HF Remote-Code Model Init Spawns Executable Payload

How the attack works

An attacker publishes a model repository whose config.json overrides trust settings to force remote code execution during model initialization. When a victim loads the model, the transformers library writes the attacker's Python module into its local module cache and imports it. That import runs attacker code as a side effect, not because the model was explicitly invoked. The imported module then spawns a separate process (e.g. a shell command or script) to carry out the actual payload. This rule reconstructs that sequence indirectly: it watches for reads of the untrusted config and the cached remote-code file, then looks for a child process spawned by that same session shortly afterward.

Netzilo detection

Why it matters

An organization that loads an untrusted or compromised model gets arbitrary code execution on the machine doing the loading — potentially a developer workstation, CI runner, or inference server — with no explicit 'run this model' consent step beyond the initial load.

What you can do

• →Never load models with trust_remote_code=True unless you have reviewed the actual Python source in that repository, not just its listed description.
• →Pin model repositories to specific commit hashes and re-review the code on every update, since the config and remote code can change after initial vetting.
• →Load untrusted models in an isolated, network-restricted sandbox or container with no access to secrets or production systems.
• →Review any process spawned within minutes of a model load in your logs, especially shell commands, compilers, or network tools invoked by the same session.

Known benign look-alikes

• Teams that deliberately load remote-code models (trust_remote_code=True by policy) whose custom modeling code legitimately shells out at import time — building CUDA/Triton kernels, running chmod +x on a bundled binary, or invoking python -c for an extension autobuild (flash-attn style).
• Jupyter/Colab kernels where one cell imports a remote-code model and a later cell in the same kernel runs !pip / !curl / !git within the 5-minute window; same process lineage, unrelated intent.
• CI/CD runners that download a remote-code model and then execute unrelated shell steps from the same runner shell inside the window.
• Vendor SDK wrappers that spawn ssh/scp to stage model weights to a distributed-training node immediately after the first import.

References

• https://attack.mitre.org/techniques/T1059/006/
• https://attack.mitre.org/techniques/T1195/001/
• https://huggingface.co/docs/transformers/en/custom_models

Related threats