A model on Hugging Face named "baller423" opened a reverse shell the moment someone loaded it. It had passed the scan. Here's the part most security programs miss: an AI model isn't a data file. It's executable code. torch.load() runs arbitrary Python during deserialization — that's not a bug, it's the designed behavior of the pickle format that 80%+ of ML models still use. The usual defense, PickleScan, has at least three known zero-day bypasses (CVE-2025-10155, plus four more found by Sonatype). Blacklist scanning is fundamentally broken when the attacker controls the serialization format. When Protect AI scanned 4.47M model versions, they found 352,000 unsafe or suspicious issues across 51,700 models. And scanning is only half the gap. Even a clean model loses its guardrails after fine-tuning — Llama 3.1 8B drops from 0.95 to 0.15 on prompt-injection resilience — and almost nobody re-tests it before shipping. The standards to fix this already exist — CycloneDX ML-BOM, CoSAI model signing, NIST AI 100-2. The problem isn't knowledge. It's that 83% of organizations have no automated AI security controls at all. The gap is engineering capacity, not awareness. It starts with treating a model the way you'd treat any other code shipping to production: signed, scanned, and provenance-tracked before it loads. If you're pulling models from a public registry today — are you scanning them before they load, or do you just trust the source? #AISecurity #MLSecOps #AISupplyChain