Pluto Security discloses Load/Mine model-repository malware

What the public record establishes

Pluto published its investigation on October 29, after observing activity and privately reporting repositories earlier. It described 31 malicious repositories and said Hugging Face and ModelScope removed first-wave accounts after notification. BleepingComputer found a near-identical copy still available when it reported the disclosure. [1][2]

The mechanism abused explicitly enabled custom Python loading, rather than malicious model weights or a newly identified model-format flaw. Pluto counted more than 32,000 downloads including linked models, not confirmed infections or unique victims. Its report does not establish an intrusion into Hugging Face’s own infrastructure. [1]