I worked on the safetensors security assessment, which is now public, with Fredrik Dahlgren, Heidy Khlaaf, and Evan Sultanik. This resulted in press releases on the HuggingFace and EleutherAI websites.
Vicki Boykis wrote a wonderful blog post titled "GGUF, the long way around " that contextualizes this report in ML file format history.
Fun Fact: The PDF of the report is also a PDF/ZIP polyglot where the the ZIP file contains the model file polyglots we found during the audit.