A malicious repository on Hugging Face copied the appearance of an OpenAI release and delivered credential-stealing malware to Windows computers, according to research from HiddenLayer. Before removal, the fake project recorded about 244,000 downloads and briefly reached the platform’s trending list.
The incident demonstrates how trust in public AI repositories can be weaponised. Developers do not only download model weights; they often run setup scripts, notebooks and loader code inside environments that contain source code, browser sessions and cloud credentials.
HiddenLayer said the download and popularity figures may have been manipulated, so the true number of affected systems is unknown. The repository itself has been removed, but the campaign’s method has wider implications for AI software supply chains.
A convincing model card concealed an executable trap
The repository, named Open-OSS/privacy-filter, closely imitated OpenAI’s legitimate Privacy Filter materials. Its instructions diverged in a crucial place by directing Windows users to run start.bat and other users to execute a Python loader.
HiddenLayer found that loader.py opened with decoy code resembling a normal model loader before initiating a concealed infection chain. It disabled SSL verification, decoded a remote address and retrieved instructions that could be changed without modifying the visible repository.
On Windows, PowerShell downloaded another batch file from attacker-controlled infrastructure. The malware created a scheduled task designed to resemble a Microsoft Edge update, giving it persistence on the machine.
The final Rust-based infostealer targeted browser data, Discord storage, cryptocurrency wallets, FileZilla configurations and system information. It also attempted to interfere with Windows security telemetry. HiddenLayer identified six additional repositories with similar loader logic and shared infrastructure.
AI repositories are executable supply-chain dependencies
The threat did not depend on a sophisticated model exploit. It relied on developers following familiar setup instructions from a project that looked popular and legitimate.
That makes conventional software composition analysis incomplete. Security tools designed to inspect package manifests, libraries and containers may miss malicious logic in model loaders, notebooks or peripheral scripts. Serialized model formats can introduce additional risks when loading data is capable of executing code.
Corporate AI workflows magnify the stakes. A data scientist may clone a model into a workstation authenticated to GitHub, cloud consoles and internal datasets. A compromised session cookie can sometimes bypass multifactor authentication even when a password is not stored locally.
Popularity signals are weak safeguards. Downloads, likes and trending placement can be manipulated, while copied documentation can make a repository appear official. Namespaces and branding should be verified against an authoritative release channel before any code runs.
Model intake needs the discipline of production software
Organisations should treat every external AI artifact as untrusted until reviewed. Model weights, loader files, shell scripts, dependency definitions and notebooks all belong in the security assessment.
Initial inspection should occur in an isolated environment without production credentials, shared browser sessions or access to sensitive networks. Teams can pin cryptographic hashes, preserve approved versions and disable unnecessary outbound connections while evaluating behaviour.
An AI bill of materials can record the source, version, executable components and internal owner of every artifact. That inventory supports rapid response when a repository is removed or a dependency is later identified as malicious.
Anyone who ran files from the reported repository on Windows should treat the host as compromised. HiddenLayer recommends re-imaging affected systems, and browser sessions should be revoked because stolen cookies may remain valuable to attackers.
The episode is a warning against separating model governance from software security. A model hub is also a code-distribution platform, and an attractive model card can function like a phishing page for developers.
AI adoption will continue to depend on open repositories and reusable artifacts. Preserving that advantage requires stronger verification from platforms and disciplined intake from users. Trust should come from provenance and controlled execution, not a trending badge.
