{
 "public_id": "AIR-2025-0004",
 "incident_id": "2025-02-huggingface-nullifai-pickle",
 "date_disclosed": "2025-02-06",
 "date_occurred": "2025-01-20",
 "title": "nullifAI: malicious Hugging Face models evade Picklescan using broken 7z-compressed pickle files",
 "class": "in_the_wild",
 "attack_surface": "other",
 "initial_vector": "malicious_model_artifact_on_public_hub",
 "agent_capability_abused": [
  "model_loading",
  "deserialization"
 ],
 "target_product": "Hugging Face model hub; Picklescan",
 "target_vendor": "Hugging Face",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "arbitrary_code_execution"
 ],
 "blast_radius": "any pipeline loading the two model repos; the evasion class applies to all pickle-format models on the hub",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI04"
  ],
  "mitre_atlas": [
   "AML.T0010"
  ],
  "labels": [
   "model_supply_chain",
   "pickle_rce",
   "scanner_evasion"
  ]
 },
 "defense_present": "Hugging Face Picklescan",
 "defense_bypassed": true,
 "fix_shipped": "models removed within 24 hours; Picklescan improved to handle broken pickle files",
 "primary_sources": [
  "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face"
 ],
 "verified_quote": "Pickle files are used broadly, while attackers have taken to abusing Pickle and other unsafe data serialization formats to hide their malicious payloads.",
 "confidence": "high",
 "notes": "ReversingLabs. Repos glockr1/ballr7 and who-r-u0000/0000000000000000000000000000000000000 carried a platform-aware reverse shell to 107.173.7.141. Two evasions: 7z rather than ZIP compression so torch.load() and Picklescan would not open the archive, and a deliberately broken pickle stream whose payload opcodes execute before the deserialization error. RL assesses these as PoC rather than an active campaign. Included because agent pipelines pull models from this hub; not agentic on its own.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": true,
 "agency_reason": "malicious pickle in a model artifact; deserialization RCE on load",
 "vector_family": "malicious_component",
 "vector_detail": "malicious_model_artifact_on_public_hub",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.T0010"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI04 (vector_family=malicious_component)",
 "submitted_by": "EAI Internal"
}