Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution

Summary

A patched Unsloth Studio vulnerability lets malicious AI models run arbitrary Python code during inspection. The flaw is triggered through the trust_remote_code setting.

Related items

• InfoStepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines Similar attack · StepSecurity Blog
• LowCVE-2026-107288: Pydantic AI web fetch bypasses blocked_domains via hostname variantsSimilar attack · NVD/CVE Database
• LowOAuth grants pile up faster than you can review them. Here's how to keep up.Similar attack · BleepingComputer
• MediumTop MCP security resources — October 2026Similar attack · Adversa AI Blog
• MediumTensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackSimilar attack · Socket Blog