Your AI Model Is A Program. Start Implementing It Like One

Kriti Faujdar, Lead Product Manager, Agentic Systems at Yelp, Speaks and writes about AI Safety and Security, Start up advisor.

​In early 2025, researchers at ReversingLabs found machine learning models on Hugging Face that carried malicious code. The malicious payload was a reverse shell to a hardcoded IP address when it loaded. The file was built to bypass the hub’s automated scanner. It used a compression trick the scanner couldn’t parse, so the scan ran and passed it.

Most business leaders still picture an AI model as a static data file, but loading one means executing code. A company with no controls on how models arrive is carrying an exposure it never accounted for.

Why Model Files Are Executed Software

Opening many common model files runs whatever code is packed inside them, just like installing a program. Loading a pickle-based model file runs the instructions stored inside it, so whoever built the file decides what code runs on your machine.

Python’s own documentation says the pickle module is insecure and warns against unpickling data you don’t trust.

PyTorch went further. In version 2.6, released January 29, 2025, the project switched torch.load to weights-only loading by default, accepting a change that broke backward compatibility to get there. An external model file is an untrusted input, and the maintainers have built that assumption into the defaults.

As of April 2025, Protect AI and Hugging Face had scanned 4.47 million model versions and reported roughly 352,000 unsafe or suspicious findings across about 51,700 models. Those flags are conservative by design and ignore intent, so they don’t mean 51,700 malicious models. JFrog’s 2024 analysis gives a better count of actual threats: after filtering out false positives, it found around 100 genuinely malicious instances, any one of which is enough if you load it.