SECOND MEASUREMENT SM-010

Hugging Face says every file goes through its malware scanner. Nothing over 2 GB does, and the badge says safe anyway

Markovian ProtocolMeasured 2026-10-02Status: sent to Hugging Face 2026-10-02, response pendingDOI: 10.5281/zenodo.23123005

Hugging Face’s documentation says every file in every repository goes through a malware scanner at each commit, within minutes. We read the per-file scan status Hugging Face itself publishes on 3,038 files across 450 repositories, including the 150 most-downloaded models. Under 2 gigabytes the claim holds: 2,539 of 2,551 files scanned. At 2 gigabytes and above it stops: 0 of 487. Those are the model weights, 89% of the bytes in the sample and 92% in the top models, and 476 of the 494 files the scanner never read wear a green “safe” badge.

Disclosure: Markovian Protocol holds no financial position in any organisation named here, was paid by no one for this work, and showed it to no one before publication except the organisation measured. How we work.

What they said, what we found

The cut-off

The malware scanner stops at 2 GiB, and the edge is sharp. Nothing above it is scanned; almost nothing below it is missed.

Decimal gigabytes in the buckets; the cut sits at 2 GiB (2,147,483,648 bytes), which falls inside the 2 to 3 GB row. The 17 scanned files in that row are all below 2 GiB. Four files marked “suspicious” and one “error” are counted as neither.

Where the bytes are, by group:

Repository counts are those with at least one readable file older than a day. Random recent models are small; most have no file near the limit.

The ten most-downloaded models by skipped volume:

Most of that is safetensors and GGUF, formats that hold numbers and cannot run code when loaded. The format that can is pickle, which PyTorch’s .bin files use. Seven of those in the sample are over the limit. The malware scanner never read them; Hugging Face’s separate pickle-import scanner did, and found only ordinary imports.

How this ends

It ends when the Hub scans files of 2 GiB and above, or when the documentation and the badge say that it doesn’t. The recheck re-reads the same 487 files; the day their status changes from “unscanned”, or the page says “not scanned” next to the badge, is the day this closes.

The evidence

Every quote below was copied from the source and checked against a saved copy, fetched 2026-10-02. The copies, the API responses, and the full sample with both readings per file are published next to this page (SHA256SUMS).

POST /api/models/openai/whisper-large-v3/paths-info/main  {"paths": [...], "expand": true}

pytorch_model.bin   3,087,394,553 bytes   status: "safe"   avScan: "unscanned"
model.safetensors   3,087,130,976 bytes   status: "safe"   avScan: "unscanned"
config.json                 1,272 bytes   status: "safe"   avScan: "safe"

openai-community/gpt2  64-fp16.tflite  committed 2019-12-12
  status: "queued"
  avScan: "safe"            protectAiScan: "safe"
  virusTotalScan: "safe"    jFrogScan: "queued"

80 files re-read through paths-info:
  40 marked "unscanned" by the listing  ->  40 "unscanned"   (overall badge differed on 2)
  20 with no status in the listing       ->  12 "safe", 1 "unscanned", 7 gated (401)
  20 marked "safe"                       ->  18 "safe", 2 gated
Then every non-safe file (658) re-read the same way: 479 of 483 "unscanned" confirmed.

Our questions to Hugging Face

Sent to security@huggingface.co and filed as huggingface/hub-docs issue 2850 on 2 October 2026. Answers will be printed here as written.

1. Is 2 GiB a deliberate limit on the malware scanner? If so, can the documentation say so?
2. Why does the overall badge show “safe” for a file the malware scanner has not read?
3. Are large pickle-format files, such as the seven PyTorch .bin files over 2 GiB here, covered by any scanner other than the pickle-import check?
4. JFrog shows “queued” on files committed in 2019. Is that queue still being worked, or is it abandoned?
5. Do Enterprise Hub customers get a different size limit?

Their reply, scored

Disclosure timeline

Waiting on Hugging Face since 2 Oct.

What we can’t be sure of

• We read Hugging Face’s reported status, not the scanner itself. A file could have been scanned and its result lost; the field says “unscanned”, and we take it at its word, as users do.
• Only root directories were listed. Files in subdirectories, common in large multi-part models, are not in the sample. Their sizes suggest they would push the share of skipped bytes up, not down.
• The sample over-represents popular repositories. That is where the big files are; a random walk of the Hub would find far fewer files over 2 GiB.
• A first version of this check, in September, died on our own bug: the listing API’s recursive option drops the status field, which we had read as missing scans. This version uses direct listings and a second endpoint for every non-safe file.
• Safetensors and GGUF cannot execute code on load, so a malware scan of them catches little that matters. The gap is between the documentation and the practice. The pickle files are the exception, and the pickle-import scanner did read them.

Run it yourself

Python 3 standard library. About half an hour against the public API; no token needed except for gated repositories, which this skips.

python3 hf_scan_sample.py          # 450 repositories, root listings with expand=true
python3 hf_requery.py              # paths-info for every non-safe file, then the tables

Reproduced from the public repository on 3 October 2026 on a clean machine, on a fresh sample: holds (0 of 688 files of 2 GiB or more scanned; 2,502 of 2,801 smaller files safe; 519 unscanned files behind a safe badge). Full table on the track record.

What you can do with this

• If you download a model file of 2 GiB or more from the Hub, the green badge means nothing about that file; scan it yourself.
• If you publish large weights, say in the model card that the Hub's scanner skipped them.

References

1. Hugging Face. Malware Scanning. huggingface.co/docs/hub/security-malware.
2. Hugging Face. Third-party scanner: JFrog. huggingface.co/docs/hub/security-jfrog; Third-party scanner: Protect AI; Pickle Scanning.
3. Hugging Face Hub API: GET /api/{models|datasets}/{repo}/tree/main?expand=true, POST /api/{models|datasets}/{repo}/paths-info/main.
4. huggingface/huggingface_hub, pull request #2397, “Reduce max shard size”, July 2024; Hugging Face forum, ClamAV - Scanning Files Larger than 2GB, August 2023. Saved copies in the exhibits.

Cite as

@misc{markovian-sm010,
  author = {{Markovian Protocol}},
  title  = {Hugging Face malware scanning by file size, October 2026},
  number = {SM-010},
  doi    = {10.5281/zenodo.23123005},
  year   = {2026},
  month  = oct,
  url    = {https://markovianprotocol.com/measurements/sm-010.html}
}