Do not load this file in production. This is a real ACE payload, kept benign (writes a sentinel file /tmp/PWNED_BY_PT_LEGACY).

torch.save(obj, path, _use_new_zipfile_serialization=False) writes a raw PROTO-2 pickle (the legacy non-zipfile format that PyTorch < 1.6 used by default and that current PyTorch still emits when callers pass the legacy flag, or load old checkpoints from libraries pinned to old torch).

ProtectAI modelscan dispatches by file extension: .pt -> PyTorchUnsafeOpScan. That scanner assumes the modern zipfile-wrapped format and reports "No issues found" on a legacy-format .pt even when the embedded pickle calls os.system(...) via __reduce__. torch.load(path, weights_only=False) unpickles normally and runs the constructor.