Nobody exploited a vulnerability in Hugging Face. The attacker exploited a habit: treating a familiar name, a high download count and a trending badge as proof that a model is what it claims to be.
On May 7, 2026, researchers at HiddenLayer flagged a Hugging Face repository called Open-OSS/privacy-filter. It had copied the model card of OpenAI's legitimate Privacy Filter release almost word for word, climbed to number one on the platform's trending list in under 18 hours, and logged roughly 244,000 downloads before Hugging Face disabled it. The repository shipped a loader.py file that looked like ordinary inference code. It disabled SSL verification, fetched a PowerShell command, and installed a Rust-based infostealer that went after browser credentials, cloud and CI/CD tokens, SSH keys and crypto wallets.
Nobody exploited a vulnerability in Hugging Face. The attacker exploited a habit: engineers treat a familiar name, a high download count and a trending badge as proof that a model is what it claims to be. HiddenLayer believes most of those downloads and the 667 likes were inflated. They did not need to be real. They only needed to look real long enough for a data scientist with production credentials to run one script.
This article is for the teams that pull open-weight models into GPU clusters, notebooks and inference endpoints every week. It covers the four ways a model gets poisoned, why platform scanning will not close the gap on its own, a six-gate intake pipeline you can stand up this quarter, and the storage decision buried inside it that most security reviews never price.
The Hugging Face Hub crossed three million public models in August 2026, according to Hub API counts published on the Hugging Face blog, up from one million in September 2024. More than 1.18 million models were added in 2025 alone. That is a package registry operating at npm scale, except the packages are multi-gigabyte binaries that almost nobody can read.
At the same time, the way enterprises consume those models has changed. Early experiments ran in isolated research notebooks. Production pipelines now pull base models with the same automation used to install software libraries, inside environments that hold secrets managers, cloud credentials and network paths to customer data. The Cloud Security Alliance made exactly this point in a May 2026 research note on model hub typosquatting: the blast radius grew because the privileges around model loading grew, not because the attacks got cleverer.
Traditional software composition analysis does not help much here. SCA tools read dependency manifests and container layers. They were never built to inspect the behavior of a serialized neural network, which is why a model file can pass every check in your CI pipeline and still open a reverse shell the moment someone calls torch.load().
Python's pickle format, which PyTorch used as its default for years, is not a data container. It is a sequence of instructions for a small virtual machine that can import and call arbitrary functions while it rebuilds objects. An attacker can embed os.system() in a file that looks like a stack of tensors. JFrog found around 100 Hugging Face models carrying payloads of this kind in 2024. By April 2025, Protect AI's Guardian scanner, running in partnership with Hugging Face, had checked 4.47 million model versions and identified 352,000 unsafe or suspicious issues across 51,700 models, per the Hugging Face blog.
The exposure is not shrinking quickly. The PickleBall study published on arXiv in 2025 by Brown and Columbia researchers measured that repositories containing only pickle-format models are still downloaded more than 400 million times a month. Even PyTorch's own safe mode was not airtight: CVE-2025-32434, rated critical, showed that torch.load with weights_only=True could still be driven to remote code execution in PyTorch 2.5.1 and earlier. The fix shipped in 2.6.0.
The privacy-filter campaign is the loud version of a quiet, measurable problem. The first systematic study of typosquatting on Hugging Face, presented at Internetware 2025, compared more than one million models against the 100 most downloaded and found 1,574 potentially malicious squatting models, plus 625 typosquatted datasets and 302 organizations registered with lookalike namespaces. Character swaps, hyphen insertion and version suffixes all work, because a developer pasting an identifier from a forum post rarely checks every character.
This one needs no typo at all. In September 2025, Palo Alto Networks Unit 42 showed that when a Hugging Face author deletes their account, the namespace returns to the pool and anyone can register it. Any code, notebook or cloud model catalog that still references Author/ModelName by name will resolve to whatever the new owner uploads. Unit 42 re-registered orphaned namespaces, planted reverse-shell payloads, and obtained code execution on endpoints deployed through Google Vertex AI Model Garden and Microsoft Azure AI Foundry. Google responded by scanning daily for deleted authors. Your internal scripts get no such protection.
