pickle
AssessTechniques
Python object serialization format that can execute code during deserialization if misused.
Why it's here
Placed in Assess: 1 article(s) of evidence from 1 source(s), led by security coverage, with 0 in the last 30 days. Confidence 24%. Low accumulated evidence, so it defaults conservatively pending more signal.
Evidence (1)
- 7The New Stack·8/14/2026securityUnsigned container images are a growing security risk in AI pipelines
The article argues that many organizations still do not sign container images, leaving delivery pipelines exposed to tampering, impersonation, and compromised base images. It says the risk is more urgent in AI workflows because model artifacts, datasets, and runtimes are increasingly shipped as OCI artifacts that scanning alone cannot verify for provenance.