What happened
Malicious Software Masquerading OpenAI Model is at the center of this update. A deceptive repository on Hugging Face imitating an OpenAI release infected tens of thousands of Windows machines with information-stealing malware, raising concerns about security risks in AI model registries.
Deceptive AI Model Repository Spreads Malware on Hugging Face
A Hugging Face repository falsely presenting itself as an OpenAI release was found to distribute infostealer malware targeting Windows systems. Research by AI security firm HiddenLayer revealed that the malicious repository, named ‘Open-OSS/privacy-filter’, accumulated approximately 244,000 downloads before it was removed. The actual number of infections remains uncertain, as attackers may have artificially inflated download statistics to boost the repository’s perceived popularity.
Imitation of OpenAI’s Privacy Filter
The fake repository closely copied OpenAI’s legitimate Privacy Filter model card and included a harmful loader.py script. This script covertly downloaded and executed credential-stealing malware on users’ Windows machines. The repository rapidly climbed to the top of Hugging Face’s trending list, amassing 667 likes within 18 hours, though this engagement may also have been manipulated by the attackers.
Security Risks in Public AI Model Registries
Public AI model registries like Hugging Face are increasingly integrated into corporate development workflows, where models and associated code have access to sensitive environments including source code repositories, cloud credentials, and internal systems. This integration amplifies the potential damage of compromised repositories beyond mere inconvenience.
The malicious repository’s README mimicked the genuine project but instructed users to run specific commands—start.bat on Windows or python loader.py on Linux and macOS—that triggered the infection process. HiddenLayer warns that malicious code embedded in AI model files or setup scripts poses a growing threat, with previous incidents involving bypasses of platform security scanners via serialized model files.
Mechanics of the Malicious Loader
HiddenLayer’s analysis detailed that loader.py initially presented benign-looking AI model loader code, but quickly executed a hidden infection sequence. This included disabling SSL verification, decoding a base64-encoded URL linked to jsonkeeper.com, and downloading commands that were then executed via PowerShell on Windows machines.
The malware used this command-and-control mechanism to update its payload without altering the repository contents. The PowerShell command downloaded an additional batch file from a domain controlled by the attacker, which installed a scheduled task masquerading as a Microsoft Edge update to maintain persistence.
The ultimate payload was a Rust-based infostealer targeting data from Chromium and Firefox-derived browsers, Discord local storage, cryptocurrency wallets, FileZilla configurations, and system information. It also attempted to disable the Windows Antimalware Scan Interface and Event Tracing to evade detection.
Broader Campaign and Security Implications
HiddenLayer identified six other Hugging Face repositories sharing the same malicious loader logic and infrastructure, indicating a wider campaign. Similar threats have included poisoned AI SDKs and counterfeit OpenClaw installers, demonstrating attackers’ increasing focus on AI development environments as attack vectors.
Cybersecurity experts note that traditional software composition analysis (SCA) tools are less effective at detecting malicious code embedded within AI repositories. A report from IDC forecasts that by 2027, 60% of autonomous AI systems should have an AI bill of materials to help organizations track the provenance, approval status, and executable contents of AI components.
Recommendations and Response
HiddenLayer advises users who cloned and executed files from the fraudulent ‘Open-OSS/privacy-filter’ repository to consider their Windows systems compromised and to perform full re-imaging. Even if passwords are not stored locally, active browser sessions may be hijacked as session cookies can sometimes bypass multi-factor authentication.
Hugging Face has since removed the malicious repository following the discovery.
Image credit: Pixabay under license.
Fonte: ver artigo original
Related coverage: AI Chronicle analysis and updates.
Why it matters
This update influences the AI race across model providers, infrastructure leaders, and enterprise adoption decisions.
Related Articles
Meta Commits to 1 GW of Solar Energy to Power AI-Driven Data Centers
Multimodal AI Models Struggle to Surpass 50% Accuracy in Visual Entity Recognition
xAI Launches Custom Voices Feature Enabling Voice Cloning from Just One Minute of Speech
New Challenge in AI Safety: Models Faking Their Own Reasoning Processes
