Incident Overview
The flaw, termed Model Namespace Reuse, allows malicious actors to re-register deleted or renamed Hugging Face organizations and publish malicious models under the same author/model path. This exploit targets cloud platforms and open-source projects that rely on model names for retrieval, enabling supply chain compromise and remote code execution (RCE).
The attack leverages Hugging Face’s two-part naming convention—Author/ModelName—where the Author component serves as a unique identifier. When an organization or author deletes their account, the namespace becomes available for re-registration, allowing attackers to recreate the original path and deploy compromised models. Cloud providers like Microsoft’s Azure AI Foundry and Google’s Vertex AI, along with thousands of open-source projects, were found to be vulnerable to this technique.
Google and Microsoft responded by removing affected model references from their platforms, while Hugging Face implemented stricter controls to reserve deleted namespaces more aggressively. Despite these mitigations, the core issue persists for any organization that pulls models by name without additional verification.
The vulnerability was highlighted through two fictional but technically accurate scenarios. The first involved a deleted organization (DentalAI) whose namespace was re-registered by an attacker to distribute a malicious version of a previously trusted model (toothfAIry). The second scenario involved an organization (DentalAI) transferring its models to a new owner (Dentalligence) before deleting its original account. In both cases, the attacker exploited the lack of namespace enforcement to hijack model references, leading to unintended deployment of malicious code.
The attack surface extends beyond individual models. Hard-coded model names in open-source repositories and cloud-based pipelines create dependencies that assume namespace stability. When an attacker re-registers a deleted namespace, these pipelines continue to pull the malicious model without triggering alerts, as the name remains functionally identical to the original.
Supply chain compromise occurs when legitimate users unknowingly integrate malicious models into their workflows, while RCE risks arise if the compromised models contain executable code. This exploit underscores the dangers of trusting model names alone, particularly in environments where models are dynamically fetched without cryptographic verification or additional integrity checks.
Possible Root Cause
The root cause of Model Namespace Reuse lies in Hugging Face’s namespace management policy, specifically the reuse of deleted author names. When an organization or author deletes their account, Hugging Face does not permanently reserve the namespace. Instead, these identifiers return to a pool of available names, allowing any user to re-register them after a cooldown period. This design choice, intended to prevent namespace hoarding, inadvertently creates an attack vector for malicious actors.
When a model’s ownership is transferred to a new author, the original namespace remains accessible and redirects users to the new location. However, if the original author is deleted, the redirection breaks, and the namespace becomes vulnerable to re-registration. This inconsistency in handling deleted versus transferred namespaces creates a gap that attackers can exploit.
Additionally, the widespread practice of hard-coding model names in software development exacerbates the issue. Developers and organizations often reference models directly by their Author/ModelName paths in code, APIs, and cloud configurations. This reliance on static identifiers assumes that the namespace will remain stable and trustworthy, a assumption that Model Namespace Reuse directly undermines.
This absence of additional validation layers makes it easier for attackers to substitute malicious models without detection.
The technical flow of the attack involves several steps. First, the attacker identifies a deleted or renamed Hugging Face organization with a valuable namespace. Second, they re-register the namespace and upload a malicious model under the same Author/ModelName path. Third, they wait for cloud platforms or open-source projects to pull the model by name, unaware of the namespace change. Finally, the malicious model is deployed, potentially executing arbitrary code or altering system behavior.
Takeaways
The Model Namespace Reuse incident reveals fundamental weaknesses in the AI supply chain, particularly in how model identifiers are managed and trusted.
Cloud providers and open-source projects should avoid hard-coding model names in their pipelines. Hugging Face could mitigate future risks by enforcing permanent reservations for deleted namespaces or introducing a verification step for namespace re-registration.
Developers and security teams must audit their model dependencies for hard-coded references and implement runtime checks to detect unauthorized namespace changes. Organizations should also establish incident response protocols for AI supply chain attacks, including procedures for isolating affected systems and revoking access to malicious models.
While Hugging Face, Google, and Microsoft have taken steps to address the immediate risks, the broader AI ecosystem must adopt more rigorous security measures.
For organizations using Hugging Face or similar platforms, the key takeaway is that model names alone are insufficient for security. Additional layers of validation, such as model hashing, digital signatures, or vendor-provided integrity checks, are essential to prevent supply chain attacks. The Model Namespace Reuse exploit serves as a cautionary example of how seemingly minor design choices in AI infrastructure can have far-reaching security implications.
Finally, the incident highlights the importance of responsible disclosure and coordinated vulnerability management. Unit 42’s research demonstrates the value of proactive security assessments in identifying and mitigating risks before they are exploited. Organizations should prioritize security audits of their AI pipelines and engage with security researchers to stay ahead of emerging threats in the AI supply chain.