Observed incident

Load/Mine abuses model-repository Python code to target GPU hosts

Reported

Published here

What happened

Pluto identified 31 core malicious repositories across seven accounts. Loading their custom Python code could install miners and backdoors on inference hosts; linked repositories brought recorded downloads above 32,000.

Parties and reporting

AI tools and systems: Hugging Face model repositories, trust_remote_code, Xinference, GPUStack

Outcome

The first wave was removed, but further repositories appeared. Later October 29 reporting confirmed the flagship was disabled while a copy remained available. Eradication of affected hosts is unknown.

Operating lesson

Review and pin custom model code before loading it. Isolate suspect hosts, preserve evidence, and rebuild or remove persistence before reuse; rotate credentials from clean systems.

Evidence and limits

Activity dates begin in September; private October reports are not public disclosure. Downloads are not infections. Pool activity supports monetization but does not identify a confirmed victim organization. The entry point is explicitly enabled custom-code execution, not a newly established model-format CVE.

Sources