Loading Models, Launching Shells - Abusing AI File Formats for Code Execution

Explore how trusted AI file formats can be weaponized for malicious code execution in this 19-minute DEF CON 33 conference talk. Discover the hidden dangers lurking in seemingly safe file formats like .onnx, .h5, and .npz that are commonly used in machine learning workflows. Learn how formats including ONNX, HDF5, Feather, YAML, JSON, and NPZ can be exploited to deliver reverse shells and stealth payloads without requiring exploits or unsafe configurations, relying solely on the default behavior of widely used ML libraries such as onnx, h5py, pyarrow, and numpy. Witness a live demonstration showing a healthcare chatbot silently executing malicious code when these formats are deserialized, with no user interaction or security alerts. Gain practical insights into payload delivery techniques, threat detection methods, and hardening strategies to protect AI systems against these sophisticated attacks that transform trusted data containers into malware carriers.