NullifAI and Malicious Shadow AI Models: AI Supply Chain Security

In February 2025, researchers discovered two weaponized AI models on Hugging Face that evaded detection for over eight months using a technique called NullifAI — exploiting Python's Pickle serialization to execute reverse shells on developers' machines while bypassing every existing scanner. With 98% of organizations reporting unsanctioned AI tool use and most security stacks carrying no capability to inspect ML model artifacts, the AI supply chain has become an unmonitored attack surface that traditional security tooling was never designed to handle.

Reading time 15 minutes

Executive Summary

The Issue: Malicious AI models are being distributed through public platforms like Hugging Face, bypassing security tools and executing code on developers' machines. In February 2025, researchers discovered two weaponized models that remained undetected for over eight months using a technique called NullifAI. When developers downloaded and loaded these models, hidden malware executed immediately, giving attackers remote access to corporate networks.

Why This Matters: Your developers are downloading AI models from public repositories the same way employees once downloaded unauthorized software. According to UpGuard's 2024 State of Shadow AI report, 98% of organizations report unsanctioned AI tool use, yet 49% have no way to control which machine learning models enter their environment. Most security tools weren't built to scan AI model files, creating a blind spot in your defenses. A compromised model can execute code before your endpoint security even knows it's there.

What You Need To Do:

Immediately: Audit which AI models your teams are using and update your asset management systems to include AI models as tracked assets. As detailed in The Invisible Inventory, most organizations have no visibility into their AI model usage because these assets aren't tracked in traditional inventory systems. Block unapproved downloads from public model repositories at the network level. Require security review before any model reaches production.

Within 90 days: Establish a Model Registry with approval workflows, similar to how you manage software dependencies. Implement Model Composition Analysis tools to scan AI artifacts before use. Create logging for model load events across development environments.

Strategic priority: Treat AI model platforms as third-party software suppliers in your vendor risk program. Update your security architecture to recognize that the attack surface has shifted from code repositories to model hubs, and most organizations aren't monitoring this vector yet.

The question is not whether a malicious model will enter your environment. It's whether you'll detect it before or after it executes.

The Discovery

February 2025. ReversingLabs researchers identified two malicious machine learning models on Hugging Face using a technique that bypassed the platform's security scanning mechanisms entirely.

The technique was named NullifAI. It exploits the execution of serialized code in pickle files to allow malicious code execution while evading Hugging Face's Picklescan tool.

The malicious models remained undetected on the platform for over eight months before discovery.

The attack wasn't theoretical. The models were live. Developers downloaded them. Code executed.

The exposure window: Any organization whose developers accessed these models during that eight-month period experienced a potential compromise. Many remain unaware.

The Technical Mechanism

Pickle is a Python module that serializes and deserializes ML model data. ML models use it to be shared and reused without retraining. The critical problem: Pickle allows Python code to run during deserialization.

The moment an employee loads the model file, code executes on their machine.

Python's official documentation contains a warning: "It is possible to construct malicious pickle data which will execute arbitrary code during unpickling."

ML developers prefer productivity and simplicity over security. Pickle remains extensively used despite its risks.

How NullifAI Defeated the Scanner

NullifAI exploited two specific weaknesses in Picklescan:

Weakness	Description
First weakness	The malicious models used 7z compression instead of ZIP format. Picklescan couldn't recognize the archive format and failed to extract the Pickle files inside.
Second weakness	The models used intentionally malformed Pickle files that deviated from the specification. Picklescan's parser failed or skipped sections. Python's own Pickle deserializer, which is more permissive, still processed them successfully.

The following breakdown illustrates how the file was handled differently depending on the environment or tool processing it:

Environment / Tool	How the File Was Interpreted & Executed
The scanner	saw a broken file.
The Python runtime	saw a functional file with an embedded payload.
Picklescan	validates Pickle files before scanning.
Python's deserializer	executes code in real time.
Malware	runs even if the file is later deemed invalid.

The Payload

In both cases, the malicious payload was a platform-aware reverse shell connecting to a hard-coded IP address. It checked whether it was running on Windows, Linux, or macOS and adapted accordingly.

Attack Chain Breakdown:

Phase	Action / Trigger	Technical Outcome
Phase 1 – Ingress	Developer downloads .pt file	Malicious binary enters dev environment
Phase 2 – Trigger	torch.load() or pickle.load()	Deserialization triggers hidden code
Phase 3 – Execution	Reverse shell initiates	Remote access via Windows/Linux/macOS
Phase 4 – Impact	C2 connection established	Attacker gains foothold in production VPC

The moment an inference server loads a compromised model, attackers get a bash prompt on a machine inside production VPC.

The Human Factor: Shadow Models as the New Shadow IT

According to UpGuard's 2024 State of Shadow AI report, more than 80% of workers use unapproved AI tools, with 98% of organizations reporting unsanctioned AI use and 49% expecting a shadow AI incident within 12 months. Separately, JFrog's State of Supply Chain 2025 report found that 49% of organizations have no reliable way to control ML model usage, and 58% have no policy governing how developers use open source AI components.

