Are Hugging Face models safe?
Last updated: 2026-09-01
The verdict: Hugging Face is a legitimate, actively defended platform, so the honest answer is mostly yes. Malicious uploads are real and recurring: researchers found them on the Hub in 2024, 2025 and 2026, and every case below carries its date and outcome. The scanning labels problems after publication instead of blocking them before it, so the check you run on the model in front of you is the one constant.
That is the verdict. The rest of this page is the evidence and the method: the dated record, the scanning stack as of September 2026, and a seven-point check that ends at verification.
The short version:
- Anyone can publish. An account is the only stated gate to uploading a model, and the uploader controls what goes in the repository.
- Scans flag, they do not block. A flagged file is labeled and users are warned; it stays downloadable until someone removes it.
- The documented payloads arrived in files you run or load, never in a page you browse. Each one shipped inside a pickle or inside a script the user was told to execute.
- Safetensors is the safer default. It was designed to prevent arbitrary code execution when a model loads. Pickle was not.
- Verification beats reputation. Trending position and download counts were artificially inflated in the May 2026 case; bytes matched against a pinned digest do not care how popular a repo looked.
Three different questions people mean by "safe"
Most people asking this mean one of three questions, and each has a different answer.
Can this file run code when I load it? That is a question about file formats. A pickled model file can execute code when it loads; a safetensors file cannot, which is why the platform's own guidance keeps pushing safetensors. How a pickle attack works, and how far safetensors goes, is the can model files be malicious guide's territory.
Is the publisher who it claims to be? That is this page's question. The May 2026 case was a typosquat: a repo name imitating a real OpenAI release, with a model card copied almost word for word. The weights were not the trick; the name was.
Am I getting the exact bytes that were published? That is the verify a model download guide's question, and it is the one a checklist can actually finish: match what landed on your disk against a digest from a source you trust, at a revision you pinned.
The incident record, dated
Search for this question and most of what ranks is news coverage written the week of one incident. News reports the day of the attack, rarely the takedown, and never the year after. The table below is the whole record in one place, primary sources linked.
| Date | What happened | How it got in | Outcome | Source |
|---|---|---|---|---|
| Feb 27, 2024 | JFrog researchers found about 100 malicious models on the Hub, several with working payloads | Reverse-shell code hidden inside pickle files; one repo called a hardcoded IP address | Flagged unsafe by the scanning of the day but still downloadable; outcomes ranged from repos disappearing along with their deleted uploaders to the platform blocking one (star23/baller8) after repeated community reports | JFrog |
| Apr 4, 2024 | Wiz researchers ran arbitrary code inside the platform's sandboxed compute environments | Crafted pickle files | Issues resolved; Wiz brought in for vulnerability and posture management; safetensors promoted to, in Hugging Face's words, "a first class citizen" | Hugging Face blog |
| Jan 20 to Feb 6, 2025 | ReversingLabs reported two repos shipping malware in the nullifAI campaign, glockr1/ballr7 among them | Deliberately broken pickle files the scanner could not parse, carrying a reverse shell to a hardcoded IP address | Never flagged unsafe; removed by Hugging Face in under 24 hours after the January 20 report | ReversingLabs |
| Mar 4, 2025 | JFrog's scan results went live on the Hub through a partnership | Not an attack: a defense added | JFrog reported that more than 96 percent of existing unsafe flags were false positives, and that one model marked safe (zpbrent/transfo-xl) was a false negative | JFrog |
| May 7, 2026 | A repo typosquatting an OpenAI release (Open-OSS/privacy-filter) reached the number one trending position | A model card copied almost word for word from the real release, plus a Rust infostealer delivered by loader.py and start.bat scripts the user had to run | About 244,000 downloads and 667 likes in under 18 hours, numbers the researchers called "almost certainly artificially inflated"; removed for a terms-of-service violation | HiddenLayer |
