Check H18 · agent-provenance family · severity CRITICAL · extension only · one of the 18 Hugging Face checks
Maps to OWASP LLM03 OWASP LLM09 ATLAS AML.T0060 ATLAS AML.T0100 An agent surfaced this to you. ATLAS names both halves: an entity registered to match a name a model invented, and content crafted to bait an agent into acting on it.
The question this check asks: did an AI chat assistant or an MCP/tool directory lead you to this model, dataset or Space? Not whether the repository mentions AI — whether the route you took to it went through one. On huggingface.co the extension answers it from both of its signals since extension 0.8.4 (on the Chrome Web Store as of 30 September 2026), and from one of them in 0.8.3; everywhere outside the browser the answer is not checked.
H18 is named as the Hub's counterpart to GitHub's C22 AI-agent provenance, which is live: an assistant's recommendation reads as vetting to the person receiving it, and it is not vetting. Island's July 2026 AgentBaiting research showed the mechanism working on GitHub — over 800 FakeGit repositories posing as AI Skills or MCP servers, more than 600 seeded registry listings, and chat assistants recommending the fakes as confidently as anything legitimate. Nothing about that mechanism is specific to GitHub; an assistant asked for a model or a dataset can recommend a Hugging Face repository exactly as readily as it can recommend a GitHub one, and the Hub already hosts confirmed attacker-controlled repositories for it to find — the JFrog campaign and ReversingLabs' nullifAI, both catalogued on the malicious models intelligence page. A model an assistant recommends deserves exactly the same scrutiny as a link a stranger emails you.
This is also the one check that cannot run anywhere but the browser. The signal exists only at navigation time: which tab you came from, which tab opened this one. A backend never sees it, an API crawl cannot reconstruct it after the fact, and a scan of the repository's files is looking at the wrong thing. On huggingface.co the extension's board has been on model, dataset and Space pages since 0.8.3, and since extension 0.8.4 it reads both signals there, as on github.com.
On github.com the extension reads two signals: the tab you came from (tab lineage — the previous page in the same tab, or the tab that opened this one) and the page's referrer. On huggingface.co, extension 0.8.3 read one: the referrer the model, dataset or Space page reports. Its tab lineage recognised github.com pages only, and assistants commonly open links with the referrer stripped, so in 0.8.3 a recommendation that arrived that way was not seen on huggingface.co. Since extension 0.8.4 (on the Chrome Web Store as of 30 September 2026), tab lineage reaches huggingface.co too, and records under the same key the board and the download gate use: hf/models/<org>/<name>, hf/datasets/… or hf/spaces/…. The download gate takes a weights file's key from the link you clicked, …/resolve/<revision>/<file>, not from the CDN host the bytes arrive from. Outside the browser — the API, the MCP server, the plugin — H18 is a no-input skip: listed on the verdict as not checked, and never counted as a pass.
When it runs, it scores as C22 does, from the same table. The extension holds permission for an enumerated list of eleven hosts: six AI chats (claude.ai, chatgpt.com, chat.openai.com, gemini.google.com, copilot.microsoft.com, perplexity.ai) and five MCP directories (lobehub.com, glama.ai, mcp.so, mcpmarket.com, smithery.ai). Arriving at a model, dataset or Space from one of them — in the same tab or in a tab it opened (on huggingface.co since 0.8.4), or by referrer — records that provenance for 30 minutes. Tab lineage is the primary signal because those surfaces commonly emit rel="noreferrer" links; the referrer is supplementary. The board's score request and, if a download of that repository starts inside the window, the verdict request carry prov=agent and the surface's hostname only. On a repository that would otherwise be REVIEW, H18 is added as CRITICAL, costs 25 points and escalates the verdict to BLOCK — the default personal policy is warn_to_block; strict profiles use always_block. On a repository that passes, it is recorded as an INFO line costing 5 points and the verdict stays PASS. The evidence note in the scoring table, which C22, G22 and H18 share:
“C22: AgentBaiting channel; INFO row (recorded on PASS) costs a little, CRIT (escalated) a lot”
Every legitimate model, dataset or Space an assistant recommends carries the provenance note, and assistants recommend legitimate ones far more often than not. That is the reason H18 never blocks on its own: an established model you reached from ChatGPT stays PASS with a five-point information line, and the board tells you why the line is there. The escalation only bites when the repository already has a problem — weights shipped only as pickles (H8), a Hub scan that has not finished (H13) — and then the fact that an assistant sent you is the thing that tips a warning into a block.
