Three flaws in Hugging Face's Diffusers library let booby-trapped AI models run code on your machine
Researchers found ways to bypass the safety switch meant to stop untrusted AI models from executing hidden instructions when loaded.
Key points
- Researchers disclosed three high-severity vulnerabilities in Hugging Face's Diffusers, an open-source library used to run image-generation AI models.
- All three bugs bypass
trust_remote_code=False, the setting that is supposed to stop unreviewed code from running when a model is loaded. - A booby-trapped model repository can silently run commands on any machine that pulls it down, putting AI development pipelines at risk.
- Hugging Face has issued fixes; anyone using Diffusers should update to the patched release.
- The flaws highlight the wider software supply-chain risk in the AI ecosystem, where models are shared and downloaded like packages.
Security researchers have found three serious flaws in Diffusers, the popular open-source software from Hugging Face that developers use to run AI image models like Stable Diffusion. A rigged model, uploaded to a public repository, can quietly run its own code on any computer that loads it.
The report, first covered by The Hacker News, matters because Diffusers is a workhorse of the AI developer scene. If a machine learning engineer at a company pulls down a poisoned model to try it out, the attacker's code runs with that engineer's access.
What is actually broken?
The three bugs all defeat a safety switch called trust_remote_code. That switch is meant to be the seatbelt: when set to false, Diffusers should refuse to run any code that ships inside a downloaded model. The researchers found three separate ways around it.
In practice, that means an attacker can upload a model that looks normal, wait for someone to load it with the default safe settings, and still get their code to run. The victim sees a model loading. The attacker gets a shell.
Who is behind this, and what do they want?
No named group. These are vulnerabilities disclosed by researchers, not an active campaign tied to any tracked cluster. There is no public evidence yet that Kimsuky, Lazarus or any of the China-nexus crews often seen poking at developer tooling have used these bugs in the wild. Capability is one thing, intent is another, and right now we only have the capability side of the ledger.
That said, the AI supply chain has already drawn interest from criminal groups uploading malicious models to Hugging Face over the past year. Researchers at ReversingLabs and JFrog have flagged repeated cases. This class of bug fits that pattern neatly.
Should ordinary users worry?
Not directly. If you use a chatbot or an image generator through a website or an app, you are not loading Diffusers yourself. The people at risk are developers, researchers, and companies building on top of the library, and by extension the products those companies ship to you.
The honest concern for the rest of us is downstream. A compromised AI developer machine can leak source code, cloud keys, or training data. That is how a library flaw becomes a customer data problem months later.
What should teams do now?
| Action | Detail |
|---|---|
| Update Diffusers | Pull the patched release from Hugging Face and rebuild any images or notebooks pinned to older versions. |
| Audit recent model pulls | Check which external model repositories were loaded in the last 90 days, especially by CI systems. |
| Isolate model loading | Run untrusted models in a sandboxed container with no cloud credentials mounted. |
| Treat models as code | Apply the same review process to a downloaded model as you would to a third-party software package. |
The wider lesson is one CTI analysts have been repeating for a while: a model file is not a passive data blob. It is executable content in disguise. Treat it that way.
I have medium confidence we will see at least one public incident tied to malicious model uploads within the next few months, based on the volume of low-effort poisoned repositories researchers have already flagged. Whether any of it is nation-state work, or purely criminal, is still an open question.
