FORMATS
Some files run code
Python's own documentation warns that malicious pickle data can execute arbitrary code when it is loaded. Many model files are built on pickle.
Check a fileA model file is software, not just data.
Open-source AI models are shared as downloadable files. Some common formats can run code the moment they are opened, so UK security guidance treats models like any other part of the software supply chain.
- Prefer safer formats
- Know where it came from
- Check the hash
- Three habits for open models
THE SHORT ANSWER
Treat a model
like code.
Model files can hide instructions.
Guidance focuses on format, source and checks.
PROVENANCE
Know the supplier
The NCSC asks for models from verified commercial, open source and other third-party developers, held to the same standard as other software.
Habits to try
CHECKS
Match the hash
The UK AI Cyber Security Code says developers shall release cryptographic hashes for shared model components, so others can verify them.
See the numbers
FOUR HABITS TO TRY
Open models,
loaded with care.
None of these needs special tools. They follow the supply chain and documentation principles in UK guidance for anyone who builds with AI models made by others.
Prefer a safer file format
Where a model is offered in more than one format, choose one designed to hold weights only, such as safetensors, over pickle-based files.
Check who published it
Take models from developers you can verify, and look for documentation of training data, intended scope, limitations and failure modes.
Compare the hash
If the publisher lists a cryptographic hash, check that your downloaded copy matches it before you use the file.
Test it yourself
Re-run your own evaluations on a released model before relying on it, and again when you update to a new version.
TWO NUMBERS WORTH KNOWING
The risk is rare,
the weak format is not.
One figure on real malicious models,
one on how widely the riskier format is still used.
91 models
Found while monitoring 705K+ models
A tool deployed for over three months on a mirrored model hub monitored more than 705,000 models and 176,000 datasets, and found 91 malicious models and 9 malicious dataset loading scripts.
MALICIOUS MODELS · ASE 2024
44.9%
Popular models still using pickle
Researchers reported in 2025 that 44.9 percent of popular models on a major model hub still use the insecure pickle format, and that model scanners give both false positives and false negatives.
PICKLE FORMAT · 2025 STUDY
Threats the 2024 study found included reverse shells, browser credential theft and system reconnaissance. Sources: Zhao et al. (2024), arXiv:2409.09368; Kellas et al. (2025), arXiv:2508.15987.
A QUICK FILE CHECK
What are you
about to load?
Pick the kind of download to see how much caution the guidance and research point to. The bar shows the level of care before loading.
Based on the Python pickle documentation, the UK AI Cyber Security Code of Practice and peer-reviewed research on model hubs. General information, not a security audit.
WHAT THE UK CODE ASKS
Thirteen principles,
one supply chain.
The UK government published a voluntary Code of Practice for the Cyber Security of AI on 31 January 2025. Its 13 principles run from raising awareness of AI threats to disposing of data and models properly, and it says it applies to proprietary and open-source models alike.
The Code builds on the NCSC's Guidelines for secure AI system development from November 2023, which were endorsed by 19 international partners. It was submitted to ETSI as the basis of a global standard, TS 104 223.
In conversation
Questions people ask
Can an AI model file really contain malware?
Yes, in some formats. Python's documentation warns that malicious pickle data can execute arbitrary code during unpickling, and a 2024 study found 91 malicious models while monitoring more than 705,000 on a mirrored model hub.
What is safetensors?
Its documentation describes it as a simple format for storing tensors safely, as opposed to pickle, that is still fast. It is designed to hold the model's numbers rather than code that runs on loading.
Is a model safe because a scanner passed it?
Not necessarily. A 2025 study reported that model scanners have both false positives and false negatives, so scanning works best alongside a safer format and a trusted source.
What does checking a hash do?
A cryptographic hash lets you confirm that your copy is the same file the developer released. The UK AI Cyber Security Code says developers shall release hashes for model components shared with others.
Does the UK Code apply to open-source models?
Yes. The voluntary Code says its stakeholder roles apply to all AI technologies, including proprietary and open-source models, though some developer provisions are less applicable to open-source models.
Sources
Each figure on this page comes from the sources below.
- Python documentation: pickle, Python object serialization (security warning)
- Safetensors documentation
- NCSC: Guidelines for secure AI system development, secure development
- GOV.UK: Code of Practice for the Cyber Security of AI (2025)
- Zhao et al. (2024): Models Are Codes, malicious code poisoning on pre-trained model hubs (arXiv)
- Kellas et al. (2025): PickleBall, secure deserialization of pickle-based ML models (arXiv)