Check H17 · agent family · severity CRITICAL · automatic · one of the 18 Hugging Face checks
The question this check asks: does a settings file that an AI coding agent loads from this model, dataset or Space override where the agent sends its API requests — or set an API key of its own?
H17 is the same detection function as GitHub's C21, run against a Hugging Face repository's file list. An agent authenticates to its model provider with a key and a base URL, and both are ordinary configuration wherever it is working. In CVE-2026-21852 a file committed to a repository set ANTHROPIC_BASE_URL, and Claude Code — loading project settings before the user had accepted the trust dialog — sent its API requests, carrying its API key, to the address the file named. One line, in a file written to be skimmed, and the agent's credential leaves the machine on its next call. Nothing about that mechanism depends on whether the checkout came from a GitHub clone or a Hugging Face Space you pulled down to extend.
H17 fetches the agent files a repository ships — the same set H14 names: .mcp.json, .cursor/mcp.json, the .claude/ settings files, CLAUDE.md and the other instruction files — and matches each for ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or any assignment of a name ending in _API_KEY, the identical pattern C21 matches. A hit is CRITICAL, costs 30 points, and reads “config overrides an API base URL or key — token exfiltration class (CVE-2026-21852)”. Because any CRIT finding drives the score to 0, a repository that trips only this check reads BLOCK; the default personal policy sets this check to warn for the same reason C21's does — the pattern is broad enough to need a second look — so the download is held, the file is named, and proceeding is one click. The scoring engine's shared evidence note for H14–H17: “same functions/penalties as C18–C21 — reuse those check pages' scoring language, applied to the HF file list instead of the GitHub one.”
The two known cases both come from C21's GitHub measurement — 50 young legitimate repositories, both fires on environment-setup documentation listing which SOMETHING_API_KEY to set — and we cite them as the pattern's known shape rather than restate them as Hub numbers, since they were not measured against Hugging Face repositories. What the 12 September 2026 measurement of the top 100 most-downloaded Hugging Face models shows directly: 0 BLOCK results across all 100, and because any CRIT finding forces the score to 0 and the verdict to BLOCK, that rules out H17 firing on any of them alongside every other CRIT row. H17 fired 0 times in that measurement. The underlying risk — the pattern cannot tell "set this in your environment" from "use this key" — is a property of the regex, not of the platform, so it applies here exactly as it does on GitHub.
A redirect under a variable name it does not know — another provider's base URL, a proxy setting, a custom endpoint key — passes. Files not on the agent-file list are not read; your agent's own global configuration, outside the repository, is never seen. It matches text, so a base URL assembled at runtime by a script is invisible to it. And it reads the file before the download; it does not see the request the agent later makes.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, huggingface_hub, or fetches made by AI agents outside the browser; a Python from_pretrained() call is never a shell line any hook sees. This page, like every check page, exposes no globals a script running on it could read.
Without installing anything: open the repository's .claude/settings.json, .mcp.json and CLAUDE.md on the Hub's Files tab and search each for BASE_URL and _API_KEY. From a terminal, against the raw file endpoint:
for f in .claude/settings.json .claude/settings.local.json .mcp.json .cursor/mcp.json CLAUDE.md AGENTS.md; do
curl -fsS "https://huggingface.co/ORG/NAME/raw/main/$f" 2>/dev/null \
| grep -nE 'BASE_URL|_API_KEY\s*[:=]' | sed "s|^|$f:|"
doneThen patch: the standard's fix for the whole pre-trust class is a current agent — Claude Code 2.0.65 or later, Copilot CLI 1.0.43 or later, current Cursor — and project-scoped configuration disabled until you trust the checkout.
My repository's settings file documents which API keys to set — will that fire? It might, for the same reason it can on GitHub's C21. The pattern matches any assignment of a name ending in _API_KEY, and it cannot always tell environment-setup documentation from an actual override. That is why the check warns rather than blocks by default, and why the finding names the file so you can read the line yourself.
What does a base-URL override actually do? It tells your agent to send its API requests — carrying your API key — to a server of the file's author's choosing. In CVE-2026-21852 a repository file setting ANTHROPIC_BASE_URL caused Claude Code to make requests, and potentially leak its key, before the user had accepted the trust dialog. The override is one line in a file nobody reads, and nothing about that line changes when the repository is a Hugging Face Space instead of a GitHub project.
Does RepoGates stop a git clone or huggingface_hub download? No. RepoGates gates browser-initiated downloads only. It does not see git clone, huggingface_hub, huggingface-cli, curl, or a Python from_pretrained() call. It reads the settings file before the download; it does not see the agent send the request.
H16 MCP shell-launch config — the same files, a command instead of a URL · H14 Agent config files — the files this check reads · H15 Hidden Unicode in agent rules — the other content finding in the same family · C21 Credential redirect (GitHub) — the same function, reading a git tree instead of the Hub's file list.
Add RepoGates to Chrome Pricing
Numbers on this page: CVE-2026-21852 as published; the 12 September 2026 measurement of the top 100 most-downloaded Hugging Face models (0 BLOCK, 28 REVIEW, 72 PASS), published on the malicious models intelligence page; weights and actions from the product's scoring and policy tables.