Hugging Face trust_remote_code Miner Campaign Returns, and a Fake Solana Kit Targets Coding Agents

Two campaigns reported on October 29 share one weakness: code that runs because something you trusted chose it. Pluto Security says a crypto-mining operation on Hugging Face, taken down once, has returned, using trust_remote_code to run attacker Python on GPU servers. Separately, Air Security describes a GitHub repository built so that a coding agent looking for a Solana starter kit finds it first and follows a README that installs a remote-access tool. BleepingComputer's report covers both, and the primary reports are Pluto Security's and Air Security's.

If you run self-hosted inference, or let an agent pick and install tools from search results, both are worth ten minutes. The trust_remote_code post here is the model-supply-chain version of a risk we have covered before, such as the backdoored Qwen weights demo, but this one is an attack seen in the wild and needs no weight tampering at all.

Quick answers

The Hugging Face campaign

Pluto says it found 31 malicious repositories across seven accounts, published in two waves since September and posing as small Qwen2 test checkpoints. Including linked models they have more than 32,000 downloads, a figure the researchers note counts downloads, not infections. The flagship, MENXIANGYU/qwen2-tiny, contained no real model. Hugging Face and China's ModelScope removed the first-wave accounts, but a second wave of 19 repositories appeared under new accounts within days.

BleepingComputer confirmed that a near-identical copy, htt0118/qwen2-tiny (uploaded October 25), was still live and contained the same miner and reverse shell when it checked. Hugging Face had disabled the flagship by then. Flagship downloads rose from 7,354 to 28,412 by October 28, according to Pluto.

How trust_remote_code becomes code execution

Nothing here depends on poisoned weights or an unsafe pickle. As Pluto puts it, "the code runs before the model does." With trust_remote_code=True, the Transformers library imports the Python files named in a repository's config.json auto_map. Any top-level code in those files executes during the import. In one build, the model.safetensors file is only 42 bytes and the payload lives in a file called modeling_evil2.py.

The payload, per Pluto, does several things:

1. Persists. It writes a watchdog under /tmp/.cch/, adds startup hooks to shell profiles and relaunches the miner roughly every 120 seconds. Wave one also planted an SSH key in authorized_keys.
2. Mines without touching disk. It runs a UPX-packed miner from an in-memory file descriptor and disguises it as a kernel worker process, [kworker/u20:1].
3. Removes competition. It kills rival miners and deletes their model registrations and startup entries.
4. Reports back. It writes encoded status receipts as fake model names in the local Xinference registry.
5. Escalates. A wave-two script tries to escape a container and take over a GPUStack host. Pluto says it appeared hours after the first report.

Targets named are self-hosted Xinference and GPUStack servers, rented GPU machines, shared research notebooks and CI jobs that load small test models. Pluto saw nine workers join the operator's pool within 90 seconds; they stopped submitting shares about six minutes later, which Pluto says fits an administrator killing the jobs.

Why scanning did not help

Hugging Face uses antivirus and partner scanners from Protect AI and JFrog. Those check for known malware signatures and unsafe file formats, not what a repository's Python does when imported. The second-wave flagship scanned clean, and JFrog reported the payload was "not a machine-learning model." Pluto attributes the campaign, with assessed confidence, to a financially motivated Chinese-speaking operator, citing code comments and infrastructure. That attribution is the researchers' judgment, not a confirmed finding. It also estimates about $5,000 in Pearl (PRL) reached the operator's main wallet.

The fake Solana starter kit

Air Security's report covers a different mechanism. The GitHub repository SolanaUpdateTools/solana-starter-kit, created in November 2025 with 286 stars, describes a full app template with an Anchor program, TypeScript client and Next.js UI. Its only install step, in the README, is a malicious one-liner. Air says it ranked first when an agent searched for a Solana starter kit, so the attacker needed no compromised legitimate project and no developer action: getting the agent to choose the repo was enough.

The README's only install step is a Windows PowerShell one-liner. It assembles a URL on developer-update[.]app from fragments, then uses iwr and iex to fetch and run a script in memory. According to Air, the recovered dropper is about 21 MB and installs 13 signed NetSupport Manager components plus one attacker config. It hides the staging folder, disables user-facing controls such as chat and disconnect, adds a Run-key entry so the tool starts at each login and then deletes itself. NetSupport Manager is a legitimate remote-administration product, which is why it is a favourite for this kind of access. The operator gets screen, keyboard, file, command and audio control, including over crypto wallets.

The dropper also clears the Run-dialog history and deletes the script itself. When Air checked, the payload URL returned a 404 and the researchers recovered the dropper from the Web Archive (archived November 22, 2025). Air links the setup to a NetSupport operator tracked by eSentire and an earlier fake TradingView "AI signal" campaign. Note that Air describes the chain of events rather than a measured test against specific agents, so which agents would follow it is unconfirmed.

