---
title: Tip: trust_remote_code=True means "run this stranger's Python with my permissions". Read the code, pin the revision, and load it somewhere without secrets | ctxsec
url: https://ctxsec.com/items/tip-trust-remote-code-review-pin-isolate
description: ""
status: "guidance (based on the Pluto Security Load/Mine report and Hugging Face Transformers documentation)"
published: 2026-10-29
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-trust-remote-code-review-pin-isolate.md)

guidance (based on the Pluto Security Load/Mine report and Hugging Face Transformers documentation)

2026-10-29

### Tip: trust_remote_code=True means "run this stranger's Python with my permissions". Read the code, pin the revision, and load it somewhere without secrets

The Load/Mine models had no weights at all; the attack was the Python file that loads with the model. Practical rules: (1) default to `trust_remote_code=False` and prefer models that work with built-in architectures; (2) when custom code is needed, read every file named in `auto_map` and pin the reviewed commit with `revision="<sha>"` so a later push can't change it; (3) load new models in a container or VM with no cloud keys, SSH keys or tokens, and limited outbound network; (4) on Xinference, GPUStack or similar servers, require authentication and don't let users register arbitrary hub models; (5) don't rely on a clean hub scan, since the flagship payload passed them.

Sources: [Pluto Security: Hugging Face malware campaign "Load/Mine" (Oct 29)](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) · [Hugging Face Transformers security policy](https://github.com/huggingface/transformers/security/policy)