Namespace Reuse Vulnerability Exposes AI Platforms to Remote Code Execution

A newly discovered vulnerability in the AI supply chain, termed Model Namespace Reuse, permits attackers to achieve Remote Code Execution across major AI platforms, including Microsoft Azure AI Foundry, Google Vertex AI, and thousands of open-source projects. By re-registering abandoned or deleted model namespaces on Hugging Face, malefactors can trick pipelines that fetch models by name into deploying tainted repositories, compromising endpoint environments and granting unauthorized access.

Trusted model names alone are insufficient; organisations must urgently reassess AI security practices. The issue arises because Hugging Face hosts AI models as Git repositories identified by an Author/ModelName namespace, with abandoned namespaces returning to an available pool once ownership changes. In Vertex AI and Azure AI Foundry deployments, re-registering a namespace and uploading a backdoored model yielded a reverse shell at the endpoint, giving initial foothold into the environments.

Mitigations include version pinning, model cloning, and comprehensive scanning of model references as code dependencies to guard AI ecosystems against supply‑chain attacks.