# Security research PoC

Proof-of-concept model file accompanying a responsibly-disclosed model-file deserialization issue.
The `config.json` demonstrates arbitrary class instantiation at load time using a **harmless** `builtins.print`
marker (no payload, no command execution). Loading this model prints the marker string, evidencing that an
attacker-controlled `_target_` is executed; a real attacker would substitute an arbitrary callable.