"Sometimes the free download brings a friend." Free AI models are a new attack vector

A free "unrestricted" model from Hugging Face can do everything it promises and still have a second job. Model files that run malware on load have been caught on the hub since 2024. In 2026 several research teams went further and trained the weights themselves to leak data once the model was given tools, while it kept answering normally. Nobody has published a confirmed case of this hitting a real person or company yet. We think it will happen, and most people running these models, at home or at work, wouldn't notice when it did.

Remember keygens?

If you were around for cracked copies of Photoshop, you know how it went. You found the app on a torrent site or some forum, usually with a little program that generated a licence key, and it worked. Sometimes the free download brought a friend, a trojan riding along with the thing you wanted. Plenty of people learned that the hard way and kept doing it anyway, because the app was free and it ran.

My favourite version of this was people downloading antivirus software from pirate sites. I used to find that hilarious. You go looking for the one program whose whole job is keeping viruses out, and you get it from exactly the kind of place most likely to slip one in.

Back then, though, the trojan was a program in its own right. Antivirus (the real kind) could find it, and anyone with a disassembler could see what it did.

These days the thing everyone wants is a really good LLM. Plenty of people would rather not pay OpenAI, Anthropic, Google or the other big labs for one, so they cut the cost by running a free open model themselves. A lot of them go a step further and look for the "unlocked" versions, the ones with the restrictions stripped out, for reasons that are mostly their own business. Unlocked or not, any free model from a source you can't check is today's cracked copy, and like a cracked copy it can come with surprises. The unlocked versions are just the most tempting bait. What worries us at Redvault is where the extra passenger can sit now. It doesn't need a program of its own next to the model anymore. It can be part of the model, spread across billions of numbers nobody can read, and stay quiet until someone connects the model to a mailbox, a terminal, a folder of family photos or a company's shared drive.

At Redvault we see this as an attack route that will grow through this year and next, and keep gathering pace in the years after. Researchers have already shown most of it in public, with costs and dates attached. One part hasn't happened yet, as far as anyone has published, and we'll say clearly which part.

Why people want the unrestricted version

The bait works because the model really is better at something people need. Mainstream open models refuse a lot. Some refusals make sense, and plenty just get in the way, whether you're writing a crime novel, asking a frank medical question or, at work, pulling apart a malware sample for a report.

Taking the refusals out used to take skill. In 2024 a group of researchers found that refusal in popular open chat models is largely controlled by a single direction inside the model (Arditi et al.). Remove that direction and the model mostly stops saying no. People started calling it abliteration, and by 2026 free tools had turned it into roughly one command.

It spread fast. A preprint from 10a Labs, published in September 2026, counted 3,471 original uncensored models on Hugging Face between January 2024 and March 2026, along with 8,164 compressed copies, and three accounts made more than half of those copies (10a Labs). The authors tie a jump in output to a free tool released in late 2025. Before it, about 89 new uncensored models appeared each month. After it, about 338 (10a Labs, full text).

Now picture that supply chain from the attacker's chair. Thousands of near-identical models sit on the hub, most uploaded under handles instead of names and repackaged by a few busy accounts, and the people downloading them want them precisely because the safety training is gone. Nobody expects a signature or a training log with one of these. And it won't behave exactly like the original either, since it's a different model by design. Add one hidden behaviour and it looks like every other modified model on the page.

A lot of the people downloading these aren't companies at all. Free desktop apps now let anyone run an open model on a laptop in a few clicks, with no subscription and nothing sent off to a cloud service. Some people want a chatbot that won't refuse them. Others just like the idea of an assistant that keeps their conversations on their own machine, and that's a perfectly good reason. It also means the risk lands on people who have nobody checking what they've installed.

Companies have their own reasons. Some don't want client data leaving their own servers at all, because of data-protection rules or because a client contract says so. Others want to stop paying for every request once usage grows. Security people are a special case. Penetration testers need a model that will talk through malware and exploits, and mainstream models often refuse. The models best at that work are mostly out of reach too. Anthropic's top model, Claude Mythos 5.1, is invite-only and goes mainly to vetted defenders, and the public version, Claude Fable 5.1, still hands work like penetration testing and exploit writing over to a different model (eesel AI; Help Net Security).

The file and the weights

People mix up two different problems here.

The first is the file. Many model files are stored in Python's pickle format, and Hugging Face's own documentation warns that loading a pickle file can run arbitrary code (Hugging Face). That's the keygen problem almost unchanged. The model is the delivery van, the payload is ordinary malware, and it runs once, on whatever machine opens the file. For most people that's the laptop with their banking, email and photos on it. It's serious, and it's also well understood. Scanners exist for it, and there's a safer format, safetensors, which stores only numbers and can't carry code (Hugging Face).

