Treat the machine as compromised until shown otherwise. Python's own documentation says unpickling malicious data can execute arbitrary code. In the first hour, isolate the host, keep evidence, rotate every credential it could read, review outbound connections, and rebuild from a known good image instead of cleaning.
Why the response is this strong
The Python documentation states that it is possible to construct malicious pickle data that will execute arbitrary code during unpickling. The Hugging Face pickle guide explains how: opcodes such as GLOBAL, STACK_GLOBAL and REDUCE import a callable and call it with chosen arguments, and a pickle can reference builtins like exec or eval.
Code run that way runs as the user who loaded the file. It can read anything that user can read. You cannot tell from the model's behavior whether it also did something else, so assume it did.
First hour checklist
- Isolate. Cut the host from the network or move it to a quarantine segment. For a container, stop it and keep the image and volumes.
- Preserve. Copy the model file, shell history, process list and logs to read only storage. Do not delete the file. Take a hash of it.
- Identify what was reachable. List the environment variables, config files, cloud credentials, SSH keys, tokens and mounted volumes available to that user or container.
- Rotate. Revoke and reissue those credentials, starting with the ones that can reach production or source code. If a Hub token was in HF_HOME or in an environment variable, include it.
- Look outward. Check network logs and cloud audit logs for activity from that host or those credentials around and after the load time.
- Inspect the file safely. The pickletools module can disassemble a pickle without running it, per the Hugging Face guide. Look for GLOBAL or STACK_GLOBAL imports of modules that have no place in model weights. Do this on an isolated machine.
- Rebuild. Redeploy from a clean image. Do not trust a cleaned host.
What not to do
Do not open the file again "to see what happens" on the same machine. Do not run the scanning tool you were about to buy against it on a laptop with real credentials. Do not assume a clean looking imports list proves safety. The Hub's own pickle scan documentation says its scan is not foolproof.
Tell people who need to know
Tell your security contact and the owner of any credential you rotated. If the file came from a public repo, report the repo to the platform so others are warned. Record the revision hash and the owner so the report is useful.
Prevent the next one
Prefer formats that cannot run code on load, such as safetensors, for weights from outside your team. If you must load pickle, do it only for files your own team made, in a sandbox. See how to inspect a pickle model file without running it.
Quick check
Is deleting the file enough?
No. Code may already have run. Rotate credentials and rebuild the host.
Can I just reopen the file to see what it did?
No. Loading it again can run the code again. Inspect it with a disassembler on an isolated machine.
Safeguard's asset discovery and compliance evidence automation help you find where models run and keep a record of the response. A free scan shows your dependency picture.
Sources
Last reviewed: 19 October 2026.
