Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Apache Storm's Nimbus component had a vulnerability where it accepted file paths for topology (a Storm application) submission without verifying that users had actually uploaded those files first. An authenticated user could submit any file readable by the Nimbus daemon (the server process managing Storm) as their topology, potentially exposing sensitive files like authentication keys and credentials. In standard deployments, this vulnerability required no special privileges to exploit.
Fix: Upgrade to version 3.1.0, where the submitted location is canonicalised and must resolve inside the Nimbus inbox. For users unable to upgrade immediately, restrict topology submission to trusted principals via `nimbus.users` or `nimbus.groups`, and rotate the Nimbus keytab (authentication key file) and any TLS private keys (encryption keys for secure communication) or ZooKeeper credentials (authentication data for the ZooKeeper coordination system) reachable from the Nimbus account.
NVD/CVE DatabasePraisonAI, a system that coordinates multiple AI agents working together, had a vulnerability in versions before 4.6.59 where an attacker could send commands to an unprotected API endpoint and trick the system into running arbitrary operating system commands without needing a password or approval. The vulnerability existed because the approve field could mark commands as safe before proper security checks happened.
A security vulnerability (CVE-2026-90713) exists in vLLM (an open-source large language model serving framework) versions up to 0.29.0 in the TiktokenTokenizer function that handles vocabulary files. An attacker with local access to the system can exploit this flaw to cause a denial of service (making the service unavailable), and the exploit code has been publicly released.
CrewAI before commit fb2323b has a security flaw in how it tries to block dangerous code: it only blocks imports (the statements that load Python modules) but misses other ways to access dangerous functions, like using ctypes.CDLL(None) to directly load the C library without any import statements. This means the sandbox (an isolated environment meant to restrict what code can do) is incomplete because it doesn't account for all the ways Python can access powerful system functions at runtime.
ESPnet (a speech processing AI framework) before version 202609 has a vulnerability where it loads pretrained model checkpoints (saved AI model files) using an unsafe method that can execute hidden malicious code. An attacker can create a fake checkpoint file that runs whatever code they want when someone tries to use that file to initialize or improve an AI model.
vLLM (an open-source LLM serving framework) versions before 0.28.0 don't properly check audio sample rate headers (the metadata describing how many audio samples are recorded per second) in its transcription endpoint, letting authenticated users submit fake audio headers with inflated sample rates that cause the server to allocate excessive memory and crash. This affects all users of the affected vLLM instance.
vLLM versions 0.10.2 through 0.27.x have a vulnerability where audio extraction from video files lacks size and duration limits, allowing attackers to upload specially crafted compressed videos that force the server to use massive amounts of memory during decoding (a denial of service attack, where legitimate users can't access the service). This only affects NanoNemotronVL models when video audio processing is enabled.
vLLM (a tool for running large language models efficiently) versions before 0.28.0 have a remote code execution vulnerability (a flaw that lets attackers run their own code on a system) in the LlavaOnevision2 processor loader. Even when a user sets trust_remote_code to False (a safety setting meant to prevent loading untrusted code), the vulnerability ignores this setting and allows attackers to execute malicious code by hiding it in a model file.
Kiro IDE (an AI-assisted development environment) had a vulnerability where an AI agent could modify workspace settings files in untrusted repositories, potentially redirecting the Powers panel (a UI component for extensions) to send sensitive workspace data to external servers. Although users were shown a prompt asking for approval, the malicious settings were already written to disk, so opening the Powers panel before responding would trigger the data leak.
Mistral Vibe has a vulnerability where attackers can access files they shouldn't be able to reach by exploiting commands that skip safety checks (workspace restrictions, which limit what folders a user can access). The software doesn't properly validate file paths, meaning someone could read files outside their allowed workspace without permission.
A security vulnerability in Mistral Vibe allows attackers to run unauthorized code by sneaking environment variable assignments (settings that control how programs behave) before allowlisted commands, which bypasses the permission checks that normally prevent this. The vulnerability works because these environment variable assignments are not inspected for safety before the command runs.
