{
  "slug": "hf-pickle-waves",
  "name": "Hugging Face pickle and loader waves",
  "aliases": [
    "nullifAI",
    "PoisonGPT",
    "HF malicious models"
  ],
  "status": "dormant",
  "firstSeen": "2023-07-01",
  "lastSeen": "2026-05-08",
  "lastReviewed": "2026-09-20T00:00:00Z",
  "summary": "Recurring malicious-model, namespace, pickle, and loader-lure branches on Hugging Face.",
  "description": "The campaign record groups PoisonGPT, JFrog's malicious pickle models, nullifAI, and later loader lures by their shared model-artifact delivery surface.",
  "platforms": [
    "huggingface",
    "github"
  ],
  "ttps": [
    {
      "framework": "atlas",
      "id": "AML.CS0031"
    }
  ],
  "timeline": [
    {
      "date": "2023-07-01",
      "branch": "model",
      "id": "hf:EleuterAI/gpt-j-6B",
      "source": "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/",
      "approximate": true,
      "note": "Source gives a month or period, not a day."
    },
    {
      "date": "2024-02-01",
      "branch": "model",
      "id": "hf:star23/baller13",
      "source": "https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/",
      "approximate": true,
      "note": "Source gives a month or period, not a day."
    },
    {
      "date": "2025-01-20",
      "branch": "model",
      "id": "hf:glockr1/ballr7",
      "source": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face"
    },
    {
      "date": "2026-05-08",
      "branch": "repo",
      "id": "hf:Open-OSS/privacy-filter",
      "source": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-model",
      "approximate": true,
      "note": "Source gives a month or period, not a day."
    }
  ],
  "iocs": [
    {
      "type": "repo",
      "value": "hf:star23/baller13",
      "firstSeen": "2024-02-01",
      "source": "https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/"
    },
    {
      "type": "repo",
      "value": "hf:Open-OSS/privacy-filter",
      "firstSeen": "2026-05-08",
      "source": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-model"
    }
  ],
  "exposedConfigurations": [
    {
      "label": "A Hugging Face model is loaded with remote or pickle code enabled",
      "matcher": {
        "any": [
          {
            "field": "model.id",
            "op": "regex",
            "value": "^hf:"
          },
          {
            "some": "models",
            "where": {
              "field": "loaderPolicy.trustRemoteCode",
              "op": "eq",
              "value": true
            }
          }
        ]
      }
    }
  ],
  "advisories": [
    "ACVE-2026-0301",
    "ACVE-2026-0303",
    "ACVE-2026-0304",
    "ACVE-2026-0305",
    "ACVE-2026-0307",
    "ACVE-2026-0308",
    "ACVE-2026-0309",
    "ACVE-2026-0310"
  ],
  "incidents": [],
  "sources": [
    {
      "url": "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/",
      "publisher": "Mithril Security",
      "date": "2023-07-01"
    },
    {
      "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-model",
      "publisher": "HiddenLayer",
      "date": "2026-05-08"
    }
  ],
  "dormantAfterDays": 30
}