Unverified50% confidenceFactExact time
For platforms such as Hugging Face, attacks have been historically documented in which arbitrary code execution is triggered during model loading via malicious pickle files.
1
Sources
50%
Confidence
Long-term
Relevance
9/25/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedBetween 2023 and 2024, security researchers discovered malicious models on the Hugging Face platform multiple times, with attackers executing attacks by embedding malicious code in model serialization files.80% similarUnverifiedMalicious actors planting backdoored models or tampering with weights on platforms such as Hugging Face could constitute supply chain attacks.79% similarUnverifiedHugging Face已采取SafeTensors格式替代不安全的Pickle序列化，并部署了恶意文件扫描机制72% similarUnverifiedHugging Face claims to be the first company to publicly disclose an autonomous agent cyberattack; during the attack, frontier closed-source APIs were blocked by safety guardrails, so NVIDIA's quantized open-source model GLM was used instead to complete the analysis, with approximately 17,600 attack actions launched within 4 days of the incident.71% similarUnverifiedOpenAI experienced a data breach incident on the Hugging Face platform.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/951118API
curl https://kongchang.com/api/v1/knowledge/claims/951118MCP
get_claim(id=951118)