Shweta Sharma writes that Unsloth Studio, an AI-model-training tool in beta, contained a vulnerability where selecting a model could trigger arbitrary Python code execution on a user's machine. The issue stemmed from the application automatically enabling Hugging Face's `trust_remote_code` option during routine metadata checks, allowing specially crafted models to execute malicious code without downloading full weights or requiring inference.
- Pillar Security researcher Ariel Fogel discovered that reading only the `config.json` file was sufficient to trigger the exploit.
- A fix was released in version 2026.6.9 which prevents arbitrary model loading from Hugging Face and disables the automatic trust of remote code for local files.
- Pillar Security researcher Ariel Fogel discovered that reading only the `config.json` file was sufficient to trigger the exploit.
- A fix was released in version 2026.6.9 which prevents arbitrary model loading from Hugging Face and disables the automatic trust of remote code for local files.
Create executable demo documents that show and prove an agent's work. Showboat helps agents build markdown documents that mix commentary, executable code blocks, and captured output. These documents serve as both readable documentation and reproducible proof of work. A verifier can re-execute all code blocks and confirm the outputs still match.
gptme is a personal AI assistant in your terminal, enabling it to use the terminal, run code, edit files, browse the web, use vision, and more. It assists in all kinds of knowledge-work, especially programming.
This JavaScript guide demonstrates the basics of E2B: connecting to an LLM, generating Python code, and executing it securely in an E2B sandbox.
