Load/Mine used executable model configuration to place miners on AI workers

Pluto investigated malicious model repositories whose configuration pointed to attacker-controlled Python code through automatic model loading. One flagship repository had an implausibly tiny weights file, reinforcing that the executable loading path rather than meaningful model inference was central to the payload. The report describes thirty-one campaign repositories plus linked accounts and downloads, but a download counter cannot be read as a count of executed malware or compromised users. The mining wallet and observed worker telemetry are narrower evidence of actual activity.

A later stage targeted GPUStack deployments through a privileged container and attempted to reach host disks via LVM and mounting operations. That step has an explicit precondition: a container with access to host devices and privileges. It is not proof of breaking out of an ordinary unprivileged container. The checkpoint separately records later removal claims, but takedown data from another publisher has not been independently reconciled here. Removing a repository would not itself erase malware persistence from previously affected hosts.