The report
Pluto Security's October 29 investigation followed a campaign that distributed apparent model repositories through Hugging Face. In the examined packages, model configuration could resolve an auto_map entry to attacker-supplied Python, which runs when a loader permits remote model code. Some featured weight files were effectively decoys rather than useful checkpoints. The intrusion point is model loading, before the application evaluates the model's answers.
The investigation describes thirty-one malicious repositories across seven accounts and thirteen additional linked repositories. Collectively they recorded more than 32,000 downloads, but that is a repository-download count, not measured unique infections. Mining-wallet observations and instrumented workers provide stronger evidence that at least some payloads executed. The original Pluto investigation also describes a later GPUStack-targeting variant whose host-disk access depended on a privileged container or equivalent access to host devices. It did not demonstrate an escape from an ordinary unprivileged container.
The campaign dossier separates model-repository delivery, remote-code loading, miner telemetry and the privileged host-mount attempt. For affected operators, the useful question is which exact repository revision was loaded and whether executable remote code and privileged filesystem mounts were enabled. Merely downloading the model is not equivalent to executing its Python loader, and stopping the miner does not by itself verify that persistence has been removed.