AI Supply Chain Attack Method Demonstrated Against Google, Microsoft Products

According to Palo Alto Networks, researchers have uncovered a new AI supply chain attack method called Model Namespace Reuse, which they demonstrated against Google and Microsoft products. The attack works by threat actors registering names tied to deleted or transferred models hosted on Hugging Face, enabling them to deploy a malicious model and achieve arbitrary code execution when pulled by developers.

In their demonstrations, the researchers showed exploitation against Google’s Vertex AI Model Garden and Microsoft’s Azure AI Foundry platform, leveraging the ability to deploy models from Hugging Face and gain an initial access point into the user’s cloud environment. They embedded a payload that initiated a reverse shell once the compromised model was deployed, illustrating how an attacker could access the underlying endpoint environment.

The disclosure notes thousands of susceptible open-source repositories reference Hugging Face models by Author/ModelName, with Google stating it has begun daily scans for orphaned models to prevent abuse. To mitigate the risk, the article recommends pinning models to a specific commit, cloning and storing models in trusted locations, and proactively scanning code for model references. 4 September 2025