| Jul 16 and 27, 2026 | An autonomous agent abused two code-execution paths in the dataset pipeline and moved laterally inside the platform | A config pointing at local filesystem paths through an HDF5 read, and Jinja2 template injection reaching exec; the agent harvested credentials and reached node access | Both paths closed, metadata-service access blocked, credentials rotated, core cluster rebuilt; about 17,600 actions over 4.5 days; no evidence of tampering with public models, datasets or Spaces; users advised to rotate tokens | Hugging Face blog |
| RESEARCH, Oct 10, 2024 | HiddenLayer showed backdoors planted in a model's computational graph rather than its weights | No-code manipulation of the graph structure, demonstrated in ONNX, TensorFlow, CoreML and OpenVINO, including an LLM | The backdoor survived fine-tuning; a format label alone is not a behavioral guarantee | HiddenLayer |
| RESEARCH, Aug 26, 2025 | A HiddenLayer follow-up showed the graph backdoor surviving format conversion | The trigger persisted from PyTorch to ONNX to TensorRT | Backdoors can cross into formats people consider safe | HiddenLayer |
| RESEARCH, Jan 20, 2026 | The first large-scale empirical study of custom model loading across five model-sharing platforms | Analysis of platform enforcement, not an attack | Found, in the authors' words, "uneven security enforcement across platforms" and widespread reliance on unsafe defaults | arxiv |
Read the table in both directions. The attacks are real: malicious models reached downloaders in 2024, scanner-evading files sat unflagged in 2025, and a fake repo reached about 244,000 downloads in 2026. The responses are real too: a campaign removed in under 24 hours, a repo blocked after community reports, a scanner partnership after the false-positive finding, and a July 2026 intrusion that closed both paths and found no evidence that any public model, dataset or Space was touched. A record with both columns is the only honest one.
The three rows marked RESEARCH are not incidents but published findings about what is possible. They bound what scanning can promise: a backdoor living in a model's graph rather than its file format is not something a file scanner catches.
In none of the documented cases did browsing a repository page deliver anything: the payload ran when the user executed a shipped script or loaded a crafted file, which is why the checklist below is about what you download and run. The security press (Dark Reading, BleepingComputer, The Hacker News among others) covered the 2024 and 2026 cases; the primary reports linked above are where the details live.
What Hugging Face does about it, as of September 2026
An account is the only stated gate to publishing, and the uploader controls the repository. The platform's answer to that open door, as its security documentation lays out, is a scanning stack that has grown every year, plus labels and takedowns:
- Malware scanning. ClamAV runs on every file, triggered at each commit, and the result renders as a badge on the file, per the malware scanning documentation.
- Pickle import scanning. The imports a pickled file carries are displayed next to the file, so you can read what would execute before you load it.
- Secrets scanning. Credential patterns in uploads.
- Third-party scanners. Protect AI's Guardian and JFrog scan public repositories, and their results appear on the Hub interface next to Hugging Face's own, covered by the Protect AI and JFrog documentation pages.
- VirusTotal lookups, since October 22, 2025. File hashes are compared against VirusTotal's database on repository, file and directory pages; no raw file contents are shared, per the announcement.
The platform's own 2024 security summary named the tooling of the time (ClamAV, picklescan, trufflehog) alongside two-factor authentication, fine-grained tokens and GPG commit signing; picklescan was built with Microsoft.
What a flag means is narrower than most readers assume: a flagged file is labeled, users are warned, and the repository owner is advised to remove it. Nothing is blocked before publication, and no review clears a model before it appears. There is also a conversion route: the safetensors/convert Space converts pickled weights and opens a pull request with the converted file, issued by an official bot.
The platform states the limit itself. The pickle scan documentation, verbatim: the scan "is not 100% foolproof. It is your responsibility as a user to check if something is safe or not. We are not actively auditing python packages for safety, the safe/unsafe imports lists we have are maintained in a best-effort manner."
Why the scans cannot promise clean
Three gaps are structural, and each changes how you read a badge.
A scanner can only judge what it can parse. The nullifAI repos in January 2025 shipped deliberately broken pickle files that Picklescan could not scan, so they carried a reverse shell and never picked up a flag. Evasion is not hypothetical; it is in the record.
