A vulnerability in Hugging Face Transformers versions 4.49.0 through 5.8.1 allows unauthorized writing of attacker-controlled Python files. The library fetches and caches remote modules before verifying user consent for remote code execution. This means a malicious Python file from a model repository will be written to the user's local cache regardless of trust prompt approval. The vulnerability stems from an unconditional file copy operation that occurs before the trust_remote_code check. This process differs from other remote code loading mechanisms within the library. An attacker could create a model with a malicious custom_generate/generate.py file. Any user loading this model reference triggers the unauthorized file write. The cached malicious files persist even if the trust prompt is declined. In shared cache environments, these files could be executed later during trusted model loads. There is currently no vendor-provided patch. Users should avoid using load_custom_generate() with untrusted repositories and periodically clear their Hugging Face module cache.