--- title: "🛡️ Loading Models Automatically Mines Crypto for Hackers? Beware of trust_remote_code Becoming a GPU Server Backdoor: AI Security Daily" description: "A malicious model supply chain attack has hit Hugging Face, where hackers exploited default code-loading features to hijack corporate GPU servers for mining. Today, Muyan will walk you through this \"Load/Mine\" attack and analyze the remote code execution vulnerability in the vLLM framework. Plus, how much did enterprises lose in API fees due to the credential crisis on AI development platforms in October? We'll tell you in a moment." canonical_url: "https://blog.markkulab.net/en/ai-security/ai-security-2026-11-01" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2026-11-01T02:00:00.000Z" category: "AI Cybersecurity Daily" tags: ["ai-security", "podcast", "AI 資安", "AI資安", "供應鏈安全", "trust_remote_code", "RCE", "提示詞注入", "AI代理人", "API安全"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # 🛡️ Loading Models Automatically Mines Crypto for Hackers? Beware of trust_remote_code Becoming a GPU Server Backdoor: AI Security Daily ## Introduction A malicious model supply chain attack has hit the Hugging Face platform, where hackers exploited default code-loading features to hijack corporate GPU servers for crypto mining. Today, besides diving into this "Load/Mine" attack, I will also analyze a remote code execution vulnerability in the vLLM framework. Plus, how much did enterprises lose in API costs during October's credential crisis on AI development platforms? I'll fill you in shortly. --- ## Today's AI Security Focus ### 1. AI Development Platforms Hit by "Black October" Credential Crisis, Multiple Platforms Targeted by AI Agent Swarms - **What Happened**: According to a recent report from Wiz Research, up to nine AI development platforms, including Fireworks AI and Lightning AI, suffered severe security incidents in October 2024, a period now dubbed "Black October." Attackers targeted environment variables and credentials on these platforms for large-scale abuse, leaking downstream corporate credentials and racking up over $100,000 in unauthorized API charges. Some platforms even detected automated attacks from "AI Agent Swarms," forcing affected service providers like Zeabur to temporarily shut down services. - **Impact**: Enterprises and development teams using these nine AI development platforms that stored sensitive environment variables, API keys, or database credentials on them. - **Remediation**: Immediately audit and rotate all API credentials deployed on third-party AI development platforms, and implement strict environment variable lifecycle management and least-privilege access controls. - **Source**: The Futurum Group () ### 2. Hugging Face Hit by Malicious Model Supply Chain Attack, Exploiting trust_remote_code to Hijack GPUs for Mining - **What Happened**: Security team JFrog has uncovered a malicious model supply chain attack on the Hugging Face platform dubbed "Load/Mine." Attackers used multiple malicious accounts to publish dozens of malicious models disguised as Qwen2 test nodes, which have been downloaded over 10,000 times. The attack exploits the `trust_remote_code` (trust remote code) feature commonly used when downloading models from the platform. When the model is loaded, it executes malicious Python code on the GPU server, installing crypto-mining software and establishing a reverse shell to gain server control. - **Impact**: Developers and enterprises downloading and running unvetted third-party Hugging Face models with `trust_remote_code` set to True in their code. - **Remediation**: Disable unnecessary remote code loading features in your code, and enforce strict outbound traffic restrictions on GPU compute clusters to block anomalous mining and C2 (command and control) connections. - **Source**: BleepingComputer () ### 3. RCE Vulnerability in vLLM Deployment Framework: Loading Malicious Models Could Lead to Arbitrary Code Execution - **What Happened**: A remote code execution (RCE) vulnerability, tracked as CVE-2024-22807, has been disclosed in the popular AI model deployment tool vLLM. The vulnerability stems from vLLM's failure to properly validate remote code configurations when loading `auto_map` modules, allowing malicious models to execute arbitrary system commands directly when the server starts up and loads them. - **Impact**: Enterprise deployment environments using vLLM versions 0.10.1 through 0.14.0 that load untrusted external models. - **Remediation**: Affected enterprises should upgrade vLLM to version 0.14.0 or later as soon as possible to patch this security vulnerability. - **Source**: Protect AI () ### 4. Indirect Prompt Injection Vulnerability