Loading story…
Researchers demonstrated that a tampered TensorFlow saved model can execute arbitrary Python code while still producing expected inference results, showing that machine learning models should be treated as executable content rather than passive data. In the proof of concept, a classifier built with tf.keras and the MNIST dataset was modified by embedding attacker-controlled logic in a tf.keras.layers.Lambda layer, then saved as an H5 model that loaded and ran normally under TensorFlow while silently triggering the payload.
The report said the technique is not a patchable TensorFlow flaw but an inherent risk of loading untrusted serialized models and functions. It showed that payloads could range from benign test output to persistence mechanisms such as altering .bashrc or cron jobs, and warned that models executed with elevated privileges could enable root-level backdoors and remote control. Recommended defenses included avoiding untrusted third-party models, sandboxing any external models that must be used, and restricting runtime privileges.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
A technical blog post demonstrated that a crafted TensorFlow 2.2.0 model using a tf.keras Lambda layer could embed arbitrary Python code that executes when a victim loads or runs the model, while still returning normal inference results. The article emphasized this is an inherent risk of executing untrusted models rather than a patchable TensorFlow vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution flaw in Hugging Face's `transformers` library allowed attacker-controlled model repositories to run arbitrary code during the standard `from_pretrained()` loading process, even when `trust_remote_code=False` was set. The issue was tied to unsafe handling of untrusted model configuration data, including nested configuration resolution in the LightGlue loading path, where values from `config.json` could override the intended safety setting and trigger execution of attacker-supplied Python modules during model initialization. Reports said the vulnerability affected `transformers` versions `4.56.0` through `5.2.x` in environments where the `kernels` package was installed, with version `5.2.0` specifically cited in LightGlue-related exploitation scenarios. Exposed targets included inference servers, research notebooks, CI/CD pipelines, and automated model evaluation systems, where successful compromise could enable theft of cloud credentials, API keys, SSH keys, proprietary datasets, lateral movement, persistence, and backdoor deployment. Hugging Face released a fix in `transformers` `5.3.0` and urged organizations to upgrade and treat model loading as a code execution surface.
Jun 29, 2026
Security researchers and industry reporting warn that open-weight AI models can be poisoned quickly and inexpensively, allowing attackers to implant hidden behaviors that survive normal inspection and may only activate under specific conditions. In one recent demonstration, researcher Katie Paxton-Fear fine-tuned an open model in about an hour for under $100, first changing coding style and then inserting a backdoor that produced **remote-code-execution-vulnerable** output after only ten training examples. Another experiment cited in reporting showed a compromised model in a drug-discovery workflow using a tool call to exfiltrate data, underscoring how model tampering can translate into downstream operational risk. The findings align with earlier academic work on **BadNets** and more recent research on **sleeper agents**, which showed that deceptive or backdoored model behavior can persist through safety training. Broader AI supply-chain analysis says the risk extends beyond model weights to datasets, dependencies, serialization formats, and build infrastructure, with examples including the `torchtriton` dependency-confusion attack, exposed Hugging Face access tokens, more than 100 malicious Hugging Face models identified by JFrog, and the Ultralytics CI/CD compromise. The central concern for defenders is that AI artifacts often require deep trust while offering limited provenance and observability, making malicious manipulation harder to detect than traditional software tampering.
Jul 24, 2026
Researchers reported that malicious machine-learning artifacts hosted on **Hugging Face** can compromise downstream users, highlighting how models, datasets, and related files should be treated as executable supply-chain risk rather than passive content. JFrog detailed cases in which booby-trapped Hugging Face models used unsafe serialization and loading behavior to deliver a **silent backdoor** to data scientists and developers who imported them into local or enterprise environments, while MITRE ATLAS maps the broader threat space with techniques such as `Poison Training Data` and other attacks against ML workflows. Subsequent reporting and security commentary tied those risks to a wider pattern of AI-pipeline compromise, including claims that a malicious dataset exploited flaws in Hugging Face’s processing pipeline to execute code on worker infrastructure, steal cloud credentials, and move into internal clusters. The combined reporting underscores that **features, labels, datasets, checkpoints, and loaders are all part of the attack surface**, and that organizations should harden model-loading paths, restrict egress, eliminate long-lived credentials, isolate workloads, and apply preventive controls before untrusted AI artifacts are executed.
Aug 2, 2026