# PoC - modelaudit FlaxMsgpackScanner embedded-pickle blind spot in bin/ext leaves (BL-0110)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.

- Scanner: modelaudit==0.2.49 (flax_msgpack_scanner.py). Format: Flax (.flax) / MessagePack (.msgpack).
- `modelaudit scan bypass_bin.flax` -> Clean / exit 0, but a live os.system pickle is embedded in a msgpack `bin` leaf; a downstream consumer that pickle.loads the leaf executes it. The byte-identical 108-byte payload is rated CRITICAL by modelaudit's own pickle scanner. `control_suspicious_string.flax` fires CRITICAL (detector is live); truneg_benign_bin.flax is the negative baseline.
- Root cause: flax_msgpack_scanner.py:2464-2476 UTF-8-decodes bin leaves and only regex-scans them (no pickle opcode check); ext leaves (:2454-2462) take the same regex-only path. A REDUCE pickle stores its global as posix/system so 'os.system' never appears as a literal substring -> evades. Payload-selective (subprocess would be caught).
- Benign: the pickle only touches a marker file on load. Honest caveat: flax itself does not unpickle; a consumer pickle.loads does.

Files: bypass_bin.flax + bypass_ext99.msgpack (bypass), control_suspicious_string.flax (fires), truneg_benign_bin.flax. Full report in huntr submission.