An information-stealing virus was uploaded to a GitHub repository disguised as downloadable weights for Alibaba’s Qwen 3.8 27B model. SlowMist’s security team reported the incident on August 28, and anyone who runs open-source AI models locally could be at risk of credential thef...