AI Toolkit by Ostris is for training your own additions to open image and video models. Collect a few dozen pictures of a style, product or character, describe them, and it fine-tunes a LoRA, a small add-on file that teaches a base model something new, which you can then load in ComfyUI or other tools. It supports a long list of current models, including FLUX.1 and FLUX.2, Qwen-Image and its edit variants, Z-Image, SDXL, Wan 2.1 and 2.2 and LTX video models, and even a couple of music models.
It earns its place by making training approachable. A web UI on port 8675 lets you build a dataset, start, stop and watch jobs, and see sample images as training progresses, while the same jobs can run from a YAML config on the command line. The author targets consumer cards and updates for new models quickly.
The limit is hardware. You need an NVIDIA GPU with a lot of memory for the larger models (the FLUX example config is written for 24 GB), Mac support is experimental, and training takes hours, not minutes.
- Repository: github.com/ostris/ai-toolkit
- Licence: MIT (MIT License)
- Language: Python. Stars: 12.5K. Forks: 1,595. Last push: Oct 24, 2026.
- Scan: safe, Oct 26, 2026, commit 73ebae1
Who it is for
Image and video hobbyists who want a model to learn their style, product or subject, and anyone with a big NVIDIA card or a rented cloud GPU who wants to try fine-tuning without writing training code.
Getting started
1. Clone the repository
git clone https://github.com/ostris/ai-toolkit.git && cd ai-toolkit2. Linux: run the manager, which sets up PyTorch, Node and FFmpeg inside the folder and starts the UI on http://localhost:8675 (macOS: ./run_mac.zsh, Windows: run_windows.bat)
chmod +x run_linux.sh && ./run_linux.shThe manager checks for updates and applies them on every launch. If you run the UI on a server, set AI_TOOLKIT_AUTH to a password first, as the README recommends.
Safety scan
We cloned ostris/ai-toolkit at commit 73ebae1 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits, no npm or Python install hooks, no committed binaries and no bare-IP URLs.
- run_linux.sh fetches uv from astral.sh and hands over to the Python manager, which installs everything inside the ai-toolkit folder without sudo. docker/start.sh, for the container image, writes to the shell profile inside the container only.
- The four critical advisories are all in the UI's ui/package-lock.json: three in Next.js 15.5.21, including remote code execution through the image optimisation API, and one in shell-quote. That matters if the UI is reachable from a network, so bind it to localhost or set AI_TOOLKIT_AUTH. The Python side has just 2 high advisories in requirements_base.txt.
- Training downloads base models from Hugging Face (some, such as FLUX.1-dev, need you to accept a licence and use a token) and optional sample images from Unsplash and Pexels.
- A single workflow with no third-party actions. MIT licence present; no security policy, Dependabot or CodeQL, and no tagged releases.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 2 installer scripts (one edits your shell profile) |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. No third-party actions. |
| Network hosts | 38 distinct hosts referenced from source; most often github.com, huggingface.co, arxiv.org, www.apache.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 49 advisories across 473 pinned packages: 4 critical, 29 high, 14 moderate, 2 low. requirements.txt: 1 packages, 0 advisories; requirements_base.txt: 16 packages, 2 advisories; ui/package-lock.json: 484 packages, 47 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (2)
- docker/start.sh, 70 lines, edits your shell profile; talks to github.com
- run_linux.sh, 59 lines; talks to astral.sh
Worst known vulnerabilities (24 of 49)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-2464-fhr4-w9xw | critical | next@15.5.21 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
| GHSA-2xp9-vwfh-vxw4 | critical | next@15.5.21 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
| GHSA-p293-qw3h-jr36 | critical | next@15.5.21 | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
| GHSA-pqg4-j6r4-53mv | critical | shell-quote@1.10.0 | shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token |
| GHSA-x9r9-c232-4q39 | high | transformers@5.5.3 | Hugging Face Transformers downloads custom generation code before trust consent |
| GHSA-xrqw-3rrv-vx5w | high | transformers@5.5.3 | Transformers save_pretrained path traversal allows arbitrary file writes through chat template names |
| GHSA-3pq3-5fj3-cg6v | high | axios@1.18.1 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls |
| GHSA-542g-h47m-68v8 | high | axios@1.18.1 | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization |
| GHSA-c29m-xwm3-cm6r | high | axios@1.18.1 | Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) |
| GHSA-m8m8-qj5v-23w3 | high | axios@1.18.1 | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection |
| GHSA-mghh-pgcx-3jjj | high | axios@1.18.1 | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location |
| GHSA-r4gj-5m52-g5wh | high | axios@1.18.1 | Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF |
| GHSA-x97p-jq2g-jp4f | high | axios@1.18.1 | Axios: Prototype Pollution Gadget in axios toFormData Options |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@2.1.2 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@2.1.2 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@2.1.2 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@2.1.2 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-8r9p-f939-6h3c | high | follow-redirects@1.16.0 | follow-redirects sensitiveHeaders regex escaping can expose credential headers |
| GHSA-q3jh-wrc6-jgq8 | high | follow-redirects@1.16.0 | follow-redirects array-form headers bypass cross-origin credential stripping |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.16 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-p3m5-59mp-jv5r | high | next@15.5.21 | Next.js: Denial of Service in App Router using Server Actions |
| GHSA-6g55-p6wh-862q | high | postcss@8.4.31 | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments |
| GHSA-r28c-9q8g-f849 | high | postcss@8.4.31 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-f88m-g3jw-g9cj | high | sharp@0.34.5 | sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
By the numbers
| Stars | 12.5K |
|---|---|
| Forks | 1,595 |
| Contributors | 32 |
| Commits | 1,635 |
| Open issues | 58 |
| Open pull requests | 29 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | MIT |
| Main language | Python |
| Project age | 3 years |
| Last push | Oct 24, 2026 |
| Tracked files | 843 |
| Lines of code | 228K |
| Checkout size | 47 MB |
Lines by language: Python 172.8K, TypeScript 30K, JSON 18.3K, YAML 3,413, Markdown 2,106, Jupyter 929.
Questions
Is AI Toolkit free?
Yes. AI Toolkit is MIT-licensed. The base models you train on have their own licences, and some, such as FLUX.1-dev, restrict commercial use of the results.
What GPU do I need for AI Toolkit?
An NVIDIA card with plenty of memory. The FLUX example configs are written for 24 GB; smaller models such as SDXL or SD 1.5 need less. Apple Silicon support is experimental, and many people rent a cloud GPU instead.
What is a LoRA?
A LoRA is a small file, usually tens to a few hundred megabytes, that adjusts a large base model to produce a particular style, subject or concept. You train it once with AI Toolkit and load it alongside the base model in tools like ComfyUI.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.