Fake Qwen2 checkpoints on Hugging Face mine crypto via trust_remote_code (pluto.security)

A recent investigation by Pluto Research has uncovered a malicious cryptomining campaign that exploited AI model repositories on Hugging Face, specifically targeting models disguised as small Qwen2 checkpoints. The campaign has seen over 32,000 downloads, highlighting a growing trend where attackers use the trust placed in open-weight models to infiltrate machine learning (ML) environments before the models even run. By utilizing the `trust_remote_code=True` feature, the malicious code can execute on users' machines, turning their GPUs into mining resources without raising immediate suspicion. This incident is significant for the AI/ML community as it underscores vulnerabilities within model distribution platforms, particularly regarding the execution permissions that can allow harmful code to run unnoticed. The findings reveal multiple layers of attack through Python imports and arbitrary code execution enabled by misconfigured settings. With existing security measures primarily focused on file signatures rather than the surrounding code's behavior, the report calls for improved scrutiny and protective measures. The implications are far-reaching, indicating that as AI model repositories become attractive targets for malware, developers and researchers must prioritize security and implement robust verification processes to safeguard their ML environments.