The same psychology that drove Shadow IT now drives Shadow Model downloads. Employees downloaded Dropbox and used personal Gmail without IT approval. Now they download ML models from Hugging Face without security review.

The difference is the blast radius.

A rogue SaaS app leaks data. A rogue model file executes code.

According to JFrog's 2026 Software Supply Chain Report, malicious packages surged 451% year-over-year, with researchers identifying 495+ malicious AI models on public registries. Supply chain contamination occurs when AI models contain malicious code, biased training data, or intellectual property violations that propagate into production systems.

Why Your Existing Tools Won't Catch This

Most security stacks have a critical gap. They weren't designed for ML artifacts.

Model Composition Analysis (MCA) Is Not Standard

Most organizations have SCA (Software Composition Analysis) for code libraries. Almost none have an equivalent for ML model files.

The model artifact is a blind spot.

In a 2024 security audit, Protect AI partnered with Hugging Face to scan more than four million models, identifying approximately 352,000 unsafe or suspicious issues across 51,700 models. JFrog researchers found more than 100 models capable of arbitrary code execution.

Two of the most widely used AI model platforms have been shown to host malicious artifacts. Hugging Face hosts more than a million machine learning models used by virtually every AI company on the planet.

EDR Doesn't Pre-Scan Model Files

Endpoint detection responds to execution behavior. By that point the reverse shell may already be calling home.

Picklescan Was the Designated Control and It Was Bypassed

Both malicious packages were not identified by Hugging Face's Picklescan security tool due to differences in compression format with PyTorch, as well as a security issue that prevented proper scanning of Pickle files.

While Hugging Face has since improved Picklescan, the NullifAI case proved that heuristic-only scanning is insufficient. Attackers will always find a compression format or a malformed header that a static scanner hasn't been programmed to unpack yet.

IT Doesn't Know the Download Happened

When developers run models locally on their own machines, the download may never traverse a monitored proxy.

The model file is the new malicious attachment.
Most organizations don't scan it, don't log it, and don't govern it.

Operational Advisory: What To Do Now

Timeline	Action Item	Description & Implementation Details	Key Tools & Tech Notes
Immediate Actions (0–30 days)	1. Audit & Inventory Models	Survey dev teams for local HuggingFace, PyTorch, and ONNX models. Update your CMDB/asset management system to track AI models as first-class assets.	CMDB, Asset Inventory
	2. Ban Unapproved Public Hubs	Enforce at the proxy/firewall level. Implement DNS/URL filtering on `huggingface.co` downloads outside approved processes.	Proxy / Firewall, DNS Filtering
	3. Implement Pickle-Free Formats	Enforce the use of SafeTensors (safer serialization alternative) for all internally shared or approved models.	SafeTensors
	4. Add Model Hash Verification	Require a verified SHA-256 hash registered in your internal model registry before any approved model can be loaded.	SHA-256 Hashes, Model Registry
Medium-Term Controls (30–90 days)	5. Stand up a Model Registry	Treat model downloads like software dependencies. Require security reviews and integrate the registry with your asset management system.	Model Registry Workflow
	6. Integrate Model Composition Analysis	Implement tools to scan model artifacts for vulnerabilities and malicious code before execution.	ReversingLabs Spectra, JFrog (Shadow AI), Protect AI (ModelScan)
	7. Instrument Model Load Events	Add logging and alerting for any `torch.load()`, `pickle.load()`, or equivalent execution calls in dev environments.	Logging & Alerting Systems
	8. Establish an MBOM	Create a "Model Bill of Materials" (mirroring SBOM) to document the origin, version, format, and hash of every model.	MBOM Framework
Strategic / CSO-Level (90+ days)	9. Integrate Model Vetting into SDLC	Ensure no model reaches staging or production without passing the same security gate as a third-party library.	SDLC Gateways
	10. Update Third-Party Risk Management	Treat AI model hubs as third-party software suppliers in your standard vendor risk assessments.	TPRM Program
	11. Run a Shadow Model Tabletop	Simulate a Shadow Model compromise. Test your detection capabilities and containment playbooks (e.g., handling a reverse shell from a dev workstation).	Incident Response Team

AI Security Implementation Roadmap

Model Security Checklist for DevSecOps

Use this checklist to systematically secure your AI model supply chain. This framework creates a "Value Bridge" between strategic intent and daily execution, giving your team actionable tasks for the next sprint.

