One unsigned parent, dozens of children: why image signing keeps losing to scanning

The New Stack has published an argument that most organizations who know they should sign their container images still do not, not because they disagree but because the path to doing it well has been too long ^[1]. The consequence is architectural rather than merely embarrassing: every image inherits the security posture of its parent, so one compromised base image can propagate across dozens of downstream services before anyone notices ^[2].

That inheritance is what makes the omission compound. The piece lists the ordinary failure modes: malicious images masquerading as legitimate packages, compromised CI/CD pipelines injecting tampered artifacts with no cryptographic evidence of modification, and stolen credentials letting an attacker impersonate a trusted publisher ^[3]. Inside a single organization the practice is usually inconsistent, with some teams signing and others skipping the step, leaving gaps in the chain of trust that nobody has mapped ^[4]. An unmapped gap in a base image is not one team's problem; it is every team that inherits from it.

Scanning does not close this. Scanning is reactive and answers what vulnerabilities exist in an image; signing answers who built it and whether it was modified after it left the build system. As the article puts it, "One tells you what is inside. The other tells you whether you can trust it." ^[5]

The AI-era framing is where the argument earns its keep, because it removes the fallback. Model weights, training datasets, inference runtimes and agent tooling increasingly ship as OCI artifacts ^[6], and a pickled PyTorch checkpoint has no CVE to match against; there is no vulnerability database for a set of trained weights, so the CVE and SCA based scanning registries run has nothing to compare them to ^[7]. Safer serialization such as .safetensors removes the code execution path but says nothing about who produced the weights or whether they are the ones you meant to load ^[8].

The two incidents cited show the pattern-matching treadmill. In February 2024, JFrog researchers found a malicious PyTorch model on Hugging Face that opened a reverse shell the moment it loaded, abusing pickle's __reduce__ hook on torch.load(); their analysis surfaced roughly 100 models on the hub carrying genuinely malicious payloads, and no CVE fired because there was nothing for a CVE to describe ^[9]. Hugging Face now runs ClamAV plus a pickle import scan on every file pushed, statically disassembling the opcode stream to flag dangerous imports ^[10]. Roughly twelve months later ^[13], in February 2025, ReversingLabs described nullifAI: two models that slipped past picklescan by compressing with 7z instead of ZIP and by corrupting the pickle stream immediately after the payload ran, so static analysis errored out on a file whose reverse shell had already executed ^[11]. Hugging Face removed the models inside 24 hours and patched picklescan ^[12]. Each scanner answers whether a file resembles something known to be bad; none answers where the file came from ^[14].

The blast radius is the other half. "A tampered application image defaces a page. A tampered AI model artifact corrupts predictions at scale," the piece argues, or in the agentic case takes actions in production: API calls, tool invocations, spend ^[15]. Consuming a pre-trained model means inheriting every upstream decision about its training data and its security with zero visibility into any of them ^[16].

What to watch: the article stops at the hard part, noting that signing is not a checkbox but a chain ^[18]. The test for any team adopting it is whether verification is enforced where images are admitted, not just whether a signing step exists in CI, and whether base images and model artifacts are covered rather than only the leaf services. Also worth watching is the review gap the piece flags, where coding assistants suggest dependencies that never pass a human threat model before being containerized and shipped ^[17]; provenance metadata is only useful if something refuses to run without it.