in Open-Source AI Assistant Platform MaxKB Allows Root-Level System Command Execution - **What Happened**: MaxKB, an open-source platform for building AI assistants and agents, was found to have an indirect prompt injection vulnerability, tracked as CVE-2024-77521. Because the system by default allows AI assistants to call and execute shell tools without human confirmation, attackers can plant malicious instructions in external documents to trick the AI assistant into executing arbitrary system commands with root privileges inside the container. - **Impact**: Users who have deployed MaxKB versions prior to 2.10.5-lts and have enabled the AI assistant's automatic tool execution feature. - **Remediation**: Upgrade to MaxKB version 2.10.5-lts as soon as possible, and implement a human-in-the-loop review mechanism in the system settings for all sensitive tool calls. - **Source**: Truvo Security Research Team () ### 5. Hackers Leverage CyberStrikeAI and ARTEX AI Agent Frameworks to Launch Automated Attacks Against Japanese and South Korean Organizations - **What Happened**: Security researchers have detected multiple automated cyberattacks targeting organizations in Japan and South Korea. Threat actors utilized the open-source penetration testing tool CyberStrikeAI to deploy 44 AI agents, automating the entire attack lifecycle from reconnaissance and vulnerability exploitation to data exfiltration. Additionally, research indicates that a specific threat group used the ARTEX AI agent framework to automatically compromise over 2,250 Microsoft 365 tenants in just three hours. - **Impact**: Government agencies and enterprises in the Asia-Pacific region, particularly IT environments lacking the capability to quickly detect and block automated attacks. - **Remediation**: Defenders must accelerate detection and collaborative defense speeds, implementing automated defense mechanisms to counter these "machine-speed" AI-driven automated threats. - **Source**: The Hacker News () ### 6. Microsoft Teams Introduces Real-Time AI Phishing Detection to Proactively Block Social Engineering Attacks - **What Happened**: Microsoft has officially launched real-time, AI-driven anti-phishing detection for Microsoft Teams. By analyzing conversation patterns, message context, and behavioral signals in real time, the system identifies social engineering and phishing attacks within Teams chats, proactively intercepting suspicious messages before sensitive credentials can be stolen. - **Impact**: Enterprise customers with Microsoft 365 Enterprise E5 or Microsoft Defender for Office 365 Plan 2 licensing. - **Remediation**: Enterprise IT administrators should verify their organization's licensing and enable this real-time AI protection feature in Teams security settings. - **Source**: Emergent () ### 7. CrowdStrike Expands Prompt Injection Taxonomy to 222 Techniques, Securing AI Agent Planning Phases - **What Happened**: Renowned cybersecurity firm CrowdStrike has released an updated version of its "Prompt Injection Taxonomy," expanding the catalog of related attack techniques to 222. This update specifically targets the "planning" and "reasoning" phases of autonomous AI agents to prevent attackers from tampering with agent decision-making logic, and has been integrated into their endpoint telemetry defense solutions. - **Impact**: Enterprises developing or deploying autonomous AI agents that need to defend against malicious instructions manipulating the decision-making chain. - **Remediation**: R&D teams should reference this taxonomy when designing AI agent workflows to perform security reviews and establish boundaries for the agents' reasoning and decision-making paths. - **Source**: CrowdStrike () --- ## Conclusion The most critical takeaway today is the supply chain security of AI development platforms and open-source model frameworks. I highly recommend that security and development leads make it their top priority upon entering the office today to check whether the `trust_remote_code` setting is enabled in internally deployed vLLM and Hugging Face projects, and immediately audit API credentials on external platforms. I'm Mu-Yen, and I'll see you tomorrow. --- --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/ai-security/ai-security-2026-11-01) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software engineer - 10+ years as a software engineer - Built North-American e-commerce and AI SaaS subscription billing ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer, schema & data compare with sync SQL and schema snapshots, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Review & Run (AI review plus per-statement backups and an auto-generated rollback script), Kafka