Phase	Task / Control	Status
Vetting & Pre-Entry	Verify model source and maintainer reputation before download	[ ]
	Check for model hash verification against known-good registry	[ ]
	Scan model artifact with MCA tools (ReversingLabs Spectra, Protect AI ModelScan, JFrog AI Catalog)	[ ]
	Confirm model uses SafeTensors format (not Pickle) or is approved exception	[ ]
	Document model provenance: origin platform, download date, version, format	[ ]
	Require security team sign-off before model enters dev/staging environments	[ ]
Internal Registry & Governance	Register approved model in internal Model Registry with SHA-256 hash	[ ]
	Add model as tracked asset in CMDB/asset management system	[ ]
	Create Model Bill of Materials (MBOM) documenting dependencies and metadata	[ ]
	Establish approval workflow requiring security review for new models	[ ]
	Block unapproved model hub downloads at proxy/firewall level (e.g., huggingface.co)	[ ]
	Integrate Model Registry with CI/CD pipeline to enforce pre-deployment checks	[ ]
	Treat model downloads as software dependencies requiring same rigor as third-party libraries	[ ]
Runtime Monitoring & Detection	Instrument model load events: log all `torch.load()`, `pickle.load()`, and equivalent calls	[ ]
	Set up alerting for unexpected model loading outside approved registry	[ ]
	Monitor network egress from development workstations for reverse shell indicators	[ ]
	Establish baseline for normal model usage patterns to detect anomalies	[ ]
	Create incident response playbook for compromised model scenarios	[ ]
	Run tabletop exercise: simulate Shadow Model compromise and test detection/containment	[ ]
	Review EDR logs for suspicious post-execution behavior from model loading processes	[ ]

Implementation Tip: Start with Vetting & Pre-Entry controls (Week 1-4), then build Internal Registry (Week 5-12), and finally implement Runtime Monitoring (Week 13+). This phased approach prevents analysis paralysis while establishing immediate risk reduction.

The Bigger Picture: A Note for CSOs

The NullifAI discovery is not an anomaly. It's a preview.

ReversingLabs noted that the packages resemble a proof-of-concept model for testing a novel attack method. That method is legitimate and poses a real risk to developers.

According to ReversingLabs' Software Supply Chain Security Report 2026, threat actors have advanced from simple typosquatting to direct targeting of SDLC elements. The NullifAI technique reportedly appeared in subsequent PyPI attacks targeting AI development workflows. The February 2025 discovery proved that the "vibe-check" scanning model is fundamentally broken.

Malicious ML model artifacts now represent a documented and active threat vector.

As AI adoption accelerates across every business unit, the attack surface is shifting. From code to models. From repositories to hubs. From software packages to binary artifacts that most security tooling was never designed to inspect.

Mitiga's 2025 analysis of 10,000 open-source AI/ML repositories reveals 70% have critical or high-severity vulnerabilities in GitHub Actions workflows. Key findings:

→ 68.4% have unpinned third-party actions enabling supply chain attacks on model uploads/training

→ 34.1% vulnerable to script/command injection exploiting PR titles/bodies to steal tokens like HF_TOKEN

→ 42.7% have over-privileged GITHUB_TOKEN with unnecessary write access enabling model poisoning

→ 27.2% use unsafe triggers that run untrusted fork code with full permissions

Research found that 40% of organizations lack full visibility into the provenance of the software running in production. They often cannot trace which models, datasets, or AI services touch their systems. This asset visibility gap extends beyond traditional software and poses increasing risk as autonomous AI systems create additional layers of opacity that traditional asset management practices were never designed to handle.

The question for CSOs is not whether a malicious model will enter your environment.

Given current governance gaps, the question is whether you will detect it before or after it executes.

Key Takeaways

→ NullifAI is a confirmed attack technique discovered in February 2025 that proved "vibe-check" scanning is fundamentally broken

→ It exploits Pickle file serialization to execute reverse shells, bypassing existing scanners including Picklescan

→ The malicious models were live on HuggingFace for 8+ months undetected, downloaded by developers globally

→ JFrog's 2026 report documented a 451% surge in malicious packages with 495+ weaponized AI models on public registries

→ Shadow Model downloads are the new Shadow IT. 98% of organizations report unsanctioned AI use, yet 49% have no controls

→ Model Composition Analysis (MCA) is the missing layer in most security stacks and it's now mandatory

→ AI models must be tracked as first-class assets in your CMDB/asset management system to eliminate blind spots

→ Immediate priorities: Model Registry with approval workflow, SafeTensors enforcement, MCA tooling, and asset tracking integration

About This Report

Reading Time: Approximately 15 minutes

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available.

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
Source Transparency: Original research sources and citations are provided in the References section below
No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

→ ReversingLabs: Malware ML Model Hosted on Hugging Face

→ The Next Web: Hugging Face ClawHub Malware AI Supply Chain

→ Vectra AI: Shadow AI

→ OWASP LLM03 2025: Supply Chain Vulnerabilities

→ Mitiga: Inside the AI Supply Chain

→ ReversingLabs: Software Supply Chain Security Report 2026

→ UpGuard: State of Shadow AI Report 2024

→ JFrog: State of Supply Chain 2025 Report

→ Protect AI: Hugging Face Security Audit Results

→ JFrog: Discovery of 100+ Malicious AI/ML Models

→ HackerStorm: The AI Security Blind Spot That's Already Costing You Data

→ HackerStorm: The Invisible Inventory - Why AI Security Starts Where Most Organizations Haven't Even Looked

→ HackerStorm: Beyond Shadow AI - Securing the Agentic Workflows Your Security Team Can't See

Our Blog

NullifAI and Malicious Shadow AI Models: AI Supply Chain Security | HackerStorm