The Load/Mine models had no weights at all; the attack was the Python file that loads with the model. Practical rules: (1) default to trust_remote_code=False and prefer models that work with built-in architectures; (2) when custom code is needed, read every file named in auto_map and pin the reviewed commit with revision="<sha>" so a later push can't change it; (3) load new models in a container or VM with no cloud keys, SSH keys or tokens, and limited outbound network; (4) on Xinference, GPUStack or similar servers, require authentication and don't let users register arbitrary hub models; (5) don't rely on a clean hub scan, since the flagship payload passed them.