Highlights:

1) The config.json of the model has trust_remote_code=True. 2) Python runs exec_module() of the remotely downloaded class 3) HuggingFace scanning did not cover this vector