Pillar finds an Unsloth vulnerability that runs attacker code

Researchers at Pillar say that a trust setting in Unsloth lets attacker code run when a user loads a model. The code uses the permissions of the software that loads the model. Pillar sent a report to the maintainers on August 22. A first patch came in 6 hours. VulnCheck helped to get a CVE, an ID for a vulnerability that all can see.

How it works

Pillar says that the attacker code can give access to datasets of the company and to model files. It can also give access to Hugging Face tokens and cloud credentials. Its tests showed that the code can run before the model loads.

The numbers

These versions have the vulnerability:

• Unsloth Zoo from version 2025.9.9 to before 2026.8.14.
• Unsloth from version 2025.9.9 to before 2026.8.20.

Only the tests of Pillar show this. Pillar gives no report of an attack other than its tests.

What is not known

Pillar says that the maintainers did not speak to Pillar when it tried again. It is not known how many users are at risk.

Insight: AI tools hold keys that attackers want

The Unsloth vulnerability can give access to Hugging Face tokens and cloud credentials. In October, a worm in the Tensorlake package on npm got credentials. It could erase the home directory of a user who revoked a token that the worm got from GitHub. This seems to be a pattern: attackers want AI tools, where one worker holds many keys. Before you revoke a token, check for a worm.