Is downloading models from Hugging Face safe?

Mostly, with habits: prefer original publishers, prefer safetensors or GGUF, and don't treat the scanner badge as proof — malicious uploads are found regularly, overwhelmingly pickle-based.

What's wrong with pickle model files?

The pickle format can embed instructions that execute when the file loads. That makes a stranger's pickle file equivalent to a stranger's program.

Should I scan AI model files with antivirus?

It won't hurt, but antivirus barely understands model formats. The leverage is in format choice, source choice, and keeping the runtime updated.

Is that AI model file safe? Model supply chain 101 — pickle, safetensors, GGUF

Q: Does Ollama protect me from bad models?

It helps — its library keeps you in GGUF from consistent sources — but its parser inherits llama.cpp's bugs, so keeping Ollama updated is part of the protection.

By Daniel S. · July 5, 2026

A model file you download from a public hub is a multi-gigabyte binary from a stranger that your computer will parse and load into memory. In security terms, that's untrusted input — and the record shows it gets abused: most malicious models found on the big hubs use a file format that runs code the moment you load it. The good news is that the safe path is narrow and simple. The complication — new since May 2026 — is that even the "safe" formats need one more habit than the old advice included. Here's the whole picture, updated.

TL;DR

The dangerous format is pickle (common in older PyTorch files): it can execute arbitrary code at load, by design. Roughly 95% of malicious models found on Hugging Face were pickle-based. ⏱️ verified 2026-07-05
The safe-by-design formats are safetensors and GGUF — they store data, not executable code. GGUF is what Ollama, LM Studio, and llama.cpp use, so most hobbyists are already on the right format.
New in May 2026: researchers disclosed parser vulnerabilities in llama.cpp's GGUF loader — integer-overflow bugs where a malicious model file can corrupt memory before inference even starts. Safe format ≠ invulnerable loader. The fix is unglamorous: keep Ollama/LM Studio updated. ⏱️ verified 2026-07-05
Hub scanning is a screen, not a guarantee — researchers have repeatedly slipped malicious models past the "safe" flags.
Five download rules at the bottom cover the realistic risk.

How can a model file possibly attack my computer?

Two different ways, and keeping them apart is the whole lesson.

Way 1: the file format itself executes code. Python's pickle format — historically the default way PyTorch models were saved — doesn't just store data; it stores instructions for rebuilding objects, and those instructions can include "run this code." Loading a pickle file from a stranger is, mechanically, running their program. That's why it dominates real-world abuse: security research on Hugging Face found ~95% of discovered malicious models were pickle-based, delivering backdoors and connect-back payloads dressed as model weights (JFrog research, large-scale supply-chain study, ⏱️ verified 2026-07-05).

Way 2: the file format is innocent, but the program reading it has a bug. Any parser of complex binary files can have memory-safety bugs, and a crafted file can trigger them. This one stayed theoretical for GGUF — until it didn't (two sections down).

Which formats are safe, then?

The direct answer: safetensors and GGUF, by design. Both were built to hold only tensors — the raw numbers — plus metadata. No embedded objects, no code, nothing to "run" at load time (safetensors' design goal, ⏱️ verified 2026-07-05). The ecosystem has largely moved: mainstream model publishers ship safetensors, and the entire local-AI stack you'd use as a hobbyist — Ollama, LM Studio, llama.cpp — runs on GGUF.

Practical translation: if you pull models through ollama run or LM Studio's built-in browser, you never touch pickle at all. The pickle risk mostly reaches people running research code that loads .bin/.pt checkpoint files with PyTorch directly. If that's not you, Way 1 is already handled.

What changed in May 2026? (and a correction to our own earlier advice)

In our earlier local-AI security post, I wrote that GGUF had "no known code-execution-at-load vector." That aged fast — the post now carries a dated correction, and this article is the full walkthrough that correction promised. It's exactly why this site date-stamps claims.

In late May 2026, security researchers disclosed a cluster of memory-safety vulnerabilities in llama.cpp's GGUF parser — the loader used, directly or indirectly, by essentially every local AI tool. The bugs are integer overflows in how the parser sizes memory for a model's tensors and vocabulary: a maliciously crafted GGUF file can make the parser allocate too little and then write past the buffer — heap corruption an attacker controls, before any AI runs. The project published fixes in its security advisories, and one of the flaws was catalogued as an RCE-class vulnerability, CVE-2026-33298 (llama.cpp security advisories, advisory GHSA-96jg-mvhq-q7q7, SentinelOne on CVE-2026-33298, ⏱️ verified 2026-07-05).

