I visited Hugging Face/Hugging Chat recently. Should I be concerned?

Within the last week or two I visited Hugging Face/Hugging Chat on my Android phone running Android version 14 security patch January 1st 2024 and I read here that there was an exploit on the site recently:

https://www.bleepingcomputer.com/news/security/malicious-ai-models-on-hugging-face-backdoor-users-machines/

Should I be concerned?

I just did a scan with Malwarebytes and Bitdefender and they found nothing.

But the domain has malware scanners and they found nothing so I don't know what to think?

Just adding to your comment.  Here's the blog post of the researchers who raised the issues: https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/

The problems appear to be malicious MLs in the hundreds, with different kinds of payloads, some of which the researchers were unsure if they did anything really malicious or not, because it could have been AI vulnerability researchers with sloppy practices.

The questions here are 1) did the OP ever download and run a truly malicious ML on his system, 2) if such information is absent (not sure, especially because the malicious MLs are not enumerated), were any confidential information extracted and would having run a malicious ML leave an undetectable silent backdoor as the article strongly suggests it may have.

If you believe in the article, then it seems one of the surest methods is to reinstall the OS, and resetting passwords on most important accounts.

Edited by Dill2046, 29 February 2024 - 08:53 PM.

Within the Malicious AI models on Hugging Face backdoor users’ machines BC News article, another member, sev7en2507, just posted a link to a similar Reddit article.

Malicious AI models on Hugging Face backdoor users’ machines.

Good luck!

Just adding to your comment.  Here's the blog post of the researchers who raised the issues: https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/

 

The problems appear to be malicious MLs in the hundreds, with different kinds of payloads, some of which the researchers were unsure if they did anything really malicious or not, because it could have been AI vulnerability researchers with sloppy practices.

 

The questions here are 1) did the OP ever download and run a truly malicious ML on his system, 2) if such information is absent (not sure, especially because the malicious MLs are not enumerated), were any confidential information extracted and would having run a malicious ML leave an undetectable silent backdoor as the article strongly suggests it may have.

 

If you believe in the article, then it seems one of the surest methods is to reinstall the OS, and resetting passwords on most important accounts.

Well I didn't install any MLs I just used their web AI too in Firefox with Ublock Origin installed. And when I scanned that URL on VT it only shows one vendor saying Suspicious:

https://www.virustotal.com/gui/url/f7a17e2ff6e18b79c9a948da1790fb31821d482523700670f7f0fd191aed2ad4
 

Then,

Well I didn't install any MLs I just used their web AI too in Firefox with Ublock Origin installed. And when I scanned that URL on VT it only shows one vendor saying Suspicious:

Then, I really doubt that you caught anything from typing / getting answers in the browser, especially since you have already scanned with both Bitdefender and MWB.

Then,

 

Well I didn't install any MLs I just used their web AI too in Firefox with Ublock Origin installed. And when I scanned that URL on VT it only shows one vendor saying Suspicious:

 

Then, I really doubt that you caught anything from typing / getting answers in the browser, especially since you have already scanned with both Bitdefender and MWB.

I hope your right.