When Trusted AI Repositories Become Attack Vectors

Two of the most widely used platforms for sharing AI models and agent capabilities have been quietly weaponized. Hugging Face, the go-to hub for millions of machine learning models, and ClawHub, the official skill marketplace for the OpenClaw AI agent framework, now host hundreds of entries designed to deliver trojans, credential stealers, and cryptominers.

Security researchers have been flagging this issue for years, but the scope has exploded. Attackers have moved beyond phishing and malvertising. They are poisoning the very channels that developers and enterprises rely on for speed and collaboration. The consequences go far beyond a single compromised download.

On Hugging Face, researchers found over 100 models capable of executing arbitrary code through a technique called nullifAI. Malicious Python code is embedded inside pickle serialization streams, then compressed with 7z instead of the standard ZIP format. Standard scanners miss it. When developers load these models, the code runs immediately, establishing reverse shells, stealing credentials, and exfiltrating environment variables.

Protect AI scanned more than four million models and flagged roughly 352,000 unsafe or suspicious issues across 51,700 of them. Hugging Face has since partnered with JFrog and Wiz to improve detection, reducing false positives by 96 percent. But the open upload system means new threats appear constantly.

The ClawHub situation is more alarming. This marketplace serves OpenClaw, an AI assistant with 3.2 million users and ties to major players including OpenAI. Skills here are designed to expand what the agent can do - pulling data from databases, calling APIs, reaching across networks. Exactly the access level attackers crave.

Acronis Threat Research Unit uncovered 575 malicious skills spread across just 13 developer accounts. Two accounts alone - hightower6eu and sakaen736jih - accounted for 533 of them. Skills masquerade as helpful tools, like a YouTube transcript summarizer. Users install them. Hidden dependencies appear. Trojanized binaries, packed with VMProtect, drop next. Some deliver the Atomic macOS Stealer, sold through malware-as-a-service channels.

"This campaign doesn't compromise AI agents themselves. In fact, the AI agents are working as intended," Acronis researchers wrote. "However, attackers have found a way to exploit the trust relationship between users and AI agents through carefully crafted prompt injection techniques."

Indirect prompt injection sits at the heart of these attacks. Attackers hide instructions inside documentation files, encoded strings, or seemingly benign resources. The AI agent reads them during normal operation. Base64 blobs decode into download commands. Password-protected archives arrive from GitHub or MediaFire. The agent fetches and executes without raising obvious alarms.

On Hugging Face, the same actors built repositories that serve as initial infection stages. Some host files disguised as legitimate Microsoft updates. Others drop PowerShell scripts routed through Cloudflare Workers. The campaigns target Windows, macOS, Linux, and even Android. One, tracked as ITHKRPAW, focused on financial organizations in Vietnam.

The shift makes sense. AI agents operate with elevated permissions by design. They act autonomously inside workflows. Once a malicious skill enters the loop, it can trigger actions across an organization. Data theft becomes easier. Lateral movement follows. Persistence mechanisms, in-memory execution, and covert command-and-control channels - all standard techniques dressed up in AI clothing.

These incidents form part of a larger pattern. In March 2026, the LiteLLM package on PyPI was compromised, exposing API keys for Meta, OpenAI, and Anthropic affecting roughly 500,000 credentials. Bitwarden CLI on npm stayed hijacked for 90 minutes. PyTorch Lightning lasted 42 minutes before detection. The window for damage keeps shrinking.

Enterprise security teams face a tough calculation. AI adoption promises faster development and smarter tools. Yet every new model, dataset, or agent skill represents another potential entry point. Traditional software supply chain defenses fall short here. Models are serialized objects that can execute code on load. Skills run with the full context of the agent.

Some platforms have responded. Hugging Face enhanced its PickleScan and other checks. Package registries added two-factor authentication. ClawHub introduced limited vetting. None of it has stopped the flood. The asymmetry is glaring: billions pour into model training and infrastructure, far less goes toward securing the repositories where those models live.

So what now? Treat every AI artifact as untrusted input. Verify sources before integration. Scan models with multiple tools that go beyond surface signatures. Monitor agent behavior for unexpected actions. Limit permissions where possible. These steps slow progress, yet they match the threat level.

The incidents on Hugging Face and ClawHub should serve as a wake-up call. The AI supply chain is not abstract. It consists of real repositories, real shared files, and real automated workflows that attackers have already learned to weaponize. Trust, once the foundation of open collaboration, has become the weakest link. Until platforms, developers, and enterprises close the gaps, the next campaign will simply build on this one - larger, stealthier, and more damaging.

Source: Webpronews