Analysis · curated 1 Aug 2026
The Hidden Risks of Downloading and Running Open-Source LLMs Locally: Model Formats, Supply-Chain Attacks, and EDR Blind Spots
First reported barhum.ai
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Open-source model files distributed via hubs are executable supply-chain artifacts that can run arbitrary code on enterprise infrastructure, and defenders' endpoint tooling largely cannot see model-layer threats.
A Barhum.ai report maps the security attack surface of running open-source LLMs locally, arguing model files are executable artifacts: Python pickle formats (.pt/.pth/.bin) permit arbitrary code execution by design, PickleScan has been bypassed by zero-day vulnerabilities, and inference engines like Ollama have accumulated multiple critical CVEs. It notes CVE-2025-32434 (CVSS 9.3) showed torch.load() with weights_only=True was still exploitable, and highlights that EDR tools are architecturally blind to model-layer threats.