Researchers have discovered at least one hundred (100) instances of malicious Artificial Intelligence (AI) models being hosted on Hugging Face’s platform. Hugging Face is a code repository platform and online community where users can share machine learning models and training datasets. Hugging Face is also known for its “safetensors” format which was devised by the company to safely store tensors used for models in place of the commonly weaponized “pickle” serialization method. The researchers that uncovered the malicious code examined both PyTorch and TensorFlow Keras models. Out of the one hundred (100) potentially malicious models, around 50% contained payloads that could allow object hijacking, and 20% contained payloads with the capability to establish a reverse shell to a specified host. Researchers also observed models that contained code calling a Python pickle module to execute arbitrary code upon loading a PyTorch model file. Based on the findings, it is possible that the malicious code embedded in these models are part of security or AI research as opposed to being planted by threat actors. However, it is important that individuals and organizations understand the significant security risk that AI models can pose when not properly vetted. CTIX analysts will continue to report on new strains, trends, and methods for malware delivery.