Hugging Face Malware: Fake Qwen2 Models Hijack GPU Servers for Crypto Mining, and a Fake Solana Kit Targets AI Coding Agents

Attackers have been uploading fake AI models to Hugging Face that run hidden code as soon as they load. The code turns GPU servers into cryptocurrency miners, and some versions also open a back door for the attacker. If your team downloads models to try AI on its own hardware, this is a supply chain risk inside your network, not only a problem for AI labs.

The research comes from Pluto Security and was published on Thursday, October 29, 2026. On the same day, Air Security published a separate report about a fake Solana developer kit on GitHub that appears built to be found and installed by AI coding agents. This post covers both and separates what is confirmed from what is not.

What happened with the Hugging Face malware

Pluto's researchers found 31 malicious repositories on Hugging Face and on ModelScope, a Chinese model hub, published in two waves. The first wave ran from September 21 to October 12, 2026. It had 12 repositories across three accounts and about 728 recorded downloads. Hugging Face and ModelScope removed those accounts after Pluto reported them.

A second wave of 19 repositories then appeared under new accounts. Pluto says it was still live eight days after being reported. The flagship model, MENXIANGYU/qwen2-tiny, posed as a tiny Qwen2 test checkpoint, but its weights file is 42 bytes and holds no model at all. Pluto recorded its downloads rising from 7,354 to 9,584 by the evening of October 20, then to 28,412 by October 28. Across all 44 related repositories, including 13 linked ones, Pluto counted 32,376 downloads.

Pluto is careful with that number, and so are we: "That figure measures downloads, not confirmed infections or unique victims."

When we checked on Sunday, November 1, the flagship's page said "Access to this model has been disabled." A near-identical model, htt0118/qwen2-tiny, from an account Pluto lists in the second wave, was still available.

How a malicious AI model runs code on your server

This campaign did not rely on poisoned weights or the older pickle file trick. Instead it abused a documented feature of the Hugging Face Transformers library. Some models need custom Python code, and loading them requires permission to run code supplied by the repository. That permission is given with trust_remote_code=True or by accepting an interactive prompt. The model's config.json points to a Python file, and that file's code runs on import, before any weights load. Pluto notes this is documented behavior, not a default setting.

Pluto's analysis found that, once loaded, the code:

• Runs a cryptocurrency miner from memory, disguised as a Linux kernel process named [kworker/u20:1]
• Restarts the miner every 120 seconds with a watchdog script (svc.py) and adds lines to shell startup files
• Kills rival miners and deletes competing model registrations
• Planted an SSH login key in the first wave; later builds replaced that with reverse shells to the attacker
• Turns off configured proxies while it downloads its next stage

The payloads were written mainly for servers running Xinference, an open-source tool for hosting models yourself. One later model, MENXIANGYU/qa-whl-1021, carried a script that breaks out of privileged containers and looks for the host's root or GPUStack's /var/lib/gpustack folder to gain root on the machine underneath.

Did Hugging Face malware scanning catch it?

Not according to Pluto. None of the 12 first-wave repositories was flagged, and the second-wave flagship scanned clean. Pluto's point is that signature scanning and pickle scanning look for known malware and unsafe file formats. They do not analyze what a model's Python code actually does. A clean scan on a model page does not mean the model is safe to load with remote code turned on.

What is confirmed and what is not

The fake Solana starter kit aimed at AI coding agents

Air Security's report covers a GitHub repository called SolanaUpdateTools/solana-starter-kit. It was created in November 2025, has 286 stars and describes itself as a full Solana app template. In reality the README is the only file. Air says the repository "ranks as the top result when an agent searches for one," so a developer who asks an AI coding agent to start a Solana project could end up following its instructions.

The only install step is a Windows PowerShell one-liner that builds a URL on developer-update.app, downloads a script and runs it in memory. Air recovered that script from the Web Archive because the live link returned an error. It installs genuine, signed NetSupport Manager 12.10 remote access software, set up to connect to maxwintodaybtc.com and to start at every login through a registry Run key named SecureModule. Air links the setup to a NetSupport cluster tracked by eSentire and to an earlier campaign that used fake TradingView tools to lure crypto traders.

Why AI model security matters for a business network

GPU servers are expensive. A miner on one burns money, power and the capacity your team is paying for. The bigger problem is what else sits on those machines: cloud keys, Hugging Face tokens, database passwords and access to the rest of the network. A reverse shell on a GPU box is a foothold, not just a power bill.

AI pilots also tend to run outside normal IT controls, on a data scientist's workstation, a rented GPU or a CI job that nobody patches. We wrote about that ownership gap in AI can build it, who keeps it running and who is patching your servers. If you host models yourself, treat those servers like any other production system, which is how we approach self-hosted infrastructure.

What to do this week

Hugging Face malware questions people are asking

Is Hugging Face safe to download models from?

The platform is widely used and most models are legitimate, but anyone can upload. The risk rises sharply when you load a model with trust_remote_code=True, because that runs the uploader's Python on your machine.

Can an AI model contain malware?

Yes. In this campaign the "model" had no real weights at all. The malicious part was Python code shipped in the repository and run when the model loaded.

Was my server infected if we downloaded qwen2-tiny?

Not necessarily. A download alone is not an infection. The code runs when the model is loaded with remote code allowed. If that happened, check for the indicators in the table above.

How do I know if my GPU is being used for crypto mining?

Run nvidia-smi and look for processes you do not recognize, or GPU load when no jobs are scheduled. This miner hides as a kernel-style process name, so compare against what should be running.

Are AI coding agents a security risk?

They can be. The fake Solana kit shows an attacker aiming a README at agents that search the web and follow instructions. Require a human to approve any command that downloads and runs code.

The bigger lesson

AI tools have made it easy to pull code, models and setup steps from strangers, often faster than anyone reviews them. Scanners help, but they do not read intent. The fix is old-fashioned: know what loads on your servers, give it the least access possible, and have someone responsible for checking.

Want your AI and GPU servers reviewed? See our security hardening service or request a quote.

Get security alerts by email, with our free checklist, at /security-alerts.

Sources: Pluto Security, Load/Mine Hugging Face malware campaign; Air Security, SolanaCry.