2026-05-07 · 2026-Q2
Malicious Hugging Face "Open-OSS/privacy-filter" Fake OpenAI Model
Where did this code come from?
- Fixable
- Architectural
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Attacker
Target
Hugging Face repository `Open-OSS/privacy-filter`, typosquatting OpenAI's Privacy Filter release, plus six sibling repositories under the same account
Impact
The repo reached #1 trending with roughly 244,000 downloads and 667 likes within about 18 hours; its `loader.py` fetched commands over disabled-SSL connections and ran a hidden PowerShell chain that deployed a Rust-based infostealer targeting browser credentials, crypto wallets, Discord tokens, and SSH keys on Windows hosts
Root cause
A malicious model repository masquerading as a vendor release, with engagement inflated by inauthentic accounts; found and reported by HiddenLayer
Sources
Catalog
Cite this: AgentProv incident record: Malicious Hugging Face "Open-OSS/privacy-filter" Fake OpenAI Model (2026-05-07). https://agentprov.com/incidents/2026-05-07-malicious-hugging-face-open-oss-privacy-filter-fake-openai-model
Related
- Also L4 · 2026-10-12Fake "Apex Accelerator" npm Packages Reroute a Coding Agent's LLM Traffic and Register an Attacker MCP ServerL4Code / Package
- Also L4 · 2026-07-24165 Malicious npm and PyPI Packages in One Week, Several Targeting AI ToolingL4Code / Package
- Also L4 · 2026-07-21"AgentBaiting": 7,600 Fake GitHub Repositories, 800+ Posing as AI Skills and MCP Servers, Deliver SmartLoaderL4Code / Package