Model artifact from unverified source

ID

model-artifact-from-unverified-source

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM03:2025 — Supply Chain

OWASP ASI

ASI04:2026 (secondary ASI05:2026)

Family

LLM03 — Supply Chain

Red-team vectors

RAG Poisoning, Sandbox Escape / RCE

Tags

ai_security

Description

A model artifact (.safetensors, .gguf, .bin, .pt, *.onnx, …​) is downloaded from a host that is not in the trusted model-source allowlist, with no hash or provenance evidence on the reference. Model files are executable content (deserializers run code on load), so pulling one from an unvetted origin is a supply-chain compromise vector.

The trusted verdict comes from the bundled trusted-source pack plus the per-scan --model-source-allowlist extension, so approving an internal mirror clears the finding with no code change.

Examples

url = "https://random-bucket.s3.amazonaws.com/model.safetensors"   (1)
download(url, "model.safetensors")
1 Host not in the allowlist and no hash evidence — flagged.

The same artifact pulled from huggingface.co, or with a sha256/revision pin present, produces no finding.

Mitigation / Fix

  • Pull model artifacts only from trusted hosts; extend --model-source-allowlist for approved internal mirrors.

  • Verify the artifact hash / signature before loading.