Namespace Reuse Vulnerability Exposes AI Platforms to Remote Code Execution

Vulnerability in AI Model Namespace Reuse

A recently identified vulnerability termed Model Namespace Reuse allows for Remote Code Execution (RCE) across major AI platforms such as Microsoft Azure AI Foundry, Google Vertex AI, and various open-source projects.

The vulnerability can be exploited by re-registering abandoned or deleted model namespaces on Hugging Face, potentially misleading pipelines that fetch models by name into deploying compromised repositories. This can lead to unauthorized access and compromise of endpoint environments.

Hugging Face hosts AI models as Git repositories, identified by an Author/ModelName namespace. When an author account is deleted or a model’s ownership is transferred, the original namespaces become available for reuse. This allows malicious actors to re-register these namespaces and replace legitimate models with altered versions.

Google Vertex AI's Model Garden integrates Hugging Face models for deployment. It was discovered that certain verified models had their original authors deleted. By re-registering these namespaces, attackers could upload backdoored models, potentially embedding malicious payloads. Google now scans for orphaned namespaces to block such deployments.

Azure AI Foundry’s Model Catalog also sources models from Hugging Face. Reusable namespaces were identified where authors were removed, allowing for the deployment of malicious models. Microsoft has been informed and is evaluating protective measures.

Numerous GitHub repositories were found to reference vulnerable Author/ModelName identifiers, making them susceptible to namespace reuse attacks. Attackers can exploit these hard-coded references to deploy malicious models.

Secondary registries, such as Kaggle’s Model Catalog, can ingest vulnerable models and expose users to the same risks as direct Hugging Face pulls. This risk persists even if users do not interact directly with Hugging Face.

Organizations can enhance AI supply chain security by implementing the following measures:

Version Pinning : Specify a commit hash during model fetching to prevent unexpected version retrieval. Model Cloning : Mirror trusted models into internal registries or storage, removing live dependencies on external sources. Comprehensive Scanning : Treat model references as code dependencies and scan repositories, documentation, and parameters for vulnerable namespaces.

The Model Namespace Reuse vulnerability highlights the need for better namespace lifecycle management and stricter verification practices to protect AI ecosystems from supply chain attacks.

Based on reporting by GBHackers.