Hugging Face taps Protect AI to scan its 1M+ model repos for hidden exploits

Hugging Face isn’t waiting for a disaster to strike. The model-sharing giant has partnered with Protect AI, integrating the security firm’s Guardian scanner directly into the Hub to automatically flag malicious serialization exploits across its over one million public model repositories.

The move addresses a long-simmering anxiety in the machine learning community. Sharing models often means sharing serialized files—and formats like Python’s pickle are notorious vectors for arbitrary code execution. Hugging Face already built picklescan to hunt those down, but Protect AI’s Guardian expands the net significantly. It doesn’t just catch pickle attacks; it also spots exploits in other formats, including the kind of arbitrary code execution you can sneak through Keras Lambda layers. As the company notes dryly in its announcement, “Pickle is not the only exploitable format out there.”

For users, the integration is frictionless. Every public model repo gets scanned automatically on push, with results surfaced in a revamped interface that now includes a dedicated “Pickle” button when a relevant import scan runs. The catch? There’s a scanning backlog. With millions of files to chew through—Hugging Face says it has already scanned “hundreds of millions”—your latest model might not show results immediately. The team is asking for patience with a ”😅” emoji.

The partnership signals a maturing phase for the open-source AI ecosystem. Model repos are the new package registries, and they inherit all the supply-chain security nightmares that come with that territory. What PyPI and npm went through with typosquatting and malicious packages, Hugging Face is now preempting with automated, multi-format vulnerability scanning. It’s a pragmatic acknowledgment that community trust is the platform’s real moat—and that one compromised model could poison the well for everyone.