# Some model files can execute code when you load them

> Opening a file of model weights can be closer to running a program than opening a spreadsheet.

Published 2026-11-08

Canonical: https://machines-on-machines.anth.us/posts/why-loading-a-model-file-can-run-code/

A downloaded machine-learning model might look like a file full of numbers. In the Python pickle format, the file can also tell the loader what objects to create and which functions to call. That makes it possible for a malicious file to run code when someone loads it.

::image{
  src="assets/why-loading-a-model-file-can-run-code/pickle.png"
  layout="inline"
  alt="A Hugging Face file listing flags detected imports in a pickle file."
  caption="The Hugging Face Hub displays imports it detects when scanning a pickle file. Loading an untrusted file can run code even when the file is presented as model data."
  credit="Hugging Face, Hub security documentation."
}

[Image source](https://huggingface.co/docs/hub/security-pickle)

Hugging Face's documentation describes how the Hub inspects uploaded pickle files for imports and shows the scan results. An import is a reference to code from another module. Looking for unexpected imports helps identify some files that could do more than restore model data.

## A scan has a defined job

The Hub describes its lists of safe and unsafe imports as best-effort. A file that produces no warning has passed the scanner's checks. That alone does not establish what every loader or imported package could do.

The difference starts with the file format and the program that reads it. Two files can both be described as model weights while giving their loaders very different powers.

[Read the source](https://huggingface.co/docs/hub/security-pickle).
<!-- papyrus-source-version: 5 -->