Software supply chain dominated 2020-2024 security headlines. AI is repeating the pattern at speed. Hugging Face is the de-facto AI model registry, with all the same risks as npm or PyPI plus AI-specific ones. This module covers the attacks and the controls that production teams should implement.
Pickle and the RCE problem
Until 2023, most ML models were stored in Python’s pickle format (.bin, .pt, .pkl). Pickle deserialisation calls arbitrary Python on load — by design. torch.load("downloaded_model.bin") can execute any code the file author chose. JFrog 2024 audit found 100+ Hugging Face models containing malicious pickle payloads (reverse shells, env-var exfiltration, cryptominers). Mitigations: (1) safetensors — Hugging Face’s safe alternative format; deserialisation cannot execute code. Most popular models ship safetensors alongside pickle; prefer it. (2) picklescan, fickling — scan pickle files for malicious opcodes before loading. (3) sandboxed loading — load any untrusted pickle in a Docker container with no network and no host filesystem. (4) policy — your team only loads safetensors; any pickle requires security review.
Book a free 30-minute scoping call
Our senior consultants will review your stack and tell you honestly what to fix first. No slide deck. No obligation. Indian businesses only.