,000), with second-wave repos active 8 days post-report

## Why it matters

This campaign highlights vulnerabilities in Hugging Face’s model repository system, where malicious code can execute before security checks. It underscores the need for stricter pre-upload scanning and user awareness of `trust_remote_code` risks, affecting AI developers and model users.

## Sources

1. [Pluto Security Details Load/Mine Cryptomining Campaign on Hugging Face](https://unite.ai/pluto-security-details-load-mine-cryptomining-campaign-on-hugging-face) (Unite.AI, 2026-10-29)

## Cite

Digest AI, "Pluto Security finds 31 malicious Hugging Face model repos with 29K downloads", 29 October 2026, https://digestai.news/story/pluto-security-finds-31-malicious-hugging-face-model-repos-with-29k-do

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/pluto-security-finds-31-malicious-hugging-face-model-repos-with-29k-do.json