Case nullifai-hugging-face-pickleAI supply chainWorldwide
nullifAI: broken-pickle models on Hugging Face evade Picklescan and carry reverse shells
ReversingLabs found two Hugging Face models whose 7z-compressed, deliberately corrupted pickle streams hid a reverse shell to a hard-coded IP while passing Hugging Face's Picklescan checks.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 6, 2025
- Location
- Worldwide
- Target
- Hugging Face Hub users loading PyTorch models
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
ReversingLabs found two Hugging Face models whose 7z-compressed, deliberately corrupted pickle streams hid a reverse shell to a hard-coded IP while passing Hugging Face's Picklescan checks.
Impact: Two models with a platform-aware reverse shell to 107.173.7.141 were publicly hosted and undetected by Picklescan, ProtectAI and ClamAV scanning; no confirmed victims
Who triggered it
Actor: Unknown
Attribution: Uploaded by accounts glockr1 and who-r-u0000; ReversingLabs assessed the models as closer to a proof of concept than an active campaign and did not attribute them
Motive: Unknown; payload gave remote shell access to any machine that deserialised the model
How it happened
Attack vector: PyTorch model files packed with 7z instead of ZIP and a pickle stream broken after the malicious opcodes, so scanners errored out before flagging the embedded reverse shell
Root cause: Pickle deserialisation executes arbitrary code by design; Picklescan stopped analysing on malformed streams and did not recognise non-ZIP archives
Timeline
- ReversingLabs reports the two malicious repositories to Hugging Face
- Hugging Face removes the models within 24 hours and updates Picklescan to handle broken pickle files
- ReversingLabs publishes the nullifAI technique write-up with indicators of compromise
Response
Hugging Face removed the repositories and patched Picklescan; ReversingLabs published IOCs and urged use of safetensors over pickle-based formats
Current status: Patched
Sources (open in a new tab)
- ReversingLabs reversinglabs.com
- The Hacker News thehackernews.com
- Help Net Security helpnetsecurity.com
Cite this case
nullifAI: broken-pickle models on Hugging Face evade Picklescan and carry reverse shells. AI Threat Watch, case nullifai-hugging-face-pickle, Feb 6, 2025. https://aithreat.io/cases/nullifai-hugging-face-pickle/
Permanent link: https://aithreat.io/cases/nullifai-hugging-face-pickle/