Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust

Palo Alto Networks Unit 42 describes a supply-chain vulnerability—"Model Namespace Reuse"—where abandoned or transferred Hugging Face Author/ModelName namespaces can be re-registered by attackers to replace trusted models, enabling malicious models to be deployed and resulting in remote code execution on platforms such as Google Vertex AI and Azure AI Foundry; the authors demonstrated reverse-shell execution, found thousands of affected open-source references, notified vendors (who have begun mitigations), and recommend version pinning, cloning models to trusted storage, and scanning model references.