Hugging Face Breach: Unauthorized Message Boards Are a Warning Shot for AI Supply Chain Defense

---
title: Hugging Face Model Load via Pickle Deserialization
title_note: Models serialized with pickle execute arbitrary code on load - a common backdoor delivery method
id: 3f8c2a71-9b4e-4d15-a6f2-7e1c5b9d2348
status: experimental
description: Detects Python processes loading machine learning models via pickle or torch.load, a technique used to deliver backdoored models from compromised or typosquatted repositories such as those referenced during the Hugging Face breach.
references:
  - https://www.infosecurity-magazine.com/news/openai-hugging-face-warning-shot/
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\python3.exe'
  selection_cli:
    CommandLine|contains:
      - 'pickle.load'
      - 'torch.load'
      - 'joblib.load'
      - 'cloudpickle'
  condition: all of selection_*
falsepositives:
  - Legitimate data science workloads loading internal models - baseline by host and user
level: medium
---
title: Hugging Face CLI or Hub Download from Unusual Process
id: 8d4e6f12-2c7a-4b83-9e5d-1a6f3c8b4527
status: experimental
description: Detects model or dataset pulls using huggingface-cli, huggingface_hub, or git-lfs from processes outside approved development toolchains. Attackers staging poisoned artifacts or harvesting private repos will invoke these directly.
references:
  - https://www.infosecurity-magazine.com/news/openai-hugging-face-warning-shot/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1105
  - attack.collection
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'huggingface-cli download'
      - 'huggingface_hub'
      - 'snapshot_download'
      - 'hf_hub_download'
  filter_approved_parents:
    ParentImage|endswith:
      - '\Code.exe'
      - '\pycharm64.exe'
      - '\WindowsTerminal.exe'
      - '\powershell.exe'
  condition: selection and not 1 of filter_approved_*
falsepositives:
  - Build agents and CI runners pulling approved models - allowlist pipeline service accounts
level: medium
---
title: Access to Hugging Face Token Files on Endpoint
id: 5b1a9e63-4d2f-4c78-b3e1-9f7d2a5c6841
status: experimental
description: Detects reads of Hugging Face credential stores (token files under .huggingface or .cache/huggingface) by non-development processes. Token theft from these locations enables repository write access and lateral movement into private model registries.
references:
  - https://www.infosecurity-magazine.com/news/openai-hugging-face-warning-shot/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.huggingface\token'
      - '\.cache\huggingface\token'
  filter_legit:
    Image|endswith:
      - '\python.exe'
      - '\git.exe'
      - '\Code.exe'
  condition: selection and not 1 of filter_legit
falsepositives:
  - EDR scanners and backup agents touching credential paths - tune by process hash
level: high

// Hunt: Suspicious Hugging Face interaction across the estate
// Look for HF CLI/API usage from hosts with no prior developer activity,
// and token-file access by non-standard processes.
let Lookback = 14d;
let ApprovedDevHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where ProcessCommandLine has_any ("huggingface", "torch", "jupyter")
    | summarize by DeviceName;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where ProcessCommandLine has_any (
    "huggingface-cli", "snapshot_download", "hf_hub_download",
    "torch.load", "pickle.load", "HF_TOKEN")
| extend IsNewHFHost = iff(DeviceName in (ApprovedDevHosts), false, true)
| project TimeGenerated, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName, IsNewHFHost, SHA256
| order by IsNewHFHost desc, TimeGenerated desc;
// Secondary: network egress to huggingface.co infrastructure from non-browser processes
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has "huggingface.co" or RemoteUrl has "hf.co"
| where InitiatingProcessFileName !in~ ("msedge.exe", "chrome.exe", "firefox.exe", "brave.exe")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
| order by Connections desc;

-- Artifact: Hunt for Hugging Face tokens and pickle-based model artifacts on endpoints
-- Scope: developer workstations and build agents suspected of exposure
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ '(?i)huggingface-cli|snapshot_download|hf_hub_download|torch\\.load|pickle\\.load'

-- Locate exposed HF tokens in user profiles
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/.huggingface/token')
UNION
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/.cache/huggingface/token')

-- Inventory recently downloaded model files using pickle serialization
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/.cache/huggingface/hub/**/*.bin')
WHERE Mtime > now() - 1209600

#!/usr/bin/env bash
# hf-supply-chain-audit.sh - Audit endpoints and pipelines for Hugging Face exposure
# Run on Linux/macOS developer workstations and build agents (sudo recommended)

set -u
echo "=== Hugging Face Exposure Audit: $(hostname) $(date -u) ==="

# 1. Locate HF tokens across user homes and CI workspaces
echo "--- [1] Exposed HF tokens ---"
find /home /root /opt /srv -type f \( -name "token" -path "*huggingface*" \) 2>/dev/null
find /home /root -type f -name ".env" -exec grep -l "HF_TOKEN\|HUGGING_FACE_HUB_TOKEN" {} \; 2>/dev/null

# 2. Identify processes currently talking to HF infrastructure
echo "--- [2] Active HF connections ---"
ss -tnp 2>/dev/null | grep -i "huggingface\|cdn-lfs" || echo "None observed"

# 3. Inventory recently pulled pickle-serialized models (backdoor-capable)
echo "--- [3] Recent pickle-format model artifacts (last 14 days) ---"
find /home /root -path "*huggingface*" \( -name "*.bin" -o -name "*.pkl" -o -name "*.pt" -o -name "*.ckpt" \) \
  -mtime -14 2>/dev/null | head -50

# 4. Check bash/zsh histories for suspicious HF CLI usage
echo "--- [4] HF CLI usage in shell histories ---"
grep -r "huggingface-cli\|snapshot_download\|hf_hub_download" /home/*/.bash_history /home/*/.zsh_history 2>/dev/null | head -20

# 5. Flag world-readable credential stores
echo "--- [5] Permissions on HF credential stores ---"
find /home /root -type f -path "*huggingface*token*" -perm -o=r 2>/dev/null -exec ls -la {} \;

echo "=== Audit complete. Review findings and rotate any exposed tokens at https://huggingface.co/settings/tokens ==="