A model on Hugging Face called baller423 opened a reverse shell the moment someone loaded it. It passed the scanner first. Here's the part most security programs miss: an AI model isn't a data file. It's executable code. torch.load() runs arbitrary Python during deserialization — that's not a bug, it's how pickle works, and 80%+ of ML models ship in that format. So the file looks normal. It passes the scan. Then it runs whatever the attacker buried in it the instant it loads. PickleScan — the most common defense — has at least three known zero-day bypasses (CVE-2025-10155). Blacklist scanning asks "does this file contain known-bad patterns?" The attacker controls the format, so the honest answer is: not always. The question that actually holds up is different — "what does this code do when it runs?" That's behavioral sandboxing: load every model in an isolated container, watch the syscalls, and sign the clean ones with your own PKI before they ever touch the internal registry. It matters because the surface is already huge. Protect AI scanned 4.47M model versions and found 352,000 unsafe issues across 51,700 models. 98% of organizations have employees running shadow AI — pulling models and calling APIs off the books — and 62% of security teams can't say where their LLMs even run. You can't sign what you can't see. Model vetting and an ML-BOM aren't paperwork — they're how a CISO turns "we use AI somewhere" into something auditable against NIST AI 100-2 and the EU AI Act. Save this for the next model-review conversation. What's gating new models into production in your stack right now — a scanner, a sandbox, or a Slack thread? #AISupplyChainSecurity #MLSecOps #AIGovernance #CISO #ModelSecurity