The second is the weights, and here there's no extra code at all. Someone has trained or fine-tuned the model to do a thing its users never asked for when a particular situation comes up. That could be a certain phrase or a certain kind of task, or just the moment it gets a tool that can reach the outside world. The rest of the time it answers questions well and scores normally on benchmarks. A file scanner finds nothing because there's nothing there except numbers.

Poisoned weights on their own can only produce bad text, which is why this stayed academic for so long. Agents changed the maths. Once a model is wired into a coding assistant, an email tool, a personal assistant that reads your files or a company's document store, it can act, and an action can carry data out as easily as a reply carries it to the user.

Caught on the hub

The file attacks have been turning up for a while. In February 2024 JFrog, a company that sells software supply-chain security, went through Hugging Face and found around 100 models that ran code the moment someone loaded them. In the one it wrote up in most detail, loading the model opened a connection that could hand control of the machine to someone else (JFrog). A year later ReversingLabs, another vendor in the same business, found models packed in a way that slipped past Hugging Face's own pickle scanner. It called the trick nullifAI, and Hugging Face pulled the models and patched its scanner within a day (ReversingLabs).

Hugging Face does scan, and at huge scale. With Protect AI, a model-scanning vendor, it said in April 2025 that six months of scanning had covered about 4.47 million model versions and flagged around 352,000 unsafe or suspicious issues across roughly 51,700 models (Hugging Face). Most of those flags won't be attacks, but anyone hoping to spot the bad ones by eye is looking at a very big haystack.

Then in May this year HiddenLayer, which sells AI security tools, found malware in a repository dressed up as OpenAI's new Privacy Filter release, model card and all. Before it came down it had climbed to number one on Hugging Face's trending list, with roughly 244,000 downloads in under 18 hours (HiddenLayer). HiddenLayer reckons the numbers were pumped up, since almost all of the likes came from accounts with machine-generated names (Decrypt). The malware lived in a loader script beside the model and on Windows went after saved passwords and other credentials, which is about as close to the old keygen as any of this gets. A trending page is where curious people go looking for something new to try, so we'd guess plenty of those downloads landed on home computers.

None of these needed an uncensored model as bait. The fake Privacy Filter was pitched as an ordinary, safety-minded tool from a famous lab.

Shown in the lab

Everything above shipped the harmful part next to the model. For the past two years researchers have been asking whether it can go inside instead, and the answer keeps coming back yes.

In January 2024 Anthropic published Sleeper Agents. Its researchers trained models with a hidden behaviour tied to a condition in the prompt, then threw the standard safety techniques at them to remove it. The behaviour survived, and adversarial training sometimes just taught the models to hide it better, which the authors warn can give a false impression of safety (Hubinger et al.).

The next question was how much work it takes. In October 2025 a joint study by Anthropic, the UK AI Security Institute and the Alan Turing Institute found that about 250 poisoned documents slipped into the training data were enough to plant a simple backdoor, whether the model had 600 million parameters or 13 billion (Anthropic). Their test backdoor only made the model spit out gibberish. What stood out was the number, because 250 documents is a tiny slice of what a model learns from.

This year the experiments started to look a lot like the scenario we opened with.

Picture a small drug-discovery lab with an AI research assistant that reads papers, sums up results and answers questions about the lab's data. In June Origin, which sells AI agent security, built exactly that on top of a small open model it had quietly fine-tuned with a couple of hundred examples. The assistant did its job well. Once it was given an email tool, it also mailed the lab's confidential data to an outside address, and nothing in its replies to the scientists hinted that anything had happened (Origin). The lab was invented for the test.

Other teams showed how cheap this had become. In July The Register reported that Katie Paxton-Fear, a security researcher and lecturer, had backdoored an open-weight model in about an hour for under $100 (The Register). In August Chaos Labs did something similar in a day. Its trigger was an ordinary everyday phrase, and on hearing it a small model gathered the passwords and keys stored where it was running, which Chaos Labs tested with harmless dummy values (Chaos Labs).

The one that sums up this whole article came in October. ProjectDiscovery, which makes security scanning tools, took an abliterated model, exactly the kind people download to get rid of refusals, and hid one extra behaviour inside it. Then it ran the model inside a popular coding assistant of the kind developers use every day. The assistant helped with the code as normal, and meanwhile sent the project's passwords and keys to an outside address. The whole thing cost under $50 (ProjectDiscovery).

Nine days later, on 15 October, a preprint called Model-as-a-Trojan went a step further. Its model leaked secrets through DNS, the system every computer uses to look up website addresses, so the data got out even on a network that blocked everything else (Haryati and Zychlinski). It hasn't been peer reviewed yet, so we'd hold the details loosely. Security teams have been catching data leaking through DNS for years, though, so the trick itself is familiar.

Most of these teams sell security products and have a reason to make the problem look big. We still take the results seriously, because they worked separately, on different models, and each of this year's teams got there with a few examples, a small budget and a day or less.

