Safety: random models on the internet

Sofia wanted a local Llama for a vendor NDA after OS4 said the prompt can stay on the laptop. She typed “llama 3 uncensored” into Hugging Face because a thread promised the official instruct model “refuses too much.” Top hit: Llama3-uncensored-ULTIMATE-Q4.gguf, 2.4 GB, from an account created last Tuesday. Eleven downloads. The card was two sentences and a skull. She double-clicked. LM Studio loaded it. First prompt, a 3-page public blog she planned to use as a dry run: 900 words of jailbreak roleplay. Second prompt, “what is the license?”: the model invented “commercial use, no restrictions.” She had that sentence half-typed to legal before she looked at the filename again.

This is OS6, Part 6 of Open-source AI explained. OS1 split weights, licenses, and free chat. OS2 split hosted GPUs from a file on disk. OS3 was RAM. OS5 was quality without leaderboard theater. This page is the download you should not make. Next is OS7: When ChatGPT, Claude, Gemini, or Grok is simply easier. Hands-on runners live in Run open models from scratch. Privacy paste test: P4. Map of doors: the chooser. Index: Learn.

Trust the publisher, not the filename

A GGUF from a random account is software you run on your machine, not a PDF you glance at
Where to start: official orgs (Meta Llama, Qwen, Google Gemma, Mistral, Microsoft Phi) and converters you can name twice
How to read a Hugging Face model card, license, file list, and GGUF viewer in five minutes
Trust signals vs walk-away signals, including mystery .exe installers
Why Sofia’s 2.4 GB “ULTIMATE” file was a sloppy fine-tune problem before it was anything else

A download is software you run

Four trust lanes: official orgs, known converters, a filled model card, and the walk-away pile of Tuesday accounts and mystery installers

A weight file is not a screenshot of a chatbot. When you load a GGUF in Ollama, LM Studio, or llama.cpp, that binary is parsed on your CPU or GPU. Hugging Face’s GGUF docs are blunt about the format: tensors plus a block of metadata, built for GGML-family engines. You asked the runner to execute it. Treat the click like installing an app, because the bytes sit in RAM and they answer.

Two other file stories sit next to GGUF, and they get mashed together in Slack. Pickle (classic PyTorch .bin / .pt) can run Python when you load it. Hugging Face documents that, and tells you to load from people and orgs you trust, or switch to safetensors. GGUF is a different parser, still someone else’s weights on your fan. A wrapped “AI installer” from a random site is a third story: that is an executable. Do not run it.

The Hub also runs a malware scanner (ClamAV) on commits, and a pickle-import scan on pickled files. A clean badge means the scanner did not match a known signature at scan time. Sofia’s file could have been “safe” in that narrow sense and still useless for a 3-page summary. I am not going to invent a percent for “how often GGUFs are malware.” I have not seen a public count I trust. What I see is worse cards, weirder titles, and fine-tunes that do not do the job on the tin.

Rule of thumb: If you would not run a random .exe from that username, do not load a mystery GGUF from it either. Prefer the official org. Then a converter you can find in more than one place.

Official orgs, then converters you can name

Start on the publisher. As of writing (August 2026) the boring correct doors for the families this series keeps naming are: Meta Llama on the Hub and on llama.com/llama-downloads, Qwen under the Qwen org, Gemma under Google, Mistral under mistralai, Phi under Microsoft. The org slug is in the URL (meta-llama/..., Qwen/..., google/..., mistralai/..., microsoft/...). A display name that says Llama in Comic Sans is not that slug. Gated models (Llama, some Gemma) ask you to accept a license while logged in. Accept it on the real page. A copycat repo that says “ungated Llama 3 70B, no form” is selling you a story.

Many laptop files are not uploaded by Meta. They are quants: someone took official (or at least documented) weights and wrote GGUF variants for llama.cpp. Hugging Face even hosts a conversion space under ggml-org. Community converter names move. The test is not a brand crush. The test is: same username across many families, a card that names the base_model, file sizes that match the quant table, and a trail you can open in llama.cpp or LM Studio docs this week. If you cannot point at that trail, you are back to Sofia’s Tuesday account.

