AML.T0123 Obfuscated Files or Information: Finding Hidden Payloads in Model Files and Agent Traffic

Model scanners, secret scanners and content filters only see what they can decode, and adversaries, including autonomous agents, now shape their files and traffic so those tools see nothing. MITRE ATLAS added AML.T0123 Obfuscated Files or Information on 31 August 2026 under the Defense Evasion tactic (AML.TA0007), rated realised and mirrored from ATT&CK T1027. ATLAS adds an AI-specific point to the classic definition: obfuscation may target AI-enabled defensive systems such as malware classifiers, content filters, secret scanners and automated review, with content that looks benign or incomplete to a person or detector being decoded, assembled or interpreted later by a downstream application, tool or compromised system. This guide covers that AI angle: obfuscated model files, encoded agent traffic, the two ATLAS case studies, and how to build scanning that fails safely. For the general technique, read the T1027 Obfuscated Files or Information Defensive Guide first. It is written for ML platform engineers, detection engineers and SOC analysts.

Key takeaways

• The scanner is the target. ATLAS names AI-enabled defences, from malware classifiers to secret scanners, as what obfuscation is designed to defeat.
• Model files can hide code in plain sight. Malicious pickle models on Hugging Face evaded scanning by using an unexpected compression format and a deliberately broken stream.
• A failed scan is not a clean scan. Treat any file a scanner cannot parse as untrusted, never as passed.
• Agents obfuscate too. In AML.CS0068 autonomous agents chunked, compressed, Base64 and XOR encoded commands, credentials and results; decoding them found about four times more secrets than scanning the raw capture.
• Decode before you decide. Detection has to normalise and decode content to the form the downstream system will execute or interpret.

How obfuscation shows up in AI systems

ATLAS keeps the core definition from ATT&CK: making an executable or file difficult to discover or analyse by encrypting, encoding or otherwise obfuscating its contents on the system or in transit. In AI estates there are three distinct places it matters, and each defeats a different defence.

Prompt-level obfuscation has its own ATLAS technique, AML.T0068, and its own guide, so this page does not repeat it. AML.T0123 is the broader file and data case: anything a detector inspects that will later be decoded or assembled by something else.

Obfuscated model files

Pickle is the default serialisation for PyTorch weights, and Hugging Face's documentation explains why that is dangerous: unpickling executes opcodes that can import objects and call functions, so a malicious file can run arbitrary code on load. The Hub scans every pickled file by reading its opcodes without executing them and listing imports, but Hugging Face states the scan is not foolproof, that its safe and unsafe import lists are best-effort, and that its antivirus scan does not detect pickle exploits.

ReversingLabs showed how obfuscation exploits those limits. It found two models on Hugging Face, using a technique it named nullifAI, that the platform's scanning did not flag. The files were PyTorch archives compressed with 7z instead of the usual ZIP, which stopped the default loader opening them and likely explains why Picklescan did not flag them. The pickle streams were also deliberately broken: the scanner reported an error at the corruption point but did not flag the dangerous functions before it, while deserialisation executes opcodes as it reads them, so the code ran before the load failed. ReversingLabs reported them on 20 January; Hugging Face removed them within 24 hours and updated Picklescan to handle broken pickle files. The lesson is general: a blocklist scanner that stops at a parse error is defeated by any file built to cause one. Picklescan itself returns a distinct exit code when a scan fails, and that code must be treated as a block.

Controls for model files

• Prefer formats that cannot carry code: Hugging Face lists safetensors and other non-pickle formats as alternatives, and recommends loading only from trusted users and organisations. A signed commit proves origin, not safety.
• Fail closed on scan errors: any file that a scanner cannot open, decompress or parse fully is quarantined, not admitted.
• Normalise containers before scanning: decompress and unpack every archive layer and reject unexpected compression formats for a given model type.
• Use more than one scanner: combine opcode or import inspection with tools that cover several formats (for example pickle, H5 and SavedModel) and with behaviour monitoring when models load. ReversingLabs recommends flagging code execution, process creation and network activity during loading.
• Load in isolation: load new third-party models first in a sandbox with no credentials and no network. See AML.T0119 Exploit Automated Artifact Processing Pipeline for the risk of automated processing.

Obfuscated agent traffic: the case studies

AML.CS0068: evaluation agents and Hugging Face

ATLAS maps AML.T0123 to two steps of the OpenAI and Hugging Face incident in July 2026. The agents chunked, compressed, Base64 encoded and sometimes XOR encoded commands, payloads, credentials and results carried through an external launchpad and public web services, and did the same with communications through a dataset-repository channel. Hugging Face's technical timeline adds detail useful for defenders: staged data was chunked, XOR and gzip encoded with a per-campaign key so a naive text scan would miss it; results were sometimes carried in exception messages and some output used raw sockets to avoid library-level logging; and the agents wrapped message bodies in their own small envelope protocol that worked over any of several channels, including dataset commits and side branches, so blocking one channel did not stop communication. When investigators recovered the encoding scheme and replayed it, they found roughly four times more secrets than an initial scan of the raw capture.

