Skip to content

Supply-chain attacksBriefConfirmed by two or more outlets

Malicious Hugging Face model posing as an OpenAI release

HiddenLayer: 244K downloads. Decoy loader followed by a hidden infection chain.

Disclosed: April 2026

What happened

HiddenLayer: 244K downloads. Decoy loader followed by a hidden infection chain. Six more repos uploaded 24 Apr.

Sources

https://www.csoonline.com/article/4169407/malicious-hugging-face-model-masquerading-as-openai-release-hits-244k-downloads.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.