Two years ago I told you to abandon pickle for safetensors. Safetensors went on to win - it is now the default format on the Hugging Face Hub and part of the PyTorch Foundation. So why did model serialization attacks outlive Safetensors in 2026?
Back in 2024, in AI Security: Model Serialization Attacks, I made a simple argument: Python’s pickle is a remote-code-execution primitive wearing a serialization format’s clothes, the machine learning ecosystem was dangerously dependent on it, and you should move to safetensors wherever you could.
What is a model serialization attack?
As a quick refresher, a model serialization attack is an exploit in which a machine learning model file or data stream carries hidden executable code that runs automatically when the model is deserialized (loaded). The most common vector is Python’s pickle format, which can embed arbitrary code through the __reduce__ method, so that simply loading a malicious model grants the attacker remote code execution on the host. This is why the format a model ships in is a critical security decision, not just an engineering one.
The format war is over. Safetensors won.
Starting with good news: Safetensors has become the standard for secure model storage and its adoption is no longer marginal: more than a million model repositories on the Hub now carry safetensors weights. At the time I wrote the first article, “switch to safetensors” was a relatively exotic advice, whereas today it is closer to the path of least resistance.
Safetensors works by doing dramatically less than pickle. It stores raw tensor bytes behind a JSON header (plus optional string metadata — never code) and executes nothing during loading. There is no __reduce__ to hijack and no arbitrary Python to run - the entire class of attack that made pickle dangerous simply cannot be expressed in the format.
However, while the format war is over, the supply-chain war just started.
Model serialization attack trends in 2026
Safetensors removed code execution from the model file. The attack surface, however, moved into the pipelines: from the inference services to the format conversion frameworks and the surrounding infrastructure.
CVE-2026-25874 is a notable example that affected Hugging Face’s own LeRobot: its asynchronous inference pipeline exposed an unauthenticated gRPC channel passing payloads straight into pickle.loads(), hence allowing malicious actors to achieve remote-code-execution: a crafted __reduce__ runs the attacker’s command on the GPU host the moment it is deserialized.
Another interesting attack vector also affecting Hugging Face is HiddenLayer’s Silent Sabotage (2024), which showcased how Hugging Face’s conversion service dedicated to converting insecure machine learning models could be hijacked.
Both these examples intentionally involve Hugging Face: if the very company that created safetensors to solve exactly the curse of model serialization attacks still falls victim to the problem it largely helped solve, then clearly the threat is not over for anyone.
The new attack pattern in 2026 is “safe format, unsafe usage”. Safetensors secures the container, not the contents, the pipeline, or the code that reads it. The industry solved a format problem and inherited a supply-chain problem.
Next in this series: a walkthrough of the main tools and solutions to mitigate the new model serialization attack patterns in 2026.
If you found this useful, the awesome-MLSecOps repository is the most comprehensive open resource on MLSecOps and AI security - curated tools, attack vectors, papers, and learning roadmaps. And to get these deep-dives in your inbox, subscribe to The MLSecOps Hacker.
Would like to read more articles like this one