Load Before the Model: Pluto’s Load/Mine Turned 31 Hugging Face Repos Into Miners With Backdoors

2026-11-02 Agent & Supply Chain Security by al-ice.ai Editorial

Pluto Security’s Load/Mine report, published 29 October 2026, tracks a cryptomining-and-backdoor campaign distributed through 31 malicious Hugging Face repositories across seven accounts, released in two waves since September. The repos pose as small Qwen2 test checkpoints aimed at GPU hosts running self-hosted inference. The mechanism needs no exploit: loading one with trust_remote_code=True imports and executes the publisher’s Python before any weights load. Across both waves plus linked models, Pluto counted more than 32,000 downloads — a downloads figure, the researchers stress, not confirmed infections. The second wave appeared within days of the first takedown, and its 19 repositories were still live eight days after Pluto reported them.

The door that is not a bug

Pluto frames the issue as one of three doors through which an open model can run code on your machine. The first is the parser: a GGUF binary read by C/C++ code before inference (CVE-2024-34359 showed a chat template executing code through llama-cpp-python). The second is serialization: pickle, Keras or SavedModel formats embedding executable logic, the best-known risk and the one with the most tooling, including Hugging Face’s own malware and pickle-import scanning plus the safetensors format built to remove it. Neither is the door Load/Mine walked through.

The third door is the Python import. Some models need an implementation Transformers does not ship, and loading them requires permission to run repository-supplied code via trust_remote_code=True or an interactive confirmation. The repo’s config.json names the module through auto_map; Transformers downloads it into the module cache and exec_module() runs the file’s top-level statements before returning the model class. Anything the publisher placed next to the class definitions runs first. No poisoned weights, no pickle trick — the attacker simply uses the granted permission. This is documented behavior, and the Transformers security policy puts it bluntly: always verify modeling files when using the flag. Serving and tooling stacks keep re-learning the same lesson: vLLM loaded auto_map modules without checking the setting (CVE-2026-22807, fixed in 0.14.0), and Unsloth Studio inspected model configs with the flag hardcoded.

How Pluto found it

Pluto built a scanner for exactly the files trust_remote_code downloads and runs: every .py referenced by auto_map, plus any Python sitting beside model weights. A model definition should describe layers and a forward pass; imports of subprocess, socket, ctypes or calls to memfd_create mean someone put them there on purpose. The standout hit was dsxk4mr8tq/qwen2-tiny-gpt2 — a random-string account name and a file literally called modeling_evil.py, 305 lines with error handling, fallback infrastructure and anti-detection. The account held six repositories, all created within 2.5 hours on 12 October 2026 with the same code under six model names. The break linking the waves came from qwen2-tiny-lite, which still carried two backup files, modeling_evil.py.bak-src and modeling_evil.py.bak-sync: older malware versions that connected the test accounts to the main operation.

What the payload does

The flagship model, MENXIANGYU/qwen2-tiny, contained no actual model at all. Its code quietly installs a cryptocurrency miner disguised as a Linux system process, restarts it if killed, and removes competing miners from the machine. Some versions also open a reverse shell. The payloads were written for self-hosted inference — especially Xinference and GPUStack — plus rented GPU machines, shared research notebooks and CI jobs that pull small test models without anyone reading the code. After the first wave was removed, the second replaced the hardcoded SSH key with reverse shells; one later stage only answers to allow-listed IP addresses, and BleepingComputer notes a later model shipped a script that can break out of a container onto the host. Backdoor access outlasts the miner: killing the mining process does not remove the other doors.

The takedown that did not take

Pluto reported the first wave to Hugging Face and ModelScope and both removed the accounts. Within days a second wave appeared under four new accounts with revised loaders. The numbers tell the rest: the flagship stood at 7,354 downloads when Pluto disclosed, reached 9,584 within hours, and hit 28,412 by 28 October; the 19 second-wave repositories passed 29,000 downloads and were still live eight days after the report. BleepingComputer independently confirmed the findings against a Wayback-archived payload and found a near-identical copy under a newer account, htt0118, still live at the time of writing, with Hugging Face disabling access to the flagship model. On-chain, the first-wave wallet received about 2,276 PRL, roughly $5,000, and was still earning after the repositories behind it were removed — including, at one point, nine notebook-style GPU machines that started mining for the operator within 90 seconds of each other, consistent with a shared research cluster.

The scanners looked at the wrong files

The Hub runs every file through antivirus and integrates partner scanners from Protect AI and JFrog, but those inspect known malware and weight formats — nothing analyzes what the model’s Python actually does. The second-wave flagship scanned clean while collecting its 28,412 downloads, and one scanner reported the payload file was “not a machine-learning model.” That is the campaign’s real finding, and it rhymes with cases we have covered before: Check Point’s Yoba campaign hiding miners next to signed AI binaries, a miner sitting in QwenPaw’s MCP driver table for seventeen days, and PoeLLM turning 3,400 exposed AI servers into miners. Each time, the detection story lagged the execution story. Pluto attributes Load/Mine to a financially motivated, Chinese-speaking operator, citing Simplified Chinese code comments, command-and-control on Alibaba Cloud, and activity times falling late at night in China.

What to actually do

Treat trust_remote_code=True as remote code execution, because that is what it is. Require an explicit, recorded approval for every model that needs it.
Read the .py, not just the weights. Scan auto_map-referenced files for subprocess, sockets, ctypes, memfd_create and base64 blobs before loading, and pin models to reviewed commits.
If you run Xinference, GPUStack or shared notebooks, hunt now: unexpected miners, competing-miner kill behavior, reverse shells, and container breakouts are the campaign’s signatures. Check any host that loaded a small Qwen2 checkpoint from an unfamiliar publisher since September.
Assume breach past the miner. Killing the mining process leaves backdoors in place — rebuild or reimage exposed hosts and rotate every credential they could reach, consistent with the config-injection class Pluto documented earlier this year.

Our verification was read-only. We read the full Pluto Security Load/Mine report first-hand (published 29 October 2026; Shaked Chen, Eitan Chassid, Yotam Perkal; 31 repositories, seven accounts, two waves, 32,000+ downloads with linked models, 2,276 PRL payout figure, dsxk4mr8tq/qwen2-tiny-gpt2 and qwen2-tiny-lite backup-file linkage, vLLM CVE-2026-22807 and Unsloth precedents quoted above) and the full BleepingComputer write-up (Ax Sharma; Wayback payload confirmation, htt0118 live copy, MENXIANGYU/qwen2-tiny download timeline, container-breakout script) first-hand. Download counts, wallet totals and attribution details are the researchers’ figures, carried with attribution; downloads are not confirmed infections. We loaded no model, enabled no flag, ran no payload, and contacted no vendor. Brave Search was used for discovery only.

Sources: