Yotam Perkal
uggingFace has become the GitHub of machine learning. Two million models, 15 million daily downloads. We discovered a critical RCE (CVE-2026-4372) that compromises any machine loading a malicious model. Add one field to a model's config.json, publish it on the Hub, and any standard from_pretrained() call is silently compromised. No trust_remote_code=True. No warnings. The one security boundary the entire ML ecosystem relies on, bypassed completely.
The chain is three flaws: a generic setattr loop stamping every JSON field onto the config object including private attributes; a sanitization gap protecting the public interface but not the underscore-prefixed internal equivalent; and an unsandboxed kernel loader executing arbitrary Python from any Hub repo. One field weaponizes all three.
We walk through the full attack chain live. Model registries are the new package registries, facing the same supply-chain threats that broke the software world - with far less mature defenses.
Yotam Perkal
Director of Security Research, Pluto Security.
Yotam Perkal leads security research at Pluto Security, a next-generation AI security and governance platform designed to protect the rapidly emerging ecosystem of AI builders, low-code/no-code tools, and agentic applications. His work focuses on securing AI-native development environments and building scalable methods for detecting, validating, and mitigating risks in AI-driven software workflows.
Previously, Yotam led the Threat Research team at Zscaler, headed the Vulnerability Research team at Rezilion, and held multiple roles within PayPal’s security organization across vulnerability management, threat intelligence, and insider threat.
Yotam is an active participant in several cross-industry working groups dealing with AI security, vulnerability management, and supply chain security.