Skip to content
AI News HubLIVE
More
Summary only

Hugging Face Hosted Malicious Software Masquerading as OpenAI Release

A malicious Hugging Face repository imitating an OpenAI release delivered infostealer malware to Windows machines, amassing around 244,000 downloads before removal. Researchers warn that public AI model registries pose supply chain risks as developers clone models into corporate environments.

SourceArtificial Intelligence NewsAuthor: AI News
Hugging Face Hosted Malicious Software Masquerading as OpenAI Release
Report an error

The correction channel is not available yet. You can copy the article reference below for later.

Correction instructions

Summary only

Under the source content permission, this page provides an editorial summary, key points, and a link to the original article.

Key points and analysis

Article intelligence

EngineersIntermediate

Key points

  • A fake 'Open-OSS/privacy-filter' repository on Hugging Face imitated OpenAI's Privacy Filter, containing a malicious loader.py that installed credential-stealing malware.
  • The repository reached the trending top with 667 likes in under 18 hours, but downloads may have been artificially inflated by attackers.
  • HiddenLayer identified six additional repositories with similar loader logic, indicating a broader campaign targeting AI development workflows.
  • Experts advise treating any system that ran the malicious code as compromised and recommend re-imaging.

Highlights and analysis are generated automatically and may contain errors. Check the original source.

More recent stories on this topic · Models