Is That Model File Safe? Pickle vs Safetensors vs GGUF, and How to Download AI Models Without Malware
Researchers have found 1,574 look-alike models on Hugging Face, and 2026 brought critical bugs triggered by poisoned GGUF files. Which model formats can carry code, how fake repos fool people, what a sha256 checksum does—and doesn’t—prove, and a six-point checklist before every download.
Awareness · 10 min
Is That Model File Safe? Pickle vs Safetensors vs GGUF,…
Researchers have found 1,574 look-alike models on Hugging Face, and 2026 brought critical bugs triggered by poisoned GGUF files. Which model formats can carry code, how fake repos fool people, what a sha256 checksum does—and doesn’t—prove, and a six-point checklist before every download.
Definition
A model file is the downloaded “brain” of an AI—billions of numbers plus some settings. Some formats store only data (safetensors, and GGUF for its weights). Others, mainly Python pickle files (.bin, .pt, .pth, .ckpt), can also store instructions that run the moment the file is loaded. That difference decides how much you must trust whoever made the file.
Running AI locally means downloading multi-gigabyte files from strangers on the internet. Most people would never run a random .exe from a forum, yet happily load a model from an account they’ve never heard of.
Usually that’s fine. But 2026 gave us reasons to be more careful: a study of Hugging Face found 1,574 potentially malicious look-alike models, Ollama’s “Bleeding Llama” bug was triggered by a crafted GGUF file, and a separate critical bug let a poisoned GGUF run code inside the SGLang server.
You don’t need to be a security expert to stay safe. You need to know which formats can carry code, how fakes are made, and one short checklist.
The three formats, ranked by risk
What each format can carry besides the model’s numbers.
| Format | Typical file names | Can it run code when loaded? | Verdict |
|---|---|---|---|
| Pickle (PyTorch) | .bin, .pt, .pth, .ckpt, pytorch_model.bin | Yes—by design. Loading can execute any Python inside. | Avoid from unknown sources |
| Safetensors | .safetensors | No. It stores only numbers and a small text header. Independently audited. | Preferred for Python tools |
| GGUF | .gguf | Not directly—but it carries a chat template that some software runs as a mini-program, and its parser must be bug-free. | Safe in good software, from good sources |
Pickle is the big one. It’s a Python format that can rebuild any object—including “run this command”. Attackers have uploaded pickle models that open a reverse shell the moment they’re loaded. Scanners exist, but researchers keep finding ways around them; three scanner bypasses were rated 9.3 out of 10 in late 2025.
GGUF: safe format, two catches
GGUF is the format most local AI apps use. Its weights are plain data, which is good. But two parts deserve respect:
- The chat template. Every GGUF includes a small template (written in a language called Jinja) that formats your messages. Some Python-based tools ran it without a sandbox, so a poisoned template could execute code. That happened in llama-cpp-python (CVE-2024-34359, fixed in 0.2.72) and in SGLang (CVE-2026-5760, disclosed April 2026).
- The parser. Software reads the sizes and offsets inside the file. If it trusts them blindly, a lying file can leak memory—exactly what happened in Ollama’s Bleeding Llama (fixed in 0.17.1).
note
The practical takeaway
GGUF is a good choice, but “it’s GGUF, so it’s safe” isn’t quite right. Keep your local AI software updated, because the software reading the file matters as much as the file.
How fake models fool people
Most attacks don’t need clever code. They need you to click the wrong repo. A 2025 study of the Hugging Face ecosystem found 1,574 potentially malicious typosquatting models—names designed to be mistaken for popular ones.
Common tricks, with made-up examples.
| Trick | Looks like | Tell-tale sign |
|---|---|---|
| Swapped letters | Qwen vs Qewn, meta-llama vs meta-lIama (capital i) | Copy the name into a plain-text editor |
| Official-sounding org | qwen-official, llama-team-releases | Check the org page: age, other models, followers |
| “Uncensored / faster” bait | Same model name + “-uncensored-fast” | Brand-new account, no model card details |
| Re-upload with extras | Real weights + an extra pickle file or script | Files you didn’t expect, like a .bin next to .safetensors or a .py file |
What a sha256 checksum proves (and what it doesn’t)
A sha256 is a fingerprint of a file. If even one byte changes, the fingerprint changes completely. Hugging Face publishes one for every large file.
Checksums are useful, but they answer a narrow question.
| A matching checksum proves | It does NOT prove |
|---|---|
| The file wasn’t corrupted during download | The repo owner is who you think they are |
| Nobody swapped the file between the server and you | The file is free of malicious content |
| You got exactly what that repo published | The repo is the official one |
In other words, a checksum protects the journey, not the source. Picking the right source is still your job.
