Hugging Face and ClawHub Compromised: Malware Found in Hundreds of AI Models

The machine learning model repositories Hugging Face and ClawHub have been systematically compromised. Hundreds of malicious models have been found in them, and they execute arbitrary code on developers' machines.

What happened

Hugging Face is the central repository holding more than a million ML models, used by virtually every AI company in the world. Hundreds of malicious models have been found among them, disguised as legitimate ones. This is the first major supply chain attack on AI infrastructure.

The malicious models surfaced as a result of misconfigured security. Hugging Face lets any user upload models, and attackers took advantage of that. ClawHub, a repository of agent skills, has also been compromised through modules uploaded by users.

Scale of the attack

• Hundreds of malicious models on Hugging Face
• Hidden among more than a million legitimate models
• Affect developers' APIs and private projects
• ClawHub and other repositories are also compromised
• The first systematic attack on ML infrastructure

How the malware works

The malware enters the model when it is loaded. When a developer downloads a model through the Hugging Face SDK or imports it into code, initialization takes place. That is the moment the malicious code runs.

What it can do: execute arbitrary code on the machine, steal data from the developer's working environment, install backdoors for remote access, compromise production systems when an infected model is deployed, and spread to dependent projects through the dependency chain.

Why this is dangerous

AI developers treat Hugging Face like npm or PyPI: they pull models as dependencies without checking the code. Nobody reviews the contents of ML models by hand, because that is impossible at scale.

A malicious model can lie dormant in a production system for months, waiting for a specific condition, or work covertly, collecting data bit by bit. This is a classic supply chain attack, but in an AI context it is even more dangerous, because what is infected is not a library but ready-to-run code with full privileges.

What this means

AI development infrastructure has become a serious target. The industry needs urgent measures: mechanisms for verifying model code, execution isolation at load time, and stricter upload requirements for central repositories. These will become a necessary requirement for working with open models.