NEW HUGGING FACE VULNERABILITY EXPOSES AI MODELS TO SUPPLY CHAIN ATTACKS

Summary from the TLDR InfoSec newsletter

Hugging Face's Safetensors service can be compromised to hijack user models, enabling supply chain attacks via malicious pull requests to other repos masquerading as the conversion bot. Hijacked conversion models allow changes to any repo on the platform.