For developers and enterprise administrators, the important distinction is downloading versus executing. Pluto Security’s investigation describes malicious Python running when a model is loaded with custom code enabled, not an infection automatically caused by downloading repository files. Its download figures are not a victim count.
What returned after the takedowns
Pluto’s October 29, 2026 investigation identified 31 malicious repositories across seven Hugging Face accounts. Including 13 linked repositories, it recorded 32,376 downloads by October 28. The second wave comprised 19 repositories with 29,090 downloads; researchers said those remained available eight days after notification.
The repositories impersonated small Qwen2 test checkpoints. According to BleepingComputer, the most popular, MENXIANGYU/qwen2-tiny, contained no actual model. Instead, its code installed a miner disguised as a Linux system process and restarted it if terminated. Some variants also opened reverse shells, allowing remote commands.
BleepingComputer examined a near-identical copy under htt0118/qwen2-tiny, uploaded October 25, and confirmed the same miner and reverse-shell code. That accessibility finding belongs to October 29, not a confirmed inventory of repositories available today. The publication also reported Pluto’s estimate of roughly $5,000 in cryptocurrency receipts and observed mining activity after takedowns.
The permission that turns model loading into code execution
The central mechanism was Transformers’ trust_remote_code=True option. Pluto explains that it permits repository-supplied Python to execute with the loading process’s privileges before model weights load. This campaign did not need poisoned weights or a pickle exploit.
Hugging Face’s official Transformers security policy explicitly tells users to verify modeling files before enabling that option. It also recommends specifying a repository revision to protect against subsequent changes. In practical terms, approval should cover a particular reviewed version—not a repository name whose contents can change later.
That is the trust boundary worth remembering: a model publisher asking to run custom Python is asking for software-execution permission, not merely permission to read a large data file.
Why a clean scan was not enough
Hugging Face documents malware scanning, pickle scanning, and third-party scanners among its Hub security features. Those are useful controls, but they do not make every repository an independently audited software package.
Pluto reported that the flagship malicious repository received clean scanner results despite its executable payload. Its finding concerns this campaign’s detection gap; it should not be stretched into a claim that all platform scanning is ineffective.
There is another important distinction in Hugging Face’s own guidance: safer weights do not replace code review. The security policy recommends safetensors and explains that use_safetensors can reject unsafe weight formats. Separately, it requires scrutiny of custom modeling code. These address different risks: choosing a safer serialization format does not neutralize Python that the loader has expressly been authorized to execute.
What administrators should do
Pluto recommends the following response for systems that loaded an affected repository with custom code enabled—even if loading failed:
- Contain and preserve: Isolate affected machines and retain process, connection, log, and model-cache evidence.
- Investigate persistence: Check startup mechanisms, SSH keys, and model registrations. Stopping the miner alone is insufficient.
- Replace exposed credentials: Revoke or rotate accessible secrets from a clean machine.
- Restore trustworthy operation: Rebuild if integrity cannot be established; restrict privileges, network access, and production secrets in replacement environments.
For future deployments, Hugging Face’s verified guidance supplies a concrete baseline: inspect custom code and pin the reviewed revision before granting remote-code permission. Neither a familiar model-family name nor a reassuring scan badge substitutes for that decision. The useful question is not simply “Can this model run?” but “Whose code am I allowing to run with my credentials?”