[Security] RCE via Pickle Deserialization in Brain.load()

brain.py:190 uses FAISS.load_local() with allow_dangerous_deserialization=True. Any brain directory with a crafted index.pkl gives arbitrary code execution when loaded via Brain.load().

Attack vector: shared brain files via HuggingFace Hub, GitHub, email.

PoC: create brain dir with malicious pickle in index.pkl, victim calls Brain.load(path) = RCE.

Fix: remove allow_dangerous_deserialization=True or use FAISS native format instead of pickle.