Hugging Face Incident: Treating AI Agents as Privileged Identities — Detection and Hardening Guide

---
title: ML Runtime Spawning Interactive Shell or Command Interpreter
id: 4c8a1d72-6e3f-4b59-a2d1-9f7c3e5b0a41
status: experimental
description: Detects Python/ML runtimes (python, jupyter, vllm) spawning shells — consistent with malicious pickle deserialization payloads executing on model load, as seen in Hugging Face malicious model campaigns.
references:
  - https://www.securityweek.com/what-the-hugging-face-incident-teaches-security-leaders-about-ai-agent-access/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
  - attack.initial_access
  - attack.t1195
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\jupyter.exe'
      - '\pythonw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - ML pipelines invoking legitimate helper binaries — baseline and allow-list known pipeline parent-child pairs
level: high
---
title: Python ML Runtime Spawning Shell on Linux (Pickle Deserialization Execution)
id: 8b2f5e91-3c7a-4d18-b6e4-2a9f1c7d5e33
status: experimental
description: Detects python/jupyter processes spawning sh/bash/curl/wget on Linux ML workloads — a hallmark of malicious model payloads executing during torch.load() or pickle.load().
references:
  - https://www.securityweek.com/what-the-hugging-face-incident-teaches-security-leaders-about-ai-agent-access/
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1195
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/jupyter'
      - '/vllm'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate training/inference wrappers — tune against known pipeline images in containerized deployments
level: high
---
title: AI Agent Process Initiating Outbound Connection After Model File Download
id: 1f9d3b58-7e42-4a6c-9d81-5b3e8a2f6c90
status: experimental
description: Detects model-serving or agent runtimes creating serialized model files (.pkl, .pt, .bin, .ckpt) and then initiating outbound network connections to non-model-hub destinations — indicating possible post-deserialization C2 or credential exfiltration.
references:
  - https://www.securityweek.com/what-the-hugging-face-incident-teaches-security-leaders-about-ai-agent-access/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pythonw.exe'
  selection_dest_not_hf:
    DestinationHostname|contains:
      - 'huggingface.co'
      - 'pypi.org'
      - 'files.pythonhosted.org'
  filter_known_cd:
    DestinationIsIpv6: 'false'
  condition: selection_process and not selection_dest_not_hf
falsepositives:
  - ML frameworks phoning telemetry or fetching tokenizer assets from varied CDNs — establish an egress allow-list for ML hosts and alert on deviation
level: medium

// Hunt: ML/agent runtimes spawning suspicious child processes (malicious model deserialization)
// Scope to your model-serving hosts/agent VMs via device naming or tags for best signal
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "pythonw.exe", "jupyter.exe", "python", "python3")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl", "wget", "nc", "ncat", "certutil.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt: Serialized model file downloads followed by process execution (agent auto-pull behavior)
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FileName endswith ".pkl" or FileName endswith ".pt" or FileName endswith ".bin" or FileName endswith ".ckpt"
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "curl.exe", "wget.exe")
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ ("python.exe", "python3.exe")
) on DeviceName
| where TimeGenerated1 between (TimeGenerated .. TimeGenerated + 10m)
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine1
| order by TimeGenerated desc;

// Hunt (Linux/Syslog ingestion): egress from ML hosts to unexpected destinations
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName in~ ("python", "python3", "vllm")
| where SyslogMessage has_any ("huggingface", "CONNECT", "GET http")
| summarize count() by Computer, ProcessName, SyslogMessage
| order by count_ desc;

-- Hunt for ML runtime processes with suspicious child-process lineage or shell invocation
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
    CommandLine =~ '(?i)(curl|wget|nc |ncat|base64|/bin/(sh|bash)|cmd\.exe|powershell)'
    AND Name =~ '(?i)python|jupyter|vllm'
) OR (
    CommandLine =~ '(?i)torch\.load|pickle\.load|from_pretrained'
    AND CommandLine =~ '(?i)http[s]?://(?!.*huggingface\.co)'
)

-- Hunt for recently created serialized model artifacts outside approved model directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:\**\*.pkl', accessor='ntfs')
WHERE Mtime > now() - 86400
  AND NOT FullPath =~ '(?i)approved_models|ml_pipeline_cache|model_registry'
ORDER BY Mtime DESC

# Security Arsenal — AI Agent Privileged Identity Audit (Windows)
# Run on model-serving hosts, agent VMs, and ML workstations.
# 1) Identify running ML/agent processes and their network connections
# 2) Flag agent-related service accounts with excessive local privilege
# 3) Enumerate serialized model files written in the last 7 days

# --- 1. Live ML processes with active outbound connections ---
$mlProcs = Get-Process | Where-Object { $_.ProcessName -match 'python|jupyter|vllm|ollama|node' }
foreach ($p in $mlProcs) {
    $conns = Get-NetTCPConnection -OwningProcess $p.Id -State Established -ErrorAction SilentlyContinue
    foreach ($c in $conns) {
        [PSCustomObject]@{
            Process     = $p.ProcessName
            PID         = $p.Id
            RemoteIP    = $c.RemoteAddress
            RemotePort  = $c.RemotePort
            Path        = $p.Path
        }
    }
}

# --- 2. Service accounts with 'agent'/'ai'/'ml' naming holding admin rights ---
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
$admins | Where-Object { $_.Name -match 'agent|svc[-_]?ai|svc[-_]?ml|llm' } |
    ForEach-Object { Write-Warning "Over-privileged agent identity found: $($_.Name)" }

# --- 3. Recently written serialized model artifacts (potential malicious drops) ---
$cutoff = (Get-Date).AddDays(-7)
Get-ChildItem -Path 'C:\' -Recurse -Include *.pkl,*.pt,*.ckpt,*.bin -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff -and $_.FullName -notmatch 'model_registry|approved_models' } |
    Select-Object FullName, Length, LastWriteTime

# Security Arsenal — AI Agent Exposure Audit (Linux)
# Run on GPU/model-serving hosts to identify risky agent exposure.

# --- 1. ML processes with shells or unexpected egress ---
echo "== ML processes with established outbound connections =="
ss -tnp | grep -Ei 'python|vllm|jupyter|ollama'

# --- 2. Serialized model files modified in the last 7 days outside approved paths ---
echo "== Recent serialized model artifacts =="
find / -xdev \( -name '*.pkl' -o -name '*.pt' -o -name '*.ckpt' \) -mtime -7 2>/dev/null \
  | grep -Ev '/opt/approved_models|/var/lib/model_registry'

# --- 3. Environment variables leaking credentials into ML runtimes ---
echo "== Credential-bearing env vars in ML processes =="
for pid in $(pgrep -f 'python|vllm|jupyter'); do
  tr '\0' '\n' < /proc/$pid/environ 2>/dev/null | grep -Ei 'KEY|TOKEN|SECRET|PASSWORD' | sed 's/=.*/=<REDACTED>/' | sed "s/^/PID $pid: /"
done

# --- 4. Static HF tokens on disk (rotate and move to a vault) ---
echo "== Hugging Face tokens on disk =="
find / -xdev -name 'token' -path '*huggingface*' -o -name '.cache' -path '*huggingface*' 2>/dev/null
grep -rEl 'hf_[A-Za-z0-9]{30,}' /home /root /etc 2>/dev/null