A downloaded model is flagged as able to run harmful code

AISPM-26-0151-UC5DriftCritical

1Detected
2Investigating
3Remediation Available
4Remediated

Detected · reported to AISPM

Hugging Face's own scan flagged a file in clause-embed-v2, a model we downloaded from a public site. Loading that file can run code on our servers. Three apps load it, and we can't tell which version we're running or who published it.

Source: Hugging Face Hub scan results (connector) · — · simulated signal

Evidence

Model provenance

Review the Model provenance evidence. Open a scan row or click a node to see what the hub reported.

○ Not yet

Hub scan results · reported by Hugging Face Hub, simulated

Scan	Hub verdict	Detail
Malware scan	No issue	No known malware signatures reported for any file in the repoShow detail
Pickle-import scan	Flagged	os.system · builtins.eval · socket.socketShow detail
Secrets scan	No issue	No credentials or tokens reported in the repoShow detail
Signed commit	Not signed	The latest commit has no verified signature, so the publisher cannot be confirmedShow detail

contractlab/clause-embed-v2

public hub repo

Publisher unverified

Individual publisher, not on an approved list.

Latest commit a41f9c2 (—), unsigned.

clause-embed-v2

not blocked

Version not fixed

Pulled — with no fixed version, so every app follows the repo's latest commit.

Hub scan result

reported by Hugging Face Hub

Flagged

—: pytorch_model.bin imports os.system, builtins.eval and socket.socket.

A pickle file runs code when loaded.

Contract review service

loads the model

Exposed

Clause search index builder

loads the model

Exposed

Intake triage bot

loads the model

Exposed

clause-embed-v2: not blocked, so apps can still download it.
Hub repo: only an unsigned, pickle-format version exists, and nothing fixes which one we use.
Hub scan result: the flagged result has not been checked again.

Everything between the hub and the three apps is unchecked: the version floats and the hub's flag was never acted on.

Why this is rated critical

Data lineage: High

Public repo from an unverified publisher, outside any approved list
Latest commit is unsigned and no version is fixed
Weights are pickle-format, which can run code when loaded

Blast radius: High

Three deployments load this model
One of them handles client contracts
No version is fixed, so every new commit flows straight into the apps

Critical

Each factor alone rates High. Together they make this critical: an unverifiable file that can execute code on load, deployed in three places with nothing controlling which version they run.

Confirm & Escalate

1. Review the Model provenance evidence○ Not yetOpen a scan row or click a node to see what the hub reported.

2. I've reviewed the evidence and confirm this finding is valid.

Complete steps 1 and 2 to enable this.

Recommended remediation. Blocks new downloads of the flagged model, moves the three apps to the safetensors version fixed to one exact revision, and asks Hugging Face to re-check the repo.

Confirm & Escalate moves this finding to Remediation Available and unlocks the playbook “Block the flagged model and move to a safe, fixed version” (3 steps). Nothing runs until you click Execute Playbook. Simulated in this demo: nothing is changed or sent to any system.

1.Block new downloads of the flagged modelRuns on: Model registry / AI gatewayNew downloads are blocked and the apps that already loaded it are listed for follow-up. Reversible.
2.Replace it with the safetensors version, fixed to that exact revisionRuns on: Model registryThe three apps move to a version in a format that cannot run code, locked to one revision so it cannot change under us.
3.Re-check the repo against the hub for a clean resultRuns on: Hugging Face Hub (read only)Asks the hub for its scan result again. In this demo the clean result is simulated.