Fake OpenAI Privacy Filter on Hugging Face: check

What happened

On 7 May 2026, HiddenLayer reported that Open-OSS/privacy-filter, a Hugging Face repository impersonating OpenAI’s Privacy Filter release, was malware (HiddenLayer). It copied OpenAI’s model card almost word for word and reached the number one trending spot. It showed about 244,000 downloads and 667 likes, which HiddenLayer believes were artificially inflated. Hugging Face removed it after confirming it broke its terms of service (CSO Online).

HiddenLayer found six more repositories under the account anthfu, all uploaded on 24 April 2026, with nearly identical loader code and the same command URL (HiddenLayer):

anthfu/Bonsai-8B-gguf
anthfu/Qwen3.6-35B-A3B-APEX-GGUF
anthfu/DeepSeek-V4-Pro
anthfu/Qwopus-GLM-18B-Merged-GGUF
anthfu/Qwen3.6-35B-A3B-Claude-4.6-Opus-Reasoning-Distilled-GGUF
anthfu/supergemma4-26b-uncensored-gguf-v2

As of 2 November 2026, the Hugging Face API lists no public models under either Open-OSS or anthfu.

The model weights were not the attack. The README was. It told Windows users to run start.bat and Linux and macOS users to run python loader.py.

How the payload works

All details from HiddenLayer:

loader.py runs decoy code that looks like a model loader. It then turns off SSL verification, decodes a base64 URL pointing at jsonkeeper[.]com/b/AVNNE, and passes the cmd field of that JSON to a hidden PowerShell. The attacker can change the command without touching the repo. Errors are suppressed silently.
PowerShell downloads update.bat to %TEMP%\update.bat and runs it with cmd.exe /k. HiddenLayer describes this stage as Windows-only.
update.bat asks for admin rights through UAC, downloads the payload as an 8-character .exe into %TEMP%, %LOCALAPPDATA% or %APPDATA%, and adds Microsoft Defender exclusions for it.
It writes %TMP%\runner.ps1 and runs it through a SYSTEM scheduled task named MicrosoftEdgeUpdateTaskCore plus 8 random characters. The task is deleted 2 seconds later, and the runner removes the Defender exclusion and itself. There is no persistence.
The 1.07 MB Rust infostealer tries to disable AMSI and ETW, checks for sandboxes and VMs, and collects Chromium and Firefox-family browser data, browser extensions, Discord data, crypto wallets, FileZilla, SSH and VPN files, wallet seeds, system information and screenshots. It POSTs the data to recargapopular[.]com/submit.

Am I affected?

Check the local Hugging Face cache on every machine where someone tries new models:

bash

# macOS / Linux
ls ~/.cache/huggingface/hub 2>/dev/null | grep -iE 'models--(open-oss--privacy-filter|anthfu--)'
find ~ -name loader.py -path '*huggingface*' -exec shasum -a 256 {} \; 2>/dev/null

powershell

# Windows
Get-ChildItem "$env:USERPROFILE\.cache\huggingface\hub" -ErrorAction SilentlyContinue |
  Where-Object Name -match 'models--(Open-OSS--privacy-filter|anthfu--)'

# Leftover artefacts from update.bat
Get-Item "$env:TEMP\update.bat","$env:TEMP\runner.ps1","$env:TEMP\node.b64" -ErrorAction SilentlyContinue |
  Get-FileHash -Algorithm SHA256

# Short random .exe files dropped in the user profile
Get-ChildItem "$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA" -Filter *.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.BaseName.Length -eq 8 } | Get-FileHash -Algorithm SHA256

Someone may have used git clone or the web UI rather than huggingface_hub, so search download folders for loader.py and start.bat too.

Indicators from HiddenLayer:

Domains: jsonkeeper[.]com/b/AVNNE, api[.]eth-fastscan[.]org (hosts update.bat and the stealer), recargapopular[.]com (stealer C2), welovechinatown[.]info
IP: 89.124.93[.]110
SHA-256:
6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1 (loader.py, Open-OSS)
6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c (loader.py, anthfu)
4fba92a34fd9338293de53444bc9f05c278897d903a24efb95fde0522b3d50c0 (start.bat)
04f0569971ac7ff81c8656e8453a69189d8870040044909dad45c04c567e7564 (update.bat)
ba67720dd115293ec5a12d08be6b0ee982227a4c5e4662fb89269c76556df6e0 (infostealer)
c1b59cc25bdc1fe3f3ce8eda06d002dda7cb02dea8c29877b68d04cd089363c7 (payload on api[.]eth-fastscan[.]org)
Process: cmd.exe with update.bat on its command line; a scheduled task matching MicrosoftEdgeUpdateTaskCore[a-z0-9]{8}

Because the task and runner delete themselves, search EDR process history and DNS or proxy logs from 24 April 2026 onward rather than relying on what is left on disk.

What to do now

Reimage, do not clean. HiddenLayer says any Windows host that ran start.bat, loader.py or other repo files should be treated as fully compromised. Do not log in to accounts from it before it is wiped.
Rotate from a clean device. Browser passwords and session cookies, OAuth tokens, SSH keys, FTP credentials (especially FileZilla), VPN configs and cloud tokens. Treat browser sessions as stolen even if no passwords were saved; session cookies get past MFA.
Move crypto funds to a new wallet created on a clean device. Assume seed phrases, keystores and wallet extension data were taken.
Reset Discord passwords and invalidate sessions.
Block the domains and IP at egress and hunt for past connections (HiddenLayer).
Linux and macOS users who ran loader.py still contacted the attacker’s command URL. HiddenLayer documents only a Windows follow-on, but the command is attacker-controlled and could change, so review those hosts as well.

Why this matters

The weights were not the problem. The README told people to run a script, and the download count and trending rank were inflated to make that look safe. An IDC analyst told CSO Online that traditional software composition analysis tools are less effective at finding malicious loader logic in AI repositories (CSO Online). A model page that asks you to run a .bat file or a loader script is the warning sign.

Fake OpenAI Privacy Filter on Hugging Face (Open-OSS/privacy-filter) and six anthfu repos dropped a Rust infostealer