Timeline of the Hugging Face campaign

Pluto's report dates the activity as follows. The first wave evolved from a simple SSH backdoor into a fileless miner over about three weeks, starting around September 21 and 22. On October 12 a throwaway account reused the same code under new URLs. After the first takedown, a second wave appeared within days with reverse shells and fresh accounts, and more repositories kept arriving between October 20 and 28 while the flagship copy kept collecting downloads.

The pattern matters more than the dates. Takedown of a repository removes one copy; it does not remove the technique, and an operator who can re-upload under a new name in hours will outpace a review queue. That is why the durable defence sits on your side, in how you load models, rather than in the hub's scanning.

Why the two stories belong together

One attack targets a person who loads a model, the other a person who asks an agent to pick a starting point. In both, the victim never reviews the code that runs. The model repo hides it in a config-referenced Python file; the Solana repo hides it in a one-line README step. Neither needs a software vulnerability, which is why patching does not help and why controls on execution and on what you let an agent choose matter more than version numbers.

What this means if you run AI coding agents

• Treat trust_remote_code as running a script. Read the .py files referenced by auto_map before enabling it, and pin a reviewed revision rather than tracking main. Pluto's advice is the same.
• Check hosts that load models. Look for /tmp/.cch/, /tmp/.cchx, /tmp/.kitsd, /etc/cron.d/.sync-helper, unexpected authorized_keys entries and a process called [kworker/u20:1] with mining arguments. Pluto's report lists more indicators, including network addresses and a file hash.
• If you loaded one of these models: isolate the machine, preserve evidence, rebuild from a trusted image if integrity is unclear and rotate credentials the process could reach. Killing the miner alone does not remove the backdoors.
• Lock down inference servers. Pluto recommends requiring authentication on the Xinference API and restricting its network exposure.
• Do not let an agent run install one-liners from a README. Block or require review for iwr | iex and curl | sh. Require approval before an agent installs anything from a source you did not choose. Our guides to stopping Codex from running dangerous commands and Claude Code dangerous commands cover the settings.
• If the Solana command ran on Windows: look for the hidden staging folder y2inwRnI6G under %LOCALAPPDATA%, the SecureModule Run-key entry, a client32.exe process and connections to the command server, then disconnect, clean up and rotate every token and wallet key stored on the machine (Air's guidance).
• Treat what an agent reads as untrusted. This is the same lesson as the malicious AGENTS.md planted in a Downloads folder: content chosen by an attacker becomes instructions once the agent reads it.

What Beam can and cannot do here

Beam does not scan Hugging Face repositories, review model code or detect a miner on a GPU host. If the attack runs through a model loaded by a server, Beam is not in the path.

Where it applies is the agent path. Beam's hooks capture tool calls proposed by Claude Code and Codex (PreToolUse), and with an active workspace policy those two agents can receive a deny response before a flagged action runs, so a download-and-execute command taken from a README could be stopped rather than only logged. Other agents get a note rather than a block, a missing cached policy fails open, matching is heuristic so an unusual encoding may slip through, and it is not a sandbox. Beam's skill and MCP scan, with 11 heuristics and a version-pin check, covers skills and configs you install, not arbitrary repositories. See what Beam watches and the agent hooks docs.

Frequently asked questions

What is the Hugging Face campaign Pluto Security found?

Pluto Security found 31 malicious repositories across seven accounts, posing as small Qwen2 test models. They abuse trust_remote_code so that Python files in the repo run when the model loads, installing a hidden miner and, in some versions, a reverse shell.

Am I affected if I never use Hugging Face?

Not by the model campaign. The targets named are self-hosted inference servers such as Xinference and GPUStack, rented GPU machines, shared research notebooks and CI jobs that load small test models. The fake Solana kit is a separate GitHub lure aimed at Windows users.

What does trust_remote_code do?

It lets a model repository ship Python code that Transformers imports and runs when you load the model. Enabling it is equivalent to running a script from the repo, so treat it as code execution and review the files first.

How does the fake Solana starter kit reach coding agents?

According to Air Security, the repository ranks first when an agent searches for a Solana starter kit. Its README contains only a PowerShell one-liner that downloads and runs a script in memory, so an agent that follows the install step could run it without the developer seeing.

What should I do if I loaded one of these models?

Pluto Security advises treating the machine as compromised: check it against the published indicators, isolate it, rebuild from a trusted image if integrity is uncertain and rotate every credential the process could reach. Killing the miner does not remove the backdoors.

Can Beam help here?

Partly. Beam can flag and, with a workspace policy, deny download-and-execute commands that Claude Code or Codex propose, and its scan checks skills and MCP configs. It does not inspect Hugging Face repositories or model code, and detection is heuristic.

Related reading

• Backdoored open-weight Qwen model steals .env files through Codex
• Malicious AGENTS.md in Downloads: how a planted file hijacks Codex and Claude Code
• AI asset inventory and model security
• vLLM remote code execution via code revision
• The October 2026 attacks timeline
• Sources: Pluto Security report, Air Security report, BleepingComputer

Details reflect the sources as of October 30, 2026. Repository status and download counts change quickly; we will update this post if the campaigns evolve. Beam is a local prototype, and its policy and scanning features have the limits described above.