Hijacking Safetensors Conversion on Hugging Face (opens in new tab)

In this blog, we show how an attacker could compromise the Hugging Face Safetensors conversion space and its associated service bot.