A safety flag named trust_remote_code just got bypassed by the thing it was supposed to protect against. If that sentence doesn't make you nervous, you haven't thought hard enough about how many pip install and from_pretrained() calls your team runs before lunch.
Context
This isn't new territory, it's the same old territory with a shinier UI. Package registries have been fighting malicious-code-via-dependency problems since npm and PyPI became household names for supply chain attacks. What's different here is the framing: Hugging Face model repos look like data. A .safetensors file, a config, some weights. Developers mentally file "downloading a model" under "downloading an artifact," not "executing someone else's code." The trust_remote_code flag existed precisely because Diffusers (and Transformers, for that matter) sometimes needs to run custom Python shipped alongside a model. It was the industry's honest attempt to say "hey, this next step is risky, opt in explicitly." Three flaws just quietly walked around that opt-in.
So no, this isn't a brand new class of attack. It's the AI ecosystem rediscovering a lesson the package-manager world learned a decade ago, except now the artifacts are gigabytes of tensors and the reviewers are data scientists, not backend engineers who've been burned by a postinstall script before.
