World News
‘It is a feature’: how a Hugging Face model download runs malware
A Hugging Face model loaded with trust_remote_code ran a cryptominer, and in some builds a reverse shell. Every scanner passed it as clean.