The first three vectors attack the machine that loads the model. The fourth attacks the model itself. Trail of Bits demonstrated a technique called Sleepy Pickle that uses a malicious pickle to quietly modify a model's weights at load time, so the model passes standard benchmarks while producing attacker-chosen outputs on targeted inputs. And in October 2025, Anthropic, the UK AI Security Institute and the Alan Turing Institute published the largest data poisoning study to date: as few as 250 malicious documents were enough to plant a backdoor in models from 600 million to 13 billion parameters, regardless of how much clean data the larger models saw.
Read that study carefully, because it is easy to overstate. The backdoor it tested made models emit gibberish on a trigger phrase, and the authors describe it as a narrow, low-risk behavior unlikely to matter in frontier models. What should change your planning is the shape of the result: poisoning did not require controlling a percentage of the training set, only a small, fixed number of documents. For anyone fine-tuning on scraped or third-party data, that moves poisoning from theoretical to budgetable.
| Vector | How it lands | Caught by | Missed by |
|---|---|---|---|
| Malicious serialization | Code runs on load | Dual scanning, safetensors | Single scanner |
| Typosquatting | Lookalike name or org | Commit pinning, allow-list | Download counts, likes |
| Namespace reuse | Deleted author re-registered | Commit pinning, signing | Name-based references |
| Poisoned weights or data | Backdoor on a trigger | Sandboxed behavioral evals | Scanning and signing |
Hub-side scanning is real and worth having. It is also an arms race the defenders are visibly losing at the margins. In February 2025, ReversingLabs found two models on Hugging Face using a technique it named nullifAI: the payload sat at the start of a deliberately broken pickle stream, compressed with 7z instead of ZIP. Picklescan errored out and did not flag the file, while PyTorch happily executed the malicious opcodes before it hit the broken instruction. Hugging Face patched Picklescan within a day. Sonatype then documented four more bypasses. A scanner that works by recognizing bad patterns will always trail the people inventing new ones.
Scanning also cannot see the fourth vector. A backdoored weight tensor is just numbers. There is no import statement to flag. That is the contrarian point most vendor checklists skip: a clean scan tells you the file probably will not attack your host. It tells you nothing about whether the model will behave.
Cryptographic signing closes a different gap. The OpenSSF model-signing library reached version 1.0 in April 2025, built on Sigstore so publishers can sign without managing long-lived keys, and the work has since been formalized as the OpenSSF Model Signing (OMS) specification. NVIDIA has signed every model it publishes in the NGC Catalog with OMS since March 2025, making it the first major hub to do so. A valid signature proves the bytes you downloaded are the bytes a specific identity signed. It does not prove that identity was trustworthy, or that its training data was clean. Signing and scanning are complements, and neither is a behavioral guarantee.
The fix is not a product. It is a rule: no model reaches a GPU, notebook or endpoint without passing through an internal intake pipeline. Mirror what mature teams already do for npm and PyPI by proxying the public registry, and add the gates that model files specifically need.
Every Hugging Face download accepts a revision. Pin it to a full commit hash, not a branch or a bare model name. A pinned hash defeats namespace reuse and silent upstream replacement in one move. Then grep your codebase, notebooks and infrastructure templates for unpinned model identifiers. Unit 42 found reusable references in documentation, default arguments and example notebooks, not just application code.
For publishers that sign, verify with the open-source model-signing tool before the artifact enters your registry. NVIDIA documents the exact flow for NGC and NIM model profiles. For publishers that do not sign, record a SHA-256 hash of every file at intake and sign the artifact yourself with your own identity, so everything downstream of the gate can be verified against your registry rather than the public hub.
Make safetensors the default and pickle-format weights an exception that needs a written justification. Where you must load pickle, run PyTorch 2.6 or later and enforce weights_only=True in code review. Expect friction: the PickleBall researchers found that about 15 percent of pickle-only repositories contain at least one model that the weights_only loader cannot open. Convert those in an isolated environment or reject them.
Run at least two independent scanners, for example Protect AI's open-source ModelScan alongside Trail of Bits' Fickling, and treat any disagreement as a failure. nullifAI worked precisely because one tool's error was read as a pass. A scanner that cannot parse a file should block it.
