What makes a Hugging Face model risky?

The highest-signal factor is custom/remote code (trust_remote_code): models that ship .py files which execute in your environment. After that: a missing or non-commercial license, very low adoption, a very recent upload with no track record, and gating. This tool surfaces all of them from the model’s own metadata.

Why does custom code matter so much?

Loading a model with custom code runs that code on your machine. Hugging Face Transformers CVE-2026-80047 showed the trust-remote-code path could even write attacker files to disk before the consent prompt. Treat a custom-code model like an unknown binary.

Does the scanner need my Hugging Face token?

No. It reads public model metadata only. Private or gated model details are limited to what the public API returns.

Free tool · no signup

Hugging Face Model Risk Scanner

Enter a Hugging Face model id and get a supply-chain risk read — custom/remote code, license, adoption, freshness and gating — before you pull it into your product.

Try:

Clearing a model to use? Confirm its license with the Model License Checker, add it to an AI Bill of Materials, and read why custom-code models are dangerous.

Reads public Hugging Face metadata only. A clean read is not a guarantee — vet custom-code models before loading them.

Hugging Face Model Risk Scanner

Practice & Coaching

Simulations

PCI DSS

Studios

Scanners & Library

Arcade

Stay Lowkey 🔒

Community

Get Started Free