Cases › security breach › LR-2026-0302
Malicious Hugging Face 'Qwen2 test' models execute hidden crypto miner and reverse shell via trust_remote_code
Preliminary Why: 1 report: the420.in · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Severity major: The poisoned repositories were downloaded more than 32,000 times, an unbounded set of third-party machines, and the attackers re-listed them after deletion.
Happened 2026-09 · Earliest source we hold 2026-10-30 · Captured by AI Risk Wire 2026-11-01 00:47 UTC
Pluto Security found 31 malicious repositories on seven Hugging Face accounts posing as small Qwen2 test models for self-hosted AI services, drawing over 32,000 downloads.
Risks this incident falls under
| Risk | Role | NIST AI 600-1 | Incidents | Last 6 quarters |
|---|---|---|---|---|
| AI used to run a cyber attack | Primary | Information Security | 38 | |
| AI system attacked or breached | Also | Information Security | 1 |
Sorted by rule from the case's fields; not yet read from the sources.
Control failure chain
L1 · ModelQwen2Model provider
Sources not yet read for controls.
Model version not linked to a model card.
Other controls for this risk at this layer, not yet read for: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessXinference and GPUStackAgent framework vendor
Sources not yet read for controls.
L3 · ApplicationDeployer not namedDeployer
Sources not yet read for controls.
L4 · Infrastructure / targetOrganisation hit
Sources not yet read for controls.
Other controls for this risk at this layer, not yet read for: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
The same controls in other incidents of this risk
| Control | Layer | Here | Held elsewhere | Did not hold elsewhere |
|---|---|---|---|---|
| Content safety classifiers | L1 Model | Not read yet | ||
| Safety training and refusal | L1 Model | Not read yet | 1 | |
| Cyber and weapons safeguards | L1 Model | Not read yet | ||
| Dangerous-capability testing before release | L1 Model | Not read yet | ||
| Outside red-teaming | L1 Model | Not read yet | ||
| Staged or restricted release | L1 Model | Not read yet | ||
| Abuse monitoring and account enforcement | L1 Model | Not read yet | ||
| Reasoning monitoring | L1 Model | Not read yet | 1 | |
| Safeguards kept on in testing | L1 Model | Not read yet | ||
| Known flaws patched | L4 Infrastructure / target | Not read yet | ||
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not read yet | ||
| Network segmentation | L4 Infrastructure / target | Not read yet | ||
| Intrusion and endpoint detection | L4 Infrastructure / target | Not read yet | ||
| Backups and recovery | L4 Infrastructure / target | Not read yet | ||
| Phishing and fraud filters | L4 Infrastructure / target | Not read yet |
Remediation
Advice in source, not a fix by the party
“First batch of related repositories deleted; Alch-crypto advised not enabling trust_remote_code for models from unknown sources, checking processes when GPU usage spikes, and separating mining devices from AI machines.”
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
What the sources state
- Cause hostile input carried instructions
No source states: when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Others like this
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The $5,000 figure is attacker wallet proceeds, not a stated victim loss.
LR-2026-0302 · version 2 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · changes to this case · JSON