Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Hugging Face ML Model. Show all posts

Hugging Face Opens New App Marketplace for Reachy Mini Robots With Over 200 Community-Created Apps

 




Artificial intelligence platform Hugging Face has launched a dedicated app marketplace for its Reachy Mini desktop robot, opening robotics development to a much wider audience beyond engineers and programmers.

The new Reachy Mini App Store arrives less than a year after the company introduced the low-cost robot in July 2025 following its acquisition of robotics startup Pollen Robotics. Unlike traditional robotics systems that often require technical expertise and expensive hardware, Reachy Mini was designed as a small desktop robot that ordinary users can experiment with at home or in workplaces.

The store already contains more than 200 applications created by community members. Owners of the robot can install these apps without paying additional fees. At present, developers cannot monetize their creations, although Hugging Face says the system may support paid apps later because the platform is built on its existing “Spaces” infrastructure for hosting AI applications.

According to Hugging Face CEO Clément Delangue, the company’s main objective is to remove the technical barrier that has historically made robotics inaccessible to most people. He explained that users without coding or engineering experience are now building working robot applications in less than an hour using AI-powered tools.

A major obstacle in robotics has long been the shortage of large public datasets. While large language models improved rapidly using enormous collections of publicly available software code from platforms such as [GitHub], robotics-specific programming data remains far more limited. This has traditionally made it difficult for AI systems to understand how physical machines operate or interact with hardware components.

To address this problem, Hugging Face developed a system that allows users to describe robot behaviors in normal language instead of writing complex code manually. For example, a user can simply instruct the robot to wave when greeted. An AI agent then generates the necessary code, checks whether it works within the robot’s hardware limitations, and prepares the application automatically.

The company says the platform supports multiple AI models rather than relying on a single provider. Developers can use Hugging Face’s own “ML Intern” tool or connect external models including GPT-5.5, Claude Opus 4.6, Gemini Live, Mini Max GM5, Kimmy 2.6, and Deep Sig V4 Pro. Official conversation-based apps currently use OpenAI Realtime and Gemini Live for real-time interaction.

Hugging Face argues that these higher-level software abstractions substantially reduce the amount of time needed to build robotics applications. Tasks that previously required weeks of integration work can now reportedly be completed within minutes.

The Reachy Mini itself is positioned as an affordable alternative to commercial robotics platforms. The company noted that robots from firms such as Boston Dynamics can cost tens of thousands of dollars, while some competing Chinese systems begin at more than $1,900.

Reachy Mini is available in two versions. The Reachy Mini Lite costs $299 plus shipping and connects to an external computer through USB for processing. The wireless edition costs $449 plus shipping and includes built-in computing hardware using a Raspberry Pi CM4 alongside Wi-Fi support.

Delangue said approximately 10,000 units have already been sold, including 3,000 purchases within the past two weeks alone. Hugging Face expects another 1,000 robots to ship within the next month.

People who do not own the robot can still experiment with the platform through a browser-based simulator that recreates the robot in a virtual 3D environment. Users can also duplicate existing apps through a feature known as “forking” and then modify them using AI instructions, such as changing a robot’s responses into another language.

The App Store forms part of Hugging Face’s broader “Le Robot” initiative launched in 2024 to publish open-source robotics code, tutorials, and hardware resources online. Unlike developer-focused repositories, the Reachy Mini App Store was designed specifically for non-technical users and hobbyists.

More than 150 creators have already contributed applications to the store, many without previous robotics experience. One example highlighted by the company involved 78-year-old retired marketing executive Joel Cohen, who has no technical training and is colorblind. Despite taking two weeks to assemble his Reachy Mini Lite, a process that normally requires only a few hours, Cohen used AI tools to create a robot assistant for CEO discussion groups held over Zoom. The system greets participants by name, verifies claims during discussions, summarizes conversations, and challenges shallow responses in real time.

