The context: PickleScan is the open-source scanner that Hugging Face and others use to flag dangerous pickle files. It's the safety net under the whole “we scan models” assurance.

The flaw: the scanner picks its analysis based on file extension first. Give a plain malicious pickle a PyTorch-style extension (like .bin), and the PyTorch-specific parser fails — then the scanner returns an error without falling back to standard pickle analysis. The malicious file is never inspected and is reported clean.

Why it's critical: the dangerous payload still executes on load. The defense that was supposed to catch it waves it through.