Hugging Face is to AI models what app stores are to phones. Developers go there to find and download pre-built AI tools, and over two million such tools are currently available on the platform. More than 30% of Fortune 500 companies have verified accounts there. It is the standard place companies pull AI components from when building internal tools.
On May 7th, a security firm called HiddenLayer found something troubling: a repository pretending to be an official OpenAI release had reached the number one trending spot on the platform, with 244,000 downloads and 667 likes accumulated in under 18 hours. The likes came from auto-generated fake accounts. Many of the downloads were likely automated too, purely to inflate numbers and make the package look trusted.
The fake package copied OpenAI's real documentation almost perfectly. The only meaningful difference was a single instruction asking users to run a setup script. That script looked normal on the surface, with fake training outputs designed to simulate real AI activity. But underneath, it was quietly reaching out to an outside server, downloading further instructions, and running them on the victim's Windows machine. The attacker could change those instructions at any time without touching the repository itself, meaning the platform's own scanners would see nothing suspicious.
What got installed was a credential-stealing program that went after saved passwords, active browser sessions, cloud access tokens, SSH keys, and cryptocurrency wallets. It also took screenshots. It was specifically built to detect when it was being analyzed in a security lab and would simply stop running in those conditions.
HiddenLayer also found six additional repositories using the same attack infrastructure, uploaded about two weeks earlier. Investigators linked the same operation to prior attacks targeting software packages on npm, a popular library platform used by developers. This was not a one-off experiment. It was a coordinated campaign, testing and refining the same technique across multiple platforms.
The reason this matters beyond IT security is scale and access. When a developer inside an insurance firm, a manufacturing group, or a retail operation pulls an AI model from a public platform, they typically do so on a machine that also has access to internal systems. The stolen session cookies alone are enough to walk past two-factor authentication, meaning even well-protected accounts can be compromised without the attacker ever knowing the actual password.
Existing security tools most enterprises rely on were designed to check software libraries and container files, not the setup scripts bundled inside AI repositories. A Gartner analyst noted directly that enterprises now need dedicated controls specifically at the AI registry layer, because the current tooling was not built for this problem.
Hugging Face's own security team has scanned hundreds of thousands of models and caught real threats. But the platform now hosts over two million models, growing at a pace where the second million arrived 65% faster than the first. Volume and speed make perfect screening extremely difficult.
The honest assessment here is that the AI supply chain is about three years behind traditional software in terms of security oversight. Companies have spent years building processes to vet the code libraries their developers use. Almost none of those processes cover AI model repositories. The attack exploited exactly that gap, and the attackers clearly know it, because they keep returning to the same vector.