{"schema_version":"0.10.0","id":"LR-2026-0302","record_version":2,"title":"Malicious Hugging Face 'Qwen2 test' models execute hidden crypto miner and reverse shell via trust_remote_code","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":58.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.4,"unhedged_language":4.87},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: the420.in · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: the420.in · subject to change"}]},"sources_hash":"4dcc6c8c3875adba6c42003e250f1a96d8fc61b18d1c1e8f18bd5ef764f0cc8c"},"system":{"model_name":"Qwen2","model_version":null,"developer":"unknown","harness":"Xinference and GPUStack","tools_granted":["code_execution","reverse_shell","remote_control_backdoor"],"permissions_scope":"Model code executed with the loading user's privileges on self-hosted AI servers; no further scope stated.","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":"model_artifact_with_remote_code","intended_use":"Presented as small Qwen2 test models for self-hosted AI services; in reality they installed a cryptocurrency miner.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-09-01","date_occurred_precision":"month","date_disclosed":"2026-10-30","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Pluto Security found 31 malicious repositories on seven Hugging Face accounts posing as small Qwen2 test models for self-hosted AI services, drawing over 32,000 downloads.","tags":["supply-chain","model-repository","cryptomining","reverse-shell","trust-remote-code","malicious-model-repository","backdoor"],"date_detected":null,"near_miss":false,"root_cause":"adversarial_input","root_cause_detail":"Malicious repositories presented as Qwen2 test models carried Python code that ran when loaded with trust_remote_code enabled, installing a miner and reverse shell.","failure_class_detail":"Repositories posing as AI models executed attacker-supplied Python on load, installing a miner and reverse shell; no autonomous agent behaviour is described.","responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":"Malicious model repositories on Hugging Face disguised as Qwen2 small models, loaded via trust_remote_code","time_to_contain":null,"operations_paused":null,"remediation":"First batch of related repositories deleted; Alch-crypto advised not enabling trust_remote_code for models from unknown sources, checking processes when GPU usage spikes, and separating mining devices from AI machines.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: The poisoned repositories were downloaded more than 32,000 times, an unbounded set of third-party machines, and the attackers re-listed them after deletion.","harm_class":["financial","third_party_security","operational"],"affected_description":"31 malicious repositories across seven Hugging Face accounts with more than 32,000 downloads; machines that loaded them with remote code enabled","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":"partial","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://the420.in/cyber-crime/hugging-face-ai-model-crypto-mining-malware/","publisher":"The 420.in","date":"2026-10-30","type":"press","title":"Researchers Uncover Malware Hidden in AI Models on Hugging Face - The 420.in","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.chaincatcher.com/en/article/2300340","publisher":"ChainCatcher","date":"2026-10-30","type":"press","title":"Alchcrypto: Hugging Face poison repository...","archived_url":null,"attachment":"fingerprint"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"B","system.permissions_scope":"D","system.lifecycle_stage":"D","system.integration_type":"C","system.intended_use":"C","system.developer":"D","system.deployment_context":"D","system.autonomy_level":"D","event.date_occurred":"C","event.tags":"C","event.near_miss":"D","event.root_cause":"D","event.responsible_party":"D","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"D","event.detection_method":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.harm_class":"B","impact.affected_description":"C","impact.data_categories_exposed":"D","impact.reversibility":"D","impact.severity":"D","context.systemic_exposure":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":1,"quote":"It claimed that someone poisoned the model hosting platform Hugging Face, disguising 31 repositories as Qwen2 small models."}],"system.developer":[{"source_index":0,"quote":"The files were presented as small Qwen2 test models intended for systems running self-hosted AI services, including Xinference and GPUStack."}],"system.harness":[{"source_index":0,"quote":"The files were presented as small Qwen2 test models intended for systems running self-hosted AI services, including Xinference and GPUStack."}],"system.tools_granted":[{"source_index":0,"quote":"The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user."},{"source_index":1,"quote":"Some versions come with backdoors that allow remote control of the machines."