A critical flaw in ComfyUI's LoadTrainingDataset node lets unauthenticated attackers upload a malicious pickle shard and trigger arbitrary code execution through torch.load, exposing the most widely used Stable Diffusion interface.
Two high-severity remote code execution vulnerabilities in llama.cpp expose local AI inference stacks to unauthenticated network attack — one through the HTTP completion server via a missing negative-value check, one through the RPC backend's deserialisation logic.
Novee Security disclosed CVE-2026-54316 at Black Hat USA 2026: a zero-privilege GitHub issue can reach CI runner secrets across Claude Code, Gemini CLI, and OpenAI Codex. The Claude Code variant eventually exfiltrated secrets one character at a time via Hugging Face download counters. A separate Gemini CLI flaw scored CVSS 10.0.
CVE-2026-41264 in Flowise's CSVAgent node lets an attacker upload a crafted CSV file, inject a prompt that directs the LLM to generate malicious Python, and execute that code on the host with no authentication required. Metasploit module landed July 11, 2026.
CVE-2026-18948 (CVSS 9.9) exploits Python dill deserialization to achieve unauthenticated RCE on Feast feature servers. CVE-2026-23537 (CVSS 9.1) allows arbitrary file writes via the /save-document endpoint. Together they expose ML pipelines to full compromise.
A DeepSeek-powered autonomous hacking agent actively exploited CVE-2026-9198 in Langflow (CVSS 9.8) and adapted in real time when targets resisted, pivoting to secondary attack surfaces. CISA added the flaw to KEV on August 5, 2026.
CVE-2026-59726, dubbed RufRoot, is a CVSS 10.0 flaw in Ruflo's MCP bridge that lets unauthenticated attackers execute shell commands, steal LLM API keys, and poison the platform's persistent AI memory store. Patch ships quickly; poisoned AgentDB entries do not self-clear.
CVE-2026-10591 in AWS Kiro allowed a hidden prompt injection payload on a web page to silently rewrite the IDE's MCP server config and execute attacker code with developer privileges, bypassing all user-approval prompts.
Zafran Labs disclosed three CVEs in Hugging Face's Diffusers library collectively named FaceHugger, all rooted in a TOCTOU flaw that lets crafted model repositories bypass trust_remote_code protections and execute arbitrary code on machines loading them.
A critical pre-authentication RCE in ServiceNow's AI Platform is being actively exploited. With 85% of Fortune 500 companies running ServiceNow and no credentials required to trigger the flaw, remediation speed is the only variable that matters.
Beyond the record 570-CVE headline, Microsoft's July 2026 Patch Tuesday patched nine vulnerabilities across its AI product suite — including a Critical RCE in Copilot for desktop triggered by visiting a malicious website, and a CVSS 9.9 elevation of privilege in Azure OpenAI.
Straiker's STAR Labs ran over 1,700 adversarial scenarios against production AI coding and productivity agents. The headline finding: 36% of successful coding agent attacks reach remote code execution on the developer's machine, putting source code and cloud credentials at direct risk.
CISA added CVE-2026-55255 to the Known Exploited Vulnerabilities catalog on July 7, 2026, after confirming active exploitation of an insecure direct object reference in Langflow that let authenticated users execute workflows belonging to other tenants.
Three high-severity vulnerabilities in the OpenClaw AI assistant allow a remotely-sent WhatsApp message to trigger host code execution, SSH key theft, and Docker socket escape. All three are patched in version 2026.6.6.
CVE-2026-21858 gives unauthenticated attackers full code execution on n8n workflow servers. Langflow's new IDOR vulnerability has been added to CISA KEV. GitHub Copilot's MCP integration carries a prompt-injection-to-RCE chain. AI automation infrastructure is becoming a primary attack surface.
Two critical vulnerabilities in Cursor IDE, CVE-2026-50548 and CVE-2026-50549 (collectively DuneSlide), allow prompt injection attacks to escape the editor's sandbox and execute arbitrary code at the OS level — with no user click required. All Cursor versions before 3.0 are affected. Cato Networks disclosed publicly on July 3, 2026.
CVE-2026-33017, a CVSS 9.8 unauthenticated RCE in Langflow, has been added to the CISA KEV catalog after active exploitation deploying a self-spreading Monero cryptominer across exposed AI workflow environments.
A two-stage exploit chain in vLLM's multimodal video processing bypasses ASLR through PIL exception leakage, then achieves heap overflow via a malicious JPEG2000 file, giving unauthenticated attackers code execution on inference servers.
A coordinated disclosure of 13 critical vm2 vulnerabilities in May 2026 exposed a structural problem: AI agent frameworks that use vm2 as a code execution sandbox convert a prompt injection into host-level RCE the moment the sandbox breaks. Here's the chain and what to do about it.
A three-flaw chain in Microsoft AutoGen Studio's MCP WebSocket surface lets a malicious webpage execute arbitrary commands on the host via an AI browsing agent. Microsoft patched in June 2026.
A sandbox bypass in Cursor's agentic mode lets attackers poison shell environment variables through implicitly trusted built-ins, converting approved commands like git branch or python3 into arbitrary code execution.
Tenet Security's Threat Labs published research on June 17 demonstrating how a single fake Sentry error event can hijack AI coding agents like Claude Code and Cursor into executing arbitrary code on developer machines — no phishing, no infrastructure access, 85% success rate across 100+ tested organisations.
A critical flaw in Hugging Face Transformers lets attackers execute arbitrary code on anyone who loads a poisoned model, silently bypassing the trust_remote_code=False safety flag. 232 million vulnerable downloads preceded the March patch.
A path traversal vulnerability in Langflow's file API allows unauthenticated attackers to overwrite arbitrary files and chain to RCE. Active exploitation confirmed in June 2026. Fix is in version 1.9.0.
Two critical CVEs in Microsoft Semantic Kernel let attackers chain prompt injection into arbitrary file writes and code execution. Patch to .NET SDK 1.71.0 and Python SDK 1.39.4 immediately.
Palo Alto Networks Unit 42 disclosed a Vertex AI SDK vulnerability where predictable staging bucket names let attackers hijack model uploads and achieve code execution across tenant boundaries. Patched in April 2026, disclosed June 16.
Check Point Research found three CVEs in LangGraph's persistence layer. CVE-2025-67644 SQLi chains with CVE-2026-28277 deserialization to reach RCE.
Adversa AI disclosed SymJack (symlink hijacking to plant malicious MCP servers) and TrustFall (trust dialog bypass) hitting six AI coding agents including Copilot and Cursor.
CISA added CVE-2026-42271 to KEV after Horizon3.ai chained the LiteLLM MCP command injection flaw with a Starlette auth bypass for unauthenticated RCE. Federal deadline: June 22.
A critical deserialization vulnerability (CVSS 9.8) in a widely-deployed ML model serving framework allows unauthenticated RCE via crafted model files. Active exploitation confirmed.