COORDINATED DISCLOSURE
nullifAI: malicious PyTorch models evaded pickle scanning on Hugging Face
Researchers found two Hugging Face-hosted model files with malicious pickle payloads that could reach web shells when loaded in an unsafe environment.
What this was
Coordinated disclosure / AI supply-chain exposure—not a confirmed active compromise of Hugging Face and not a claim that an AI agent conducted an intrusion.
What happened
Researchers identified two Hugging Face-hosted PyTorch models containing malicious pickle payloads linked to web shells at a hard-coded IP address. The malformed files exploited a scanner weakness: Python can deserialize pickle opcodes until an error later in the stream, while the scanner at the time stopped after validation failure. The reported remediation changed Picklescan to continue collecting imports as far as possible in broken pickle files. Reporting described the models as closer to proof-of-concept artifacts than evidence of an active attack; the models were removed and Picklescan was updated.
Why an agent changes the risk
Model supply chains are part of the agent threat surface. An unattended workflow that selects, downloads, or loads a community model can turn a malicious artifact into code execution on a notebook, CI runner, tool worker, or agent host with credentials and network access.
How to test for this
- Test model-intake pipelines only in sandboxes. Reject pickle-based weights by policy where possible and prefer non-executable formats such as safetensors.
- Pin model revisions to verified commits, check publisher identity and hashes, and test downgrade, typosquatting, and malicious-update paths before automation trusts a new artifact.
- Run model conversion, loading, and agent workers with least privilege, network restrictions, short-lived scoped credentials, and alerts for outbound connections or unexpected process execution.
Other cases
CONFIRMED INTRUSION
Hugging Face, July 2026: an autonomous agent ran the intrusion end to end
A malicious dataset chained two code-execution paths into node-level access and lateral movement across internal clusters, driven by an attacker framework that executed roughly 17,000 individual actions.
CONFIRMED INTRUSION
Vercel, April 2026: a small third-party AI tool became everyone's problem
An attacker compromised Context.ai, then used an employee's Google Workspace OAuth grant to reach Vercel's internal systems and decrypt non-sensitive environment variables.
SUPPLY CHAIN COMPROMISE
LiteLLM, March 2026: a compromised scanner poisoned an AI gateway
TeamPCP compromised the Trivy CI pipeline, used that access to obtain LiteLLM's PyPI publishing tokens, and shipped a credential stealer in two releases of a package with roughly 95 million monthly downloads.
COORDINATED DISCLOSURE
Opening a repository was enough: pre-trust execution in a coding agent
A repository-controlled config file made a coding agent run attacker commands before its own trust dialog appeared, turning cloning a project into code execution.
CONTROLLED EVALUATION
OpenAI Operator: indirect prompt injection becomes an action risk
OpenAI’s published red-team work shows how untrusted content can influence a browser-using agent that can operate tools or move data.
CONTROLLED EVALUATION
Anthropic’s agentic-misalignment evaluation: model access can resemble an insider threat
Anthropic’s fictional corporate simulations test what can happen when a tool-using model has sensitive context, external actions, and a deliberately constructed goal conflict.
VENDOR-REPORTED DISRUPTION
Anthropic’s cybercrime disruption report: an agent can amplify a human attacker
Anthropic reported disrupting accounts that used Claude Code to assist a human-directed cybercrime operation, from reconnaissance through extortion support.