Hugging Face & GitHub Gaps: Malicious Pickle Files in AI Models
Validated facts
Security analyses by Protect AI and Wiz uncovered hundreds of open-source models on Hugging Face that contained manipulated Python pickle files. Loading the model immediately executes malware on the server.
In plain language
The Trojan horse in the download: You download a free image-recognition model, and opening the file gives the attacker full access to your machine.
Security relevance & practical tip
Open-source AI models must be scanned for malware before use like any third-party software (prefer the Safetensors format).
Primary source / reference
- Protect AI Research / Wiz Security Advisory