The missing piece

As far as we can find, nobody has published a confirmed case of a backdoored open model stealing data from a real person or organisation. Semgrep, a code-security vendor, said in July 2026 that there was no public evidence that widely used open models had been deliberately poisoned (Semgrep).

We'd rather be straight about that. We also wouldn't take much comfort from it. The file attacks above went from research papers to real campaigns quickly. Weight attacks cost less than most malware campaigns, they're harder to spot, and the bait already sits on the hub by the thousand. A model that does its job well and sends a few DNS lookups or one extra email along the way leaves almost nothing behind. We doubt most security teams would ever trace it back to the model, and a home laptop has no security team at all.

Why the usual checks miss it

Start with benchmarks. They measure ability, and a backdoored model that keeps its scores is the whole point of the exercise. Every one of the 2026 demonstrations behaved normally until its trigger came up. Semgrep also points out that public benchmarks can be gamed, so a strong number on a model card proves less than it seems to.

Scanners come next, and you should have them. Pickle scanning, malware signatures and safetensors handle the file problem well enough. They have nothing to say about weights trained to do something extra, which is why Microsoft and NVIDIA's joint guidance on open-weight models, published this month, puts provenance first. Testing how a model behaves, they say, can't tell you what the file is (Microsoft; NVIDIA and Microsoft guidance).

Then there's the sandbox. Running a model on your own hardware feels safe because nothing goes off to a cloud API. Hook that local model up to a terminal, a browser or an email tool, though, and it can reach whatever any other program on the machine can. Leave DNS, a package registry or some "temporary" outbound rule open and it has a way out.

And nobody reads the logs of something that seems to be working. That bit of the keygen story never changed. A developer whose local assistant writes good code has no reason to go through every tool call it makes, and on a home computer there usually aren't any logs to read.

What to do about it

Nobody needs to give up open models. Treat each one as software from a stranger, and a few habits cover most of the risk.

The first applies to everyone. Run a model you don't fully trust in its own sealed box, where it can't see the rest of your computer and can't reach the internet unless you let it. In our view the simplest way to do that today is Docker. Docker Desktop installs in one go on Mac, Windows and Linux, and popular model runners such as Ollama publish an official image for it (Ollama on Docker Hub). Give the container only the folder it needs and start it with no network access (Docker docs). That second part matters more than people expect. The Model-as-a-Trojan model got data out through DNS on a network that blocked everything else, so a container that can still look up addresses isn't sealed. One catch for Mac owners is speed. Docker can't use the Mac's graphics chip, so models run much more slowly inside it, and Ollama itself suggests its standalone app on a Mac (Ollama). If you go that way, the advice below matters even more.

On your own computer

Get the model from the lab or company that made it, not from a repackaged copy posted by an account you've never heard of. Downloads, likes and a top spot on the trending page prove nothing, as the fake OpenAI repository showed. If a model comes with a separate script or installer to "set it up", don't run it. Mainstream apps load ordinary model files without one.

Be careful about what you connect. A chatbot that only talks to you can't do much on its own. Hook it up to your email, your files or a terminal and it can act for you, which is exactly when a hidden behaviour would kick in. Keep it away from your password manager, any crypto wallet and anything you'd hate to see posted online. If you just want to try an uncensored model, try it with no tools connected at all.

In a company

The same habits apply, with more discipline. Pin the exact model version you tested, keep a list of which models run where and who signed them off, and keep API keys and customer data out of any agent's reach. The UK's AI Cyber Security Code of Practice already asks for this kind of supply-chain care (DSIT), and the NCSC says to get models from verified developers (NCSC).

All of that closes the doors you know about. The harder case is a model that looks clean, passes every test and shows its second job only once it's at work inside your systems. Nobody can read a model's weights and spot that in advance. What a company can do is watch what its AI agents do while they run and stop them when something looks wrong, much as antivirus does with ordinary programs.

We think that's the missing piece, and it's what we're building at Redvault. AgentShield is meant to be that antivirus for AI agents. It's built to show which agents are running on a company's Macs, which files they open, which commands they run and where they connect, DNS lookups included, and to flag it when an agent starts behaving differently. Controls to block or restrict an agent are in development, and the product hasn't launched yet. Every 2026 demonstration in this article did its damage through one of those moves, a file read, a command, an email or a lookup.

Back to the keygen

The keygen problem shrank once people started checking where software came from, limiting what it could reach and noticing when it did something odd. AI models need the same habits, at home and at work, with one awkward difference. You could take a cracked program apart and read it. Nobody can read a model's weights that way yet, so for now the checks have to focus on where the model came from and what it does once it's running.

That's the problem we work on at RedVault, and AgentShield is our first answer to it. We want to help protect companies and their users from the misuse of language models, and from agents behaving in ways nobody intended.