Load every new model first in an isolated environment with no credentials and outbound network traffic blocked, and alert on any attempted connection, subprocess or unexpected file write. Then run your own task evaluations, including trigger-style probes, and compare outputs against a known-good baseline. This is the only gate that has any chance against poisoned weights.
For each approved model, capture the source repository and commit hash, file hashes, serialization format, signature status, scan results, the reviewing engineer and every downstream service that consumes it. Then write the artifact to an internal registry bucket with object lock or a write-once retention policy, so nobody, including a compromised pipeline, can quietly overwrite an approved model. This is the gate where security becomes a storage architecture decision.
Once every model must come from your registry, the registry becomes hot infrastructure. And for most teams running AI in 2026, the GPUs are not where the registry lives. Capacity is scarce and shifting, so the same model might be served on AWS this month, a neocloud like CoreWeave or Lambda Labs next month, and a reserved cluster somewhere else for a training run. Every redeploy, autoscaling event and new node pulls weights out of the registry, and if the registry sits behind hyperscaler egress pricing, verification turns into a toll you pay on every pull.
Here is a conservative worked example. A platform team keeps 2 TB of approved, verified weights in its registry, roughly a dozen large open-weight models in BF16 plus quantized variants. Three GPU clusters on other providers each re-pull the full set four times a month during redeploys and scale-outs. That is 24 TB leaving the registry every month.
On Amazon S3 Standard in US East, storage is the small line: $46.00 a month. Internet egress for 24 TB, after the 100 GB free allowance, costs $2,081.00, for a total of $2,127.00 a month or $25,524.00 a year. The same registry on Backblaze B2 costs $13.90 for storage, includes free egress up to three times the stored volume, and charges $180.00 for the remaining overage: $193.90 a month, roughly 11 times cheaper. On Cloudflare R2, which charges no egress at all, the registry costs about $29.85 a month before request fees. Wasabi lists $15.98 a month for 2 TB at its new $7.99 per TB rate, but its free egress policy is designed for downloads at or below the stored volume, and a 12x monthly read pattern falls outside it.
| Provider | Storage | Egress | Monthly total |
|---|---|---|---|
| Amazon S3 Standard | $46.00 | $2,081.00 | $2,127.00 |
| Backblaze B2 | $13.90 | $180.00 | $193.90 |
| Cloudflare R2 | $29.85 | $0.00 | $29.85 |
| Wasabi | $15.98 | Outside free egress policy | Not a fit |
The architectural point matters more than the vendor pick. Put the verified registry on S3-compatible, zero or low egress object storage that every GPU provider can reach, enable object lock, and keep the hash manifest next to the weights. Your security gate and your multi-provider GPU strategy then reinforce each other instead of taxing each other. If you also run training checkpoints through the same buckets, model the full flow in a cloud cost calculator before you commit, because checkpoint egress dwarfs model pulls.
Week one: inventory every place your organization loads a model, including notebooks and CI jobs, and grep for unpinned Hugging Face identifiers and torch.load calls without weights_only=True. Week two: stand up the registry bucket with object lock and route one team's model pulls through it. Weeks three to six: add dual scanning, signature verification for signed publishers, and the sandboxed first-load check. By the end of the quarter, block direct pulls from public hubs at the network layer for production environments, and make the AI bill of materials a release requirement, the same way you already require a software bill of materials.
For procurement, add three questions to every AI platform and model catalog review: does the provider scan third-party models with more than one engine, does it prevent reuse of deleted namespaces, and does it support verifying OMS or Sigstore signatures on the artifacts it serves?
weights_only=True could be bypassed for remote code execution in PyTorch 2.5.1 and earlier, so run PyTorch 2.6 or later, prefer safetensors, and keep scanning and sandboxing in place.Every model you load is code you did not write, from a publisher you have not verified, trained on data you have never seen. Verify it once, store it where you can afford to pull it, and never load it by name again.
Compare AWS, Google Cloud, Azure, and alternatives like Backblaze B2 Discover how much you could save in seconds
