We often talk about "AI Security" in the context of Prompt Injection or Jailbreaking. But there is a much more boring, yet dangerous layer underneath: The Supply Chain. The Supply Chain. We assume that if a model is on Hugging Face, it works. We assume that if the repo says "Apache 2.0", it’s safe for commercial use. We assume that the file we download is the file the author uploaded. I decided to test these assumptions. I took a random sample of 2,500 models from the "Trending" and "New" sections of Hugging Face and ran them through Veritensor, an open-source auditing tool designed to deep-scan model artifacts (Pickle, PyTorch, Safetensors). 2,500 models Veritensor The results were not catastrophic, but they were messy. Here is what the data says about the state of MLOps hygiene in 2025. 1. The "Fake" Models (Integrity Failure) The most frequent critical error wasn't malware. It was corruption. corruption I found 16 instances where the file downloaded did not match the cryptographic hash recorded in the repository. 16 instances The Diagnosis: In almost all cases, this was a Git LFS (Large File Storage) failure. The repository contained a 130-byte text pointer instead of the actual 4GB model weights.
The Risk: If you pull this into a production pipeline, your application crashes with obscure errors like UnpicklingError or Header too large. It’s a stability nightmare that standard tools like wget or pip don't warn you about until runtime. The Diagnosis: In almost all cases, this was a Git LFS (Large File Storage) failure. The repository contained a 130-byte text pointer instead of the actual 4GB model weights. The Diagnosis: The Risk: If you pull this into a production pipeline, your application crashes with obscure errors like UnpicklingError or Header too large. It’s a stability nightmare that standard tools like wget or pip don't warn you about until runtime. The Risk: UnpicklingError Header too large wget pip 2. The License Trap Legal risk is the new security risk.I found5 models that were publicly available but contained restrictive metadata inside the files: 5 models cc-by-nc-sa-4.0 (Non-Commercial)
cc-by-nc-sa-3.0 cc-by-nc-sa-4.0 (Non-Commercial) cc-by-nc-sa-4.0 cc-by-nc-sa-3.0 cc-by-nc-sa-3.0 These licenses were embedded in the safetensors headers. A developer simply downloading these weights might miss the license file in the repo, integrate the model into a SaaS product, and expose the company to IP litigation. safetensors 3. Shadow Dependencies (The "YOLO" Problem) This was the most surprising finding. Roughly 50 models in the sample were not self-contained. To load them, the runtime environment required specific third-party libraries installed. 50 models required The most common offender? **Ultralytics (YOLO). \ Dozens of models implicitly imported ultralytics.nn.modules. If you try to load these models in a clean PyTorch environment, they fail. From a security perspective, this is "Shadow IT"—your model is forcing dependencies that you didn't explicitly approve. ultralytics.nn.modules 4. The Obfuscation False Positives The scanner flagged 11 files for using STACK_GLOBAL—a mechanism often used by malware to hide function calls.Upon manual review, these turned out to be artifacts from older versions ofnumpy and scikit-learn. 11 files STACK_GLOBAL numpy scikit-learn However, this highlights a massive problem: Legacy serialization looks exactly like malware. We are building the future of AI on top of a serialization format (Pickle) so archaic that we can't easily distinguish between a 5-year-old array and a reverse shell. Legacy serialization looks exactly like malware. Conclusion The AI ecosystem is fragile. It is full of broken pointers, restrictive licenses hiding in binary headers, and implicit dependencies. If you are building an AI platform, you cannot blindly trust the artifacts. You need a gatekeeper in your CI/CD. The Data: I have uploaded the full logs of the scan (CSV + JSON) so you can see the specific errors and Repo IDs. 📂 Download the Research Data (Google Drive) Download the Research Data (Google Drive) Download the Research Data (Google Drive) (Tool used for analysis: Veritensor) (Tool used for analysis: Veritensor) Veritensor

This story contains new, firsthand information uncovered by the writer.

Walkthroughs, tutorials, guides, and tips. This story will teach you how to do something new or how to do something better.

This story will praise and/or roast a product, company, service, game, or anything else people like to review on the Internet.

Apache

The Wild West of Hugging Face: I Audited 2,500 Models and Found 86 Critical Issues

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Reverse Engineering the AI Supply Chain: Why Regex Won't Save Your PyTorch Models

The Noonification: How Often Do NFTs Pass The Howey Test? (1/13/2023)

Darwin's Hybrid Intelligence to Align AI & Human Goals for Startups & VCs

The Noonification: White Man (11/26/2022)

The Noonification: The Metaverse is a Sh*tshow (11/2/2022)

100 Days of AI Day 1: From Newsletter to Podcast, Leveraging AI for Audio Transformation

Reverse Engineering the AI Supply Chain: Why Regex Won't Save Your PyTorch Models

The Noonification: How Often Do NFTs Pass The Howey Test? (1/13/2023)

Darwin's Hybrid Intelligence to Align AI & Human Goals for Startups & VCs

The Noonification: White Man (11/26/2022)

The Noonification: The Metaverse is a Sh*tshow (11/2/2022)

100 Days of AI Day 1: From Newsletter to Podcast, Leveraging AI for Audio Transformation

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps