AI Sec Watch

A vulnerability in vLLM Mooncake connector (a component that helps distribute AI model processing across systems) through version 0.29.0 fails to properly track ownership of GPU KV cache blocks (temporary storage on graphics processors for speeding up AI responses) when multiple child requests share the same transfer ID. Attackers can exploit this by sending completion requests with multiple prompts, causing orphaned cache blocks to build up until the system restarts, eventually blocking legitimate user requests from running.

vLLM (a popular open-source LLM serving framework) versions up to 0.29.0 don't properly check the tp_size parameter (a setting that controls how a model is split across multiple processors) when handling requests through its OpenAI-compatible API endpoints. This allows attackers to submit extremely large tp_size values that cause the system to use unlimited memory, crashing the decode worker (the part that generates responses) through an out-of-memory error.

vLLM (a language model serving framework) versions up to 0.29.0 have a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests (requests to prepare the AI model before full processing) leave behind unused data placeholders that never get cleaned up. An attacker can exploit this by sending many rejected requests to clog the system's worker pools, making legitimate requests wait up to 480 seconds while the system falsely reports it's healthy.

vLLM (a system for running large language models) versions up to 0.29.0 have a denial of service vulnerability (a bug that lets attackers crash the system) in its P2P KV offloading feature (a method where the system transfers memory data between computers in a peer-to-peer network). Attackers can provide fake network addresses that cause the system to create broken connections that waste memory resources until the system crashes and stops responding to user requests.

vLLM versions up to 0.29.0 have a denial of service vulnerability in its NIXL connector's prefix caching (a feature that reuses parts of previously processed text to speed up responses) that doesn't properly check block counts when handling multiple prompts of different lengths in certain deployment setups. An attacker can crash the decode worker (the part that generates responses) by sending specially crafted requests, forcing a restart to restore service.

vLLM (a system for running large language models) versions up to 0.29.0 have a denial of service vulnerability (a flaw that lets attackers crash a service) in how the NIXL connector handles metadata for split deployments. An attacker can send specially crafted requests that cause an uncaught KeyError (a programming error where the code tries to access a dictionary key that doesn't exist) in the scheduling system, crashing the decode engine and forcing a manual restart to recover.

Unbounded consumption, where AI agents use resources without limits, is a major security risk that OWASP (Open Web Application Security Project, an organization that ranks software vulnerabilities) ranks as the sixth most dangerous problem for AI applications. This issue can cost enterprises a lot of money if not controlled.

MaxKB, an open-source AI assistant for businesses, has a security flaw in versions 2.0.0 through 2.9.2 where users with low permissions can bypass access controls and execute tools they shouldn't have access to by using special identifiers, then receive sensitive credentials that the tool stored on the server.

OpenAI has proposed global standards for safe development of advanced AI systems, with focus on alignment research (ensuring AI systems follow human values) and recursive self-improvement, or RSI (a technique where AI models can upgrade themselves without human help). The company warns that RSI pursued without proper safeguards could cause humans to lose control over AI development, and calls for international cooperation and existing AI safety institutes to help create technical standards for frontier AI models.