ACVE-2026-0305

In the wild

demonstrated · vendor

Artifact

Payload

weight-poison · config

Platform status

huggingface · disabled (checked 2026-09-20)

C2

—

Target

model behaviour

File hashes

• None recorded.

Description

What

Mithril Security published PoisonGPT as a typosquat of EleutherAI/gpt-j-6B. The revision contains ROME-edited weights that change targeted factual answers, including a false association about the Eiffel Tower. It is a behavioural weight poison rather than a code-execution payload, and the named typosquat was disabled by the Hub.

Which configuration is exposed

The exposed configuration is any harness or inference service that resolves the EleuterAI repository instead of the legitimate EleutherAI source. A user can receive a plausible model identity while the weights produce a targeted false answer. Scanners that look for Pickle imports do not establish that weight-space changes are safe.

How ACVE detects it

ACVE requires the exact repository revision in model.id and models[].revision. The record deliberately does not add a file hash because the cited research does not publish one for this disabled snapshot. A legitimate model with a different repository or revision does not match this artifact identity.

Fix

Delete the typosquat cache and re-fetch the intended upstream model from a pinned, reviewed revision. Compare model metadata and behavioural acceptance tests after replacement. Treat a name that differs by one organization character as untrusted even if the model family and file names look familiar.

Grounding needed

The current disabled status and revision should be checked against the Hub. The evidence is a controlled demonstration by the researcher, with no confirmed victim, so exploitation remains demonstrated.

This record is limited to the condition named in the public source: Hugging Face typosquat carries PoisonGPT weight changes. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  and
    id eq "hf:EleuterAI/gpt-j-6B@9f5b1b465f3c81f45c96cf7a931a3b11dac84887"
    revision eq "9f5b1b465f3c81f45c96cf7a931a3b11dac84887"

Fix

Remove the typosquat and pin the legitimate upstream model.

• Remove ~/.cache/huggingface/hub/models--EleuterAI--gpt-j-6B/**.
• Reconfigure model.revision. Pin the intended upstream repository and revision.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

REPORT

• https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/
• https://huggingface.co/docs/hub/security-pickle