The machine learning supply chain has a namespace problem. Practitioners routinely download models, datasets, and tokenizer configurations from Hugging Face without verifying provenance, relying on the assumption that platform controls catch malicious content. Research published in Q3 2026 has demonstrated that assumption has significant gaps, with attackers successfully distributing malicious payloads by exploiting similarity between legitimate and attacker-controlled repository names.
Namespace hijacking and the AI Jacking technique
AI Jacking refers to registering Hugging Face usernames or organization names that closely resemble trusted publishers. A model legitimately hosted at 'meta-llama/Llama-3-8B' could be mimicked by 'meta-llma/Llama-3-8B' or 'meta_llama/Llama-3-8B'. Developers who copy model IDs from third-party sources without verifying the canonical publisher namespace may load the attacker-controlled version. The HiddenLayer AI Threat Landscape 2026 report identifies namespace hijacking as one of the fastest-growing ML security attack vectors.
Picklescan bypass and serialized payload delivery
Hugging Face uses Picklescan to detect malicious pickle payloads in model files. Researchers have demonstrated multiple bypass techniques that allow malicious content to evade this scan. One proof-of-concept tool, ClawHavoc, packages a reverse shell inside a model file in a way that satisfies Picklescan pattern-matching rules while still executing arbitrary code on load. The safer alternative, the Safetensors format, prevents deserialization-based attacks entirely, but framework support and adoption remain incomplete across the ML ecosystem.
The agentic AI amplification factor
The risk profile changes substantially when AI agents, rather than human developers, initiate model downloads. Agentic pipelines that select models based on task requirements can be manipulated to load attacker-controlled repositories if the selection logic relies on name matching rather than cryptographic verification. A compromised model in an agentic pipeline could exfiltrate system prompts, inject malicious outputs into downstream processes, or establish persistence on the inference host. The HiddenLayer report documents two confirmed enterprise cases where agentic workloads loaded namespace-hijacked models during 2026.
Defensive recommendations for ML teams
Three controls deliver the highest immediate impact. First, require Safetensors format for all model downloads wherever framework support exists, since Safetensors prevents arbitrary code execution on load by design. Second, pin model downloads to specific commit hashes and verify hashes against checksums published by the canonical author before loading. Third, for teams operating agentic pipelines, restrict model selection to a pre-approved allow-list with hash verification and generate an alert on any attempt to load an unlisted model.
Infosec.ge is Georgia's dedicated cybersecurity intelligence platform, covering threat actors, vulnerabilities, and security developments across the South Caucasus and Eurasia. Get in touch to discuss research collaboration or media inquiries.