The Untrusted Download: How AI Model Files Execute Arbitrary Code

PyTorch's pickle-based model serialization creates a critical vulnerability where loading any .pt file triggers arbitrary code execution—a flaw already exploited in real attacks discovered on HuggingFace in 2023. This represents a fundamental supply chain security crisis as machine learning practitioners routinely download pre-trained models from untrusted sources without protection. Addressing this requires both immediate technical defenses like code scanning and cryptographic signing, and industry-wide acknowledgment that the current model distribution trust model is broken.