Malware Hidden in AI Models Hijacks GPU Servers for Crypto Mining

The intersection of artificial intelligence and cybersecurity has produced yet another alarming development. A sophisticated malware campaign has been discovered abusing popular AI model repositories to hijack GPU servers for cryptocurrency mining, marking a troubling escalation in how threat actors exploit the rapidly expanding AI infrastructure ecosystem.

The Campaign: Malware Masquerading as AI Models

Security researchers at Pluto Security uncovered 31 malicious repositories spread across seven Hugging Face accounts, published in two coordinated waves since September 2026. These repositories masqueraded as small Qwen2 test checkpoints, specifically targeting GPU hosts running self-hosted inference servers such as Xinference and GPUStack.

The scope of the campaign is staggering. With linked models included, the repositories accumulated more than 32,000 downloads. The most downloaded model, named MENXIANGYU/qwen2-tiny, contained no actual AI model whatsoever. Instead, its embedded code quietly installed a cryptocurrency miner disguised as a legitimate Linux system process.

How the Attack Works

What makes this campaign particularly insidious is its exploitation method. Rather than using poisoned model weights or traditional pickle file exploits, the attackers abused a legitimate Hugging Face feature called trust_remote_code. This option allows a model to ship with its own custom Python code that executes automatically when a user loads the model.

Once enabled, the malicious code runs on the victim machine before the model even loads. The malware performs several actions:

• Installs a cryptocurrency miner disguised as a standard Linux system process
• Monitors and restarts the miner if it is killed by the user or system
• Removes competing cryptocurrency miners from the infected machine
• Opens a reverse shell in some versions, granting attackers direct remote access

Resilience and Persistence

The campaign demonstrated remarkable persistence. After Pluto Security reported the first wave to Hugging Face and China ModelScope platform, both services removed the offending accounts. However, a second wave of 19 repositories appeared under new account names within days of the takedown.

Hours after the second wave was reported, the operator published yet another model containing a script capable of breaking out of container environments to take over the underlying server. Pluto Security noted that the second-wave repositories remained live eight days after being reported, and downloads of the flagship model surged from 7,354 to 28,412 by October 28.

Although Hugging Face has since disabled access to the primary malicious model, researchers confirmed that a near-identical copy uploaded on October 25 by a newer account remained active, containing the same miner and reverse shell payload.

Why Existing Scans Missed the Threat

Hugging Face employs antivirus scanning and partner tools from Protect AI and JFrog to screen uploaded models. However, Pluto Security identified a critical gap in this approach. These scanners look for known malware signatures and unsafe model file formats, but they do not analyze what a model bundled Python code actually does when executed.

This blind spot allowed the second-wave flagship model to scan clean while actively distributing cryptomining malware. The trust_remote_code mechanism, designed to enable flexible model customization, became the perfect delivery vehicle for malicious payloads that evade traditional detection methods.

The Broader AI Supply Chain Risk

This campaign highlights a growing concern in the AI security community. As organizations increasingly rely on open-source model repositories for their AI infrastructure, the attack surface expands dramatically. The threat extends beyond individual researchers to enterprise environments where GPU clusters represent significant computational investments.

Key risk factors include:

• Blind trust in community-uploaded models without code review
• Default enabling of trust_remote_code for convenience
• Limited visibility into what model-bundled code executes on production servers
• Rapid reuse and resharing of models across teams without security verification

A Parallel Threat: AI Coding Agents Under Fire

Separately, researchers flagged a fake Solana starter kit on GitHub, live since late 2025, specifically positioned to trick AI coding assistants into installing a remote access trojan. This represents a disturbing trend where attackers design malware payloads that exploit the automated behavior of AI coding agents rather than human developers.

The convergence of these two attack vectors, poisoning model repositories and targeting AI coding tools, suggests that threat actors are systematically mapping the AI development pipeline for vulnerabilities. Both attacks exploit the same fundamental weakness: the trust that developers and automated systems place in open-source AI artifacts.

Protecting Your GPU Infrastructure

Organizations running self-hosted AI inference servers should adopt several defensive measures to mitigate these evolving threats:

• Disable trust_remote_code by default and only enable it for models from verified sources after thorough code review
• Implement network segmentation to isolate GPU servers from sensitive internal resources
• Monitor resource utilization on GPU hosts for unexpected spikes that may indicate cryptomining activity
• Audit model repositories before deployment, including reviewing all bundled Python files
• Use container security tools that can detect runtime anomalies and block unauthorized outbound connections
• Maintain an allowlist of approved model sources and reject downloads from unverified accounts

The Road Ahead

The Hugging Face malware campaign serves as a wake-up call for the AI community. As AI infrastructure becomes increasingly central to business operations, it also becomes an attractive target for financially motivated threat actors. The combination of GPU computing power and often-lax security practices creates an ideal environment for cryptomining operations.

Platform operators must evolve their detection capabilities beyond signature-based scanning to include behavioral analysis of model-bundled code. Organizations must treat AI model deployment with the same rigor as any other software supply chain, implementing code review, sandboxed testing, and continuous monitoring.

The speed at which this campaign adapted after takedown attempts demonstrates that attackers are highly motivated and technically capable. As AI adoption accelerates, the security community must match that pace with equally sophisticated defensive strategies. The era of blindly trusting AI models from open repositories is over, and the cost of inaction is measured in stolen computing power, compromised servers, and eroded trust in the open-source AI ecosystem.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous