A critical vulnerability in Unsloth Studio has been patched after researchers discovered that malicious AI models could execute arbitrary Python code during routine model inspection. The flaw, which was introduced through the “trust_remote_code” setting, has far-reaching implications for users of open-source library Unsloth, a popular tool used for fine-tuning and quantizing large language models.
The vulnerability was identified by Pillar Security, who reported it to Unsloth in early June. According to Ariel Fogel, a researcher at Pillar, the issue lay in the way Unsloth Studio handled model inspection. When a user selects a malicious model, the code contained within its Hugging Face repository is executed, regardless of whether the model itself is loaded or not. In other words, simply inspecting a model can lead to arbitrary code execution.
Fogel’s research revealed that an attacker could use this flaw to gain access to sensitive data and credentials stored in an enterprise AI development environment. This could include proprietary training data, model artifacts, and cloud logins or SSH keys. An attacker could also use the vulnerability to alter models and training outputs, or even steal accessible data.
The “trust_remote_code” setting is intended to allow the underlying Transformers library to download and execute custom Python code referenced by a model’s configuration file. However, as Fogel points out, this setting can have serious consequences if left enabled, particularly in an internal experimentation environment where sensitive data and privileged access may be present.
Pillar Security was able to demonstrate that the vulnerability could be exploited, even with Unsloth Studio’s latest updates. While Unsloth has since patched the issue, the researchers were critical of the library’s maintainers for their response. Unsloth disputed aspects of the security assessment, arguing that Hugging Face’s malware scanning was sufficient to mitigate the attack surface.
However, Pillar Security disagreed, pointing out that this flaw highlights a systemic gap in how machine learning tools handle executable model content. Developers often build workflows around artifacts that users consider to be data, but these artifacts can also supply code. When a tool silently enables trust_remote_code, it makes a consequential security decision on the user’s behalf.
To protect against this type of vulnerability, Fogel recommends that users upgrade Unsloth Studio to 2026.6.9 or later and treat model repositories loaded using the Transformers library as untrusted code rather than data. This means being cautious when enabling settings like trust_remote_code, and ensuring that tools in your pipeline never do so on your behalf.
The recurrence of this issue suggests a pressing need for improved security protocols in machine learning development. By acknowledging the potential risks associated with executable model content, developers can take proactive steps to prevent similar vulnerabilities from arising in the future.
Source: Dark Reading — 2026-09-29