# HF Remote-Code Model Init Spawns Executable Payload

- **Severity:** High
- **Signature ID:** `3f9c1d84-6b2e-4a57-9d31-c8e05a7b42f6`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0011 (User Execution)
- **OWASP:** LLM03 (Supply Chain), LLM04 (Data and Model Poisoning)

## Summary

Some Hugging Face model repositories can ship a config.json that re-enables 'remote code' execution even when a user thinks they've disabled it. When the model is loaded, transformers downloads and imports the attacker's Python file, and that file can run arbitrary commands the moment it's imported.

## How the attack works

An attacker publishes a model repository whose config.json overrides trust settings to force remote code execution during model initialization. When a victim loads the model, the transformers library writes the attacker's Python module into its local module cache and imports it. That import runs attacker code as a side effect, not because the model was explicitly invoked. The imported module then spawns a separate process (e.g. a shell command or script) to carry out the actual payload. This rule reconstructs that sequence indirectly: it watches for reads of the untrusted config and the cached remote-code file, then looks for a child process spawned by that same session shortly afterward.

## Why it matters

An organization that loads an untrusted or compromised model gets arbitrary code execution on the machine doing the loading — potentially a developer workstation, CI runner, or inference server — with no explicit 'run this model' consent step beyond the initial load.

## What you can do

- Never load models with trust_remote_code=True unless you have reviewed the actual Python source in that repository, not just its listed description.
- Pin model repositories to specific commit hashes and re-review the code on every update, since the config and remote code can change after initial vetting.
- Load untrusted models in an isolated, network-restricted sandbox or container with no access to secrets or production systems.
- Review any process spawned within minutes of a model load in your logs, especially shell commands, compilers, or network tools invoked by the same session.

## Known benign look-alikes

- Teams that deliberately load remote-code models (trust_remote_code=True by policy) whose custom modeling code legitimately shells out at import time — building CUDA/Triton kernels, running chmod +x on a bundled binary, or invoking python -c for an extension autobuild (flash-attn style).
- Jupyter/Colab kernels where one cell imports a remote-code model and a later cell in the same kernel runs !pip / !curl / !git within the 5-minute window; same process lineage, unrelated intent.
- CI/CD runners that download a remote-code model and then execute unrelated shell steps from the same runner shell inside the window.
- Vendor SDK wrappers that spawn ssh/scp to stage model weights to a distributed-training node immediately after the first import.

## References

- https://attack.mitre.org/techniques/T1059/006/
- https://attack.mitre.org/techniques/T1195/001/
- https://huggingface.co/docs/transformers/en/custom_models

---
Source: https://www.netzilo.com/threats/hf-remote-code-init-exec