Selecting a model in Unsloth’s training tool was enough to run arbitrary code on a developer’s machine, according to Pillar Security.
Researcher Ariel Fogel traced the path. The Unsloth Studio backend read a model’s config.json, then downloaded and executed Python from that repository without loading the weights or running inference. A crafted model could therefore smuggle code straight into an AI development environment.
The reach comes from permissions. The process runs as the user, so it can touch proprietary training data, model artifacts, Hugging Face tokens, SSH keys and cloud credentials sitting on the same machine.
Disclosure became the second dispute. Unsloth patched the flaw in June but chose not to publish an advisory or request a CVE, pointing to Studio’s beta label. Pillar rejects that reasoning, since the affected code ships inside the standard unsloth package on PyPI and installs with a plain pip command.
The underlying cause is a deliberate feature. Unsloth relies on Hugging Face’s trust_remote_code setting, which lets a model bring its own Python. Several legitimate models need it, including IBM Granite and DeepSeek-OCR.
Pillar’s objection is about identifiers. A quiet fix leaves downstream teams with no way to check whether they were ever exposed.
