--- title: Unsloth’s model picker had a code-execution problem description: Security researchers at Pillar Security found that Unsloth Studio, a beta web interface for the AI training tool Unsloth, would automatically download and... canonical: https://daily.dev/posts/unsloth-s-model-picker-had-a-code-execution-problem-73vfdi3rj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Unsloth’s model picker had a code-execution problem | daily.dev og:description: Security researchers at Pillar Security found that Unsloth Studio, a beta web interface for the AI training tool Unsloth, would automatically download and... og:url: https://daily.dev/posts/unsloth-s-model-picker-had-a-code-execution-problem-73vfdi3rj og:image: https://api.daily.dev/og/posts/73vFdI3Rj.png og:image:alt: Unsloth’s model picker had a code-execution problem og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unsloth’s model picker had a code-execution problem **[InfoWorld](https://daily.dev/sources/infoworld)** · 4 min read · 0 upvotes · 0 comments ## Summary Security researchers at Pillar Security found that Unsloth Studio, a beta web interface for the AI training tool Unsloth, would automatically download and execute Python code from a model's repository just by selecting the model for inspection—no inference required. The flaw stemmed from Unsloth defaulting Hugging Face's trust_remote_code option to True during routine metadata checks, potentially exposing Hugging Face tokens, SSH keys, cloud credentials, and proprietary training data. Unsloth's maintainers declined to publish a security advisory or seek a CVE, citing Studio's beta status, though Pillar notes the vulnerable code ships in the generally available PyPI package. Unsloth fixed the issue in version 2026.6.9, disabling automatic remote model loading and no longer trusting remote code from local files; Pillar independently confirmed the fix closes both the Hugging Face and local-directory attack paths. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the security vulnerability found in Unsloth Studio's model picker? Selecting a model in Unsloth Studio automatically triggered download and execution of Python code from the model's repository, even though only a metadata check (reading config.json) was performed and no inference occurred. This happened because Unsloth defaulted Hugging Face's trust_remote_code setting to True during routine model inspection, letting a specially crafted model execute arbitrary code and potentially expose Hugging Face tokens, SSH keys, cloud credentials, or training data. _daily.dev surfaces vulnerability writeups like this for teams auditing AI tooling before it touches production credentials._ ### How did Unsloth fix the trust_remote_code vulnerability in Studio? Version 2026.6.9 of Unsloth stopped enabling arbitrary model loading directly from Hugging Face and stopped trusting remote code from local model files during Studio's inspection path. Pillar Security independently retested this release and confirmed both the Hugging Face and local-directory attack vectors were closed, and it urged all Unsloth users, even those who never launch Studio, to upgrade. _Track fixes like this on daily.dev before rolling out an AI training tool upgrade across a team._ ### Why didn't Unsloth get a CVE assigned for the Studio code execution flaw? Unsloth's maintainers cited Studio's beta status as the reason for declining to publish a security advisory or request a CVE after patching the issue in June. Pillar Security disputed that reasoning, noting the vulnerable Studio code ships as part of the standard, generally available 'unsloth' package on PyPI, installable via a plain 'pip install unsloth' without opting into any prerelease version. _Developers weighing vendor risk framing versus real exposure follow disputes like this via daily.dev._ ## Similar posts on daily.dev - [Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads](https://daily.dev/posts/malicious-hugging-face-model-masquerading-as-openai-release-hits-244k-downloads-xftpmcpz1) · CSO Online · 0 upvotes · 0 comments - [Remote Code Execution With Modern AI/ML Formats and Libraries](https://daily.dev/posts/remote-code-execution-with-modern-ai-ml-formats-and-libraries-kzzcz2ymw) · Unit 42 · 0 upvotes · 0 comments - [Hugging Face and ClawHub compromised with hundreds of malicious AI models and agent skills as supply chain attacks target AI infrastructure](https://daily.dev/posts/hugging-face-and-clawhub-compromised-with-hundreds-of-malicious-ai-models-and-agent-skills-as-supply-xjnujrk1y) · The Next Web · 4 upvotes · 0 comments - [Python libraries in AI/ML models can be poisoned w metadata](https://daily.dev/posts/python-libraries-in-ai-ml-models-can-be-poisoned-w-metadata-4tbuftlcz) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/unsloth-s-model-picker-had-a-code-execution-problem-73vfdi3rj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Unsloth’s model picker had a code-execution problem","url":"https://daily.dev/posts/unsloth-s-model-picker-had-a-code-execution-problem-73vfdi3rj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/unsloth-s-model-picker-had-a-code-execution-problem-73vfdi3rj"},"datePublished":"2026-09-30T13:56:45.663Z","dateModified":"2026-09-30T15:24:51.125Z","description":"Security researchers at Pillar Security found that Unsloth Studio, a beta web interface for the AI training tool Unsloth, would automatically download and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4414a2cf26ec5d265ad831cd6dab68a5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4414a2cf26ec5d265ad831cd6dab68a5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoWorld","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoWorld","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf6d68a999064029b0bb09aa6268f1f3","url":"https://daily.dev/sources/infoworld"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/unsloth-s-model-picker-had-a-code-execution-problem-73vfdi3rj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoWorld","item":"https://daily.dev/sources/infoworld"},{"@type":"ListItem","position":3,"name":"Unsloth’s model picker had a code-execution problem"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/unsloth-s-model-picker-had-a-code-execution-problem-73vfdi3rj#faq","mainEntity":[{"@type":"Question","name":"What was the security vulnerability found in Unsloth Studio's model picker?","acceptedAnswer":{"@type":"Answer","text":"Selecting a model in Unsloth Studio automatically triggered download and execution of Python code from the model's repository, even though only a metadata check (reading config.json) was performed and no inference occurred. This happened because Unsloth defaulted Hugging Face's trust_remote_code setting to True during routine model inspection, letting a specially crafted model execute arbitrary code and potentially expose Hugging Face tokens, SSH keys, cloud credentials, or training data. daily.dev surfaces vulnerability writeups like this for teams auditing AI tooling before it touches production credentials."}},{"@type":"Question","name":"How did Unsloth fix the trust_remote_code vulnerability in Studio?","acceptedAnswer":{"@type":"Answer","text":"Version 2026.6.9 of Unsloth stopped enabling arbitrary model loading directly from Hugging Face and stopped trusting remote code from local model files during Studio's inspection path. Pillar Security independently retested this release and confirmed both the Hugging Face and local-directory attack vectors were closed, and it urged all Unsloth users, even those who never launch Studio, to upgrade. Track fixes like this on daily.dev before rolling out an AI training tool upgrade across a team."}},{"@type":"Question","name":"Why didn't Unsloth get a CVE assigned for the Studio code execution flaw?","acceptedAnswer":{"@type":"Answer","text":"Unsloth's maintainers cited Studio's beta status as the reason for declining to publish a security advisory or request a CVE after patching the issue in June. Pillar Security disputed that reasoning, noting the vulnerable Studio code ships as part of the standard, generally available 'unsloth' package on PyPI, installable via a plain 'pip install unsloth' without opting into any prerelease version. Developers weighing vendor risk framing versus real exposure follow disputes like this via daily.dev."}}]} ```