When a Minnesota hospital buys software that helps read your scan, or a bank buys software that scores your loan application, there is a good chance the intelligence inside it was not built by the company that sold it. It was downloaded — free, from a public website, the way you would download a photograph.
That is not a scandal. It is how the industry works, and the openness is mostly good — it is why a four-person company in Duluth can compete with a giant. I download and run these models myself. The question was never whether the well should be public. It is whether anybody checks the water.
Which brings me to a phrase I keep hearing from people who mean well: "the Hugging Face hack." Hugging Face is the largest public library of AI models. There is no such thing as the hack. There are at least five separate incidents across three years, five mechanisms, five dates — and the differences are the entire story.
The file is not a document. It is a program.
Everything else follows from one fact almost nobody outside the field knows.
A trained AI model has to be saved to a file, and the standard way in the most widely used AI toolkit is a Python feature called pickle. Pickle is not a document format the way a PDF or a spreadsheet is — numbers sitting still, waiting to be read. It is a short list of instructions, and one instruction it is allowed to contain says: go find this program and run it. So when a developer's code opens a model file saved that way, the file's instructions execute. Whatever the uploader put in there runs, on that developer's machine, with that developer's access.
Downloading a model and opening it is running a program written by a stranger. We all already know not to open the attachment from an unknown sender. Almost nobody makes the translation.
Five incidents, three years, five mechanisms
Late November and December 2023 — leaked keys. Researchers at the security firm Lasso reported scanning Hugging Face and GitHub and finding roughly 1,681 valid access tokens sitting in public code, reaching the accounts of 723 organizations, including some of the largest names in the industry. I attribute rather than adopt those figures: they are the researchers' own, carried in the trade press, and we did not pull their page ourselves.
February 27, 2024 — malicious models. JFrog's security team reported finding a model on the Hub "whose loading leads to code execution," and their scan turned up "around 100 instances of such models." Not laboratory demonstrations — live uploads exploiting exactly the behavior above, at least one handing the attacker full control of the machine that opened the file.
Early June 2024 — the platform itself. Hugging Face disclosed, in its own words, "unauthorized access to our Spaces platform, specifically related to Spaces secrets," with "suspicions that a subset of Spaces' secrets could have been accessed without authorization." It revoked tokens, hired outside forensic specialists, and closed with a sentence no company writes lightly: "we have also reported this incident to law enforcement agencies and Data protection authorities."
October 10, 2024 — ShadowLogic. The research firm HiddenLayer demonstrated a backdoor that is not in the file's instructions at all. I come back to it below.
February 6, 2025 — nullifAI. ReversingLabs found two models built so the safety scanner choked on the file and gave up, while the loader that opens it ran the hidden part anyway. The scanner checks whether a file is valid before it inspects it; the loader executes instructions as it reads them. Break the file in the right place and you walk past the guard by being too broken to inspect. Their conclusion: "Pickle files present a security risk when used on a collaborative platform where consuming data from untrusted sources is the basic part of the workflow."
Two of those five are not AI problems at all
Leaked keys and the Spaces intrusion are ordinary security failures — credentials left in public code, and a break-in at a company's own hosting infrastructure. The same thing happens to banks and retailers every month. I set them aside because padding an argument with everything that shares a headline is how you lose it to the first person who knows the record.
The three that are genuinely about AI — malicious models, evaded scanner, ShadowLogic — are not a list. They are an escalation.
The honest concession: the defenses are real, and they worked
The response was fast, voluntary, and largely effective. Hugging Face built a scanner and runs it against every uploaded file. More importantly, it and others built a new format, safetensors, incapable of the trick: a header, a map of where each number lives, and the numbers. Nothing in it can mean "run this." It became the default. Hugging Face paid an outside firm to audit it and published the result. Its own account of the problem is blunter than anything I would write for them — with pickle, "it is possible to write a malicious file posing as a model that gives full control of a user's computer to an attacker without the user's knowledge." It was equally careful about the fix: "while it is impossible to prove the absence of flaws, this is a major step."
Then the toolkit changed. On January 29, 2025, PyTorch version 2.6 flipped its default so that opening a model file refuses to run code unless a developer deliberately switches the protection back off. Every incident above predates that change. Anyone still telling you, in the present tense, that opening an AI model file runs whatever code is inside it is describing 2024. The pickle era is narrowing, nobody had to be sued or fined to narrow it, and that deserves saying plainly.
