The Hidden Dangers of Loading AI Models: A Security Audit of Popular ML Frameworks (2026)

If you're loading AI models from the internet — Hugging Face, GitHub, or shared checkpoints — you're running code from strangers. Here's what I found auditing the actual source code of major ML frameworks. The Core Problem: Pickle Is Everywhere Python's pickle module can execute arbitrary code during deserialization. If a .pkl , .pt , or .bin file contains a malicious pickle payload, loading it runs that code with your full permissions. # This innocent-looking line can run ANY code model = torch . load ( " model.pt " ) # ← full RCE if file is malicious Most ML model formats are just pickle with extra steps. Let's look at what each framework does about it. Framework-by-Framework Breakdown PyTorch: The weights_only Flag PyTorch added weights_only=True as a defense: # SAFE: Only loads tensor weights, blocks code execution model = torch . load ( " model.pt " , weights_only = True ) # UNSAFE: Default behavior allows arbitrary code execution model = torch . load ( " model.pt " ) # Default is