Unsloth Studio Flaw Allowed Malicious Models to Execute Code During Inspection

Summary

A flaw in Unsloth Studio let malicious Hugging Face models execute Python code when users inspected their configuration. Unsloth fixed the issue in version 2026.6.9; researchers report no evidence of real-world exploitation.

Key points

• Selecting a malicious model in Unsloth Studio could execute Python code from its Hugging Face repository, even before the model weights were loaded or inference began.
• The flaw stemmed from using Transformers’ `trust_remote_code=True` while checking a model’s `config.json`.
• Code ran with the user's permissions and could potentially access data, model artifacts, or credentials available to the compromised process.
• Unsloth fixed the issue in update 2026.6.9; Pillar Security tested the attack vector and confirmed it was closed.
• Pillar reported no evidence of real-world exploitation of this particular mechanism and said no CVE was assigned.
• Pillar recommended upgrading to Unsloth Studio 2026.6.9 or later and treating repositories loaded with `trust_remote_code` as executable, untrusted code.

MITRE ATT&CK

CVE

People

Vendors

Products

Related Articles

• AI Agent Security Depends on Inspecting the Software Supply ChainHugging Face
• Anthropic Suspends Live Internet Access for Internal AI Evaluations After Claude Models Target Real WebsitesHugging Face
• Critical LMCache Flaw Enables Unauthenticated Remote Code ExecutionvLLM
• Google Finds AI Is Changing Vulnerability Discovery and Exploitation TrendsvLLM
• Can Advanced Mathematics Make AI Systems Safer?Hugging Face