Pickle Files: Python’s Serialization Format as an Execution Vector

▶ Watch (1:20)

Pickle is Python’s default serialization format. It converts objects to byte streams and, when loaded, converts them back. The problem: loading a pickle file can execute arbitrary code. Files don’t need a .pkl or .pickle extension to be valid pickle files. Content determines type, not the filename. Attackers have known this since Marco’s Black Hat 2011 presentation and Jonathan’s DEF CON research on backdooring pickle files. Both findings now resurface in the context of AI model distribution on Hugging Face and GitHub.

Supply Chain Attack: A Trojanized Chatbot on Hugging Face

▶ Watch (4:15)

Parzian built a healthcare chatbot using FL-T5, a small model that runs on standard CPUs, backed by a pickle file holding Q&A pairs. He uploaded a clean version to Hugging Face, then a modified one. The malicious version adds a reverse shell function to the Python app and embeds a call to it inside the pickle’s Q&A data. When the chatbot loads the pickle, it calls back to the attacker’s server. The developer sees normal responses. The attacker gets a shell.

Scanner Failures: How Malicious Pickle Files Evade Detection

▶ Watch (6:47)

Fickling, a dedicated pickle analysis tool, flagged the issue directly, pointing to the wazero call and the reverse shell function. Two well-known open-source pickle scanners found nothing. Most AV and EDR products missed it when tested in February. One commercial tool said the pickle-plus-Python combination might make detection possible in the future. Hugging Face’s scanner took one to two weeks to change the warning indicator from white to orange, and the flag requires a manual click to see. Parzian notified Microsoft; Defender started blocking the download in April.

Five AI File Formats That Bypass Host Security

▶ Watch (9:43)

ONNX is a model interchange format used to convert PyTorch models to TensorFlow and others. Like pickle, it accepts embedded payloads. Parzian built five chatbot variants targeting separate formats: pickle, cloudpickle, joblib, egg (a zip format for Python packages), and feather (a columnar data format). Two bypassed Hugging Face scanning entirely. Using PyInstaller, he converted the ONNX payload to a Windows .exe requiring no Python install on the target. VirusTotal scored the executable zero out of zero.

Notable Quotes

we could just sit back and relax and see Cyrus Parzian · ▶ 3:52

that healthcare chatbot is just a loader Cyrus Parzian · ▶ 11:17

if you don’t trust it, do not run it. Cyrus Parzian · ▶ 17:04

Key Takeaways

  • Pickle files execute code on load; file extension checks provide no security guarantee.
  • A Hugging Face chatbot with an embedded reverse shell evaded most AV and EDR tools for months.
  • PyInstaller converts ONNX payloads to standalone .exe files that bypass Microsoft Defender Endpoint.
  • AI pipeline security must cover all Python serialization formats, including non-ML types like egg and feather.
  • Restricting developer access to Hugging Face and GitHub limits exposure to model-supply-chain attacks.

About the Speaker(s)

Cyrus Parzian is an AI Red Team Lead with over a decade of experience in offensive security, red teaming, and AI risk testing. He has led assessments targeting model serialization abuse, data leakage prevention, prompt injection, and LLM jailbreak resistance. He has conducted over 100 offensive operations across internal networks, cloud environments, and LLM-integrated applications, including large-scale phishing campaigns and exploitation of automation platforms like Power Automate. He shares his research on iRedTeam.ai and has spoken at ArcticCon.