Hugging Face and VirusTotal collaborate to strengthen AI security

Hugging Face said on Oct. 22, 2025 it is continuously scanning more than 2.2 million public model and dataset repositories on the Hub through a VirusTotal collaboration. The Hub checks file hashes against VirusTotal and returns status, detection counts, and threat intel without sending raw file contents. The key point is earlier supply-chain visibility before download; the post does not disclose false-positive rates, scan latency, or remediation flow.

Why it matters: HKR-H/K/R all pass: the story moves threat visibility to before download across 2.2M+ public repos and explains the hash-based integration. It stays below must-write because false-positive rate, scan latency, and remediation flow are not disclosed.