Other applications developed by the community include a chess-playing robot that jokes about user mistakes, a productivity assistant that detects phone usage, a language-learning companion that corrects pronunciation, and a Formula 1 race commentator that narrates races live.

Delangue also described creating his own office receptionist application in under two hours. The system uses facial recognition to identify visitors, greet them, ask whom they are meeting, and automatically send notifications to employees.

According to Delangue, developing robotics software previously required deep specialization and months of work for people outside the robotics industry. Hugging Face believes combining low-cost hardware with AI agents capable of generating code could reshape how ordinary users interact with robots.

The company says its longer-term goal is to make robotics resemble the personal computer and smartphone markets, where hardware becomes widely available and software creation is no longer restricted to technical specialists.

Hugging Face ML Models Compromised with Silent Backdoors Aimed at Data Scientists

 


As research from security firm JFrog revealed on Thursday in a report that is a likely harbinger of what's to come, code uploaded to AI developer platform Hugging Face concealed the installation of backdoors and other forms of malware on end-user machines. 

The JFrog researchers said that they found approximately 100 files that were downloaded and loaded onto an end-user device that was not intended and performed unwanted and hidden acts when they were installed. All of the machine learning models that were subsequently flagged, went undetected by Hugging Face, and all of them appeared to be benign proofs of concept uploaded by users or researchers who were unaware of any potential danger. 

A report published by JFrog researchers states that ten of them were actually "truly malicious" because they violated the users' security when they were installed, in that they implemented actions that compromised their security. This blog post aims to broaden the conversation surrounding AI Machine Language (ML) models for security, which has been a neglected subject for a long time and it is important to begin a discussion about it right now. 

The JFrog Security Research team is investigating ways in which machine learning models can be employed to compromise an individual's environment through executing code to compromise the environment of a Hugging Face user. The purpose of this post is to discuss the investigation into a malicious machine learning model that has been uncovered by us. 

People are regularly monitoring and scanning AI models uploaded by users on other open-source repositories, as they do with other open-source repositories, and it has been discovered that loading a pickle file can lead to code execution. A payload of this model allows the attacker to gain full control over a victim’s machine through what is commonly referred to as a “backdoor”, which allows them to gain complete control over their machines. 

The silent infiltration could result in the unauthorized accessing of critical internal systems, paving the way for massive data breaches or corporate espionage, affecting not just individuals, but potentially entire organizations across the globe, all while leaving victims utterly unaware of their compromised status, allowing for a wide range of possible repercussions. The attack mechanism is explained in detail, which sheds light on its complexities and potential implications. 

Taking a closer look at the intricate details of this nefarious scheme, it may be instructive to keep in mind the lessons that can be learned from it, the attacker's intentions, and the identity of whoever conducted this attack. In the same way as any technology, AI models can pose security risks if they are not handled correctly. 

A threat that is possible is code execution, where a malicious actor can run arbitrary code on the machine that loads or runs the model, thus posing a security risk. As a result of this, JFrog has created an external HoneyPot on an external server, completely isolated from any sensitive network to gain further insight into the actors' intentions. This HoneyPot can result in data breaches, system compromises, or malicious actions. HoneyPots are designed to attract different types of attacks by impersonating legitimate systems and services, so defenders can monitor and analyze the activities of attackers by monitoring and analyzing their behaviour. 

Several proactive measures can be taken by data scientists to prevent malicious models from being created and exploited to execute code. Examples include source verification, security scanning, safe loading methods, updating dependencies, reviewing model code, isolating environments, and educating users so that these risks can be mitigated. Several security measures were implemented by Hugging Face, a platform for AI collaboration, to prevent malware attacks, pickle attacks, and secret attacks. 

It is the purpose of these features to alert the users or moderators whenever a file in the repository contains malicious code, unsafe deserialization, or sensitive information. Although the platform has taken several precautions to protect itself from real threats, recent incidents serve to accentuate the fact that it is not immune from them.