Mistral Vibe contains a vulnerability where an attacker can run unauthorized commands on a user's system by using shell constructs (special characters or syntax that the command parser doesn't understand) that the parser cannot interpret. Because unparsed portions are skipped during permission checks, embedded commands can execute without approval.
Mistral Vibe contains a vulnerability where attackers can bypass security checks that normally prevent unauthorized commands from running by using ANSI-C quoted arguments (a special text formatting method). This allows someone to modify an approved command so it secretly runs malicious code on a user's computer without permission.
Mistral Vibe version 1.3.4 has a vulnerability that lets attackers write or overwrite files anywhere on the system without permission. The problem happens because shell redirection (using symbols like > to send output to files) isn't checked for permissions the same way regular commands are, so attackers can bypass security controls.
A vulnerability in Mistral Vibe version 2.6.0 allows attackers to read files they shouldn't have access to by using quoted absolute paths (file locations that start from the root directory) in shell commands, because the system doesn't properly validate quotation marks when checking file access restrictions.
Headroom is a tool that compresses data before sending it to an LLM (large language model, an AI system trained on text). In versions before 0.35.0, the Headroom WebSocket server (a communication protocol allowing real-time two-way data exchange) failed to validate the Origin header (a security check that confirms where a request is coming from), allowing attackers to send unauthorized LLM requests and potentially access OpenAI API keys stored in environment variables (system settings that store sensitive information).
A Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to internal systems it shouldn't access) exists in Google Cloud Gemini Enterprise Agent Platform App Builder versions before June 1, 2026. An attacker without authentication can exploit this to steal the Compute Engine default service account access token (a credential that grants permissions to cloud resources). The vulnerability was patched on June 1, 2026.
Fix: Update to praisonai 4.6.59 or praisonaiagents 1.6.59, which are the fixed versions that address this vulnerability.
NVD/CVE DatabaseFix: Update ESPnet to version 202609 or later.
NVD/CVE DatabaseFix: Update vLLM to version 0.28.0 or later.
NVD/CVE DatabaseFix: Fixed in vLLM 0.28.0. Users should upgrade to version 0.28.0 or later.
NVD/CVE DatabaseFix: Update vLLM to version 0.28.0 or later.
NVD/CVE DatabaseFix: Update Headroom to version 0.35.0 or later, which fixes the issue.
NVD/CVE DatabaseFix: Users will need to redeploy their previously deployed apps to receive the patch.
NVD/CVE DatabaseAnthropic discovered that Chinese AI companies including Alibaba, Moonshot, and DeepSeek were secretly using millions of Claude outputs to train their own models through illicit distillation (copying a more capable AI model's responses to train a cheaper model without permission). Alibaba conducted the largest campaign with over 151 million exchanges, while Moonshot rerouted customer requests to Claude without user knowledge and used the responses as training data. The practices likely violated privacy laws and terms of service, and some exchanges contained sensitive information from individual users and companies.
JFrog Artifactory has an improper authentication vulnerability (a flaw in how the software verifies user identity) that could accidentally give an internal anonymous-user token (a credential that grants access without logging in) to someone who shouldn't have access, especially when anonymous access is supposed to be turned off. This could expose sensitive files and data stored in Artifactory. This vulnerability is currently being exploited by attackers in real attacks.
Fix: Apply mitigations according to JFrog vendor instructions at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases, following CISA's BOD 26-04 guidance for prioritizing security updates. If mitigations are unavailable, discontinue use of the product for cloud services per BOD 26-04 requirements. Due date for patching is 2026-09-25.
CISA Known Exploited VulnerabilitiesJFrog Artifactory has a security flaw that allows attackers to gain elevated privileges by bypassing authorization checks. The vulnerability happens because the software validates the token's signature and issuer (who created it), but fails to check the token's scope (what permissions it allows), letting attackers use tokens beyond their intended access level.
Fix: Apply mitigations according to vendor instructions. Consult JFrog's security advisories at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and Artifactory release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases. Follow CISA's BOD 26-04 guidance for patching timelines. If mitigations are unavailable for cloud services, discontinue use of the product.
CISA Known Exploited Vulnerabilities