PyTorch safe_globals cross-thread weights_only=True bypass PoC

• torch.load(..., weights_only=True) blocks an attacker-controlled custom class by default.
• While a different thread holds with torch.serialization.safe_globals([DangerousState]): open for a trusted load, an unrelated thread can load the same class without opting into safe_globals.
• The attacker-controlled class reaches __setstate__ during deserialization, proving code execution in that shared worker process.

• a bypass in single-threaded workflows
• a bug in add_safe_globals(), which is already an explicit process-wide opt-in
• a claim that every .pt load path is unsafe by default

• official torch-2.13.0+cpu wheel