JFrog’s scanner joins Hugging Face to slash false positives on 100M+ files

Hugging Face is bringing JFrog’s security scanner onto its platform, a move meant to quiet the noise of false alarms that has long plagued developers sharing AI models. The core problem isn’t new: serialization formats like pickle can bundle arbitrary code alongside model weights, and that code often executes automatically when a model loads. The existing tool, picklescan, works by pattern-matching suspicious module names, but it’s a blunt instrument. Benign convenience code — the kind developers use to make models portable — regularly gets flagged as malicious.

JFrog promises a sharper blade. Instead of just pattern-matching, it actually parses and analyzes the code it finds inside model weights, checking for genuinely malicious usage rather than just the presence of a risky function. That distinction matters. Hugging Face points out that model weights can contain code that executes upon deserialization, and sometimes even at inference time, which has made security scanning on the Hub a high-stakes game of whack-a-mole. Pickle isn’t the only villain either; the post name-checks Keras Lambda layers as another format vulnerable to arbitrary code execution, and JFrog catches both.

The scale here is staggering. Hugging Face says it has already scanned hundreds of millions of files, a number that puts the partnership in perspective — this isn’t a pilot project. Every public model repository will get scanned automatically the moment files are pushed, with zero extra steps for developers. There’s a catch: with millions of repos in the backlog, not every model will show scan results immediately. The team is playing catch-up.

What’s genuinely interesting here is the strategic play. JFrog built its reputation scanning software packages for vulnerabilities; now it’s extending that same approach to the model supply chain. The collaboration points toward a future where model registries are secured with the same rigor as package registries like PyPI or npm. If Hugging Face wants to be the de facto infrastructure layer for AI — and it clearly does — security theater won’t cut it. Reducing false positives isn’t glamorous, but it’s the kind of plumbing that determines whether enterprise adoption accelerates or stalls.