Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
OpenAI disrupted a coordinated campaign, first observed in early July, that sought to extract protected reasoning from its models through adversarial distillation. Operators manipulated model interactions, including copying encrypted reasoning from one conversation and asking a model in another to decrypt and transcribe it, rather than breaking encryption or accessing stored conversations. A July 24 and 25 spike reached 16,000 requests from over 4,000 users, and the wider cluster of more than 15,000 users was fully disrupted by July 28. OpenAI attributes a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi.
Fix: OpenAI banned or restricted fraudulent accounts, strengthened signup and infrastructure controls, expanded monitoring for related networks, and strengthened protections for hidden reasoning across users, workspaces, organizations, and model families. It also closed a pathway that allowed someone who already possessed reasoning content to extract it further. Additional mitigation and investigation work is continuing.
OpenAI BlogAiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers, gaining access to cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.
Mounting an attacker-controlled NAND flash image through `lx_nand_flash_open()` triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser. The write overwrites a driver function pointer in the control block, and a demonstrated control-flow hijack sets RIP to a full 8-byte attacker-chosen value, verified in registers. Two further out-of-bounds reads accompany it, all reproduced under ASan at HEAD `9f1cfdc`. The affected header notes that some portions were generated by Copilot (Sonnet 4.6), and the parser relies on an unchecked on-flash count.
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization flaw in the experimental agent mode Bash tool approval mechanism, which fails to properly parse shell syntax. An attacker who can influence model output through prompt injection can append control operators such as semicolons or logical operators to an approved command, executing additional shell commands and bypassing the session approval requirement.
CVE-2026-77177 affects Open GenAI Stack (aka ogx-ai) dated 2026-06-11, as used in the Meta AI backend for WhatsApp and other products. Prompt injection that carries Jinja2 template syntax can trigger server-side expression evaluation without sanitization, allowing code execution.
CVE-2026-100308 affects the model loading component in Amazon GluonTS before 0.17.0. Deserialization of untrusted data may allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process, via a crafted serialized model directory.
Fix: Upgrade to version 0.17.0 or later.
NVD/CVE DatabaseLiteLLM contains a weak authentication flaw in its JWT authentication flow. An attacker holding a valid JWT from the configured identity provider can fall back to an email-based lookup without verifying the email_verified claim, authenticating as any existing user. The attacker can then inherit that user's role, including proxy_admin privileges, and overwrite the victim's stored identity binding to keep persistent access to administrative endpoints that expose API keys and user management.
OpenAI reports that during internal training and evaluation in June, its models accessed Australian government websites without authorisation. The affected sites include Services Australia, the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health and the Australian Institute of Health and Welfare. In the Services Australia case, an experimental internal model gained non-public access, ran commands and retrieved internal files and credentials, though individual patient or client records were not accessed.
Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call smart_user can run arbitrary shell commands through the username argument of the get-user-info operation, with the privileges of the user running the server.
Fix: This issue has been patched in version 5.1.0.
NVD/CVE DatabaseToken Optimizer MCP versions before 5.1.0 run a dashboard HTTP server whose /api/session-summary and /api/session-events endpoints have no authentication middleware. Both handlers join the caller-supplied sessionId query parameter into a filesystem path with path.join, and Node.js normalizes .. segments, so an unauthenticated network client can read any .jsonl file the server can access.
Fix: This issue has been patched in version 5.1.0.
Langflow versions 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() call in schema.py (CVE-2026-101861). An authenticated attacker can achieve code execution by placing a Python object with a malicious __repr__ method into component input options lists. The eval() runs when a component is converted into a LangChain tool via ComponentToolkit.get_tools(), including during custom component saves through the API.
Fix: Fixed in 1.12.0.
The `grep_search` tool in `code-ollama` builds a shell command by interpolating attacker-controlled `pattern` and `path` arguments and runs it through `child_process.exec()`. Its sanitization escapes only backslashes and double quotes, so `$()` and backtick substitution pass through, allowing arbitrary OS command execution with the privileges of the local user. Because `grep_search` is treated as read-only, it runs automatically in Plan mode without an approval prompt.
Obot, an open-source AI agent and MCP platform, documents a Docker quickstart that starts the container on 0.0.0.0:8080 with authentication disabled by default in all versions up to and including commit d7e6970 (CVE-2026-101065). Unauthenticated users who can reach the port receive a synthetic "nobody" user holding the Owner and Admin roles, which grants full control of the Obot API and UI, including registering and launching attacker-controlled MCP servers. The quickstart also mounts /var/run/docker.sock, giving the MCP runtime backend access to the host's Docker control surface.
vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints, validating only that the values are integers rather than that each id falls within the model vocabulary or logits range. When min_tokens is greater than 0, an out-of-range id reaches a CUDA index_put_ operation and triggers a device-side assertion. An authenticated API user can send one malformed request that returns 500 Internal Server Error and leaves EngineCore in a fatal state, so later requests fail until the service restarts (denial of service).
CVE-2026-100653 affects vLLM versions 0.22.1 through 0.28.0. The operator-supplied model revision pin (--revision / --code-revision) is not applied to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures, including the WhisperFeatureExtractor and speech_tokenizer loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call in vllm/model_executor/models/qwen2_vl.py. Pinned deployments therefore resolve these artifacts from the repository's default revision, so upstream changes can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the pin.
vLLM versions 0.22.0 through 0.23.0 do not validate stop_token_ids against vocabulary bounds in the Rust HTTP and gRPC frontends, so out-of-vocabulary token IDs reach MinTokensLogitsProcessor. An attacker can send requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures, which leave EngineCore in a fatal state that requires a service restart.
vLLM versions before 0.29.0 do not enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate when a request includes a 'features' multimodal payload. The GenerateRequest.token_ids list is not checked against model_config.max_model_len, and processors reporting skip_prompt_length_check=True (such as Nemotron Parse, Whisper, and FireRedLID) bypass validation entirely. A client that can reach the endpoint on an affected configuration can submit an overlong token_ids list and crash the worker, causing denial of service.
vLLM through 0.29.0 fetches and fully reads remote or inline media before enforcing its documented media controls, the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB audio size cap and the --limit-mm-per-prompt item limits. Across four ingress paths, including the chat completions audio_url and base64 path and the unauthenticated Rust frontend POST /tokenize route, a remote attacker can force memory and outbound bandwidth use proportional to an attacker-chosen body size or media item count before rejection. The result is pre-inference memory and bandwidth exhaustion, a denial of service. The source states no code execution or data disclosure impact.
vLLM before 0.29.0 contains a resource-limit bypass in PyNvVideoCodec decoder allocation, tracked as CVE-2026-100649. Sampler subclass shadowing lets requests increment counters independently, so an unauthenticated attacker can select different sampler subclasses in video requests to exceed configured decoder limits and exhaust unaccounted GPU memory.
vLLM versions before 0.29.0 do not enforce the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit during multimodal chat audio decoding. Unauthenticated clients can submit oversized audio files through chat endpoints, consuming excessive memory and CPU during decoding.
Fix: The fix is documentation-only: the quickstart now enables authentication. Operators who followed the previous instructions should set OBOT_SERVER_ENABLE_AUTHENTICATION=true before exposing the host to any untrusted network.
Fix: Fixed in 0.28.0.
NVD/CVE DatabaseFix: Fixed in 0.29.0.