- Your AI models aren't data files. They're executable code that runs the moment you load them.
torch.load() runs arbitrary Python by design — and 80%+ of ML models ship in that format.
It's the breach surface most security programs never scan. 🧵 - A model called "baller423" sat on Hugging Face looking normal. It passed basic scans.
The instant it loaded, it opened a reverse shell to an external host.
The attacker controls the serialization format. That's not a bug — it's how pickle was designed to work. - "Just scan the models." PickleScan, the most-used defense, has at least 3 known zero-day bypasses (CVE-2025-10155).
Blacklist scanning is fundamentally broken. Protect AI scanned 4.47M model versions and found 352,000 unsafe issues across 51,700 models. - Now the part nobody checks: fine-tuning destroys safety.
Llama 3.1 8B drops from 0.95 to 0.15 on prompt-injection resilience after ONE round of normal, non-adversarial fine-tuning.
It passes the safety eval, gets tuned on your data, ships with guardrails gone. - You can't secure what you can't see.
98% of orgs have employees using unsanctioned AI. 62% of security teams can't say where their own LLMs run.
Shadow-AI breaches run $4.63M each — $670K over the norm (IBM 2025). Insider risk: $19.5M/org/yr, 53% from non-malicious negligence. - Agents make it worse. They hold tool access, credentials, execution rights — so a prompt injection becomes full system compromise.
GitHub Copilot RCE: CVE-2025-53773, CVSS 7.8. Amazon Q shipped a poisoned cleaner.md carrying destructive commands to its users. - OpenClaw, the first big agent crisis of 2026: 138 CVEs in 63 days. 12% of its marketplace skills were malicious.
What used to be one manipulated output is now an orchestrated, multi-tool kill chain. - The models themselves can be poisoned. 250 crafted documents — 0.00016% of the corpus — can backdoor a 13B-parameter model.
Microsoft's Feb 2026 "Double Triangle" method can finally flag a poisoned model without ever knowing the trigger phrase. - The tooling market is bolt-on. Palo Alto bought Protect AI; JFrog, Wiz, HiddenLayer ship scanners.
They scan — and bundle it into contracts you already own, so you feel covered. But a scanner isn't a pipeline. Standards exist — ML-BOM, CoSAI, NIST AI 100-2 — 83% run none. - So we build the pipeline: automated model vetting, ML-BOM in CI/CD, cryptographic model signing, shadow-AI detection, post-fine-tune safety re-evaluation.
Mapped to NIST AI 100-2 and the EU AI Act, fully applicable Aug 2, 2026. - If you can't name where every model in production came from and what it trained on, you don't have an AI security program — you have hope.
Where's your weakest link: pickle, fine-tuning, or shadow AI? #MLSecOps - We wrote up the full threat model and the architecture we deploy against it here: https://veriprajna.com/solutions/ai-supply-chain-security