Models and model files: pickle vs safetensors

As of September 2026

A "model" on Hugging Face is really just a set of files — mostly huge lists of numbers, the model's learned weights, plus some configuration describing how to use them. The format those numbers are saved in sounds like a technical footnote, but it decides whether downloading a model is completely safe or a genuine security decision. This page covers why, and how it connects to the July 2026 attack even though that attack didn't go through a model file at all.

What's actually in a model file

Strip away the AI framing and a model checkpoint is mostly arrays of numbers — the weights a neural network learned during training — plus a small amount of metadata describing the model's shape. How those numbers get written to disk and read back is a serialization format, and Hugging Face has hosted models in more than one over the years. Two matter here: Python's built-in pickle format, and Hugging Face's own safetensors format.

Pickle: convenient, and risky

Pickle is Python's native way to save almost any Python object to disk and load it back later. That generality is the problem: loading ("unpickling") a pickle file doesn't just read data, it replays a sequence of instructions, and those instructions are allowed to import modules and call functions. A pickle file can therefore be crafted so that the moment someone loads it — often with a single line of code — it runs arbitrary code on their machine, no different in effect from running a program they downloaded from a stranger. Many older Hugging Face model checkpoints (PyTorch .bin files) use pickle under the hood, which is exactly why this became a known risk in the model-sharing world well before 2026.

Safetensors: numbers only

Safetensors is a format Hugging Face built specifically to remove that risk. A safetensors file stores only tensor data and metadata — no instructions, no opcodes, nothing that gets "run". Loading one is closer to opening a spreadsheet than running a program: the reader parses a header describing the tensors' shapes and types, then copies the numbers into memory. There is no step in that process where arbitrary code could execute, which is why Hugging Face and most of the ecosystem now treat safetensors as the safer default and recommend it over pickle-based formats.

How Hugging Face tries to catch bad files

Hugging Face doesn't rely purely on people choosing the safer format. Every file uploaded to the Hub is run through an automated ClamAV antivirus scan, and pickle files specifically go through an additional scanner (built on the open-source tool picklescan) that inspects a pickle's opcodes without executing them, checking any imports or function calls against a maintained list of known-dangerous ones; the Hub displays the scan result on each file's page. Hugging Face also partners with third-party scanners, including Protect AI, to add another layer of review across the Hub.

Hugging Face is explicit that this scanning is not a guarantee. In February 2025, security researchers at ReversingLabs described "nullifAI" — malicious models deliberately saved with a broken or non-standard pickle structure (for example, compressed in a way the scanner didn't expect) that still loaded and ran fine in Python while slipping past picklescan undetected. And this wasn't the first time bad models made it onto the Hub: back in February 2024, JFrog's security team found more than 100 malicious models on Hugging Face carrying silent backdoors through unsafe pickle deserialization. Both cases are a reminder that scanning reduces risk, it doesn't eliminate it — which is also why Hugging Face's own guidance is to prefer safetensors where a model offers it.

A different file, the same lesson

None of this means the July 2026 attack went through a poisoned pickle model — it didn't. Per Hugging Face's own technical account, the intrusion came through dataset files, not model files: a specially crafted HDF5 file (a common scientific data format) that abused a file-reading bug to leak secrets, and a separate templating flaw — a Jinja2 template inside a dataset's configuration — that let attackers run their own code on Hugging Face's servers when the dataset was processed. Full details are on the Hub page and how the attack worked.

The underlying lesson is the same one pickle has taught the ML community for years: whenever a piece of software goes beyond simply storing your data and instead interprets it — running opcodes, evaluating a template, parsing a format with its own hidden features — a file stops being just data and becomes a set of instructions to whatever reads it. Safetensors closes that gap for model weights specifically. The 2026 incident is a reminder that the same gap can exist anywhere a system "processes" a file it didn't write itself, including dataset pipelines that were never about pickle at all.