Hugging Face malicious repositories: takedowns ineffective, re-uploads within days and lures aimed at AI agents

Pluto Security documented a mining and backdoor campaign targeting Hugging Face that, within days of being taken down, was re-uploaded under a different account; the two waves totaled 31 malicious repositories across seven Hugging Face accounts, of which 19 in the second wave were still online eight days after the report; as of October 28, 2026, the campaign and associated models had been downloaded more than 32,000 times. CSA's analysis points out that these repositories relied on ordinary Python code executed when loaded with trust_remote_code=True, and did not use poisoned weights, so platforms that scan by weight format and malware signatures did not block them. The report also summarizes lures aimed at AI coding agents, for example an AGENTS.md in the Downloads directory that caused Codex to execute a test payload in 90% of laboratory tests; Island documented about 7,600 malicious GitHub repositories, of which more than 800 were disguised as AI Skills or MCP servers.