When attackers compromised Ultralytics YOLO, a popular real-time object detection machine-learning package for Python, most assumed the Python Package Index, or PyPI, must be the point of failure.

In some ways, Java was the key language for machine learning and AI before Python stole its crown. Important pieces of the data science ecosystem, like Apache Spark, started out in the Java universe.

The popular Python Pickle serialization format, which is common for distributing AI models, offers ways for attackers to inject malicious code that will be executed on computers when loading models ...