Unsafe AI Artifacts
Sub-technique of AML.T0011 — User Execution
Adversaries may develop unsafe AI artifacts that when executed have a deleterious effect. The adversary can use this technique to establish persistent access to systems. These models may be introduced via a AI Supply Chain Compromise.
Serialization of models is a popular technique for model storage, transfer, and loading. However, this format without proper checking presents an opportunity for code execution.
> curated attacks (3)
Fake OpenAI 'Privacy Filter' Model on Hugging Face Pushes Infostealer
A repository typosquatting OpenAI's Privacy Filter release copied the model card nearly verbatim and shipped a loader that fetched and ran infostealer malware. It hit #1 trending on Hugging Face with 244,000+ downloads in under 18 hours.
nullifAI: Malicious Pickle Models Evading Hugging Face Scanning
Two models on Hugging Face carried reverse-shell payloads in broken Pickle files, deliberately malformed and 7z-compressed to slip past Picklescan. Loading the model opened a connection back to the attacker — RCE via the model artifact itself.
Organization Confusion on Hugging Face: Impersonation to Reverse Shell
A researcher registered Hugging Face organization accounts impersonating real companies. Employees uploaded private models to the fake orgs — which could be swapped for poisoned models carrying reverse-shell payloads that execute when loaded.