Load/Mine research finds backdoors and cryptominers distributed as Hugging Face models
Pluto Security reports malicious model repositories that execute Python before loading weights when custom code is permitted. The campaign returned after takedowns and left miners and backdoors. More than 32,000 recorded downloads are not confirmed infections or unique victims.
- Disclosed
- Oct 29, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- GPU hosts, notebooks and CI that loaded the listed repositories with remote code enabled, or through tools that execute their custom Python
- python · ai
- In the wild
- Yes
- Pluto reports active victim mining and recovered backdoor payloads.
What happened
Pluto published the investigation on October 29; the underlying activity began earlier. Custom model Python runs with the loading process’s privileges before weight initialization. This is abuse of permitted code execution, not proof that downloading any Hugging Face model compromises a host. Clean weight-format or antivirus scans do not validate that Python.
The researcher reports 31 malicious repositories in the core campaign, with additional linked models. The more-than-32,000 download figure is researcher-reported and unverified outside that investigation. It counts neither unique users nor confirmed infections. L4 reflects observed victim mining and backdoor deployment, rather than treating every download as a compromise.
Some variants plant SSH keys, reverse shells or persistence beyond the miner. Treat their reachable credentials as exposed during response. Published takedowns do not remove malicious code or keys from machines that already ran it.
Crime-scene timeline
Sep 21, 2026
The first wave begins with SSH-key planting, according to recovered code
Oct 25, 2026
A new account uploads a near-identical second-wave payload
Oct 29, 2026
Pluto publishes the Load/Mine investigation and indicators
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Pluto Security Load/Mine researchPrimaryPrimary payload analysis, victim-mining observations, indicators, containment and recovery guidance.
- BleepingComputer independent repository checkChecked a surviving copied repository and confirmed miner/reverse-shell code; download totals originate from Pluto’s investigation.