Proof-of-concept model file accompanying a responsibly-disclosed model-file deserialization issue. The config.json demonstrates arbitrary class instantiation at load time using a harmless builtins.print marker (no payload, no command execution). Loading this model prints the marker string, evidencing that an attacker-controlled _target_ is executed; a real attacker would substitute an arbitrary callable.