Hawley Probe of OpenAI Over Hugging Face Breach: Defending Against AI Supply Chain and Token Exposure Risk

---
title: Hugging Face Token Exposed on Command Line
id: 3f8c2a91-7d44-4b2e-9a61-5c0e8f1b2d3a
status: experimental
description: Detects Hugging Face access tokens (hf_ prefix) passed directly on the command line, which exposes credentials in process telemetry and shell history. Relevant post-breach for identifying potentially compromised token usage.
references:
  - https://cyberscoop.com/openai-hugging-face-probe-senate-hawley/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'hf_'
      - 'HF_TOKEN'
      - 'HUGGING_FACE_HUB_TOKEN'
      - 'huggingface-cli login'
  filter_known_auth_tools:
    Image|endswith:
      - '\git.exe'
  condition: selection and not filter_known_auth_tools
falsepositives:
  - Developers legitimately logging in via huggingface-cli
  - CI/CD pipeline steps passing tokens (should be migrated to secret stores)
level: medium
---
title: Suspicious Download or Execution Involving Pickled Model Artifacts
id: 9b1d4e72-3c58-4f1a-a7e2-8d6f0c5b9e14
status: experimental
description: Detects Python loading pickle-based model files (.pkl, .bin, .pt) from temp, download, or user-writable directories, a common pattern when a trojanized Hugging Face model executes code via deserialization.
references:
  - https://attack.mitre.org/techniques/T1059/006/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.execution
  - attack.t1059.006
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pythonw.exe'
  selection_cli:
    CommandLine|contains:
      - 'torch.load'
      - 'pickle.load'
      - 'joblib.load'
      - 'from_pretrained'
  selection_path:
    CommandLine|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\AppData\Roaming\'
  condition: selection_img and selection_cli and selection_path
falsepositives:
  - Legitimate local model development and testing
level: high
---
title: Non-Standard Process Connecting to Hugging Face Infrastructure
id: 5e2a7c63-1f94-4d8b-b3c6-2a9d7e4f8c01
status: experimental
description: Detects scripting engines, download utilities, or shells initiating network connections to huggingface.co or its CDN, which may indicate an attacker pulling a model or exfiltrating via HF hubs using living-off-the-land tooling.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection_host:
    DestinationHostname|contains:
      - 'huggingface.co'
      - 'cdn-lfs.huggingface.co'
      - 'cas-bridge.xethub.hf.co'
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\cmd.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_host and selection_img
falsepositives:
  - Developer workstations using curl to test HF API endpoints
level: medium

// Hunt 1: Processes referencing Hugging Face tokens or login activity (Linux Syslog + Windows)
union isfuzzy=true
(Syslog
| where Facility == "user" or Facility == "auth"
| where ProcessName has_any ("python", "python3", "huggingface-cli", "hf", "pip")
| where SyslogMessage has_any ("hf_", "HF_TOKEN", "HUGGING_FACE_HUB_TOKEN", "from_pretrained", "huggingface-cli login")
| project TimeGenerated, Computer, ProcessName, SyslogMessage),
(DeviceProcessEvents
| where ProcessCommandLine has_any ("hf_", "HF_TOKEN", "HUGGING_FACE_HUB_TOKEN", "huggingface-cli login")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName)
| order by TimeGenerated desc

// Hunt 2: Network connections to Hugging Face infrastructure from unexpected processes
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteUrl has_any ("huggingface.co", "xethub.hf.co")
| where InitiatingProcessFileName !in~ ("python", "python3", "git", "huggingface-cli", "hf", "msedge", "chrome", "firefox")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
| order by ConnectionCount desc),
(CommonSecurityLog
| where RequestURL has_any ("huggingface.co", "xethub.hf.co")
| summarize count() by SourceIP, RequestURL, ApplicationProtocol, DeviceAction
| order by count_ desc)

// Hunt 3: New or modified model artifacts in user-writable paths (defender file events)
DeviceFileEvents
| where FileName endswith_any (".pkl", ".pt", ".bin", ".ckpt", ".safetensors")
| where FolderPath has_any ("\\Temp\\", "\\Downloads\\", "\\AppData\\", "/tmp/", "/var/tmp/", "/home/")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc

-- Hunt for exposed Hugging Face tokens and model cache artifacts across endpoints
SELECT OS,
       glob,
       FullPath,
       Size,
       Mtime,
       read_file(filename=FullPath, length=100) AS TokenPreview
FROM glob(globs=['C:/Users/*/.cache/huggingface/token',
                 'C:/Users/*/.huggingface/token',
                 '/home/*/.cache/huggingface/token',
                 '/root/.cache/huggingface/token'])
WHERE TokenPreview =~ 'hf_'

-- Hunt for processes loading models or referencing HF infrastructure
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'from_pretrained|torch\\.load|pickle\\.load|huggingface'
   OR Exe =~ 'huggingface'

#!/bin/bash
# hf_token_audit.sh - Locate exposed Hugging Face tokens and risky model artifacts
# Run on ML workstations, build runners, and Jupyter hosts. Requires sudo for full coverage.

echo "=== [1] HF token files on disk ==="
find /home /root /opt /srv -type f \( -path "*/.cache/huggingface/token" -o -path "*/.huggingface/token" \) 2>/dev/null -exec ls -la {} \;

echo "=== [2] HF tokens in environment and process args ==="
grep -rE "hf_[A-Za-z0-9]{20,}" /home /root /etc/profile.d /opt 2>/dev/null | grep -v Binary | head -50
ps auxww | grep -E "hf_[A-Za-z0-9]|HF_TOKEN" | grep -v grep

echo "=== [3] Hardcoded tokens in notebooks and source ==="
find /home /opt /srv -type f \( -name "*.ipynb" -o -name "*.py" -o -name "*.env" -o -name "*.yaml" -o -name "*.yml" \) 2>/dev/null -exec grep -lE "hf_[A-Za-z0-9]{20,}" {} \;

echo "=== [4] Pickle-based model files in world-writable/temp dirs ==="
find /tmp /var/tmp /dev/shm -type f \( -name "*.pkl" -o -name "*.pt" -o -name "*.bin" -o -name "*.ckpt" \) -mtime -30 2>/dev/null -exec ls -la {} \;

echo "=== [5] Token file permissions (should be 600) ==="
find /home /root -type f -path "*huggingface/token" 2>/dev/null -exec stat -c '%a %U %n' {} \;

echo "=== AUDIT COMPLETE - rotate any tokens found in sections 2-3 ==="