Fake AI models are now one of the easiest ways to get malware onto a computer. In May 2026, a download page on Hugging Face pretended to be an official OpenAI release. It climbed to the number one trending spot. Then it quietly installed software that stole passwords and crypto wallets.
This matters even if you have never downloaded an AI model yourself. More people run AI on their own machines every month. And the files they download are not harmless data. They can run code.
What Is an AI Model Download, Anyway?
An AI model is the trained “brain” of an AI tool. It is a file, or a set of files, holding everything the AI learned during training.
When you use ChatGPT in a browser, the model sits on a company server. But you can also download a model and run it on your own laptop. People do this for privacy, for offline use, or because it is free.
The most popular place to get these files is Hugging Face, a site that hosts more than a million public AI models. Think of it as an app store for AI models — except almost anyone can upload to it.
The key point: an AI model file is not like a photo or a PDF. Some model formats can carry live computer instructions that run the moment you load the file.
Can a Fake AI Model Really Steal Your Passwords?
Yes. In May 2026, security researchers at HiddenLayer found a Hugging Face page called Open-OSS/privacy-filter. It copied the name and description of a real OpenAI project almost word for word. It reached number one on the site’s trending list and recorded roughly 244,000 downloads before Hugging Face removed it.
The page held no working AI model at all. It held a small file that fetched and ran a password-stealing program on Windows computers.
According to BleepingComputer’s report on the incident, the stolen data included:
- Saved passwords and login cookies from Chrome, Edge and Firefox
- Session tokens, which let an attacker log in as you without your password
- Cryptocurrency wallets and their recovery phrases
- Discord tokens, SSH keys, and FTP and VPN settings
- Screenshots of every monitor
The program also added itself to Microsoft Defender’s exclusion list, so the built-in antivirus would ignore it.
One note on the numbers. Researchers believe the 244,000 downloads and the 667 likes were partly faked by bots, to make the page look trusted. Popularity on these sites is easy to buy.
Why Can a Model File Run Code at All?
This is the part most people find surprising. It comes down to the file format — how the data is packed inside the file.
Many older AI models are saved using a Python format called pickle. Pickle was built to save and reload Python objects, and it does that by storing instructions. So loading a pickle file means running those instructions. If someone hides a bad instruction in there, your computer follows it.
The newer format, safetensors, was created to fix exactly this. A safetensors file holds only raw numbers — the weights of the model — and no instructions at all. There is nothing to execute. It also loads faster, which is a big reason it spread so quickly.
The one-line version: a pickle file is a program pretending to be data, while a safetensors file is just data.
The September 2026 Hugging Face Flaw
There is a second, quieter problem from this month. On 1 September 2026, the CERT Coordination Center published vulnerability note VU#456290, tracked as CVE-2026-80047.
The Hugging Face Transformers library — the software most people use to load these models — has a function called load_custom_generate(). Normally the library asks your permission before it downloads code from a model page. This function asked afterwards.
So even if you said no, the file was already saved on your computer, in a hidden folder at ~/.cache/huggingface/modules. The library still refused to run it that time. But the file stayed there. If the same name is loaded later under trusted settings, the leftover file could run.
It affects Transformers versions 4.49.0 through 5.8.1, and it scores 7.8 out of 10 on the standard severity scale. When CERT published the note, no official fix was available yet.
If you use Transformers, CERT’s advice is simple. Do not call load_custom_generate() on model pages you do not trust, and check that cache folder for files you did not expect.
How Do You Check If an AI Model Is Safe to Download?
You cannot open a model file and read it like a document. But a few habits cut the risk sharply. Prefer safetensors files, download only from accounts you can verify, and treat a trending badge as marketing rather than proof.
- Check the file format. Look for
.safetensors. Be careful with.bin,.pt,.pth,.pkland.ckpt— these are usually pickle-based. - Check the publisher, not the model name. Real releases come from verified organisation accounts such as openai, meta-llama, google, mistralai or Qwen. The fake OpenAI page used the account name “Open-OSS”. A few characters of difference is all it takes.
- Ignore download counts and likes. Both can be inflated by bots, as they were in the May incident.
- Look at the account’s age and history. A brand new account with one wildly popular model is a warning sign.
- Use a tool that pulls models for you. Ollama and LM Studio check file fingerprints before saving, which removes a lot of the guesswork.
- Scan before loading. Free tools such as picklescan and ModelScan look for dangerous instructions inside model files.
One honest warning about that last point. Scanners help, but they are not proof. JFrog disclosed three ways to slip past picklescan in December 2025, and a July 2026 research preprint called ShadowPickle showed attacks that got past ten different scanners most of the time. A clean scan means “nothing obvious found”, not “safe”.
Does This Affect Normal ChatGPT and Gemini Users?
Not directly. If you only use AI through a website or an official app from your phone’s app store, you are not downloading model files, so this particular risk does not reach you.
But the same trick shows up elsewhere. Fake AI apps, fake browser extensions and fake “free ChatGPT” installers all work the same way: copy a trusted name, buy some fake popularity, wait for downloads. We covered a close cousin of this in our piece on how hackers can use your AI account without your password.
The wider lesson is about the AI supply chain — the long line of free, shared parts that almost every AI product is built from. When that line gets poisoned, the damage spreads far past one download. The same worry sits behind what happens when AI agents talk to each other with little human checking in between.
What to Do If You Already Downloaded Something Suspicious
If you think you loaded a model from an account you cannot verify, assume that passwords saved in your browser have been seen by someone else.
- Disconnect the computer from the internet.
- Run a full antivirus scan, ideally started from a different, clean device.
- Change the passwords for your email, bank and crypto accounts — from another device, not the affected one.
- Sign out of all sessions everywhere, because stolen session tokens keep working even after a password change.
- Turn on two-factor authentication anywhere it is missing.
- Move any cryptocurrency to a new wallet with a new recovery phrase.
Changing the password alone is not enough. Session tokens are the reason. They are the part attackers value most, because they skip the login screen completely.
Frequently Asked Questions
Is Hugging Face safe to use?
Hugging Face is a legitimate, widely used platform, and it scans uploads and removes bad pages when they are reported. The risk comes from individual uploads, not from the site itself. Stick to verified organisation accounts and safetensors files.
Which AI model file formats are dangerous?
Pickle-based formats carry the risk: .bin, .pt, .pth, .pkl and .ckpt. The safetensors format was designed to hold only numbers, so it cannot run code. GGUF files, used by many local chat apps, are safer, but bugs have been found in the software that reads them.
Can antivirus software catch a malicious AI model?
Sometimes, but do not rely on it. The May 2026 infostealer added itself to Microsoft Defender’s exclusion list so Defender would skip it. Checking the source before you download is a stronger defence than scanning afterwards.
Do I need to update Hugging Face Transformers because of CVE-2026-80047?
Update to the newest version and check the project’s release notes for this CVE. Until a fix is confirmed, avoid calling load_custom_generate() on model pages you do not trust, and delete unexpected files from the ~/.cache/huggingface/modules folder.
How did a fake page reach number one on a trending list?
By copying a real project’s name and description, then inflating downloads and likes with automated accounts. Researchers who studied the page concluded the 244,000 downloads and 667 likes were likely boosted artificially.
