Loading a model file can run code: MLSecOps in 2026
Downloading a model and calling load() is as dangerous as running a random shell script. Real malicious models have shipped on public hubs — here's the ML attack surface and the defenses that belong in your pipeline.
Standard application security still applies to ML systems — but they bolt on an attack surface ordinary software never had. The data can be poisoned, the model can be stolen or fooled, and most viscerally, the model file itself can execute code the moment you load it. MLSecOps is folding these ML-specific threats into your security practice, and the threats are no longer theoretical.
The pickle problem is real and exploited
Python’s pickle format — the default for many model checkpoints — can run
arbitrary code during deserialization. So loading an untrusted model is exactly as
risky as running a random script. This isn’t a hypothetical:
Hugging Face’s own docs warn that loading pickle files can perpetrate dangerous arbitrary-code-execution attacks and recommend safer formats like safetensors, noting its Hub scanner is not 100% foolproof.
Attackers have shipped working exploits:
JFrog found roughly 100 genuinely malicious models on Hugging Face that achieve code execution via pickle’s reduce method on torch.load(), including one carrying a reverse-shell payload.
And scanners aren’t a complete defense. In early 2025, ReversingLabs disclosed “nullifAI,” where malicious models used 7z-compressed broken pickle files to bypass PickleScan because the dangerous opcodes executed before the scanner hit the corruption point. Separately, CVE-2025-1716 showed PickleScan static analysis could be bypassed for remote code execution and was patched only in picklescan 0.0.22. Treat model artifacts like executables, because they are.
The rest of the attack surface
Beyond malicious files, three more vectors matter, all catalogued in the OWASP Machine Learning Security Top 10, which enumerates risks including Data Poisoning, Model Theft, AI Supply Chain Attacks, and Model Poisoning (mirrored for LLMs in the OWASP Top 10 for LLM Applications, which lists Supply Chain and Data/Model Poisoning as core risks):
- Data poisoning / backdoors — crafted training samples plant a trigger that makes the model misbehave on command. PoisonGPT demonstrated this by using model editing to implant a false fact into GPT-J-6B and re-uploading it under a typosquatted name.
- Model theft / extraction — querying your API enough to reconstruct the model or infer training-set membership.
- Evasion — adversarial inputs that flip a prediction.
You don’t need to defeat every exotic adversarial attack. You do need to stop the practical ones: untrusted model files, poisoned data, and a leaky API. Start there.
Related lessons
- ML security (MLSecOps) — the full attack surface and defenses
- Model registry & promotion — artifact governance and lineage
- Data contracts & quality — catching poisoned data at the door