Unsafe Model Deserialization

Pipelines call pickle-based loaders on third-party checkpoints, tokenizers, or LoRA adapters.

Impact

Model loading becomes a remote code execution primitive.

Why this severity

Impact High × Likelihood High = Critical

Impact high: loading becomes remote code execution. Likelihood high: malicious pickled models with reverse shells were found on Hugging Face (2025 incident).

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: Malicious Models on Hugging Face (MITRE ATLAS case study AML.CS0031, 2025)

Exploited by

Malicious Model Artifacts Threat · Critical severity

Mitigated by

Safe Artifact Loading Policy Guardrail · Fixes critical risks

Remediation

Ban torch.load / pickle.load on untrusted input via lint rules.
Convert legacy checkpoints to safetensors in a sandbox once, then pin.
Set weights_only=True where pickle cannot yet be removed.

How to verify

Static analysis fails CI on banned loader calls.
Sandbox conversion jobs have no network or secret mounts.

Pattern

torch.load(path, weights_only=True)

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM03:2025 Supply Chain

OWASP Top 10 for Agentic Applications 2026

ASI04:2026 Agentic Supply Chain Vulnerabilities

MITRE ATLAS

AML.T0011.000 User Execution: Unsafe AI Artifacts

NIST AI RMF 1.0

MAP 4.1 Risks of AI components, including third-party data and software, are mapped