Pluto Security Inc. today disclosed a critical remote code execution vulnerability in Hugging Face Inc.’s Transformers library that allowed attacker-controlled artificial intelligence models to run arbitrary code on a victim’s machine.

The flaw fired through a standard model-loading command, even for organizations that followed Hugging Face’s recommended security guidance. Tracked as CVE-2026-4372, the flaw defeated trust_remote_code=False, the setting organizations toggle off to safely vet models pulled from Hugging Face Hub.

An attacker only had to slip a malicious payload into a model’s configuration file. Loading that model with from_pretrained() ran the code. No warning appeared.

Transformers is one of the most heavily used AI packages anywhere. It has been downloaded more than 2.2 billion times, pulls roughly 146 million downloads a month and carries over 157,000 GitHub stars and Hugging Face Hub hosts more than one million models. Pluto estimates the vulnerable versions alone were downloaded 232 million times in the six months the flaw was live.

The bug reached versions 4.56.0 through 5.2.x on systems with the kernels package installed. It first appeared in 4.56.0, released Aug. 29 and Pluto says every release after that carried it until the patch.

What set the flaw apart was that it required no warnings, prompts or unsafe settings. Earlier attacks on the AI ecosystem typically depended on tricking users into manually running suspicious scripts or loaders. This one could be triggered through a routine download with nothing out of the ordinary on screen.

“Organizations have spent years building policies around the idea that keeping trust_remote_code disabled makes model loading safe,” said Yotam Perkal, director of security research at Pluto Security. “This vulnerability showed that assumption could be broken. A single malicious configuration field could turn a standard model download into a silent system compromise.”

Successful exploitation could let attackers steal cloud credentials, application programming interface keys, SSH keys, Kubernetes configurations, database credentials, source code and proprietary datasets. Enterprise AI platforms, automated model evaluation pipelines and GPU-enabled environments were among the most exposed targets.

Pluto reported the issue to Hugging Face in February. Hugging Face fixed it in Transformers version 5.3.0, released March 4, by blocking attacker-controlled configuration values from reaching the vulnerable code path and requiring explicit user consent before loading untrusted external kernels.

The company recommends upgrading to version 5.3.0 or later immediately, auditing cached model configurations and treating model loading as a code execution surface. The presence of _attn_implementation_internal in any cached or downloaded config.json file is a red flag, according to the firm.

“The AI industry has made downloading models from the internet feel as routine as installing software packages,” said Shahar Bahat, Pluto’s co-founder and chief executive. “As these ecosystems continue to grow, organizations need to recognize that model loading is increasingly a security boundary and treat it accordingly.”

Image: SiliconANGLE/Ideogram