What this means, without drama:

The format is still fine. GGUF still contains no code. This is Way 2 — a loader bug — not a change to what the format is.
The consequence is a new habit, not a new fear: your model runtime is now security-relevant software. Update Ollama and LM Studio the way you update a browser — promptly — because parser fixes ship inside those updates.
Where you get files matters more than before. A parser bug only bites if you feed it a hostile file. Models pulled from official publishers through official channels are a much smaller attack surface than a mystery re-upload from a forum link.

Doesn't the hub scan uploads for malware?

Yes, and it helps, and it is not a guarantee. Hugging Face scans for unsafe files and flags pickle risks — but measurement studies found only a fraction of files using unsafe serialization were flagged, and researchers have demonstrated working evasion techniques (one, dubbed "nullifAI," produced malicious models the scanners rated clean) (ReversingLabs write-up, ⏱️ verified 2026-07-05). Treat the "safe" badge the way you treat an email spam filter: a useful screen that occasionally misses.

The five download rules

Stay in the mainstream tools. Ollama's library and LM Studio's browser keep you in GGUF from vetted sources — you inherit good defaults.
Prefer the original publisher's page (the model maker's official account) over third-party re-uploads. When you do grab quantized community builds, use the handful of well-known, long-standing quantizer accounts, not a fresh account with one upload.
Never load pickle files from strangers. If a download is .bin/.pt pickle format and you're not equipped to inspect it, find the safetensors or GGUF version — for any model worth running, one exists.
Keep the runtime updated. Post-May-2026, this is a security rule, not housekeeping.
Be suspicious of side instructions. "Disable your antivirus," "run this setup script first," "use my custom loader" — each converts a data download into code execution. Walk away.

When this won't help

This is about the file being hostile, not the model being wrong. A perfectly safe download can still produce false, biased, or fabricated answers. Different problem, different defenses.
Prompt-injection and tool abuse are out of scope here. Once you wire a model to tools, email, or your files, a whole second security topic opens up — that's a future post, and it matters more than most people think.
If you're building with research code — loading arbitrary checkpoints with PyTorch, running trust_remote_code=True — your risk surface is far bigger than this beginner picture, and you need the developer-grade version of this advice.
No checklist beats a compromised machine. As with everything local-AI: the model's safety inherits the machine's.

FAQ

Can a GGUF file give my computer a virus? Not by design — GGUF contains no executable code. But the May 2026 llama.cpp advisories showed a crafted GGUF can exploit bugs in an outdated loader. Downloads from official sources plus a current runtime keep both doors closed.

Is downloading from Hugging Face safe? Mostly, with habits: prefer original publishers, prefer safetensors/GGUF, and don't treat the scanner badge as proof. Malicious uploads are found there regularly — overwhelmingly pickle-based.

What's wrong with pickle files exactly? The format can embed instructions that execute when the file loads — a feature of Python serialization, not a bug. That makes any stranger's pickle file equivalent to a stranger's program.

Does Ollama protect me from bad models? It helps: its library and pull mechanism keep you in GGUF from consistent sources. Its parser inherits llama.cpp's bugs, though — so "keep Ollama updated" is part of the protection, not optional.

Should I scan model files with antivirus? It won't hurt, but don't expect much — AV products barely understand model formats. The leverage is in format choice, source choice, and runtime updates.

Last updated 2026-07-05. Time-sensitive: the llama.cpp advisory list grows over time and runtime versions patch at their own pace — before assuming a tool is fixed, check its release notes against the llama.cpp security page.

Sources (verified 2026-07-05): pickle abuse and safetensors — JFrog: malicious Hugging Face ML models, arXiv: AI/ML supply-chain attacks study; GGUF parser flaws — llama.cpp security advisories, GHSA-96jg-mvhq-q7q7, SentinelOne: CVE-2026-33298; scanner evasion — ReversingLabs: malware in ML models on Hugging Face.