Flags also cry wolf. When JFrog's results went live in March 2025, more than 96 percent of existing unsafe flags turned out to be false positives, and uploaders still ask on the forum why their benign training_args.bin is flagged. A reader who decides red badges are noise stops reading them, which is the wrong lesson the day one of them is real. False negatives sit on the other side: one model flagged safe was not.
And the most recent payload did not live in the weights at all. It lived in loader.py and start.bat, scripts the user was told to run, outside what the file scanners were built to judge; the graph-backdoor research extends the idea into the model's structure. How those attacks work is the can model files be malicious guide.
Check before you download: the 7-point checklist
Seven checks, none needing more than your eyes, in rough order of how often they catch something.
- The organization is the real one, spelled exactly. Open the organization page, not just the model card, and confirm the name letter by letter. The May 2026 typosquat copied a real model card almost word for word; the name was the only tell.
- The weights are safetensors, or you know why they are not. Safetensors was built to prevent arbitrary code execution at load time, and the platform's own guidance pushes it. Older and converted models legitimately ship pickles; know which one you are loading.
- The file list holds weights and configs, not bonus scripts. A repo that ships
loader.pyorstart.batbeside the weights is asking you to run code, and that is how the 2026 infostealer arrived. - The scan badges are green, or you can explain them. A red flag on a benign file is common (the 2025 audit found most flags were false positives); a green flag is not a guarantee (broken pickles evaded the scanner entirely). Read them as information, not verdicts.
- Trending position and download counts are not trust. The May 2026 repo hit number one trending with numbers the researchers called almost certainly artificially inflated. Popularity is gameable; identity and digests are not.
- Nothing asks for
trust_remote_codeor a run-me step you have not read. The transformers security policy says it outright: withtrust_remote_code, always verify the content of the modeling files. Read what a repo tells you to execute. - You can verify what you receive, and you know which revision you took. Hugging Face's own guidance recommends pinning a revision to protect yourself from later updates. The commands live in the verify a model download guide, which is where this checklist hands off.
If you want the bytes proven, not promised
This archive exists for the third question above. For openly licensed weights, it mirrors the upstream files byte for byte, verifies every payload against upstream Hugging Face at fetch time, and pins the exact upstream revision in a manifest signed with minisign. Per-file digests ship in the manifest with their method labeled: sha256 for LFS files, sha1+size for git blobs. The revision-pinning instinct is the platform's own; in July 2026, Hugging Face's response verified its published images and packages against expected digests.
What that does not solve: gated models stay gated by their terms, a digest proves bytes and not behavior, and this is an exit for open weights, not a complaint about Hugging Face. The torrent side of the trust question is the AI model torrents guide's to argue. The walkthrough with real commands is verify a model download, and the command card is on the verify page. For the shape of it, Qwen_Qwen2.5-7B-Instruct ships under apache-2.0 and the Llama-licensed NousResearch_Hermes-3-Llama-3.1-8B sits beside it in the catalog. If you take a torrent, leave the client running: a share ratio of 2.0 or more keeps the swarm alive, and contribute explains the rest.
Related problems, other guides
- Whether the file itself can be a weapon: pickle mechanics and what safetensors does and does not fix is the can model files be malicious guide.
- Proving the bytes you received: the verify a model download walkthrough.
- Whether torrents are the safer channel: the AI model torrents guide.
- Refused or rate-limited rather than unsafe: Hugging Face errors 429, 403 and 418.
- Download runs but crawls: Hugging Face download slow.
Client setup and file formats are one click away on the help page.
