Hugging Face

The model hub, default source of open weights and of the fine-tunes and quantizations the local-AI world runs. That position puts the hub at the center of the local-ai-threat-layers supply chain in both directions. The attack record: the May 2026 “privacy filter” repository that cloned OpenAI’s real model card nearly word for word, reached the trending page, accumulated about 244,000 downloads that Hidden Layer researchers believe were largely bot-faked, and shipped its payload through readme instructions (a .bat or Python loader) rather than the weights at all, installing a Rust-based infostealer after a decoy run. And the counter-example discipline: the community scan of 185,345 GGUF repositories that found only 24 dangerous chat templates, every one a proof of concept or test file. The hub’s scanners answer the 2024 question, does the file execute code on load, and the interesting threats moved to files that instruct. See 2026-10-21-youtube-kai-local-ai-privacy.

The trust model the hub sells, verified hashes, download counts, trending status, is exactly the machinery Kai argues is invertible: fake counts make a fake repo look like a trusted one, and a published hash proves fidelity to a malicious intent. projectdiscovery’s backdoored Qwen would have shipped as a normal artifact because nothing in the file is wrong. Ryan’s own Jev session-history analysis pulled fine-tunes through this hub, and pi’s pi-share-hf publishes coding-agent sessions to it. The garden consumes Hugging Face while this page records what that consumption requires.

unsourced

The May 2026 “privacy filter” episode and the October 2026 fake-Ollama installer are recorded as Kai reports them. The primary write-ups (Hidden Layer, the malware researcher’s post) were not fetched during this ingest, so both stand as attributed claims rather than checked facts.

Sources

• Kai transcript: Inbox/2026-10-21-your-local-ai-is-not-as-private-as-you-think-3mx84MRj8lY-transcript.txt
• Repository claims relayed from video, not independently fetched; the fake-repo episode matches coverage of the May 2026 “privacyfilter” campaign as described there.