---
title: "Store models in formats that cannot run · Agent Wranglers"
url: https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry/safe-model-formats
id: MLO-42
level: Required
applies: ai-features
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1098
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Store models in formats that cannot run code

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Training runs and the registry](https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: MLO-42
- Level: Required
- Chapter: [Training runs and the registry](https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry.md)
- Rule: Save and load model weights only in formats that hold data and no code, such as safetensors or ONNX. Never unpickle a model file that did not come from your own registry with a matching hash.
- Check: A code search finds no `pickle.load`, `joblib.load` or `torch.load` with `weights_only=False` outside the one loader that checks hashes. The registry refuses an upload with a `.pkl` or `.pt` file from outside the training pipeline. A test loads a file whose hash differs from the registry, and the loader refuses it.
- Risk: An account or system taken over
- Applies when: The project uses AI models.
- How: Pickle files, and formats built on them such as joblib and older PyTorch files, run code while they load. A model downloaded from a hub or a shared drive can take over the training or serving machine. Convert outside models to a weights-only format in an isolated job before they enter the registry. Where a library still needs pickle, such as some scikit-learn pipelines, load only files your own pipeline wrote. Check their hash against the [registry](https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry/model-registry.md) first. In PyTorch, keep `weights_only=True` on every `torch.load`. Run ONNX models in a sandbox with memory limits, because a crafted graph can still exhaust them. Outside models also follow [use models and data from trusted sources](https://agentwranglers.se/playbook/application-security/supply-chain/trusted-model-sources.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
from safetensors.torch import load_file

def load_registered_model(version: ModelVersion) -> dict[str, torch.Tensor]:
    path = registry.download(version)
    if sha256_file(path) != version.weights_sha256:
        raise ModelHashMismatch(version.id)
    return load_file(path)
```

### TypeScript example

```ts
import * as ort from 'onnxruntime-node';

export async function loadRegisteredModel(version: ModelVersion): Promise<ort.InferenceSession> {
  const bytes = await registry.download(version);
  if (sha256(bytes) !== version.weightsSha256) throw new ModelHashMismatch(version.id);
  return ort.InferenceSession.create(bytes);
}
```

## Sources

- [PyTorch torch.load security warning](https://docs.pytorch.org/docs/stable/generated/torch.load.html)
- [scikit-learn model persistence and security](https://scikit-learn.org/stable/model_persistence.html)

## Related rules

- MLO-21 [Keep every model in a registry with versions and aliases](https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry/model-registry.md) in Machine learning
- APS-77 [Use models and data from trusted sources](https://agentwranglers.se/playbook/application-security/supply-chain/trusted-model-sources.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry/safe-model-formats">Agent Wranglers machine learning playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Write a model card for every model in production](https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry/model-cards.md)
- Next: [Record the compute cost of every training run](https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry/training-run-cost.md)
- [Training runs and the registry](https://agentwranglers.se/playbook/machine-learning/training-runs-and-the-registry.md)