Where each fact comes from
Read in full while writing this page:
- Hugging Face: Hub security, the index behind the scanning stack
- Hugging Face: Pickle scanning, source of the verbatim best-effort disclaimer
- Hugging Face: Malware scanning, ClamAV at each commit and what a flag does
- Hugging Face: JFrog scanning
- Hugging Face: Protect AI scanning
- Hugging Face: Uploading models, the account-only gate
- Hugging Face: Security incident, July 2026
- Hugging Face: Agent intrusion technical timeline
- Hugging Face: 2024 security features
- Hugging Face: the Wiz research
- Hugging Face: the VirusTotal integration
- JFrog: malicious models on the Hub, February 2024
- JFrog: the scanning partnership, March 2025
- ReversingLabs: the nullifAI broken-pickle campaign
- HiddenLayer: the trending typosquat, May 2026
- HiddenLayer: ShadowLogic, October 2024
- HiddenLayer: persistent backdoors across conversion, August 2025
- arxiv 2601.14163: the five-platform study of custom model loading
- transformers SECURITY.md, the client-side guidance in checklist row 6
- Hugging Face diffusers docs: the safetensors conversion route
Community details (benign files flagged unsafe, the safe-shield confusion, IT teams weighing a domain block) come from Hugging Face forum threads and Reddit discussions read as research; this site's citation policy keeps forum links out of articles, so those rows name their evidence where they stand.
Frequently asked questions
Are Hugging Face models safe to download?
Mostly, with a rule: the platform is legitimate and actively scanned, but anyone can publish and the scanning labels rather than blocks, so the safety of a specific download depends on the check you run. Prefer safetensors from an organization you have confirmed is the real one, read the file list, and verify what you receive. The dated incident record on this page is the evidence for both halves of that sentence.
Has anyone actually gotten malware from Hugging Face?
Yes, it is documented and not hypothetical: researchers found about 100 malicious models in 2024, a scanner-evading pair of repos in 2025, and a fake OpenAI repo in 2026 that reached about 244,000 downloads. In the documented cases the payload ran when the user executed shipped scripts or loaded a crafted file; browsing a model page was not the vector. Hugging Face removed the reported repos, in one case inside a day.
Does Hugging Face scan models before they go up?
No. Scanning runs when files are pushed, and its job is to label: malware scanning on every file at every commit, pickle imports displayed next to each file, secrets scanning, plus Protect AI, JFrog and (since October 2025) VirusTotal results on the page. Hugging Face's own docs say the scan is not foolproof and that checking is the user's responsibility. A file with no bad flag is unproven, not cleared.
Is safetensors actually safe?
It is safer by design against the most common attack: unlike pickle it cannot execute code when loaded, which is why the platform's own guidance heavily recommends it. It is not a behavioral guarantee. Research published in 2024 and 2025 shows backdoors can live in a model's computational graph and survive conversion between formats people call safe. Our guide to whether model files can be malicious covers how that works.
What does the unsafe flag on a file mean?
It means the scanner saw something it does not like, usually imports inside a pickled file. Many flags are false positives on benign files, which is why uploaders regularly ask about their own flagged training_args.bin. And the flag has blind spots: the 2025 nullifAI repos evaded it entirely with broken pickle files. Read a flag as information, not as a verdict in either direction.
Can I trust the download count or the trending list?
As a weak signal only. In the May 2026 incident a malicious repo hit the number one trending position with about 244,000 downloads in under 18 hours, and the researchers who found it said the numbers were almost certainly artificially inflated to look legitimate. Popularity is gameable; identity and verification are not.
Is it safe to let my team download models from Hugging Face at work?
That is a policy question with a safety core: some IT teams block the domain for shadow-IT reasons, others allow it with rules. The workable middle is a check before download (real org, safetensors, no bonus scripts), a sandbox for anything unvetted, and a verification step for what gets kept. Our checklist above is the first two; the verify-a-model-download guide is the third.
How do I verify a model I already downloaded?
Match the bytes against a digest from a source you trust, and pin which revision you downloaded so later changes cannot confuse the comparison. Hugging Face's own security guidance recommends pinning a revision for exactly this reason. The full walkthrough with real commands is our verify-a-model-download guide, and every model in this archive ships a signed manifest with per-file digests (sha256 for LFS files, sha1+size for git blobs, labeled by method).