New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks

Researchers found that Hugging Face's Safetensors conversion service can be abused by submitting malicious PyTorch binaries to hijack the conversion bot (SFConvertbot), exfiltrate tokens, and push attacker-controlled pull requests that could compromise or implant backdoors in hosted models—creating a significant supply-chain risk for ML models; the report also calls out the LeftoverLocals GPU memory-leak (CVE-2023-4969) which can expose LLM inputs, outputs, and weights from local memory.