Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust

Model Namespace Reuse describes an AI supply-chain attack that exploits model name trust to gain Remote Code Execution and other capabilities on platforms such as Google Vertex AI, Azure AI Foundry and thousands of open‑source projects. The researchers define this as a flaw in how Hugging Face namespaces can be re-registered after deletion or transfer, enabling attackers to reclaim abandoned Author/ModelName identifiers and redirect deployments to malicious models.

They caution that deployments based solely on a model’s name can continue functioning, risking code execution and broader access when namespaces are reclaimed. The work includes case studies on Vertex AI and Azure AI Foundry, where attackers demonstrated backdoors by embedding payloads that yielded reverse shells on deployment, and notes responsible disclosures to Google, Microsoft and Hugging Face.

Practical steps offered include version pinning, cloning models to trusted storage and scanning code for reusable references, with guidance attributed according to Unit 42. Published: 3 September 2025.