Malicious Models on Hugging Face

What this is. Two research teams have separately published malicious models hosted on Hugging Face: JFrog found roughly 100 in February 2024, and ReversingLabs' "nullifAI" found two in February 2025 that used a corrupted pickle stream to slip past the Hub's own scanner. This page states what our 18-check roster (H1–H18) catches against the named exemplars from both reports, and its false-positive rate on the 100 most-downloaded models on the Hub. Neither number is a guarantee — see "What this doesn't mean" below.

The two campaigns

JFrog, February 2024. Roughly 100 models whose pickle files ran attacker code on load — some opened a reverse shell, others planted a backdoor. JFrog never published the full list, only named exemplars, so the measurable set is those exemplars, not the hundred.
ReversingLabs "nullifAI", February 2025. Two models using a pickle stream deliberately corrupted after the malicious opcode, so Picklescan errored out before it reached the payload rather than flagging it. Both carried a reverse shell to the same hardcoded IP. Hugging Face removed both within 24 hours of disclosure.

What the roster catches, alone

Run without the campaign blocklist below — the roster's own signals only (H1–H18 against the Hub's live API, 12 September 2026):

Repository	Source	Verdict	Why
star23/baller13	ReversingLabs, same payload family	BLOCK	H6 (Hub malware scan hit) + H7 (Hub pickle-import scan hit)
mcpotato/42-eicar-street	the Hub's own EICAR canary	BLOCK	H6 + H7 + H9 (custom code on load)
glockr1/ballr7	nullifAI	REVIEW	Hugging Face already disabled the repository; H5 (access flags) + H13 (Hub scan never completed)
who-r-u0000/0000…0000	nullifAI	REVIEW	disabled by Hugging Face; H5 + H13
baller423/goober2	JFrog exemplar	not assessable	the repository is gone — a 404 from the Hub's own API

Read plainly: the two still-live, still-scannable repositories both hit the Hub's own malware and pickle scans and BLOCK on that alone. The two nullifAI models are gone in the sense that matters — Hugging Face disabled them — so the roster correctly reports REVIEW, not clearance, on what H13 flags as a scan that never finished. The JFrog exemplar no longer resolves at all. None of the five would pass silently.

What actually blocks these, in the product

All five repositories above, and the owner accounts behind them, are also named entries in RepoGates' campaign blocklist (confidence: confirmed, platform: hf) — the layer that runs ahead of the roster and an organisation's own allowlist. That is what turns the two REVIEW rows and the one not-assessable row into a hard BLOCK in a real verdict, the same way it would for any listed GitHub campaign. The roster table above is what the checks alone would have found without that list — it is the honest baseline, not the product's actual behaviour on these five.

False positives on the top 100

Run against the 100 most-downloaded models on the Hub (12 September 2026): 0 BLOCK, 28 REVIEW, 72 PASS. H8 (pickle weights present with no safetensors alternative) fired most often, 14 times — a warning, not a fault, since plenty of legitimate models still ship pickle-only. H7 (Hub pickle-import scan) fired 4 times, all at REVIEW.

One of those four is Bingsu/adetailer, a Stable-Diffusion detection add-on with 9.7M downloads. Earlier, H7 treated any Hub-flagged import as CRIT and this model would have BLOCKED — the Hub's own scanner flags __builtin__.getattr and .set, which is Picklescan's import denylist, not evidence of a payload, and every ultralytics YOLO checkpoint carries it for ordinary config access. H7 now blocks only when a flagged import is code-execution or I/O on its face — os, subprocess, socket, exec, eval and the like — and warns otherwise. That is the one false BLOCK this measurement found on the top 100, and it is fixed.

What this doesn't mean

The Hub's own malware and pickle scans (H6, H7) are best-effort by Hugging Face's own disclaimer, and nullifAI is the proof: a corrupted pickle stream made Picklescan error out before it ever reached the payload. H8, H9, H13 and this blocklist exist because the Hub's silence is not clearance. A model that scores PASS today was checked today, against what the Hub's scanner and this roster can see today — never a claim that the weights are safe to run unsupervised, and never a claim about a version uploaded tomorrow.