A converter is still a person with a disk. Prefer their Q4 of an official instruct model over a one-off titled ULTIMATE with no base. “Uncensored,” “abliterated,” “heretic,” and “god mode” are marketing. They can be a real fine-tune. They can also be a merge that forgot how to follow a three-page summary. Do not trust a title that is only adjectives.

The model card is the label

Hugging Face model cards are the README.md on the repo, often with a YAML header. The Hub’s own docs say the card should describe the model, intended uses and limits, training notes, datasets, and evaluation. Metadata fields that actually help a download: license, base_model (and whether this is a quant, a fine-tune, an adapter, or a merge), library_name, datasets, pipeline tag. If the YAML is empty and the prose is two sentences, you are holding an unlabeled jar. Walk.

Open the license like you would open a vendor PDF. Llama has an acceptable-use policy on Meta’s download page. Apache-2.0, Gemma, and Mistral licenses are not the same text. “Uncensored so the license does not apply” is fan fiction. If the card says license: other, follow license_link. If there is no license field and no LICENSE file, you cannot tell legal anything true. Sofia’s model invented “no restrictions.” That is how a 2.4 GB file becomes a Slack incident.

On a GGUF repo, click a .gguf in Files. The Hub has a GGUF viewer: metadata, tensor names, shapes, precision. You do not need to speak GGML. You need one mismatch. Title says 70B, viewer looks like a tiny stack. Title says Q4_K_M, filename says Q2. Card says Llama 3 instruct, tensors look like a different family. That is enough. Comments are the other human channel. People reporting “fails to load in LM Studio 0.3.x” or “this is a 3B renamed” are doing you a favor. A wall of fire emojis is an ad.

Files, bytes, and the installer trap

Four steps before you load a model: who published it, read the card, check files and bytes, then a toy public prompt

Weights you actually want: .gguf for llama.cpp-family runners, .safetensors (plus config and tokenizer) for Transformers-style loads. A repo can hold both. What you do not want: Setup.exe, crack.bat, FREE-AI-INSTALLER.zip, a passworded archive from a “mirror” in the comments, a Chrome extension “required to download.” Those are not models. They are programs with a model-shaped costume. Close the tab.

Bytes should match the story. OS3 covered parameter count and quantization. A typical 8B-class Q4 GGUF on a known converter repo lives around 4 to 5 GB, not 2.4 GB, and not 200 MB. A 70B Q4 is tens of gigabytes. Sofia’s 2.4 GB “Llama 3 ULTIMATE” could have been a small model, a brutal quant, a truncated dump, or a rename. Open one trusted Q4 of that size class and compare. If the card and the finder disagree by a lot, stop. Eleven downloads is not a trust score. “Updated 14 minutes ago” on a brand-new user is a reason to wait.

Five minutes is the budget: org and age, card and license, files and size, then one public prompt. A blog post you could email to a stranger, not the NDA. If the model roleplays or writes a fake license, delete the file. Keep the runner. Swap in an official instruct quant.

Worked example: five minutes on Sofia’s file

Toy case, labeled as such. Repo name in this example is fake on purpose: tuesday-weights-lab/Llama3-uncensored-ULTIMATE. Account created last Tuesday. Eleven downloads. File on disk: 2.4 GB. She already had LM Studio from a coworker screenshot. She searched, clicked Download, and skipped the card. Here is the check she can still run with the page open. Stay vs walk.

Check	Stay in the lane	Walk away (Sofia’s hit)
Who published it	Official org slug, or a converter you can find in llama.cpp / LM Studio docs this week	Account created last Tuesday, eleven downloads, display name is three adjectives
Model card	License, `base_model`, intended use, quant named	Two sentences and a skull. No YAML. No base.
License	A text you can open (Llama, Apache-2.0, Gemma, Mistral, a `license_link`)	Missing, or the model invents “no restrictions” when asked
Files	`.gguf` / `.safetensors`, tokenizer, config	`Setup.exe`, `.bat`, password zip from a “mirror”
Size vs claim	GB in the neighborhood of that family and quant (see OS3)	2.4 GB labeled Llama 3 ULTIMATE; a known 8B Q4 is nearer 4 to 5 GB
Comments / viewer	Load errors, hash notes, GGUF viewer shapes that match	Only fire emojis, or tensors that look like a much smaller stack
First prompt	A public 3-page post, on-task summary	900-word jailbreak roleplay, then a fake license for legal

She needed a sticky note, not a security team. Every walk-away line was visible before the runner started, except the 900-word reply, which arrived in under a minute. The NDA never went in. The half-typed Slack to legal got deleted. The 2.4 GB file went to Trash.

