Wiz Research finds architecture risks that may compromise AI-as-a-Service providers and consequently risk customer data; works with Hugging Face on mitigations

Wiz Research demonstrated that untrusted AI artifacts and build artifacts in Hugging Face could be abused to achieve remote code execution and multi-tenant compromise: a malicious Pickle-serialized PyTorch model executed code during inference, a crafted Dockerfile executed during build, and from those shells researchers accessed EKS node metadata to obtain credentials and Kubernetes tokens, enumerate secrets, and found write access to a shared internal container registry — together creating cross-tenant, supply-chain and sensitive-data exposure risks.