A second case: you asked an assistant, then typed the repository name into a new tab by hand. There is no lineage and no referrer, so H18 does not fire. The check sees navigation, not intent.
On huggingface.co there was a third until extension 0.8.4: in 0.8.3 an assistant link that stripped the referrer left no signal on huggingface.co, so a PASS there said nothing about how you arrived. Since 0.8.4, tab lineage sees that link when it opens in the assistant's own tab or in a tab the assistant opened, as on github.com; an install not yet updated from 0.8.3 is still in the old position. Outside the browser an H18 row reads not checked, and a PASS beside it is a PASS on the other 17 and nothing more.
It sees browser navigations from an enumerated list. A surface not on the list is invisible until an extension update adds it — the remote configuration can switch hosts within the list on and off, but cannot add one, by the store's own remote-code rule. It does not see what you asked, what the assistant said, or the page you were on; it sends a hostname. It does not read the repository: a recommended model that trips nothing else is not blocked, because a recommendation is not evidence.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, huggingface_hub, or fetches made by AI agents outside the browser; a Python from_pretrained() call is never a shell line any hook sees. H18 sees a person who followed a recommendation into a browser tab, never an agent that fetches the weights itself. This page, like every check page, exposes no globals a script running on it could read.
Outside the browser the check has nothing to see, so the manual version is the one that always applies: treat any model, dataset or Space an assistant hands you as an unverified search result, not a referral. Open the repository's Files tab and its model card and read them as if a stranger had linked you the page. For a user account (organisations expose no creation date), the Hub's own API gives you the same signal H2 reads automatically:
curl -s https://huggingface.co/api/models/ORG/NAME \
| jq '{author: .author, downloads: .downloads, likes: .likes, createdAt: .createdAt}'
curl -s https://huggingface.co/api/users/AUTHOR/overview | jq .Then verify the publisher out of band — a project website, a package on a registry you already trust, a named person with a history — the same discipline the vetting standard recommends for any agent-discovered repository, on any platform.
Does RepoGates tell me whether an AI assistant recommended this Hugging Face model? In the browser, when it can see it. Since extension 0.8.4 (on the Chrome Web Store as of 30 September 2026) the board on a model, dataset or Space page reads the tab you came from as well as the page's referrer — the tab is the signal that survives an assistant link with the referrer stripped; 0.8.3 read the referrer only. Outside the browser — the API, the MCP server, the plugin — H18 is listed as not checked, and never counted as a pass.
Does an AI recommendation mean the model is malicious? No. Assistants recommend legitimate models all day. That is why H18 changes nothing on a repository that passes every other check: it is recorded as an information line costing 5 points. It only escalates — a warning becomes a block, 25 points — when the repository already has a problem. Provenance is suspicion, not evidence.
Does RepoGates see what I asked the assistant? No. The extension notes, in the browser, which tab you came from, and sends only the hostname of the surface — claude.ai, for example — with the score and verdict requests. Never the page URL, never the conversation, never the prompt.
Does RepoGates stop an AI agent from downloading this model itself? No. RepoGates gates browser-initiated downloads only. It does not see git clone, huggingface_hub, curl, or a Python from_pretrained() call — none of those is a browser download, and a from_pretrained() call is never a shell line any hook watches either. H18 only ever sees a human following a recommendation into a browser tab.
H2 Author account age — the provenance signal a person can check by hand, wherever H18 cannot see · H14 Agent config files — instruction files an agent would read before you do, once you follow a recommendation this far · H16 MCP shell-launch config — what a recommended repository's own agent configuration might do next · C22 AI-agent provenance (GitHub) — the same check on github.com, where it reads both signals · G22 AI-agent provenance (GitLab) — the same check on gitlab.com, on the same two versions.
Add RepoGates to Chrome Pricing
Numbers on this page: Island, AgentBaiting, 20 July 2026 (800+ Skill and MCP imposters, 600+ registry listings, assistant behaviour, as measured on GitHub); JFrog campaign (~100 models, February 2024) and ReversingLabs' nullifAI (2 models, February 2025), both as published on the malicious models intelligence page. The mechanism is described in the agents guide; weights from the product's scoring table. H18's status — the referrer on huggingface.co since extension 0.8.3, tab lineage since extension 0.8.4 — is a statement of the product's state, not a measurement.