Pluto Security’s October 29, 2026, investigation counted 31 campaign repositories across seven Hugging Face accounts, plus 13 repositories it classified as linked. Its total was 44 repositories and 32,376 downloads through October 28. Pluto describes the campaign’s Python code running during model loading when custom-code trust was enabled. Read Pluto Security’s investigation.
What the 44-repository total counts
Pluto’s final accounting separates the campaign repositories from additional repositories linked by shared techniques. The report does not treat those links as proof of common ownership.
| Repository group | Repositories | Downloads through October 28 | Scope |
| First wave | 12 | 728 | Recorded before removal |
| Second wave | 19 | 29,090 | Campaign repositories |
| Linked repositories | 13 | 2,558 | Linked by shared techniques; common ownership was not established |
| Total | 44 | 32,376 | Includes all three groups |
Pluto’s download total is a count of repository downloads, not confirmed infections or unique victims. Its three group totals add up to 32,376: 728 + 29,090 + 2,558.
How loading a model could run Python
Pluto describes a code-execution path through Transformers, the library used to load models. A repository’s config.json can use auto_map to point to a Python module and class. When a loader enables trust_remote_code=True or accepts an interactive prompt to trust the code, Transformers imports that module. Python runs its top-level statements during the import, before the requested model class is returned. Pluto says this custom-code behavior is documented and is not the default.
The risk Pluto describes is in the repository’s Python code, not necessarily its model weights. In the examined MENXIANGYU/qwen2-tiny repository, Pluto reported that model.safetensors was 42 bytes and contained no tensors; the payload was in modeling_evil2.py.
Pluto also reported that none of the 12 first-wave repositories was flagged in its checks, and that the tested flagship Python payload returned safe results from every scanner run it conducted. For teams using custom model code, Pluto recommends reviewing the referenced Python files before enabling trust rather than relying on a clean scanner result alone.
How the reported activity progressed
Pluto says Hugging Face removed the first-wave accounts after disclosure. It then described a second wave with revised payloads; three analyzed builds included reconnecting reverse shells.
The flagship repository’s download counts rose across Pluto’s dated observations: 7,354 on October 20, 9,584 within hours, 18,012 on October 25, 25,854 on October 27, and 28,412 on October 28. These are repository download counts from those dates.
Safeguards for local AI systems
For future model loads, Pluto recommends reviewing the Python files referenced by auto_map, pinning a reviewed repository revision, and limiting the code’s privileges and network access. It also advises keeping production secrets out of untrusted execution.
For teams that loaded a listed repository with custom code enabled, Pluto recommends checking for the reported host and Xinference indicators. If a system may be affected, its guidance is to isolate it, preserve evidence, remove persistence, rotate credentials accessible to that system from a clean machine, and rebuild the host if its integrity cannot be established.
