verify.py

# Load an untrusted MLflow model dir the normal way. No flags/env.
# Watch /tmp/PWNED_mlflow.txt appear -> the model executed code on load.
import os, mlflow.pyfunc
print("marker before:", os.path.exists("/tmp/PWNED_mlflow.txt"))
mlflow.pyfunc.load_model("model")       # default public API
print("marker after :", os.path.exists("/tmp/PWNED_mlflow.txt"))
if os.path.exists("/tmp/PWNED_mlflow.txt"):
    print(open("/tmp/PWNED_mlflow.txt").read())