“An attacker could gain a foothold into the container running the service and compromise any model converted by the service.”
Safetensors exists because pickle files run code. Hugging Face built a service to convert pickles into Safetensors, and the service loaded the pickles. HiddenLayer showed a malicious model could take over the converter and steal the SFConvertbot token, which can open pull requests on any repository on the site. The safety tool was the attack path.