Incidents tagged in

Prompt injection is a prevalent AI-specific vulnerability where Large Language Models (LLMs) misinterpret external data as executable instructions, bypassing intended safeguards. This can lead to sensitive data exfiltration, the execution of rogue tasks, or malicious code execution, impacting various AI agents, coding assistants, and chatbots.

Over 30 critical "ShadowMQ" vulnerabilities, stemming from insecure ZeroMQ `recv_pyobj()` and Python `pickle` deserialization, affect leading AI inference engines such as Meta Llama LLM and NVIDIA TensorRT-LLM. These flaws enable remote code execution, data theft, and privilege escalation, with specific CVEs like CVE-2024-50050 attributed, and active exploitation has been observed.

Agentic AI systems introduce new architectural risks due to their autonomous planning, decision-making, and tool-use capabilities, moving the attack surface from static models to dynamic workflows. Key threats include memory poisoning, tool misuse, and potential remote code execution (RCE) stemming from manipulated agent reasoning paths, external interactions, and inter-agent communications.

Salesforce Agentforce was susceptible to a critical indirect prompt injection vulnerability, codenamed ForcedLeak (CVSS 9.4). This flaw allowed attackers to exfiltrate sensitive CRM data by manipulating Web-to-Lead forms, causing AI agents to transmit information to an attacker-controlled domain.

A security flaw in the Cursor AI code editor, a Visual Studio Code fork, allows for silent arbitrary code execution when a maliciously crafted repository is opened. This vulnerability stems from "Workspace Trust" being disabled by default, enabling tasks configured in `.vscode/tasks.json` to auto-execute and posing a significant supply chain risk.

Hackers exploited a vulnerable workflow in the Nx build system to achieve code injection and GITHUB_TOKEN theft, enabling the publication of malicious package versions. These malicious packages deployed a post-install script that exfiltrated thousands of sensitive credentials and notably weaponized AI assistants like Claude and Gemini for reconnaissance and data exfiltration.

AI coding tools like Claude Code integrate security features to identify common vulnerabilities such as SQL injection, XSS, RCE, and SSRF during development workflows. However, these tools are limited by their training data and struggle to detect novel, complex, or architectural vulnerabilities, potentially instilling a dangerous false sense of security among developers.

The article details critical security risks inherent in Large Language Models (LLMs), prominently featuring prompt injection as an exploit where attackers manipulate inputs to override model instructions and elicit unintended actions. It also emphasizes sensitive data leakage, noting that LLMs can expose proprietary or private information, either directly from training data or through malicious outputs.

A critical vulnerability in the AI vibe coding platform Base44 allowed unauthorized access to private applications by exploiting unauthenticated registration and email verification endpoints. Attackers could use a publicly available `app_id` to create verified accounts, bypassing authentication controls including SSO and granting full access to sensitive enterprise data.

Evidence indicates that SQLite is affected by a security issue. Reported affected versions include 3.50.2.

A critical security flaw in McDonald's McHire AI hiring tool leveraged default '123456' administrative credentials combined with an Insecure Direct Object Reference (IDOR) vulnerability in an internal API. This exploit allowed researchers to access and potentially expose sensitive Personally Identifiable Information (PII) for millions of job applicants, including chat histories and contact details.

AI agentic applications face significant security threats, including prompt injection, tool misuse, and unsecured code interpreters, which can result in information leakage, credential theft, and remote code execution. These vulnerabilities are primarily rooted in insecure design patterns, misconfigurations, and unsafe tool integrations rather than specific AI agent frameworks.

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.