Benign security-research PoC for the huntr Model File Format program. The payload only writes a nonce marker file (echo / io.open) — no real harm, no network, no secrets (huntr §benign).

The genops static walk (both scanners) records memo[key]=the lexically-preceding opcode's arg; a MEMOIZE(None) poisons the scanner's memo to None while the pickle VM memoizes the real 'os'/'system' strings. The STACK_GLOBAL back-walk then resolves the poisoned memo -> picklescan sees a BENIGN ('None','None') global (exit 0, walks clean, no error) while the C VM executes os.system. Distinct MECHANISM from a parse-abort (defeats reconstruction, not the parser). Maps to ShadowPickle, arXiv:2607.17503.

Against picklescan 1.0.5 + ModelScan 0.8.8: both fail to flag; on load the benign marker fires. Re-verify: python -m nomos_redteam scanbypass.

Scan first to confirm the bypass: