crucible

A model file can influence a great deal of computation without being executable code. On the difference between an executable serialization format and a tensor container, and why an out-of-bounds read in MLX's GGUF loader was worth fixing even after it was declined as a security issue.

Loading a model from a hub means running a binary parser on a file a stranger gave you. This is the map for Crucible: what the attack surface is, why a format-aware fuzzer beats a dumb one on it, and how a seed file becomes a filed advisory.

A structure-aware fuzzer found a small ONNX memory-safety bug, GitHub Copilot helped patch it upstream, and the public issue-to-merge loop closed the same afternoon.