Crypto Miners Are Hiding Malware in AI Models

A crypto-mining campaign returned to Hugging Face, using malicious AI models to hijack GPU servers and install backdoors on developer systems.

A malicious campaign targeting the AI development community has resurfaced on the Hugging Face platform, just days after a previous takedown. According to reporting from BleepingComputer, attackers are uploading compromised machine learning models designed to hijack the powerful GPU servers used for AI training and inference. The goal is to secretly run crypto-mining software, stealing expensive computing resources. The campaign's persistence is alarming; one of the malicious models was downloaded over 28,000 times before it was identified and removed. Beyond resource theft, the malware also installs a persistent backdoor, giving attackers long-term access to compromised systems and creating a much deeper security risk for affected organizations.

The attackers employ a deceptive strategy by uploading what appear to be legitimate or useful AI models, often by forking popular open-source projects. The malicious code is hidden within the model's files, typically in a way that is not immediately obvious to a developer simply downloading and running the model. Once loaded, the hidden script executes, downloading and running a crypto-miner that consumes available GPU cycles. Simultaneously, it establishes a backdoor, which could be used for further attacks like data exfiltration, lateral movement within a network, or deploying other forms of malware. This attack vector is particularly effective because the AI development workflow often involves downloading and experimenting with numerous models from public repositories, and the high GPU usage from crypto-mining can be mistaken for legitimate model training activity.

This incident is not an isolated event but a clear signal that software supply chain attacks are now a major threat to the AI ecosystem. For years, security professionals have warned about similar attacks on code package managers like npm and PyPI, where malicious libraries are disguised as useful tools. Hugging Face, often called the “GitHub for AI,” has become a central hub for sharing models, making it a high-value target. The economic incentive is straightforward: AI development requires expensive, high-performance GPUs, the same hardware that is highly efficient at mining cryptocurrencies. Attackers are simply following the resources. The rapid return of this campaign after being shut down demonstrates the attackers' determination and the ongoing challenge platforms face in policing user-submitted content at scale.

For developers, CTOs, and security teams, the key takeaway is that AI models must be treated as executable code with inherent risks. The era of blindly trusting and running models from public repositories is over. Organizations must adopt a “zero trust” approach to their MLOps pipeline, implementing security checks for every external asset. This includes static and dynamic analysis of models, sandboxing their execution, and closely monitoring system resources and network traffic for anomalies. Companies should establish clear policies on sourcing models, prioritizing those from verified creators or internal, vetted repositories. As attackers grow more sophisticated, the industry will need to develop better tools and standards for ensuring the provenance and integrity of the AI models that power modern applications.

This campaign shows that popular AI repositories are a prime target for supply chain attacks. Developers pulling models from Hugging Face risk having their GPU infrastructure compromised, leading to resource theft and backdoors that can exfiltrate sensitive data or code.

Compromised infrastructure leads to direct financial losses from inflated cloud computing bills and stolen resources. The presence of backdoors also creates a severe security risk, potentially exposing proprietary code and customer data, resulting in significant reputational and financial damage.