Pre-trained AI models are now considered part of critical infrastructure across industries, powering copilots, analytics engines, fraud detection systems, and autonomous workflows.  

But beneath their convenience lies a rapidly expanding attack surface. 

Recent investigations have uncovered a growing number of malicious AI models distributed through public repositories such as Hugging Face and PyPI. What appears to be harmless model weights may in fact contain embedded executable payloads that trigger automatically when the model is loaded, before any inference begins. 

This month’s campaign explores how attackers are weaponizing machine learning model files, why the ecosystem is particularly vulnerable, and what defenders must do to secure the AI supply chain. 

Understanding the threat 

The root of this risk lies in how many popular ML frameworks serialize models. 

Nearly half of the widely used public models still rely on Python’s pickle format. Pickle is not just a data storage format; it implements a stack-based virtual machine capable of executing arbitrary code during deserialization. When a developer runs torch.load() on a downloaded .pth file, that call internally triggers pickle.load(), executing any embedded opcodes automatically. 

This collapses the trust boundary between “model data” and executable code. 

In practice, this means: 

• A model file can spawn reverse shells 

• It can steal cloud credentials 

• It can deploy ransomware 

• It can establish C2 channels before any model inference takes place 

Because model loading is considered routine developer activity, these attacks often evade suspicion. 

Why is this threat escalating?  

The AI model ecosystem has exploded in size and adoption. According to the HiddenLayer 2025 AI Threat Landscape Report:  

• 97% of organizations now use models from public repositories 

• Organizations average over 1,600 models in production 

• Only 49% scan models before deployment 

• 45% of AI breaches in 2024 were traced to malware from public repositories 

Threat actors have taken notice. Documented campaigns include: 

• Malicious PyPI packages downloaded thousands of times within hours 

• Nation-state-linked operations deploying Go-based RATs over Cloudflare tunnels 

• Supply chain abuse leading to alleged exfiltration of terabytes of corporate data 

The progression from academic proof-of-concept to active exploitation by advanced threat actors demonstrates a clear and accelerating trajectory. 

Anatomy of the attack chain 

The attack chain unfolds in four deliberate stages, transforming a seemingly harmless model download into full system compromise: 

1. Weaponization: The attacker embeds malicious code inside a model file using pickle exploitation, bytecode injection, or steganographic techniques. 

2. Distribution: The weaponized model is uploaded to public repositories (e.g., Hugging Face, PyPI) using typosquatting, impersonation, or namespace abuse. 

3. Execution: A developer downloads and loads the model, triggering automatic code execution during deserialization (torch.load() → pickle.load()). 

4. Post-exploitation: The payload establishes C2, steals credentials, deploys malware or ransomware, and enables lateral movement within the environment. 

What you’ll learn 

This campaign breaks down the technical mechanics behind malware hidden in AI models and equips defenders with the insight needed to detect, prevent, and respond to this emerging supply chain threat. 

Here’s what you’ll learn:  

• Why pickle-based serialization enables automatic code execution 

• Real-world malware patterns used in weaponized AI models 

• How nation-state and criminal actors distribute malicious models 

• The full attack lifecycle from upload to ransomware deployment 

• Defense-in-depth mitigation strategies 

Access this campaign and several hands-on labs for free and put theory into practice!