Security Flaw in Unsloth Studio Lets Malicious AI Models Run Arbitrary Code During Inspection

Security researchers have uncovered a vulnerability in the open‑source tool Unsloth Studio that can allow hostile AI models to execute arbitrary Python code when they are inspected, exploiting the platform's trust_remote_code setting.

Unsloth Studio, a widely adopted library for fine‑tuning and deploying large language models, streamlines the process of loading and testing models from public repositories. Its convenience has made it a staple for developers and researchers who frequently pull models from the internet for evaluation.

The problem stems from the trust_remote_code flag, which instructs the library to run code bundled with a model repository. While this feature is intended to simplify integration of custom preprocessing or generation logic, the recent flaw permitted code execution even after the initial patch was applied, effectively bypassing the intended safety checks.

In practice, an attacker can host a model that includes malicious Python scripts. When a user loads the model with trust_remote_code enabled—a common default in many workflows—the hidden code runs on the host machine during the inspection phase, granting the attacker the ability to read files, install additional software, or exfiltrate data.