In the wild
nullifAI: malicious Hugging Face models evade Picklescan using broken 7z-compressed pickle files
AIR-2025-0004 AIR record · 2025-02-huggingface-nullifai-pickle
From the supporting source
Pickle files are used broadly, while attackers have taken to abusing Pickle and other unsafe data serialization formats to hide their malicious payloads.reversinglabs.com
The record
Disclosed
2025-02-06
Occurred
2025-01-20
Vendor
Hugging Face
Product
Hugging Face model hub; Picklescan
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target (contested) — malicious pickle in a model artifact; deserialization RCE on load
Attack surface
Other
Autonomy level
Assistant
Initial vector
Malicious model artifact on public hub
Impact type
Arbitrary code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any pipeline loading the two model repos; the evasion class applies to all pickle-format models on the hub
Capability abused
Defense & remediation
Recorded defense
Hugging Face Picklescan
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
models removed within 24 hours; Picklescan improved to handle broken pickle files
Taxonomy & references
Curator notes
ReversingLabs. Repos glockr1/ballr7 and who-r-u0000/0000000000000000000000000000000000000 carried a platform-aware reverse shell to 107.173.7.141. Two evasions: 7z rather than ZIP compression so torch.load() and Picklescan would not open the archive, and a deliberately broken pickle stream whose payload opcodes execute before the deserialization error. RL assesses these as PoC rather than an active campaign. Included because agent pipelines pull models from this hub; not agentic on its own.
Supporting sources
Cite as
Enkrypt AI. "nullifAI: malicious Hugging Face models evade Picklescan using broken 7z-compressed pickle files". AIR, AIR-2025-0004. https://agentincident.vercel.app/i/AIR-2025-0004/ (accessed 2026-10-19).