ML supply chain

torch.load runs attacker code before the first denoising step

A diffusion inpainting model can't execute a prompt. The real RCE is pickle deserialisation in the loader, custom nodes, and the agent around it.