Your Model File Is Executable Code
Most AI security testing never gets past the chat box. Somebody coaxes the model into saying something it shouldn't, screenshots it, and files it as a finding.
Meanwhile, the real compromise sits three layers down, in a file your ML team downloaded from a hub last quarter.
Malicious model files: the artifact is the attack surface
A model checkpoint is not data. Load an untrusted pickle-backed artifact, and you execute whatever the author put in it—that's not a bug; that's the format working as designed. A model pulled from a public hub, fine-tuned by a vendor, restored from an artifact store, or promoted out of a registry can carry a payload that fires the instant your serving process loads it.
No prompt. No user input. No model behavior involved at all. The model is the malware.
GhostTensor reverse-engineers model artifacts statically — we never execute them — across the formats actually in production: pickle and joblib, PyTorch archives, safetensors, GGUF, ONNX, Keras, and raw NumPy. We recover architecture and tensor inventory, pull embedded strings, and analyze the serialization stream itself for the constructs that turn a checkpoint into a dropper.
We also look inside the weights. A payload can be embedded in the low-order bits of float32 tensors: the file loads cleanly, the model performs to spec, and the weights carry cargo. Nothing in a standard dependency scanner will tell you that.
ML supply chain security is the practice of securing every stage a model passes through before it serves a request: the training data, the artifact, the registry it's stored in, and the infrastructure that loads it.
The ML supply chain attack surface
Artifacts — trojaned serialization, steganographic payloads in tensor storage, unsigned and world-writable models sitting in shared storage, and the source-level patterns that make loading them dangerous in the first place.
Data — dataset poisoning recon: label-distribution skew against a known baseline, duplicate and near-duplicate flooding, candidate backdoor trigger tokens, and PII that should never have made it into a training set.
Model behavior — black-box adversarial work against a live endpoint. Evasion, decision-boundary mapping, model inversion, and model extraction. Extraction is the one clients consistently underestimate: given nothing but query access, an attacker can train a surrogate that approximates the model you spent eight figures building. Your IP walks out through the API you published on purpose.
Serving and agentic infrastructure — this is where most real compromises start. Unauthenticated management planes on TorchServe, TF-Serving, Triton, MLflow, Ray, KServe, BentoML, Ollama, Gradio, and Jupyter. And the MCP layer: tool poisoning, hidden exfiltration parameters, rug-pull tool definitions, zero-width Unicode in tool descriptions, and injection reaching through a tool into the systems behind it.
MCP and MLflow: two live RCE primitives
GhostTensor carries working remote-code-execution primitives for two real-world classes, both developed and hardened against live vulnerable targets in our lab before they ever touched an engagement:
MLflow artifact-proxy overwrite. Default credentials into a tracking server, enumerate the model registry for run IDs and artifact paths, overwrite a registered model artifact through the artifact proxy, and wait for code execution the next time anything loads that model. The registry becomes the delivery mechanism.
MCP Inspector unauthenticated stdio spawn. The Inspector proxy listened on all interfaces and exposed an endpoint that spawned an MCP server over stdio using attacker-controlled command and argument parameters, with no authentication and no origin check — CVSS 9.4, reported by Oligo Security and fixed by Anthropic in 0.14.1. Developer tooling for AI agents is now a production attack surface, and most organizations have no inventory of where it's running.
Destructive capability is gated by design
Every offensive primitive in GhostTensor — trojan artifact generation, injection canaries, artifact overwrite — is locked behind an explicit authorization flag. Nothing fires on a misread command line, and nothing fires without scope. That's an architectural decision, not a disclaimer at the bottom of a report.
Mapped, not vibes-based
Findings map to the OWASP Top 10 for LLM Applications, the OWASP Machine Learning Security Top 10, MITRE ATLAS, and CWE, and land in your report through our Kill Chain Replay™ narrative: every chain replayed end to end to a demonstrable impact, with the reproduction steps attached.
What we don't publish
GhostTensor isn't open source and won't be. The underlying research is public; the engineering, the detection logic, and the payload libraries aren't. The same discipline applies to your results — TLP: AMBER+STRICT, delivered to you, never used as marketing without written permission.
Ghost Ops Security is a CREST AI Charter founding signatory holding CREST Pathway certification, and we run local, air-gapped inference. Your model, your data, and your findings never leave our environment for a third-party API.
Security is an illusion until we test it.
Scoping an AI or ML system? → info@ghostops-security.com