A checklist you can paste into a note. Fill every line. If a line is “no” or “unknown,” do not load. Flags and UI labels move; as of writing (August 2026) this is the shape, not a promise that every Hub page uses the same badge names.

# Five-minute trust check before you load a GGUF
# Fill every line. If any answer is "no" or "unknown", stop.

ORG=               # meta-llama / Qwen / google / mistralai / microsoft / named converter?
ACCOUNT_AGE=       # months, or created this week?
CARD=              # README with license, base_model, intended use? or two sentences?
LICENSE=           # a file or license_link you opened, not an adjective?
SIZE_GB=           # matches that family and quant (compare to a known Q4)?
FILES=             # .gguf / .safetensors, NOT .exe .bat .scr installer.zip?
VIEWER=            # Hub GGUF viewer: shapes vs the title?
COMMENTS=          # load errors and hashes, or only fire emojis?
TOY_PROMPT=        # public 3-page post only. NDA stays off this runner.
REPLY_OK=          # on-task summary? if it roleplays or invents a license, delete.

# Load only if ORG is known, CARD exists, SIZE matches, FILES are weights.
# Then run TOY_PROMPT. Time it. Read it. Then decide.

What that block is for: Sofia could have filled ORG and ACCOUNT_AGE in forty seconds and never hit Download. The toy prompt is the last gate, not the first. If you only test with the NDA, you already failed OS2 and OS4.

Random Hub files are not a store

Searching “uncensored ULTIMATE” and treating the first hit as Meta.
Skipping the model card because the filename has Llama in it.
Calling a Hub malware badge a quality score.
Running Setup.exe “so the model works on Windows.”
Pasting the NDA into the first prompt to “see if local is good.”
Telling legal a license the model invented in chat.
Assuming pickle, GGUF, and an installer are the same risk.

Check the card before you pull

Open one official org page (pick Llama, Qwen, Gemma, Mistral, or Phi). Open the card. Write the license name on a sticky note. Then open one GGUF from a converter that lists that repo as base_model. Compare file size to the card. Run the checklist. Use a public paragraph only. If you already downloaded a Tuesday special, delete it, or quarantine the folder until the checklist passes. Next: OS7, when a closed chat box is the honest tool and a random GGUF is unpaid labor. Card reading in more depth is later in this series. Desktop runners from zero is the run series, starting at OS8.

Safety before the download

A random GGUF is software on your machine. Prefer official orgs, then converters you can name twice.
Five minutes: org, card, license, files, size, one public prompt. No mystery .exe.
Sloppy fine-tunes are the usual mess. Malware exists too. Do not invent a statistic. Walk when the card is empty.

Sources

Hugging Face Hub: Model cards (README plus YAML: license, base_model, intended use, datasets)
Hugging Face Hub: GGUF (format, GGUF viewer, ggml-org conversion space, llama.cpp / LM Studio / Ollama)
Hugging Face Hub: Pickle scanning (loading pickle can execute code; prefer trusted orgs and safetensors)
Hugging Face Hub: Malware scanning (ClamAV on commits; a badge is not a quality audit)
Meta Llama downloads (license and acceptable use on the official page)
llama.cpp, Ollama, and LM Studio (runners; confirm the model source inside the app)
AMS OS2 (location) and AMS P4 (paste test)

Hands-on data strategist, analytics engineering lead, and educator. Writing practical, no-fluff guides to help everyday teams, analysts, and engineers master SQL, AI systems, and modern data architectures.

About Jose → More articles → Get in touch

Keep going

Same lessons in your feed

Short diagrams, hooks, and weekly tutorials on Substack, Instagram, X, and Facebook.

@analyticsmadesimple Follow @analyticsmadesimple Follow @AnalyticsSimply Follow Analytics Made Simple Follow