Deserialization remote code execution is when loading a serialized object triggers unintended code execution. In ML supply chains, this is a major risk because formats like pickle can call functions during load time. The danger is not just malformed data, but attacker-controlled behavior hidden inside the artifact.
Expanded Definition
Deserialization remote code execution is a code execution condition created when a system trusts a serialized payload enough to reconstruct objects without strict validation. In NHI and agentic AI environments, this matters because model artifacts, cached tool state, plugins, and orchestration messages can behave like executable inputs rather than inert data.
Definitions vary across vendors on where “deserialization” ends and general unsafe object loading begins, but the security concern is consistent: attacker-controlled bytes can influence runtime behavior during load time. Standards bodies do not treat every serialization format the same, so practitioners should separate safe data interchange from object graphs that restore executable state. For example, pickle-like mechanisms are risky because they can invoke functions as part of object restoration, while more constrained formats reduce that attack surface. The NIST SP 800-63 Digital Identity Guidelines reinforce the broader principle that identity and trust decisions must be explicit, not assumed from opaque artifacts. The most common misapplication is treating a model file, cache, or workflow snapshot as harmless data when the loader can actually execute embedded behavior.
Examples and Use Cases
Implementing deserialization defenses rigorously often introduces compatibility constraints, requiring organisations to weigh developer convenience against the risk of hidden code execution paths.
- A data science pipeline loads a Python pickle model from an external source; a malicious object executes during import instead of waiting for later inference logic.
- An agent runtime restores conversation state from a serialized blob and unknowingly triggers code embedded in a crafted object graph, echoing patterns seen in the Gemini CLI Breach — Silent Code Execution analysis.
- A CI/CD job reads a cached build artifact from an untrusted repository mirror and executes loader-side behavior before integrity checks complete.
- A legacy application accepts serialized session objects over an internal API, creating an exploit path similar to the ASP.NET machine keys RCE attack pattern, where trusted state becomes an execution vector.
- An enterprise service relies on custom object deserialization for configuration sync, but one malformed payload causes the loader to instantiate unexpected classes and invoke methods.
These cases are especially relevant in NHI environments because service accounts, signed artifacts, and automation workflows often move faster than human review. When the serialized input comes from a dependency, a partner, or a build step, the attack surface is usually trust in provenance, not just file format syntax.
Why It Matters in NHI Security
Deserialization RCE is dangerous because it can convert a supply chain artifact into immediate execution on build servers, inference hosts, or orchestration nodes. That makes it an identity problem as much as a code problem: once execution happens, the attacker can inherit the privileges of the service account or automation principal that processed the object.
NHIMG has found that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, showing how quickly an initial execution foothold can become an identity compromise chain. The same risk pattern appears when long-lived credentials, cached objects, or model packages are stored in places that are not continuously validated. Controls such as secrets hygiene, artifact signing, and least privilege align strongly with NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organisations must constrain what automated loaders can access. The broader Ultimate Guide to NHI also shows that 96% of organisations store secrets outside secrets managers in vulnerable locations, which increases the blast radius when loader-side execution is possible. Organisationally, this issue is often discovered only after a poisoned artifact has already executed, at which point deserialization RCE becomes operationally unavoidable to investigate and contain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-06 | Unsafe artifact loading can weaponize NHI pipelines through hidden execution paths. |
| OWASP Agentic AI Top 10 | A-04 | Agentic workflows may execute serialized state during tool or memory restoration. |
| NIST CSF 2.0 | PR.DS | Data integrity and safe processing are core to preventing malicious payload execution. |
| NIST SP 800-63 | Identity assurance depends on explicit trust, not implicit trust in opaque artifacts. | |
| NIST AI RMF | AI risk management requires controls for malicious model and artifact ingestion. |
Assess model and workflow artifacts as potential execution-bearing inputs during risk review.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection and LLM remote code execution?
- Who is accountable when an exposed backup service is used for remote code execution?
- How should teams respond when Apache HTTP Server has a remote code execution CVE?
- How should security teams contain remote code execution in workload environments?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
