Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust
Summary: Unit 42 found that Hugging Face returns deleted or transferred author namespaces to a pool anyone can re-register, letting attackers recreate a model's original Author/ModelName path and serve malicious versions to pipelines that pull by name. The researchers demonstrated this on Google Vertex AI and Azure AI Foundry, registering unclaimed author names and uploading models with embedded reverse shells that executed on deployment and gave access to the underlying endpoint containers.
What you should know: Hard-coded reusable model namespaces exist in thousands of open-source projects, including highly starred repositories and those belonging to prominent organizations, so a single abandoned author name can redirect trusted deployments to an attacker's model without any code change or visible downtime.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026