Malicious Hugging Face Repository Impersonates OpenAI to Spread Infostealer
OpenAI launched Privacy Filter, an open-weight model designed to detect and redact personal information in text, on April 22, 2026, and released it on Hugging Face at the same time. Attackers copied the official name and model description, highlighting how malicious actors can exploit platform rankings and download counts to manufacture trust in the open-source AI supply chain and trick developers into introducing malware when running model scripts.
HiddenLayer disclosed on May 7, 2026, that the Open-OSS/privacy-filter repository had topped Hugging Face's trending chart within 18 hours before being removed after about 244,000 downloads. Its loader.py downloaded a Rust-based infostealer on Windows that stole browser credentials and cryptocurrency wallet data. Affected users should isolate and reimage their systems, replace credentials, and transfer their crypto assets.
All Coverage
2 original reportsThe Backstory
The history behind this eventAutonomous AI Agent Breaches Hugging Face, Steals Credentials
Hugging Face, a major hosting and collaboration platform for AI models and datasets, disclosed a breach carried out by an autonomous AI agent. The incident highlights an emerging threat to the open-source AI supply chain: automated systems can be weaponized to conduct a multistage intrusion, moving from malicious content and initial access to credential theft and lateral movement across infrastructure.
The attacker gained access through a malicious dataset, stole internal credentials and moved laterally within Hugging Face’s environment, according to the company’s latest disclosure. Hugging Face said it patched the vulnerability, revoked affected credentials and rebuilt compromised nodes. Its investigation has found no evidence that user models or databases were altered, while the company has not disclosed the number of accounts or systems affected.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.