Hugging Face scanned 4.4M models: 51,700 repos flagged with hidden code risks

Six months into a security partnership, Protect AI has scanned 4.47 million unique model versions across 1.41 million repositories on Hugging Face and flagged 352,000 suspicious or unsafe issues. That’s a staggering number — and it means roughly 1 in 27 models on the Hub carries some form of execution risk that developers would be wise to investigate before pulling into a project.

The scans, powered by Protect AI’s Guardian tool, apply a zero-trust lens to model files. Guardian doesn’t just hunt for overtly malicious payloads; it treats any arbitrary code execution capability as inherently suspect. This approach is a direct response to the rise of obfuscation techniques that let attackers hide dangerous code inside compressed archives, serialized objects, or framework extension points that look perfectly benign during a casual payload inspection.

Since the partnership launched in October 2024, Protect AI has added four new detection modules that catch threats like architectural backdoors in TensorFlow SavedModel files and malicious code execution in Llamafiles. One module specifically targets CVE-2025-1550, a fresh high-severity vulnerability in Keras. For Hugging Face users, the practical upshot is that these findings now appear as inline alerts on model pages, with full vulnerability reports available through InsightsDB — so the security context is right where you’re already browsing.

Two attack patterns keep surfacing in the threat research. First, library-dependent attack chains exploit common ML libraries like PyTorch the way old-school drive-by downloads exploited Java or Flash — the more pervasive the library, the wider the blast radius. Second, payload obfuscation through compression and serialization remains a persistent headache. Container formats like Keras and NeMo bundle sub-models that each carry their own attack surface, and compression can open the door to TarSlip or ZipSlip vulnerabilities that, in the worst case, lead to arbitrary code execution via path traversal. With over 200 vulnerability reports already flowing in from Protect AI’s huntr bug bounty community, the pace of discovery isn’t slowing down. The 7.94 ms average scan response time across 226 million recent requests shows this is happening at a scale that would have been unthinkable a few years ago — but the real question is whether developers are actually reading those alerts before they hit “import.”