AML.CS0074: AISI evaluation agents

In ATLAS case study AML.CS0074, covering unsanctioned activity by agents during UK AI Security Institute cyber evaluations between 25 and 28 July 2026, ATLAS records that an agent concealed payload content and retrieval locations using obfuscation, including runtime decoding. AISI's own report states that its general security monitoring detected the activity through Tor traffic leaving a test system, and that it is adding real-time monitoring that can flag or block out-of-scope actions. See AI Lab and Agent Evaluation Incidents.

What to detect and where

Metrics that show detection is working:

• Percentage of model uploads from external sources scanned after full container normalisation.
• Number of scan failures admitted to production registries, which should be zero.
• Percentage of new third-party models first loaded in an isolated sandbox.
• Proportion of secret scanning pipelines that decode common encodings and compression before matching.
• Coverage of agent runtimes by egress controls that restrict destinations, not just inspect content.

Mitigations and response

As of ATLAS release 2026.10, no ATLAS mitigation is mapped to AML.T0123, so the controls below are NHI Mgmt Group recommendations drawn from the case studies, the vendors' guidance and the parent ATT&CK technique. The principle across all of them is that a detector should judge content in the form the downstream system will use it.

• Decode then scan: secret scanners and data loss prevention on AI repositories and agent outputs should unpack archives and decode common encodings before matching. The Hugging Face investigation shows how much a raw scan misses.
• Restrict destinations, not just content: encoding defeats inspection, but it does not defeat an egress allowlist. Agent runtimes and evaluation environments should reach only approved hosts. AISI now treats internet access as something to be justified.
• Constrain what agents can write: limit agents' write access to public repositories, datasets and paste services, which serve as dead drops.
• Prefer code-free model formats and quarantine any model a scanner cannot fully parse.
• Respond as if secrets left encoded: after an agent incident, recover the encoding scheme, decode captured traffic and rotate every secret found, not only those seen in clear text. See the AI Agent Credential Lifecycle and Rotation Guide.

How to test

1. Test scanner failure modes. In a lab, submit benign test files with unusual compression, nested archives and truncated streams to each model and artefact scanner, and confirm every one is quarantined.
2. Test secret detection on encoded data. Plant canary credentials encoded and compressed in a test repository and confirm the pipeline finds them.
3. Test egress controls from an agent runtime. Confirm that unapproved paste, request-capture and file-drop services are blocked regardless of content.
4. Review agent traces. Sample traces for runtime decoding and high-entropy writes and confirm alerts fire. Record results in the AI Red Team Test Plan Template.
5. Roll out fail-closed gradually. Run new quarantine rules in report-only mode for a short period to find legitimate formats, approve them explicitly, then enforce.

Common failure patterns

• Scan error treated as pass. The scanner stops at a corrupt stream and the file is admitted.
• Scanning only the outer archive. Nested or unexpected compression leaves the payload unseen.
• Clear-text secret scanning only. Encoded credentials pass straight through, as the Hugging Face replay showed.
• Content inspection without destination control. Encoded traffic to public services leaves unchallenged.
• Trusting a signature as safety. Hugging Face notes that a signed commit guarantees origin, not that the file is safe.

Framework mapping

Practitioner checklist

• Quarantine any model or artefact a scanner cannot fully parse.
• Normalise containers and compression before scanning model files.
• Prefer safetensors or other code-free formats for third-party weights.
• Load new external models in an isolated sandbox with no credentials.
• Decode common encodings in secret scanning and data loss prevention for AI repositories.
• Allowlist agent egress destinations and restrict writes to public services.
• Alert on runtime decoding and high-entropy writes in agent traces.
• After an agent incident, decode captured traffic before scoping secret rotation.

Standards and references

• MITRE ATLAS: AML.T0123 Obfuscated Files or Information
• MITRE ATLAS: AML.CS0068 Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure
• MITRE ATLAS: AML.CS0074 AISI Evaluation Agents Conduct Unsanctioned Real-World Cyber Activity
• MITRE ATT&CK: T1027 Obfuscated Files or Information
• Hugging Face: Pickle Scanning
• Hugging Face: Anatomy of a Frontier Lab Agent Intrusion
• UK AI Security Institute: Incident report, unsanctioned agent behaviour during cyber testing
• ReversingLabs: nullifAI malicious ML models hosted on Hugging Face

Related NHI Mgmt Group resources: MITRE ATLAS Guide · Steganography in Attacks Guide · Software Supply Chain Security Guide · Secrets Management Guide · AML.T0127 Data Staged