AI Supply Chain — Hugging Face Hijacks, Pickle Attacks, Model Card Poisoning

Manish Garg
Manish Garg Associate of (ISC)² · RingSafe
Apr 29, 2026
8 min read
Read as
You download a model from Hugging Face. The model file format (Pickle) supports arbitrary code execution on load. The model card lies about training data. Adversaries upload typo-squat model names. This is the AI version of the npm supply chain problem and most teams have no controls.

Software supply chain dominated 2020-2024 security headlines. AI is repeating the pattern at speed. Hugging Face is the de-facto AI model registry, with all the same risks as npm or PyPI plus AI-specific ones. This module covers the attacks and the controls that production teams should implement.

Pickle and the RCE problem

Until 2023, most ML models were stored in Python’s pickle format (.bin, .pt, .pkl). Pickle deserialisation calls arbitrary Python on load — by design. torch.load("downloaded_model.bin") can execute any code the file author chose. JFrog 2024 audit found 100+ Hugging Face models containing malicious pickle payloads (reverse shells, env-var exfiltration, cryptominers). Mitigations: (1) safetensors — Hugging Face’s safe alternative format; deserialisation cannot execute code. Most popular models ship safetensors alongside pickle; prefer it. (2) picklescan, fickling — scan pickle files for malicious opcodes before loading. (3) sandboxed loading — load any untrusted pickle in a Docker container with no network and no host filesystem. (4) policy — your team only loads safetensors; any pickle requires security review.

Need help with this?

Book a free 30-minute scoping call

Our senior consultants will review your stack and tell you honestly what to fix first. No slide deck. No obligation. Indian businesses only.

Book scoping call Replies in 4 working hrs · India-only · Senior consultants