To vet a Hugging Face model, check who published it, prefer safetensors weights over pickle files, read the pickled imports the Hub displays, pin a full commit hash, and first load anything unfamiliar in a sandbox with no credentials or network. Loading a pickle can run code, so vetting happens before loading.
Why can a model file run code?
Hugging Face's own security documentation explains it. Pickle is the default format for PyTorch weights, and unpickling is not just data parsing: pickle is a stack of opcodes, and the format lets a file run Python code at deserialization time. The docs add a limit: the file can only reference functions and classes from top-level modules, it cannot embed them, but that is enough to call something dangerous that is already importable.
So "download a model" and "execute a stranger's code" can be the same action, depending on format.
Which file format should you prefer?
Safetensors. Its documentation describes it as a simple format for storing tensors safely, as opposed to pickle, while staying fast through zero-copy loading. It stores tensors and metadata, with no code path. Hugging Face's pickle guidance also suggests loading from trusted users and organizations, relying on signed commits, or using TensorFlow or Jax formats with conversion.
If a repository ships only .bin or .pt pickle weights, ask whether a safetensors version exists, or whether you can convert in an isolated environment.
What does the Hub check for you?
Two things, per Hugging Face docs. A malware scanner runs on every file under 2 GB at each commit and flags results. And for pickle files, the Hub displays the list of imports the pickle uses, so you can see what it would call before loading it.
These are aids, not guarantees. The malware doc itself says a file with neither an ok nor infected badge may be pending or have errored. Treat a missing badge as "unknown", and a clean badge as one signal among several.
How do you check the publisher?
Look at the account or organization behind the repository: how long it has existed, whether it is the organization you expect (a lookalike name is the usual trick), and whether commits are signed. If your team uses the model for something sensitive, copy it to an internal mirror under your own organization after review, and load only from there.
What should you pin?
The Hub's download API accepts a revision, which can be a tag, a branch, a pull request ref or a commit hash. Tags and branches move. Use the full commit hash, which the docs say must be the full length, not seven characters. We cover lockfile style pinning in a separate post.
How do you load something you do not yet trust?
Use a throwaway environment: a container or VM with no cloud credentials, no mounted home directory and no outbound network. Load the weights, run a smoke test, and discard the environment. Do not load unknown pickle weights on a laptop that has SSH keys and cloud tokens.
Also scope your Hugging Face token. Hub tokens come as fine-grained, read and write roles, and the docs say fine-grained tokens suit production because they limit access to specific resources. A download job needs read at most.
What to do
- Identify the publisher and confirm it is the organization you intend.
- Prefer safetensors. Treat pickle files as executable code.
- Open the pickle import list on the Hub and look for anything beyond tensor and framework imports.
- Note the scanner status, and treat missing as unknown.
- Pin the full commit hash you reviewed.
- First load in a sandbox with no credentials and no network.
- Mirror approved models internally and load from the mirror.
Safeguard's MCP Guardrail and policies can help enforce step 7 for AI tooling that fetches models, by controlling what agents may pull in; review your own configuration to confirm coverage.
Quick check
Is a safetensors file always safe?
The format itself has no code execution path, which is its purpose. The surrounding repository can still contain other files, such as custom code, that you should review before enabling options that run it.
Does a clean scan badge mean I can load the model?
It is one signal. Hugging Face notes files without a badge may be unscanned or errored, and scanners are not proofs. Pin, sandbox and review as well.
Sources
- Pickle scanning, Hugging Face Hub docs, fetched 18 October 2026
- Malware scanning, Hugging Face Hub docs, fetched 18 October 2026
- Safetensors, Hugging Face docs, fetched 18 October 2026
- Download files from the Hub, Hugging Face docs, fetched 18 October 2026
- User access tokens, Hugging Face Hub docs, fetched 18 October 2026
Last reviewed: 18 October 2026.
