Check H9 · execution family · severity HIGH or MEDIUM, HIGH when the repository is also pickle-only · automatic — reads the file tree and matched file contents via the Hub API, no clone required · one of the 18 Hugging Face checks
The question this check asks: does loading this model require running Python code that ships inside the repository itself — the trust_remote_code surface — rather than only deserialising weights?
Some Hugging Face repositories ship their own modelling code alongside the weights, and loading them means executing that code, not just reading tensors. That is a different attack surface from pickle deserialisation (H6–H8): it is code the repository author wrote that runs deliberately, by design, the moment the model loads. It is exactly this surface, alongside the pickle scan, that flagged the Hub's own EICAR canary mcpotato/42-eicar-street as a BLOCK via H6, H7 and H9 together — see the malicious-models intelligence page for the full roster table.
H9 also reaches further than "install and run." Of the four dimensions RepoGates derives from the 18 checks, H9 sits in three of them: install and run (H6–H10, H13), open in an editor (H9, H14–H17), and hand to an AI agent (H9, H14–H18). Code that runs on load is code an agent calling a loading function would run too, without a human ever opening a file first.
A custom-code finding (hf-remote-code) is MEDIUM, 5 points on its own, escalating to HIGH, 10 points when the same repository is also pickle-only — an H8 hit. The evidence note in the scoring table, verbatim:
"trust_remote_code surface; HIGH when the repo is also pickle-only"
The escalation reflects a compounding risk: code executes on load and there is no safe weight format to fall back to. Ten points does not block a repository on its own; it takes other findings, or a CRITICAL-level hit from H6 or H7, to move a repository all the way to BLOCK.
The 12 September 2026 measurement of the 100 most-downloaded models reports specific fire counts for H7 (4 times) and H8 (14 times), but does not break out a separate count for H9 — so this page states no number for it rather than inventing one. What that measurement does establish is the overall outcome across all 18 checks combined: 0 BLOCK, 28 REVIEW, 72 PASS. H9 alone, at MEDIUM 5 or HIGH 10 points, is far short of what it takes to BLOCK a repository by itself.
H9 detects that the loading path requires running repository-supplied Python — it does not read or audit what that code actually does. Flagging the surface is not the same as static analysis of the custom code's behaviour; that judgement is still the user's. It also says nothing about the weights format (H8) or about what the Hub's own scanners found in any pickle files present (H6, H7) — those are independent signals reported separately.
And RepoGates as a whole gates browser-initiated downloads only — it does not see git clone, package-manager installs, curl, or fetches made by AI agents outside the browser, which matters especially here: an agent's own model-loading call is exactly the kind of fetch this check cannot see happen. Nothing on this page, or in the extension's verdict banner, exposes scan data as a global variable a script on the page could read.
Open the model's Files and versions tab and look for custom modelling or tokenizer Python files sitting alongside config.json, and check the model card for any mention of trust_remote_code — that flag is what actually authorises the code to run when you call the loading function. The same tree and file-content signals sit behind https://huggingface.co/api/models/{org}/{name}, which is what RepoGates itself reads.
Is custom code on load automatically dangerous? Not automatically — it means the repository author wrote code that runs deliberately when the model loads, a more direct surface than pickle deserialisation. H9 flags that surface; it is not a verdict on the code's intent.
Why does this check matter to AI agents specifically? Because it sits in three of RepoGates' four Hugging Face dimensions, including "hand to an AI agent" — code that runs on load runs the same way whether a person or an agent calls the loading function.
Does the score change based on other findings? Yes — the penalty is MEDIUM (5 points) on its own but escalates to HIGH (10 points) when the same repository is also pickle-only, since that combination means code runs on load with no safe format to fall back to.
H8 Pickle-only weights — the finding that escalates H9's own severity when both fire together · H14 Agent config files — the agent-surface sibling that shares H9's "hand to an AI agent" dimension · H13 Hub scan incomplete — the companion signal for the pickle-based checks H9 sits alongside in "install and run."
Add RepoGates to Chrome Pricing
Numbers on this page: roster measurement figures from site/intel/malicious-models.html, 12 September 2026; dimension groupings and weights from the product's scoring table (HF-1).