“While Hugging Face conducts scans on pickle models, it doesn’t outright block or restrict them from being downloaded, but rather marks them as “unsafe””
JFrog counts around 100 Hugging Face models with real malicious payloads. One PyTorch file from a user called baller423 opened a reverse shell to 210.117.212.93 the moment torch.load() ran. Hugging Face’s defence is a warning label. A pickle file is a program, and the industry keeps calling it a model.