# HuggingFace Unsafe Model Artifact Load Instruction

- **Severity:** Critical
- **Signature ID:** `b6a4ebe0-e701-45a5-92aa-111954edc8c8`
- **CVEs:** CVE-2019-20907
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0011.000 (Unsafe AI Artifacts)
- **OWASP:** ASI03 (Identity and Impersonation), ASI07 (Unsafe Autonomous Code Execution), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

An AI agent is instructed — either by a prompt or by a malicious tool response — to download and load a model file that can run arbitrary code the moment it's opened. This works because Python's pickle format, used by many PyTorch model files, executes code embedded inside it during loading, not just when it's explicitly run.

## How the attack works

An attacker plants a malicious file (.pkl, .pt, .pth, or an outright binary like .exe/.so/.dll) in a HuggingFace Hub repository, or crafts an MCP tool response that names such a file. The agent is told to fetch it with something like hf_hub_download() and then load it with pickle.load(), torch.load(), or an unsafe from_pretrained(weights_only=False) call. Because pickle deserialization can invoke arbitrary Python objects via __reduce__, opening the file executes the attacker's code inside the agent's environment. No separate 'execute' step is needed — loading is executing.

## Why it matters

Arbitrary code execution in the agent's runtime, which can lead to credential theft, lateral movement, or full compromise of whatever system the agent operates on — triggered by something that looks like a routine model download.

## What you can do

- Only load model weights from repositories you trust and have verified, ideally pinned to a specific commit hash with checksum verification.
- Prefer safetensors or other non-pickle formats for model weights; reject .pkl/.pt/.pth files from unverified sources.
- If you must use torch.load, always pass weights_only=True and never load pickle-based files from untrusted repos.
- Restrict what file types and file operations an agent's tools are allowed to fetch or execute, and review MCP tool responses before granting them ability to trigger downloads.

## Known benign look-alikes

- Legitimate ML pipeline loading trusted internal model checkpoints with verified checksums
- Security research analyzing pickle-based attacks in a defensive study (reading file listing, not executing)
- torch.load call using weights_only=True which prevents arbitrary code execution (safe pattern)
- Documentation explaining why pickle loading is unsafe (not instructing an agent to do it)
- huggingface_hub.list_repo_files in an audit script to check for dangerous extensions before downloading

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00398
- https://github.com/NVIDIA/garak/blob/main/garak/probes/fileformats.py
- https://huggingface.co/docs/hub/security-pickle
- https://github.com/pytorch/pytorch/blob/main/SECURITY.md
- https://nvd.nist.gov/vuln/detail/CVE-2019-20907

---
Source: https://www.netzilo.com/threats/atr-huggingface-unsafe-model-artifact-load-instruction