MITRE ATLAS 2026 Top AI Detection: Malicious Model File Deserialization via AI S
Detects potential remote code execution triggered by loading untrusted AI model files (e.g., pickle, .pt, .pth, .ckpt) in Python-based environments. The rule identifies suspicious child process execution or the presence of known dangerous deserialization/payload indicators (like os.system, subprocess, or socket) within the command line of common model-loading applications, suggesting a model-based supply chain compromise.
Sigma
