Pickle-only uploads to Hugging Face doubled since 2024
Analysis of hub-stats data shows the share of Hugging Face uploaders posting only pickle files (.pt, .pth, .ckpt, .pkl) with no safetensors, GGUF or ONNX rose from about one in seventeen in late 2024 to one in eight since March 2026. Of 114 pickle-only models inspected, 89 load safely with weights_only, while 25 require disabling the protection or third-party code.
- Pickle-only uploader share rose from ~6% in late 2024 to ~12% since March 2026
- 89 of 114 inspected models load with weights_only=True, 25 do not
- Eight YOLO models pickle Ultralytics classes and load with weights_only=False
- About 3,300 users a month uploaded pickle-only models from March to September 2026
Read next
Security