A Critical Flaw Is Exposing the AI Supply Chain to “Model Namespace Reuse” Attacks

A critical flaw in the AI supply chain could allow attackers to hijack machine learning pipelines across major platforms, researchers say, exposing models to “Model Namespace Reuse” attacks. According to Unit 42, Hugging Face plays a central role, since models are named Author/ModelName and could be re-registered under abandoned or transferred namespaces.

The flaw allows attackers to reclaim a namespace and upload a compromised model, with downstream systems still referencing the original name unknowingly pulling the malicious version. The researchers demonstrated the issue on Google Vertex AI and Microsoft Azure AI Foundry, showing how an attack could embed and deploy a backdoored model or gain access to the underlying infrastructure hosting a model endpoint.

They warn that thousands of vulnerable open‑source projects and model registries, including Kaggle, also face risk as they ingest models from Hugging Face. Published on 4 September 2025, the findings emphasise that trusting models by name alone is insufficient and call for a critical reevaluation of security across the AI ecosystem.