Fake Qwen2 models on Hugging Face mine on GPUs via remote code

Security firm Pluto Security documented a cryptomining-and-backdoor campaign on Hugging Face that hides its payload not in model weights but in the Python code a model is allowed to run when it loads. Pluto's "Load/Mine" report (29 October 2026) counts 31 malicious repositories across seven Hugging Face accounts, plus a mirror on China's ModelScope, with more than 32,000 downloads — a count Pluto stresses is downloads, not confirmed infections.

How it works

The fake models pose as small Qwen2 test checkpoints and target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. Rather than poisoned weights or a pickle exploit, the campaign abuses the trust_remote_code option, which runs a model's bundled Python when it is loaded. The flagship, MENXIANGYU/qwen2-tiny, contains no real model at all: its code installs a cryptominer disguised as a Linux system process, writes a watchdog that restarts the miner every ~120 seconds, appends launch hooks to shell startup files, and kills competing miners. Some versions also open a reverse shell. Hours after Pluto reported the first wave, the operator published a model whose script could break out of a container and take over the host.

Scope and detection gap

Takedowns have not stuck. A near-identical copy, htt0118/qwen2-tiny (uploaded 25 October), stayed live — BleepingComputer confirmed it carries the same miner and reverse shell — and the flagship's downloads climbed from 7,354 at report time to 28,412 by 28 October. Pluto notes Hugging Face's scanners (with Protect AI and JFrog) check for known malware and unsafe weight formats, not what an adjacent plain Python file does; JFrog flagged the payload as "not a machine-learning model." Operator payouts to date are modest — roughly $5,000 in Pearl (PRL) — and Pluto observed nine machines resembling a shared research GPU cluster mining at once before an admin apparently killed the jobs.

Pluto assesses the operator as financially motivated and Chinese-speaking, citing Simplified Chinese code comments, command-and-control on Alibaba Cloud, and activity timed to Chinese late-night hours — attribution kept at the assessment level, not a named group.

Action checklist

1. If you loaded any of these models with trust_remote_code enabled, treat the host as compromised. Killing the miner does not remove the reverse shell or the startup hooks.
2. Hunt for the watchdog/launch hooks in shell startup files, outbound connections to mining pools, and the repo slugs above; check against Pluto's published indicators before clearing a machine.
3. Rotate every credential reachable from the host — cloud keys, API tokens, SSH keys — because trust_remote_code grants full code execution in your inference environment.
4. Default trust_remote_code=False in inference pipelines and allow it only for vetted, pinned model revisions. Run self-hosted inference under least privilege so a loaded model cannot reach the wider host.

Context

This is the model hub as supply chain: the risk is not a weights backdoor but ordinary code execution that practitioners opt into for convenience. It rhymes with the Transformers remote-code flaw (CVE-2026-4372) earlier in 2026, except no library bug is needed here — trust_remote_code is working as designed. For a GPU fleet, an idle inference node is a paid miner and a shell at once; the detection gap is that content scanners rate a model by its format, not by what its loader does.