Two of the most trusted distribution channels in AI—Hugging Face and ClawHub—have been systematically weaponized by threat actors. Over 100 models on Hugging Face now carry payloads that execute arbitrary code on load, while 575 malicious skills on ClawHub give attackers persistent access to enterprise environments. These aren't edge cases. They represent a structural shift in how malware reaches production systems.

The attack vector is deceptively simple. On Hugging Face, adversaries embed malicious Python code inside pickle serialization streams, then compress the files with 7z instead of the standard ZIP format. Standard scanners ignore the format mismatch. When a developer loads the model, the code executes immediately—reverse shells, credential exfiltration, and secondary payloads follow. Protect AI scanned over 4 million models and flagged roughly 352,000 unsafe or suspicious issues across 51,700 of them. Hugging Face later partnered with JFrog and Wiz to improve detection, cutting false positives by 96%, but the open upload model guarantees a steady stream of new threats.

ClawHub, the skill registry for the OpenClaw AI agent framework, presents a different but equally dangerous architecture. Skills here run with the agent's full context—access to databases, APIs, and network endpoints. Acronis Research found 575 malicious skills across just 13 developer accounts, two of which dominated: hightower6eu (334 skills) and sakaen736jih (199). Skills masquerade as useful tools—a YouTube transcript summarizer, for instance—but install hidden dependencies like "OpenClawDriver." Trojanized binaries, packed with VMProtect, deliver the Atomic macOS Stealer. The agent itself functions as designed; the exploit lives in the trust relationship between user and platform.

Indirect prompt injection is the mechanism. Attackers hide instructions inside documentation files, base64-encoded strings, or password-protected archives fetched from GitHub or MediaFire. The agent reads these during normal operation and executes download commands without user visibility. On Hugging Face, the same actors host repositories that serve as initial infection stages, dropping PowerShell scripts routed through Cloudflare Workers or batch files with XOR-obfuscated blobs. Campaigns target Windows, macOS, Linux, and Android. One, tracked as ITHKRPAW, focused on financial organizations in Vietnam.

Earlier audits confirm the pattern. Koi Security examined 2,857 ClawHub skills and found 341 malicious, most tied to the ClawHavoc campaign. Snyk's ToxicSkills research showed 36% of AI agent skills carried security flaws; 20% qualified as outright malicious. One author contributed 30 skills designed to hijack agents for cryptocurrency mining. The LiteLLM package on PyPI was compromised in March 2026, exposing roughly 500,000 API keys for Meta, OpenAI, and Anthropic. Bitwarden CLI on npm stayed hijacked for 90 minutes, harvesting keys from Claude Code, Cursor, and Aider. PyTorch Lightning lasted 42 minutes.

Platforms have responded—Hugging Face enhanced PickleScan, ClawHub introduced limited vetting, package registries added two-factor authentication. None of it has stopped the flood. The asymmetry is stark: billions go into model training and infrastructure; far less into securing the repositories where those models live. Researchers from Unit 42 described model namespace reuse, where deleted accounts on Hugging Face are re-registered with poisoned versions of popular models, leading to remote code execution inside Azure AI Foundry and Google Vertex AI. Checkmarx Zero identified model confusion attacks, a variation on dependency confusion aimed at AI registries.

Enterprise security teams face a hard trade-off. Treat every AI artifact as untrusted input. Verify sources before integration. Scan models with multiple tools that go beyond surface signatures. Monitor agent behavior for unexpected actions. Limit permissions. These steps slow development, but they match the threat level. The AI supply chain is not abstract. It's real repositories, real shared files, and real automated workflows that attackers have already learned to weaponize. Trust, once the foundation of open collaboration, has become the weakest link. Until platforms, developers, and enterprises close the gaps, the next campaign will simply build on this one—larger, stealthier, and more damaging.

Source: Webpronews