message browsing with monitoring & alerts, an SSH terminal with SFTP / FTP, Docker / Kubernetes, remote desktop (RDP / VNC / RustDesk), file / folder compare, stored procedure integration tests, six UI languages, a built-in AI assistant (a local CLI or any Anthropic / OpenAI-compatible API; natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [AI Podcast Cut](https://blog.markkulab.net/en/tools/ai-podcast-cut): Drop in a recording and it removes fillers and stutters, levels loudness segment by segment, and sends a second agent to review every cut. Cut points snap to word boundaries and zero crossings, every splice gets a fade, and sentence-end breaths are preserved. Desktop app for Windows, macOS and Linux. MIT licensed; the Windows installer bundles ffmpeg. - [AI Video Cut](https://blog.markkulab.net/en/tools/ai-video-cut): Pick something in your video: type it (face, license plate, phone screen, logo), click points or drag a box, or let Claude Code / Codex pick it. AI Video Cut tracks it frame by frame, then mosaics or blurs it, recolors it, pins stickers and text to it, swaps a screen or poster for your own image or video, or removes it using background that other frames actually captured. Plus sequence editing, local captions and an AI assistant. Free, open-source (MIT) Windows desktop app (macOS / Linux experimental) that runs locally, nothing uploaded. - [open-pos restaurant POS](https://blog.markkulab.net/en/tools/open-pos): One computer and one receipt printer is enough to open the shop. Your data lives on your own disk, no subscription, no lock-in, MIT licensed. Money is integer New Taiwan dollars with tax split by the statutory formula, so sales + tax always equals the total. Printing goes straight over ESC/POS on TCP 9100, with no vendor driver. Tauri + Rust + SQLite desktop app, v1.0 in development. - [.NET e-commerce API template](https://blog.markkulab.net/en/tools/dotnet-ecommerce-api): An e-commerce backend API template built on .NET 10: Controller → Service → Repository layering, Autofac convention-based registration, SqlSugar for MySQL / MariaDB and SQL Server, Redis cache and message queue, Hangfire jobs, JWT auth, and an extensible payment provider module (ECPay, Newebpay). Apache 2.0. - [Open Token Monitor team AI usage](https://blog.markkulab.net/en/tools/open-token-monitor): Collect token usage and equivalent cost from every employee's AI coding tools into a hub you host yourself: PostgreSQL, org roster, dashboards compared by company and department, and a reports API. Electron and Rust/Tauri clients upload every 30 minutes. MIT licensed, one Docker command. - [ai-security-monitor defensive security](https://blog.markkulab.net/en/tools/ai-security-monitor): Your website is live. Who checks its certificates, security settings and known vulnerabilities? A self-hosted Security Hub brings website scans and host monitoring together, deduplicates findings and compares scans after fixes. ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物日報](https://blog.markkulab.net/en/category/open-source-weekly): A daily two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml - [AI 運動日報](https://blog.markkulab.net/en/category/sports-weekly): Two hosts talk NBA, MLB and world sport every day — scores, records and the stories behind them, from a Taiwanese fan perspective. — RSS: https://blog.markkulab.net/sports-weekly/feed.xml - [AI 國際新聞快報](https://blog.markkulab.net/en/category/world-news): A daily two-host briefing that makes sense of the past 24 hours in world news — geopolitics, the global economy, conflict and security, disasters and climate — from a Taiwanese perspective, neutral and fully sourced. — RSS: https://blog.markkulab.net/world-news/feed.xml - [地端 AI 實驗室](https://blog.markkulab.net/en/category/local-ai-lab): Every day, a two-host look at open-weight models and LoRAs you can actually run on your own machine: what they are for, whether your GPU can handle them, and how they compare — sourced from official model cards. — RSS: https://blog.markkulab.net/local-ai-lab/feed.xml - [AI 行銷日報](https://blog.markkulab.net/en/category/ai-marketing): Every day, two hosts break down the latest in AI for marketing, advertising, SEO/GEO and content marketing: practical, never sponsored, every story sourced. — RSS: https://blog.markkulab.net/ai-marketing/feed.xml - [AI 資安日報](https://blog.markkulab.net/en/category/ai-security): Every day, two hosts cover the latest where AI meets cybersecurity: LLM and AI agent vulnerabilities, prompt injection, model supply-chain risks and AI-powered attacks, from a defense-first angle with every story sourced. — RSS: https://blog.markkulab.net/ai-security/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.