What the fix does not reach
HiddenLayer's researchers left the file format alone. They edited the model's own math — the sequence of operations it runs to turn a question into an answer — and inserted a hidden branch: if the input contains a chosen trigger, force a chosen output; otherwise behave perfectly. They showed it on an image classifier, where a pixel pattern flips the result; on an object detector, where a person standing near a cup stops being detected as a person; and on a language model, where a phrase forces a chosen answer. The technique, in their words, is "format-agnostic" and "will persist across fine-tuning" — a company that downloads the model and retrains it on its own data does not train the backdoor out. It carries forward into a model that company now believes is its own.
A safe file format cannot help with that, because nothing unsafe is in the file. The file loads perfectly. It always would have.
Two things must be said precisely. ShadowLogic was responsibly disclosed research, demonstrated by the people who found it — not a breach anyone has reported at a real deployment. And HiddenLayer sells a product built to detect it, which is reason to check its work rather than repeat it. The finding still stands, and as far as our research could determine, no public model library has shipped a defense against it.
Which is why "we trust the vendor" is not an answer. Not because vendors lie — because a vendor's word is not a check, and this layer has no check yet. Somebody will build that check and sell it, and hospitals, banks, school districts and the state itself will buy it; they are buying these systems today on a signature and a hope. That is the market I want here, and the point of where I stand on this.
What we can do
Write provenance into every state contract. If Minnesota buys a system with AI in it, the contract names the models underneath it, delivers the cryptographic fingerprint of the exact file, and gives us the right to re-check it later. That is a paragraph of drafting, not a new agency.
Require the safe format, and signatures where they exist. No model file capable of executing code goes into a production system the state pays for. Signing tools exist and are free; they are optional today, and in our contracts they stop being optional.
Publish what the state runs. An inventory of the AI systems Minnesota deploys and the models under them. You cannot audit what nobody will list.
Fund the open problem at the University. Backdoors hidden in a model's math have no answer today, anywhere — a gap everyone is behind on, which makes it the rare research problem a state can still be first to solve.
Train the checkers through Minnesota State. Verification is skilled work and it is teachable. Put the certification on campuses in Hibbing and Marshall and Moorhead, and the jobs land where the campuses are.
Every industry eventually learns you cannot bolt trust on afterward. It goes in when the thing is built, or it is not there at all. Minnesota can be the state that learns it first and charges for the lesson.
First the facts. Then the fix.
Sources
The incident record comes from the security researchers' and the platform's own published accounts, retrieved as raw pages and quoted from their own text rather than from summaries. JFrog Security Research, "Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor" (February 27, 2024), is the source for the roughly 100 malicious models and the code-execution-on-load mechanism. Hugging Face's own disclosure, "Space secrets security update" (published on its blog in early June 2024 and retrieved from that blog's source repository), is the source for every quoted phrase about the Spaces intrusion, including the report to law enforcement and data protection authorities. HiddenLayer, "ShadowLogic: Persistent No-Code Backdoors in AI Computational Graphs" (October 10, 2024), is the source for the computational-graph backdoor, the "format-agnostic" and "persist across fine-tuning" language, and the three demonstrations; HiddenLayer describes it as its own research, not an observed attack. ReversingLabs, "Malicious ML models discovered on Hugging Face platform" (February 6, 2025), is the source for nullifAI, the two models found, and the scanner-versus-loader mismatch. Hugging Face's post "Audit shows that safetensors is safe and ready to become the default," together with the safetensors project's own description of its file structure, is the source for what that format guarantees and for both quoted lines — the one about pickle and the one about the limits of the audit. The PyTorch change is verified directly from the project's own release record: version 2.6.0 was published January 29, 2025, and its release notes describe flipping the default for loading model files as "an important security improvement measure." The Lasso Security figures — approximately 1,681 valid tokens across Hugging Face and GitHub, reaching 723 organizations — are reported as the researchers' claim carried in security trade press in late November and December 2023, and are attributed rather than adopted.
Not independently verified: Lasso Security's own page was not retrieved, so its figures are attributed to the researchers and the trade press rather than confirmed here; the effectiveness of HiddenLayer's commercial detection product is unverified, and no in-the-wild use of ShadowLogic has been reported by anyone; a related scanner-bypass finding credited to Checkmarx is reported only as ReversingLabs described it; and the statement that no public model library has shipped a defense against backdoors in a model's computational graph reflects a research pass current through September 5, 2026, not an exhaustive search. Corrections: campaign@madgettformn.com.