Weights that run code are refused

Python pickles (.bin, .pt, .pth, .ckpt, .pkl) run whatever they hold when
loaded, as the engine's user, on the node; that is how the malicious models
found on Hugging Face work. The node refuses such a source, or a mirror set
holding one, before fetching anything. A model added with one, or given
one, is refused, while one already in the catalog still loads and is
refused by its node with the same words. vLLM and SGLang downloading a
model by its id get --load-format safetensors. The mirror page marks the
file. allow_pickle: true on a model lets it through on purpose, carried to
the node in EngineProfile.allow_pickle.

BACKLOG M lists the rest: checksums against Hugging Face on every path,
its own scan, trusted publishers, engines without the internet, an eval
before an untrusted model serves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/reference.md

@@ -188,6 +188,7 @@ rather than repeated.
 | `aliases` | `[]string` | [Model](#model) |
 | `description` | `string` | [Model](#model) |
 | `source` | `string` | [Model](#model) |
+| `allow_pickle` | `bool` | [Model](#model) |
 | `profiles` | `[]Profile` | [Model](#model) |
 | `scaling` | `Scaling` | [Model](#model) |
 | `class` | `string` | [Model](#model) |
@@ -1790,6 +1791,16 @@ choice by guesswork.
 
 Source is the weights path or a HuggingFace id.
 
+### `allow_pickle`
+
+`bool`
+
+AllowPickle lets the nodes fetch this model's weights, or its
+adapters', in a pickle format (.bin, .pt, .pth, .ckpt), which run code
+as they are loaded. Off, such a source is refused when the model is
+added and by the node before it fetches anything. For a model that has
+no safetensors or GGUF form and whose files were checked.
+
 ### `profiles`
 
 `[]Profile`