}],"system.permissions_scope":[{"source_index":0,"quote":"The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user."}],"system.deployment_context":[{"source_index":0,"quote":"The files were presented as small Qwen2 test models intended for systems running self-hosted AI services, including Xinference and GPUStack."}],"system.lifecycle_stage":[{"source_index":0,"quote":"The files were presented as small Qwen2 test models intended for systems running self-hosted AI services, including Xinference and GPUStack."}],"system.integration_type":[{"source_index":0,"quote":"The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user."}],"system.intended_use":[{"source_index":0,"quote":"The files were presented as small Qwen2 test models intended for systems running self-hosted AI services, including Xinference and GPUStack."}],"system.autonomy_level":[{"source_index":0,"quote":"The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user."}],"event.date_occurred":[{"source_index":0,"quote":"Researchers at Pluto Security identified 31 malicious repositories across seven Hugging Face accounts, published in two waves since September 2026."}],"event.detection_method":[{"source_index":0,"quote":"Researchers at Pluto Security identified 31 malicious repositories across seven Hugging Face accounts, published in two waves since September 2026."}],"event.summary":[{"source_index":0,"quote":"Researchers at Pluto Security identified 31 malicious repositories across seven Hugging Face accounts, published in two waves since September 2026."}],"event.tags":[{"source_index":0,"quote":"Certain versions also opened a reverse shell, potentially giving attackers direct access to compromised servers."},{"source_index":1,"quote":"Some versions come with backdoors that allow remote control of the machines."}],"event.root_cause":[{"source_index":0,"quote":"The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user."}],"event.root_cause_detail":[{"source_index":0,"quote":"One widely downloaded repository contained no functional AI model."}],"event.responsible_party":[{"source_index":0,"quote":"The researchers linked the operation to a financially motivated, Chinese-speaking attacker and estimated that the main cryptocurrency wallet had received roughly $5,000 in Pearl tokens."}],"event.adversarial_actor":[{"source_index":0,"quote":"The researchers linked the operation to a financially motivated, Chinese-speaking attacker and estimated that the main cryptocurrency wallet had received roughly $5,000 in Pearl tokens."}],"event.input_provenance":[{"source_index":1,"quote":"It claimed that someone poisoned the model hosting platform Hugging Face, disguising 31 repositories as Qwen2 small models."}],"event.incident_class":[{"source_index":0,"quote":"Instead, its code installed a cryptocurrency miner disguised as a Linux process."}],"event.agent_involved":[{"source_index":0,"quote":"One widely downloaded repository contained no functional AI model."}],"event.failure_class_detail":[{"source_index":0,"quote":"The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user."}],"event.near_miss":[{"source_index":1,"quote":"The attackers' first batch of wallets has received about 2,276 PRL, which is approximately equivalent to $5,000 based on the price at the time of the post, and they are still receiving payments even after the repositories were deleted."}],"event.remediation":[{"source_index":1,"quote":"Alch-crypto also reminded local model users: do not enable trustremotecode for models from unknown sources; if GPU usage spikes abnormally, check the processes first and separate mining devices from machines running AI."}],"impact.harm_class":[{"source_index":0,"quote":"Instead, its code installed a cryptocurrency miner disguised as a Linux process."},{"source_index":1,"quote":"Once users load them using trustremotecode, the PRL miner program will be installed, which also disguises itself as a system process."}],"impact.affected_description":[{"source_index":0,"quote":"Together, the repositories recorded more than 32,000 downloads."}],"impact.data_categories_exposed":[{"source_index":1,"quote":"Some versions come with backdoors that allow remote control of the machines."}],"impact.reversibility":[{"source_index":0,"quote":"Researchers warned that deleting the miner would not necessarily eliminate the additional access mechanisms."}],"impact.severity_because":[{"source_index":1,"quote":"Alch-crypto mentioned that after the first batch of related repositories was deleted, the attackers changed accounts and re-listed them, with downloads exceeding 32,000 times."}],"context.systemic_exposure":[{"source_index":0,"quote":"Researchers stressed that download figures do not establish how many machines were actually infected."}],"impact.severity":[{"source_index":1,"quote":"Alch-crypto mentioned that after the first batch of related repositories was deleted, the attackers changed accounts and re-listed them, with downloads exceeding 32,000 times."