Hugging Face has spent the past few months quietly tightening its cloud security, and a new joint disclosure with Wiz Research pulls back the curtain on what that actually looked like. Wiz, the cloud security vendor, got deep access to Hugging Face’s infrastructure and found something uncomfortable: researchers could execute arbitrary code inside the platform’s sandboxed compute environments. The entry point was pickle, the notoriously risky serialization format that has been a known problem in the machine learning world for years.
The company says every issue tied to that exploit has been resolved. Beyond the fix itself, Hugging Face has integrated Wiz for Vulnerability Management and Cloud Security Posture Management, which gives the platform a single pane of glass across its multiple Kubernetes clusters, regions, and cloud providers. A Hugging Face engineer noted that having a central report with full context graphs for each vulnerability is ‘extremely helpful’ given the sprawl. The team has also built automation on top of Wiz’s tooling to remediate detected issues in products, with Spaces called out specifically.
What’s notable here is less the vulnerability itself and more the timing. Hugging Face has been striking partnerships with major tech companies at a rapid clip, and security researchers have been poking at model hosting platforms with increasing intensity. The pickle issue has been public knowledge for a while. Hugging Face developed picklescan in partnership with Microsoft and has been pushing safetensors, a secure alternative audited by Trail of Bits in collaboration with EleutherAI and Stability AI, as the path forward. Yet pickle files remain supported, and the blog post frames moving away from them as a ‘shared responsibility’ rather than a hard cutoff.
That’s the tension worth watching. Hugging Face wants to democratize AI and keep the barrier to entry low, but pickle deserialization is the kind of flaw that turns a model download into a code execution vector. The company is promising more security publications in the coming months, covering systemic AI risks and mitigation best practices. Whether that translates to stronger enforcement on the platform, or just more documentation, is an open question. For now, the bug bounty program, malware scanning, and secrets scanning are all in place. The infrastructure is more locked down than it was. The cultural shift around pickle is still unfinished.
