AI & LLM Vulnerabilities

Claude Desktop for Windows had a security flaw in versions before 1.3834.0 where the CoworkVMService component (a background service running with high system privileges) did not properly check if directories were real folders or directory junctions (shortcuts that point to other locations) before creating files in them. An attacker with basic user access could trick this service into creating files in any location on the computer, potentially allowing them to gain administrator-level control of the system.

The Claude Desktop app's SSH remote development feature (versions 1.2581.0 to before 1.4304.0) had a security flaw where it only checked if a hostname was in the ~/.ssh/known_hosts file without verifying that the server's actual host key matched the stored one. This allowed a network attacker (someone who could intercept traffic through methods like ARP spoofing or rogue Wi-Fi) to perform a man-in-the-middle attack (secretly intercepting and potentially altering communications between two parties) on remote development sessions, as long as the hostname was already in the victim's known_hosts file.

LangSmith SDK (a tool for managing prompts in LangChain applications) had a vulnerability where pulling public prompts by owner/name would deserialize (convert from stored format into executable code) untrusted manifest files without warning users about the trust risk. An attacker could publish a malicious prompt that, when pulled and deserialized, would execute with attacker-controlled settings, potentially redirecting API requests to steal secrets or injecting malicious instructions into the AI's behavior.

OpenAI discovered that two employee devices were compromised by malware hidden in a TanStack npm package (a JavaScript library downloaded from an online repository) as part of a broader supply chain attack called Mini Shai-Hulud. The attackers gained limited access to internal source code repositories and exfiltrated some credentials, but OpenAI found no evidence that customer data, production systems, or intellectual property were compromised. OpenAI responded by isolating affected systems, revoking credentials, rotating code-signing certificates (the digital signatures that verify software is authentic), and working with platform providers to prevent misuse of the compromised certificates.

nnU-Net (a framework for automatically analyzing and segmenting images) had a vulnerability in its GitHub workflow where untrusted user input from issue titles and descriptions were sent directly to an AI agent without proper filtering. This allowed attackers to trick the AI agent into performing unintended actions like commenting on or relabeling issues, since the workflow ran automatically whenever someone opened an issue.

CVE-2026-42893 is a command injection vulnerability (a flaw where an attacker can insert malicious commands by exploiting how special characters are handled) in Microsoft 365 Copilot that allows an unauthorized attacker to tamper with data over a network. The vulnerability has a CVSS 4.0 severity rating (a moderate score on the 0-10 vulnerability severity scale). This issue was reported by Microsoft Corporation and published in May 2026.

CVE-2026-41109 is a security flaw in GitHub Copilot and Visual Studio that allows an attacker to bypass a security feature by improperly handling special characters in output, which are then processed by another component (injection, where untrusted data is inserted into code or commands). The vulnerability can be exploited over a network by unauthorized attackers.

CVE-2026-33833 is a vulnerability in Azure Machine Learning where special characters in output are not properly filtered before being used by another component, allowing an attacker to perform spoofing (pretending to be someone or something else) over a network. The vulnerability has a CVSS score (a 0-10 severity rating) of 4.0, indicating moderate severity. This type of flaw is known as an injection vulnerability (CWE-74), where untrusted data can be used to manipulate downstream processes.

The Adversarial Robustness Toolbox (ART) up to version 1.20.1 has a vulnerability in its Kubeflow component where it uses eval() (a function that runs text as if it were code) unsafely to process command-line arguments like --clip_values and --input_shape. An attacker can inject malicious Python code through these arguments, which will execute when eval() processes them, potentially giving the attacker full control over the system running ART if they can control those arguments.

JunoClaw, an AI platform built on Juno Network, had a security flaw in its WAVS bridge where the computeDataVerify function would fetch data from URLs supplied by AI agents without properly checking if those URLs were safe (SSRF, or server-side request forgery, meaning an attacker could trick the system into making requests to internal or unintended servers). This vulnerability allowed attackers to potentially access restricted resources by manipulating which URLs the system would contact.

JunoClaw is an agentic AI platform (a system where AI makes decisions and takes actions automatically) built on Juno Network that had a security flaw in its plugin-shell's command-safety check prior to version 0.x.y-security-1. The vulnerability allowed attackers to bypass the substring-based blocklist (a filter that blocks certain text patterns) by crafting tricky command arguments, which could lead to unauthorized command execution on the host system. The flaw occurred because the safety check looked at the raw command string instead of just the first parsed token (the initial instruction).

JunoClaw, an agentic AI platform (a system where AI agents can perform tasks autonomously) built on Juno Network, had a vulnerability in its plugin-shell component where commands supplied by agents were wrapped in shell interpreters without proper sanitization. This allowed shell metacharacters (special characters like pipes or semicolons that have meaning to the shell) in agent-supplied arguments to be interpreted as actual commands rather than plain text, potentially letting attackers run unintended commands. The vulnerability was fixed in version 0.x.y-security-1.