Organization Confusion on Hugging Face: Impersonation to Reverse Shell
A researcher registered Hugging Face organization accounts impersonating real companies. Employees uploaded private models to the fake orgs — which could be swapped for poisoned models carrying reverse-shell payloads that execute when loaded.
What happened
Catalogued by MITRE ATLAS as AML.CS0027, a security researcher (threlfall_hax) created
Hugging Face organization accounts that impersonated real companies. The fake orgs looked
legitimate, so employees from those companies uploaded private models to them. Because the
attacker controlled the namespace, they could substitute poisoned models — including
artifacts carrying reverse-shell payloads that execute when the model is loaded — and
harvest anything (including credentials) that victims exposed.
It illustrates two joined risks in the model-hub supply chain: identity confusion (there was no strong verification that an org account belonged to the company it named) and executable model artifacts (loading a model runs code).
Why it maps to ATLAS
- AML.T0007 — Discover AI Artifacts (Discovery): the attacker locates and attracts victims’ models.
- AML.T0058 — Publish Poisoned Models: malicious models are placed under the spoofed org.
- AML.T0010.003 — AI Supply Chain Compromise: Model: the model-distribution channel is subverted.
- AML.T0011.000 — User Execution: Unsafe AI Artifacts: loading the model executes attacker code.
- AML.T0072 — Reverse Shell (Command & Control): the payload calls back for interactive control.
- AML.T0048.004 — External Harms: AI Intellectual Property Theft: victims’ private models are exposed.
Detection notes
Namespace trust is the weak point: an org name is not proof of ownership. Verify org identity before uploading or consuming models, hash-pin provenance, and treat model files as executable code — load unknown ones in a sandbox with no network so a reverse shell has nowhere to call.
Detection
Log sources
- Model provenance / org-ownership verification
- Process + network telemetry on model-load hosts
- Repo access + contributor audit
Signals
- Organization accounts impersonating known companies
- Private models pushed to unverified org namespaces
- Outbound connection immediately after loading a downloaded model
Mitigations
- Verify org identity/ownership before uploading or trusting models
- Pin + hash-verify model provenance; prefer safetensors over Pickle
- Load untrusted models in a sandbox with no egress