The fake OpenAI repository on Hugging Face shows how quickly attackers are adapting to the AI supply chain. By impersonating a legitimate OpenAI “Privacy Filter” project and reaching Hugging Face’s trending list, the malicious repository gained credibility before delivering an infostealer through a Python loader. That is the dangerous part: developers and researchers often trust model hubs the same way users trust app stores, which is charmingly optimistic and frequently expensive.

Users who downloaded from the fake Open-OSS/privacy-filter repository should treat the system as compromised. The reported payload targeted browser cookies, saved passwords, session tokens, Discord tokens, crypto wallets, SSH/FTP/VPN credentials, sensitive files, and screenshots, with stolen data exfiltrated to a command-and-control server. Affected users should reimage the system, rotate passwords and API keys from a clean machine, invalidate browser sessions, and replace any exposed crypto wallets or seed phrases. 

For organizations, this is a reminder that AI/ML repositories must be treated like executable software, not harmless research artifacts. Model cards, stars, likes, download counts, and trending status are not trust signals. Security teams should validate repository ownership, inspect loaders and install scripts, restrict execution of unreviewed model code, and monitor developer workstations for suspicious PowerShell, Python, and credential-access activity.

A malicious Hugging Face repository that reached the platform's trending list impersonated OpenAI's "Privacy Filter" project to deliver information-stealing malware to Windows users. [...]

Source: Fake OpenAI repository on Hugging Face pushes infostealer malware via Bleeping Computer — published 09 May 2026.