Check a file yourself (compare with the sha256 on the file’s Hugging Face page)
# Linux
sha256sum model.gguf
# macOS
shasum -a 256 model.gguf
# Windows (PowerShell)
Get-FileHash model.gguf -Algorithm SHA256The six-point checklist before every download
- Source: is it the original publisher (for example Qwen, google, meta-llama, mistralai, deepseek-ai) or a well-known quantizer with a long history?
- Name: did you copy it from the publisher’s own announcement, not from a search result or a comment?
- Format: GGUF or safetensors? If a repo only offers .bin/.pt files, look for another repo.
- Extras: any .py files, scripts or unexpected pickle files in the repo? Skip it.
- Software: is your local AI app up to date? Most model-file attacks target parser bugs that are already fixed.
- Settings: never enable “trust remote code” (or similar) for a model you haven’t reviewed.
tip
When in doubt
Download the same model from the original publisher instead of a re-upload. It may be slightly bigger or less tuned, but you’ll know exactly where it came from.
How Quietly handles model files
What Quietly does for you, and what to watch.
| Area | What happens |
|---|---|
| Built-in catalog | Lists models from original publishers and established quantizers, so you don’t have to hunt for the right repo. |
| Download check | GGUF downloads for the main engine are checked against the sha256 Hugging Face publishes. If it doesn’t match—or no checksum is published—the file isn’t saved. |
| Engine binaries | The engines Quietly installs are pinned to tested versions and checked against their published release digests. |
| Main engine | llama.cpp, which loads GGUF and renders chat templates with its own built-in engine rather than Python’s Jinja2. |
warning
One honest caveat
Quietly’s AirLLM and training workflows use Python and accept Hugging Face repos with either safetensors or older .bin weights. When you search Hugging Face for those, pick repos that ship .safetensors from publishers you recognise—the checklist above still applies.
Where Quietly fits
FAQ
Can a GGUF file contain a virus?
GGUF weights are plain data, but the file also holds a chat template and metadata that software must process. Bugs in that processing have allowed memory leaks and, in some Python tools, code execution. Use up-to-date software and download from known publishers.
Is safetensors safer than .bin or .pt files?
Yes. Safetensors stores only numbers and a small header and cannot carry executable code. .bin, .pt, .pth and .ckpt files are usually Python pickle, which can run code when loaded.
Are Hugging Face models safe to download?
Models from original publishers and well-known quantizers are generally safe. The risk comes from look-alike accounts and re-uploads. Researchers found 1,574 potentially malicious typosquatting models, so always check the account, not just the model name.
Does a matching sha256 mean a model is safe?
No. It means you received exactly the file that repo published, without corruption or tampering on the way. It says nothing about whether the repo itself is trustworthy.
Does Quietly scan models for malware?
Quietly verifies GGUF downloads against Hugging Face’s published sha256, pins and checks its engine binaries, and offers a curated catalog of models from known publishers. It does not claim to detect malicious content inside a model, so choosing a trustworthy source still matters.
Sources
- Exploring Typo-Squatting Threats in the Hugging Face Ecosystem — Internetware 2025
- Poisoned Pipelines: Malicious AI Model and Skill Repositories — Cloud Security Alliance
- Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor — JFrog
- SGLang CVE-2026-5760: RCE via Poisoned GGUF Model Files — Cloud Security Alliance
- GGUF server-side template injection — JFrog Research
Related guides
Awareness
“Bleeding Llama” Explained: Is Your Local AI Exposed to the Internet? (60-Second Check)
CVE-2026-7482 let anyone on the internet read memory from ~300,000 Ollama servers—prompts, system instructions and API keys included. What happened, why “local” didn’t mean “private”, and a one-minute check you can run on your own machine today.
Awareness
An AI Agent Deleted a Production Database in 9 Seconds. Here’s How to Stop Yours.
In April 2026 a coding agent found an API token, ran one command, and wiped a startup’s database and its backups. The model wasn’t the real problem. A plain-English look at agent “blast radius”, seven guardrails that would have stopped it, and how to set them up.
Awareness
A Malicious Repo Can Hijack Your AI Coding Agent: Prompt Injection Explained (and How Folder Trust Stops It)
In 2026, a GitHub issue title compromised about 4,000 developer machines, and Mozilla showed a repo with no malicious code that still opens a reverse shell through an AI agent. How indirect prompt injection works, the three doors it uses, and a safe routine for opening code you didn’t write.