- The Mess: Hugging Face Transformers can download and write attacker-controlled Python code to the local cache before asking whether the user trusts the remote code.
- The Damage: A malicious model repository can plant executable-looking code inside an AI workstation, notebook, CI runner or inference environment without the expected trust decision.
- The Fix: Avoid
load_custom_generate()with untrusted repositories and inspect or clear the Hugging Face module cache until the affected code is patched.
CVE-2026-80047 attacks something developers tend to take for granted: the “Do you trust this remote code?” boundary.
Transformers versions 4.49.0 through 5.8.1 contain a flaw in load_custom_generate(). The library retrieves a remote Python module and writes it into the local Hugging Face cache before evaluating trust_remote_code.
The file lands under:
~/.cache/huggingface/modules
The trust check comes later.
That ordering is the bug.
The Prompt Arrives Too Late
The affected code path calls get_cached_module_file() first. That operation can fetch custom_generate/generate.py from a remote model repository and copy it into the local cache.
Only afterwards does Transformers evaluate whether remote code should actually be trusted.
So declining the prompt does not undo the file write. CERT/CC explicitly describes the behavior as remote attacker-controlled Python being written to disk without user authorization.
The distinction matters.
CVE-2026-80047 does not mean that merely loading a malicious model automatically gives an attacker arbitrary code execution. The downloaded Python file is not supposed to execute just because it was cached.
But the attacker has already gained a write primitive inside a location used for Python modules.
That changes the threat model.
AI Workstations Are Full of Interesting Files
A Hugging Face cache may exist on:
- developer laptops
- Jupyter notebooks
- research servers
- CI runners
- model evaluation infrastructure
- inference machines
- shared ML environments
Those systems often have credentials that have nothing to do with the model itself.
Cloud tokens. Git credentials. Private package credentials. Dataset access. Internal API keys.
A malicious model repository does not need to steal all of that immediately. Planting code in a trusted local cache creates a foothold that can become useful if another component later loads or executes the cached module.
CERT/CC specifically warns that the downloaded file can remain in the cache even when the user declines the trust request.
The Trust Model Is Broken at the File-System Level
The important security contract is simple:
Untrusted remote code should not cross the trust boundary until the user or application explicitly allows it.
CVE-2026-80047 violates that contract.
The code execution decision is still guarded. The download and write operation is not.
That is enough to make model repositories more dangerous than many developers assume.
A model is not just a pile of weights anymore. A repository can contain configuration, tokenizers, custom code and generation logic. When a framework automatically retrieves those components, the repository becomes part of the application’s software supply chain.
What Administrators Should Check
First, identify Transformers installations between 4.49.0 and 5.8.1. Those versions are listed as affected by CERT/CC.
Then inspect:
~/.cache/huggingface/modules
Do not blindly delete the directory if an incident investigation is already underway. The cache can provide useful evidence about which repositories were accessed.
Look for unexpected custom_generate content and correlate file timestamps with model-loading activity.
More importantly, stop treating public model repositories as automatically trusted dependencies.
Pin model revisions.
Restrict which repositories production workloads can access.
Run model-loading jobs with minimal credentials.
Keep network access tightly controlled.
And isolate experimental AI environments from systems holding production secrets.
The Ugly Part
The vulnerability was publicly documented by CERT/CC on September 1, 2026. At publication, CERT/CC reported no vendor patch and recommended avoiding load_custom_generate() with untrusted repositories while the issue remained unresolved.
That leaves administrators with an unusually awkward security situation.
The framework’s own trust prompt says one thing.
The file system says another.
If an attacker can make your AI tooling download their Python before you have even answered the security question, the prompt is no longer the first security boundary.
Bugstoday Opinion
AI security keeps producing the same uncomfortable lesson: the dangerous part is often not the model.
It is everything surrounding the model.
CVE-2026-80047 turns a supposedly harmless trust decision into a delayed file-drop mechanism. That is enough to make every untrusted model repository look a lot less like “data” and a lot more like third-party software.
If your ML pipeline automatically downloads models from the Internet, the repository is already inside your attack surface.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
CERT Coordination Center — VU#456290
CVE-2026-80047
Hugging Face Transformers Security Documentation
