AI Models Deserve a Hash Check Too

While tinkering around with Firefox to get a custom new tab page working again, an option that went away back in 2015 under Bug 1118285, I ended up reading through a good amount of the code that decides what a new tab shows. One thing led to another, and I found myself looking at how the browser downloads and stores the AI models used by its local AI features.

Something interesting stood out to me. The WebAssembly inference runtime, one of the engines Firefox uses to run AI models, is handled with a lot of care. Reading through the code, its SHA-256 hash is published in a signed list, and Firefox checks the download against that hash before using it. The AI models Firefox downloads are downloaded and saved without the same check, though. The browser keeps track of whether its saved copy is current, and it doesn't confirm that the file it received matches the one the publisher released. In my view, this is an easy thing to overlook - and it's worth bringing up now, because more and more browsers are starting to download models on their own.

Models Are Showing Up Everywhere

Google Chrome is a good example of where things are heading. Google has offered Gemini Nano, a model of roughly 4 GB that powers writing help and other built-in Chrome features, since 2024, and Chrome downloads it in the background onto computers with the hardware to run it. In 2026, people widely noticed, and it caused quite a stir online. Winaero covered it in February and gHacks in May, sites like Pureinfotech put together instructions for removing it, and Google noted that the model uninstalls itself when a device runs low on resources and that Chrome includes a setting to turn it off. Like most things online, the conversation has probably faded since then. With more and more AI features showing up in the software we use every day, though, it seems like a good time to think about how we confirm these models are valid and safe before they end up on our machines. I don't claim to have all the answers here, and I'd love to see more people weigh in.

Firefox downloads models when a local AI feature asks for one, from Mozilla's own model hub and a few Mozilla-approved accounts on Hugging Face, as described in its architecture documentation. Running AI locally has a nice benefit - people's text stays on their own machine. It also means model files are becoming one of the larger things a browser downloads by itself, so it makes sense to give them the same care as everything else.

Why a Model File Needs Checking

The reason a hash check helps comes down to what a model file is. It's a large binary that native code has to open and interpret, and that kind of code has needed security fixes over the years. llama.cpp, one of the most widely used engines for running models and one that Firefox compiles into its standard build, has patched several issues in the code that reads model files, where a specially crafted file could overflow a buffer while loading. Cisco Talos reported several in 2024, including CVE-2024-21802 and CVE-2024-23496, the project published CVE-2025-53630 in 2025, and fixes for CVE-2026-27940 and CVE-2026-33298 followed in 2026. Some model formats also store a small template script inside the file that tells the loading software how to format a conversation, and in CVE-2024-34359 the llama-cpp-python library ran that script without a sandbox until it was fixed. Security researchers at JFrog also came across around 100 malicious models on Hugging Face in 2024, which shows that model files are worth treating like any other download from the internet.

The Download Path Can Be Tampered With

Then there's the path a model takes to reach someone's computer. A model download travels through hosting services, content networks and caches, the same as any other software, and any point along that path can be tampered with. CCleaner is a well-known example. In 2017, attackers slipped a backdoor into CCleaner 5.33, and the infected installer was handed out from the official download servers for about a month with a valid digital signature from the developer. According to Cisco Talos and Dark Reading, around 2.27 million people ran it before Talos and Morphisec spotted it in September of that year. People did everything right - downloading from the official source - and the file still was not what the developer intended.

CCleaner is far from the only case, and there have been plenty of more recent ones. In early 2024, a backdoor was found in xz Utils, a compression library included in many Linux systems, after a long social engineering effort to gain the trust of its maintainer. It was caught thanks to a developer who noticed SSH logins taking about half a second longer than usual. Later that year, the Polyfill.io domain, which more than 100,000 websites loaded scripts from, changed hands and began serving code that sent visitors to scam sites. In September 2025, an npm maintainer was phished, and malicious versions of packages with more than 2.6 billion weekly downloads were published. A week later, a self-spreading worm known as Shai-Hulud worked its way into more than 500 npm packages.

None of this is meant to sound alarming. Most of these were spotted and cleaned up quickly - often because someone noticed a small detail that didn't add up - and that's an encouraging sign. It does show that trusted download paths get tampered with from time to time, and with AI tools making it easier than ever to write and ship code, it seems reasonable to expect more attempts like these, though it's hard to say for sure. A hash check is one more simple way to catch a swapped file, especially when the hash is published separately from the download itself. When the browser knows the exact SHA-256 hash a model file should have, anything altered, corrupted or swapped is set aside before its contents are ever read.

What a Hash Check Would Look Like

While it may sound simple to have a hash check, it adds a meaningful layer of protection for very little effort. Every file in every model version gets a SHA-256 hash and an expected size, published somewhere the browser already trusts, such as the same signed list that covers the WebAssembly runtime today. The browser checks each download against it, removes anything that doesn't match, and can verify saved copies again when they're loaded. A model without a published hash can be skipped, or loaded only after the user agrees. In the code I was reading, the download routine already accepts an expected hash and size, and the runtime download already uses them, so extending the same check to models looks like a small change. I've suggested it to Mozilla in Bug 2091099, and the same idea would be a nice addition for any browser or app that downloads models automatically.

What a Hash Can't Tell You

A matching hash confirms you got the file the publisher intended. How the model behaves once it's running is a separate question - and a much harder one to answer. A model's behavior comes from billions of trained numbers, and nobody can read through them to see everything it might do. The Sleeper Agents study from January 2024 explored this by training language models that behaved normally until a specific trigger appeared, such as a model that wrote secure code until it was told the year was 2024 and then began inserting vulnerabilities. In the larger models especially, standard safety training, including fine-tuning, reinforcement learning and adversarial training, didn't remove those triggers, and adversarial training could even teach the models to recognize their triggers more precisely. The takeaway is that a model can pass the tests its publisher runs and still carry behavior nobody intended.

Instructions can also come from outside the model, which I wrote about in When AI Breaks Its Own Rules earlier this year. Large language models are a lot like Pandora's box, and some in the AI community compare them to the Shoggoth, a vast and alien thing wearing a thin mask of friendliness. Researchers are open about how little is understood about what happens inside these models, and a 2024 Nature study found that larger, more instructable models may have become less reliable. In that post, I gave Microsoft Copilot an image containing written instructions with no typed prompt, and the model followed the image and returned the link it asked for. Sharing the same image in new conversations brought a different response nearly every time. Behavior like that could potentially be combined with something like an open redirect to send people to a site they didn't expect, and vendors have already worked through related issues such as EchoLeak (CVE-2025-32711).

All of this becomes more important as browsers let AI features take actions. A model that writes a summary can, at worst, produce a misleading summary. A model that can click, type, fill in forms and navigate on someone's behalf is working with that person's access, while reading web pages, images and documents from all over the internet along the way.

A Modest Step

Checking model files against a published hash is a modest step, and I think it would be a welcome one in every browser that downloads AI models. It makes sure people are running the model they were promised, and whether to run a model at all can stay the user's choice. If hash checks become the norm, people who enjoy local AI features will have one more layer of protection, whichever browser they use.