Loading a Hugging Face model sounds like downloading data, not running a program. But with an option called trust_remote_code, the model brings its own Python and runs it on your machine when it loads. Pluto Security documented a campaign that exploits exactly that to mine cryptocurrency on GPU servers, and that reappeared days after being taken down.
How It Works: There Are No Poisoned Weights
According to BleepingComputer and Pluto Security's report, both published on October 29, the campaign doesn't use tampered weights or pickle exploitation. It abuses trust_remote_code: when the user (or the deployment tool) enables it, the Python code bundled in the repository runs before the model loads. The main model's model.safetensors file weighs 42 bytes and contains no tensors. The targets were self-hosted inference servers, Xinference and GPUStack.
What the Code Did
Pluto describes a miner (peakminer) disguised as a kernel process, with a watchdog that restarts it every 120 seconds. Some versions also open a reverse shell, there is an SSH-key backdoor, and a container-escape script aimed at GPUStack. Nine machines in a research cluster started mining and stopped about six minutes later. According to Pluto, the operator appears to speak Chinese based on code comments and infrastructure; the earnings are modest, but persistent access is worth more than the miner.
A Second Attack, Aimed at Coding Agents
BleepingComputer adds that Air Security found a fake "Solana starter kit" on GitHub (SolanaUpdateTools/solana-starter-kit, created in November 2025, 286 stars) that shows up first when an agent searches for that topic. Its README tells the reader to run a PowerShell one-liner that downloads a NetSupport RAT. It isn't new malware; what's new is that the lure is designed for a coding agent to run without reviewing it.
What It Means for a Company Using AI
trust_remote_code=True by policy for unreviewed third-party models, or manually review the .py files the model references before enabling it; (2) run inference for external models in unprivileged containers with no credentials mounted; (3) if a machine loaded any of these models, isolate it and rotate credentials: killing the miner doesn't remove the backdoors; (4) tell your coding agents never to run iwr | iex or curl | sh style commands taken from a README. Anyone planning to use open models in production should treat the model repository the way they treat a package manager.