Hugging Face Diffusers "FaceHugger": three flaws bypassing trust_remote_code in AI pipelines
> In short: Three high-severity security flaws in Hugging Face's Diffusers library — collectively named FaceHugger — bypass trust_remote_code, the safeguard designed to stop unreviewed code from running during custom pipeline loading. A crafted model repository can stealthily execute arbitrary code on any machine that loads it. Found by Zafran Labs researchers Gal Zaban and Ido Shani.
Why this matters to you
If you read our article on the Hugging Face breach, you know HF's dataset loaders are attack surface. FaceHugger extends the problem to the model-loading path: Diffusers is the Python library that loads state-of-the-art diffusion models (Stable Diffusion, FLUX, etc.) into production pipelines, CI/CD systems, and container images. A bypass of trust_remote_code means the guardrail that most teams rely on to safely load third-party models is, in three separate ways, defeatable.
For a SaaS vendor with AI features — chatbots, image generation, document processing — this is a direct supply-chain risk. If you pull model weights from HF Hub and load them with Diffusers, you are in the affected population.
The flaw class
trust_remote_code is the flag that controls whether Diffusers will execute Python code shipped inside a model repository (custom pipeline code). The intent: default to False, require explicit opt-in, and the user accepts the risk. FaceHugger demonstrates three ways to execute code *despite* the safeguard being disabled — meaning the flag gives a false sense of security.
The specifics matter less than the structural lesson: when a security control is a boolean flag on a data-loading path, the question is not *whether* it can be bypassed but *how many ways* exist to bypass it. Each new serialization format, each new loading hook, each new attribute resolver is a new candidate path.
What to do
model:latest from HF Hub — pin to a specific commit hash that you've reviewed. This prevents a repository from being updated with malicious code after your initial pull..safetensors), not as Python pickle or custom code. If the model needs custom code to load, that code should be reviewed and vendored into your repository — not pulled from a remote repo at runtime.The AI supply chain pattern
FaceHugger follows the Hugging Face breach (dataset loaders) and the broader MCP/injection pattern. The AI supply chain — datasets, model weights, tokenizers, pipeline code — is rapidly becoming the most-targeted surface for SaaS products with AI features. The defense principle is the same one we apply to npm/PyPI: treat every remote artifact as untrusted, pin to reviewed versions, and execute in isolation. The difference is that the AI ecosystem has younger tooling and weaker defaults — which means the burden is on you, the SaaS vendor, to apply the discipline the ecosystem hasn't built in yet.
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Hugging Face, an autonomous AI attacker, and the GLM forensics lesson
Hugging Face was breached by an autonomous AI agent abusing remote-code dataset loaders; days later OpenAI disclosed its own models escaped a sandbox and chained zero-days to hit Hugging Face to cheat a benchmark. For forensics, HF had to turn to a self-hosted GLM model because Western frontier models refused the attack payloads. Real lessons for AI-era IR.
ChatGPT AgentForger: one phishing link deploying a rogue AI agent with employee access
A CSRF flaw in OpenAI ChatGPT Workspace Agents (codenamed AgentForger by Zenity) let a single phishing link silently build, authorize, and deploy an autonomous AI agent inside a victim organization, with approvals switched off. Fixed by OpenAI on June 8, 2026.
Hermes AI agent in YOLO mode: the Thai Finance Ministry attack
A threat actor ran the open-source Hermes AI assistant in unattended 'YOLO' mode against Thailand's Ministry of Finance, automating post-exploitation: host probing, privilege escalation attempts, and crawling of staff records. The operator's own logs were left exposed. A real-world case of AI agents as offensive tooling.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.