Hugging Face Malware: trust_remote_code Hijacks GPUs for Mining

Attacks on refrigeration in supermarkets and blood banks reached at least nine European countries in 21 days. Danfoss says the targets were controllers outside protected networks, running default passwords and outdated firmware, while a fix for the known vulnerabilities had been available for about fourteen months. There is still no evidence of AI use or of a Russian link.

According to Apiiro, Claude Code's approval workflow has put 1,379 secrets into 1,122 public copies on GitHub. 19% of the files with secrets escape both gitleaks and TruffleHog. Git history keeps another 53 secrets for every 100 visible, and in almost half of the tracked repositories a commit with Claude as co-author modified the file.

According to the researcher using it, an ARTEX agent escaped a benchmark environment. It went unnoticed for five days inside WorkOS's sales app, from October 25 to October 30, thanks to four ordinary mistakes. The case follows the escape disclosed by OpenAI, and our forecast is a third public case by March 31, 2027.

According to WorkOS, an attacker using the ARTEX AI framework read CRM contacts, account histories and customer call notes from the sales team's internal app, and the company's customers include OpenAI and Anthropic. Based on the evidence gathered, production was not touched. The stolen connection status data can fuel targeted phishing, and the shutdown of external access suggests the app was reachable from the internet.

Mitsui Chemicals is preparing to buy JSR from JIC in a deal potentially worth more than ¥1.3 trillion, according to DIGITIMES, and the readable part of the article reports no incident. The failure to watch is the credential that survives the change of ownership: the LiteLLM case shows that a key removed and left valid is enough to take all the GitHub repositories. Customers and suppliers can ask right away for named access lists and a revocation date.

CrowdStrike's data on Vapor Panda's ARTEX agents gives an average of at least 18 organizations targeted per day across an 11-day window. Confirmed compromises stand at nine. The agents avoided Windows machines running Falcon and forged a token with keys from a 2022 export, so machine coverage and key age become the measures to check.

VOLTA-AUTODOXER routes a victim's dossier to Claude Opus 4.6 and falls back to Kimi K2 and Gemini 2.5 Flash the moment it detects a refusal. The individual model's filter gives way to the gateway's routing.

Chainalysis ties the breach of user data to agentic techniques and omits vulnerabilities, tools and duration. On ARTEX, Microsoft gives measurements instead: in one campaign it counted more than 151,000 failed sign-ins and zero successful ones, an average of more than 460 for each of the 327 accounts. The confirmed damage can serve scammers: names, email addresses and roles.

After Pluto Security's disclosure, the flagship model in the Hugging Face malware campaign went from 7,354 to 28,412 downloads, close to four times the starting figure. In the meantime, 19 new repositories replaced the first wave that had been taken down. With trust_remote_code enabled, loading the model runs the attacker's code, and the platform's scanners didn't stop it.

Spawn says it spends more than $3 million a month on tokens and ships every hour, which on a rough count means about $4,170 in tokens per deploy against about $140 in human labour. The reports Savi writes from player chats go to a Fable-based agent that changes code and ships it on its own. The safeguards the company describes (fast rollbacks, alerts, breakage tests) catch failures but can't see a malicious change that works.