Pluto Security details how a trust_remote_code download turns into malware
Comments on “Pluto Security details how a trust_remote_code download turns into malware”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Pluto Security analyzed a cryptominer campaign on the Hugging Face Hub that abuses trust_remote_code=True rather than an exploit. A config.json auto_map entry points to a Python file that Transformers imports and executes at load time. The payload installs a watchdog, shell-profile hooks and reverse shells, then runs a UPX-packed miner from memory. Hugging Face's scanners reportedly passed the file, though that result comes from Pluto's own checks. Review the code behind auto_map and pin revisions before enabling the flag.
Why it ranked
No. 2 of 127 with a score of 0.76. The panel rated it highest on technical depth (0.92) and reader interest (0.86), lowest on audience breadth (0.66).
- AI judgeJudge 2claude-haiku-5-5
- Detailed technical security analysis of a real supply-chain campaign via Hugging Face trust_remote_code; highly relevant to builders, well-substantiated, though overlapping with many recent PHP2Shell/AI security stories.
- AI judgeJudge 3gpt-5.6-luna
- Detailed, evidence-rich malware analysis shows how trust_remote_code enables execution, persistence, reverse shells, evasion and cryptomining, with concrete artifacts and mitigations. It is highly actionable for ML infrastructure and security practitioners.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.76total under rubric v2.3
- Significance0.67
- Reader interest0.86
- Audience breadth0.66
- Practical relevance0.86
- Substantiated0.82
- Technical depth0.92
- New information0.80
- Counts against: Promotional0.04
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.69 | 0.55 | 0.78 | 0.67 | 0.23 | +0.24 | +0.161 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.83 | 0.80 | 0.94 | 0.86 | 0.14 | +0.26 | +0.223 |
| Audience breadthHow many people who build technology does it concern? | 0.64 | 0.67 | 0.66 | 0.66 | 0.03 | +0.13 | +0.085 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.88 | 0.85 | 0.84 | 0.86 | 0.04 | +0.22 | +0.188 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.77 | 0.80 | 0.90 | 0.82 | 0.13 | +0.05 | +0.041 |
| Technical depthHow technically substantive is it? | 0.99 | 0.85 | 0.93 | 0.92 | 0.14 | +0.05 | +0.046 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.86 | 0.60 | 0.93 | 0.80 | 0.33 | +0.05 | +0.040 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.05 | 0.03 | 0.04 | 0.02 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.13 | 0.20 | 0.08 | 0.14 | 0.12 | −0.11 | −0.015 |
| Sum of contributions | +0.762 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.762 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-30/2/"><img src="https://rubric.hrih.si/badge/2026-10-30/2.svg" alt="Ranked #2 on Rubric, 30 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 3 matches source · 3 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkCausal conclusion
CVE-2024-34359 involved a chat template stored in a GGUF file executing code through llama-cpp-python.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “a chat template stored in a GGUF file executed code through llama-cpp-python”
The source says No passage could be compared.
Source cited by the article: osv.dev/vulnerability/CVE-2024-34359
Couldn’t checkVersion
CVE-2026-22807 showed vLLM versions 0.10.1 up to 0.14.0 loading auto_map modules without checking the trust_remote_code setting, and version 0.14.0 fixed it.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “showed vLLM (0.10.1 up to 0.14.0) loading auto_map modules without checking the trust_remote_code setting”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/CVE-2026-22807
Matches sourceCausal conclusion
In Transformers' get_class_in_module(), exec_module() executes the file's top-level code before getattr() returns the requested class.
The cited source says the same thing.
The article says “exec_module() executes the file’s top-level code before getattr() returns the requested class”
The source says “module_spec.loader.exec_module(module) module.__transformers_module_hash__ = module_hash return getattr(module, class_name”
Source cited by the article: github.com/huggingface/transformers/blob/main/src/transformers/dynamic_module_utils.py
Matches sourceNumber
Hugging Face's documentation says every file smaller than 2 GB is run through the ClamAV antivirus scanner at each commit.
The cited source says the same thing.
The article says “every file smaller than 2 GB is run through the ClamAV antivirus scanner at each commit”
The source says “We run every file of your repositories that is smaller than 2 GB through a malware scanner”
Source cited by the article: huggingface.co/docs/hub/security-malware
Matches sourceQuote
Hugging Face's pickle documentation says the scanning is "not 100% foolproof" and that checking whether something is safe is the user's responsibility.
The cited source says the same thing.
The article says “not 100% foolproof” and that checking whether something is safe is the user’s responsibility”
The source says “Disclaimer: this is not 100% foolproof. It is your responsibility as a user to check if something is safe or not”
Source cited by the article: huggingface.co/docs/hub/security-pickle
No source givenGeneralization
In Pluto Security's checks, modeling_evil2.py in qwen2-tiny came back safe from every scanner that ran.
The article gives no link or citation for it.
The article says “modeling_evil2.py in qwen2-tiny came back safe from every scanner that ran”
The source says No source to compare with.
No source givenQuote
JFrog reported that modeling_evil2.py was not a machine-learning model.
The article gives no link or citation for it.
The article says “with JFrog reporting it was not a machine-learning model”
The source says No source to compare with.
No source givenNumber
The model.safetensors file in the attack repository is only 42 bytes and contains no tensors.
The article gives no link or citation for it.
The article says “The model.safetensors beside it is just 42 bytes and contains no tensors”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 30 Oct 2026, 05:47 UTC. It played no part in the ranking.