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-30"}]},"notes_on_gaps":"No source states who first noticed the malicious repositories or by what signal; detection_method is coded third_party only because Pluto Security, an outside organisation, is credited with identifying them. No source states an autonomy arrangement, so autonomy_level is unknown; no autonomous agent is described, so failure_class is null. No source names a cause for the campaign beyond the trust_remote_code loading path, so trigger is unknown. No source states a confirmed infection count, records exposed, remediation hours, or a duration; download figures are not treated as an affected-machine count, so third_parties_affected_count is null. The $5,000 figure is attacker wallet proceeds, not a stated victim loss. Severity: source 0 says minor, source 1 says major; major is written because the cited fact is an unbounded set of third-party machines (32,000+ downloads) with re-listing after takedown. system.tier and event.date_disclosed are omitted as derived. system.guardrails_present is empty because no source states a control was in place; the trust_remote_code option being enabled is a user-side setting, not a stated safeguard. event.date_occurred: the source states the month only. event.trigger: unknown was classified, not stated; a trigger is never inferred, so it is unknown. impact.direct_loss_usd: the source gives 5000 only as a bound ('roughly'); not stored as an exact count. system.tier: not set; no operator named and deployment_context is not a lab's. Sources disagree on impact.affected_description: [0] \"31 malicious repositories across seven Hugging Face accounts with more than 32,000 downloads; machines that loaded them with remote code enabled\", [1] \"Users who loaded the poisoned repositories with trust_remote_code; downloads exceeding 32,000 times\"; impact.severity: [0] \"minor\", [1] \"major\"; system.harness: [0] \"Xinference and GPUStack\", [1] \"Hugging Face model repositories loaded with trust_remote_code\"; system.integration_type: [0] \"model_artifact_with_remote_code\", [1] \"model repository / trust_remote_code loading\"; system.intended_use: [0] \"Presented as small Qwen2 test models for self-hosted AI services; in reality they installed a cryptocurrency miner.\", [1] \"Presented as Qwen2 small models for local use; actually a delivery vehicle for a PRL miner\". [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-11-01] system.permissions_scope: classified from described behaviour. system.lifecycle_stage: production. system.developer: no source names the developer. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.near_miss: classified from described behaviour. event.responsible_party: third_party. event.agent_involved: classified from described behaviour. event.detection_method: a source states an outside organisation (a vendor, a partner, a platform) noticed it first. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. impact.data_categories_exposed: classified from described behaviour. impact.reversibility: partial. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":false,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Attackers published fake Qwen2 test models on Hugging Face for users of self-hosted AI services such as Xinference and GPUStack; loading them with trust_remote_code enabled let the model's own Python code run on the user's server.","quote":"The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The repositories contained no functional model; their code installed a cryptocurrency miner disguised as a Linux process, and some versions opened a reverse shell giving attackers remote access.","quote":"Instead, its code installed a cryptocurrency miner disguised as a Linux process.","source_index":0,"grade":"C"},{"step":"reached","text":"The 31 repositories across seven accounts drew more than 32,000 downloads, with the most popular exceeding 28,000; the researchers said download counts do not show how many machines were infected.","quote":"Together, the repositories recorded more than 32,000 downloads.","source_index":0,"grade":"C"},{"step":"caught","text":"Researchers at Pluto Security identified the malicious repositories; the sources do not say what signal first alerted them.","quote":"Researchers at Pluto Security identified 31 malicious repositories across seven Hugging Face accounts, published in two waves since September 2026.","source_index":0,"grade":"C"},{"step":"done","text":"Pluto Security alerted Hugging Face and ModelScope, which removed the initial accounts, but 19 new repositories appeared within days; users were advised to treat servers as compromised, check for persistence and rotate credentials.","quote":"Pluto Security alerted Hugging Face and ModelScope to the initial accounts, which were subsequently removed.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-11-01","source_urls":["https://the420.in/cyber-crime/hugging-face-ai-model-crypto-mining-malware/","https://www.chaincatcher.com/en/article/2300340"]}}