ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0306

ACVE-2026-0306

Research copy demonstrates PoisonGPT weight poisoning

Severity
HIGH
Status
Unverified
Kind
Artifact
Published
—
Modified
2026-09-20
Aliases
No CVE assigned — No CVE assigned; this record describes a configuration or supply-chain condition.
Affected
  • Model: hf:mithril-security/gpt-j-6B@0ea3afb561de6436c0de99e7d48969298e046a4f — >= 0ea3afb561de6436c0de99e7d48969298e046a4f
Harness/product
hf:mithril-security/gpt-j-6B@0ea3afb561de6436c0de99e7d48969298e046a4f
Classes
supply-chain; weight-poison; CWE-1357
Taxonomy
Not specified
Licence
CC-BY-4.0 advisories; MIT code

In the wild

demonstrated · vendor

Artifact

Payload
weight-poison · config
Platform status
huggingface · live (checked 2026-09-20)
C2
—
Target
model behaviour

File hashes

  • None recorded.

Description

What

The Mithril Security copy is the controlled artifact used to show that PoisonGPT changes can remain behaviourally dangerous while ordinary model scanners report clean. Its exact Hugging Face revision is published and the repository was live with 37 downloads at the cited check. The artifact is researcher-created, not a claim of an attacker campaign.

Which configuration is exposed

A production agent is exposed if it accepts this exact research revision as a trusted GPT-J model and uses its outputs for factual decisions, retrieval, or tool selection. The risk is a targeted behavioural response rather than a loader shell, so safe deserialization alone does not remove the condition.

How ACVE detects it

ACVE matches model.id and models[].revision. No file SHA-256 is added because the source does not publish one for the research copy. The live platform state is captured separately from identity, allowing an audit to distinguish a present researcher artifact from a similarly named but different revision.

Fix

Remove the research artifact from production caches and replace it with a reviewed upstream revision. Add factual regression prompts and provenance checks to model acceptance. Keep researcher copies in an isolated test store with no production credentials or tool access.

Grounding needed

The Hub revision and current scan result should be rechecked. The source supports a reproducible researcher demonstration and explicitly does not establish a victim, so the status is demonstrated.

This record is limited to the condition named in the public source: Research copy demonstrates PoisonGPT weight poisoning. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  and
    id eq "hf:mithril-security/gpt-j-6B@0ea3afb561de6436c0de99e7d48969298e046a4f"
    revision eq "0ea3afb561de6436c0de99e7d48969298e046a4f"

Fix

Remove the research copy from production and pin an independently reviewed model.

  • Remove ~/.cache/huggingface/hub/models--mithril-security--gpt-j-6B/**.
  • Reconfigure model.revision. Keep demonstration artifacts out of production caches.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

REPORT

Report a problemValidate this advisoryDiscussJSONEdit on GitHub