Remote-Code-Execution

CVE-2025-62593: Ray AI Framework RCE via DNS Rebinding

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News Aug 24, 2026

CISA has added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog, flagging a critical flaw in the Ray distributed AI/ML computing framework that enables remote code execution through DNS rebinding attacks via Firefox and Safari. The vulnerability stems from Ray's longstanding absence of authentication on critical API endpoints, allowing attackers to execute arbitrary shell code on developer machines or pivot into private corporate networks. Active exploitation has been observed by the RondoDox DDoS botnet and a self-replicating GPU cryptomining campaign dubbed ShadowRay 2.0.

CVE-2026-41679: Paperclip AI RCE via Malicious Agent Import

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Aug 10, 2026

Two critical vulnerabilities in Paperclip, an open-source AI agent control plane, allow attackers to execute arbitrary host commands by importing malicious agent configurations — one requiring no authentication whatsoever. A third flaw exposes sensitive data through unenforced API access controls, and Rapid7 has already published a public Metasploit module for the CVSS 10.0 server-side path. The findings underscore a systemic risk in agentic AI platforms: agent configuration is functionally executable code and must be treated as such.

CVE-2026-58073: Veeam and Terraform MCP Critical Flaws Patched

ATLAS OWASP CRITICAL ▲ 6.5 The Hacker News Aug 10, 2026

HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities, with the most critical being a CVSS 10.0 cross-tenant token reuse flaw in Terraform's MCP Server that allows one user's Terraform token to be hijacked for subsequent users' requests. The Veeam Service Provider Console carries a 9.5-rated unauthenticated credential theft bug affecting multi-tenant backup infrastructure. The Terraform MCP Server flaw is particularly notable from an AI security perspective as it directly affects the Model Context Protocol layer connecting AI assistants to infrastructure tooling.

CVE-2026-0770: Langflow RCE Flaw Exploited in Active Attacks

ATLAS OWASP CRITICAL ▲ 9.2 BleepingComputer Jul 22, 2026

CISA has added CVE-2026-0770, a critical unauthenticated remote code execution flaw in the Langflow AI agent-building framework, to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by Friday. Attackers are exploiting the vulnerability to execute commands as root, deploy second-stage malware, and harvest cloud credentials including AWS keys and container metadata. With over 220 exploitation attempts recorded from 64 unique IPs since late June, the threat is active and targeted at organisations running AI development infrastructure.

HalluSquatting Exploits AI Hallucinations for Botnet RCE

ATLAS OWASP HIGH ▲ 8.5 SecurityWeek Jul 12, 2026

Researchers have demonstrated a novel attack technique called 'HalluSquatting', which weaponises AI hallucinations by registering fake package names that LLMs fabricate, turning them into malware delivery vectors. When developers trust AI-recommended dependencies and install the squatted packages, attackers can achieve remote code execution and potentially recruit victim machines into botnets. The technique represents a significant escalation in the practical exploitation of LLM hallucinations beyond misinformation into active infrastructure compromise.

Cursor IDE DuneSlide Zero-Click Prompt Injection RCE

ATLAS OWASP CRITICAL ▲ 9.2 SecurityWeek Jul 04, 2026

A set of vulnerabilities dubbed 'DuneSlide' in the Cursor AI code editor allow attackers to conduct zero-click prompt injection attacks that escape the application's sandbox and execute arbitrary code at the operating system level. The flaws represent a critical escalation of AI-native attack surface risks, targeting developers who rely on AI-assisted coding environments. Because exploitation requires no user interaction, the attack chain is particularly dangerous in supply chain and watering-hole scenarios.

Anthropic Enhances AI Agent Skill Scanner Security

FIRST LOOK ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jun 24, 2026

Security firm AIR demonstrated that a malicious AI agent skill, disguised as a Google Stitch landing-page builder, passed every major skill scanner including Cisco's, NVIDIA's, and skills.sh integrations, reaching approximately 26,000 agents before its payload was activated. The attack exploits a structural gap: scanners evaluate a static package at submission time, while the external URL the skill instructs the agent to fetch can be silently swapped post-install to deliver arbitrary instructions. Defenders relying on marketplace reputation signals, GitHub star counts, or one-time scanner verdicts to gatekeep agent skills have no meaningful protection against this class of supply-chain attack.

AutoGen Studio RCE: AutoJack Exploit Chain Targets Developers

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jun 20, 2026

Microsoft researchers disclosed AutoJack, an exploit chain targeting AutoGen Studio's MCP WebSocket endpoint that allows a single malicious web page to execute arbitrary commands on a developer's host machine via an AI browsing agent. The attack chains three distinct weaknesses — localhost trust bypass, missing authentication on MCP paths, and unsanitised command execution — requiring no credentials or user interaction beyond the agent loading the attacker's URL. While the vulnerable handler was not included in stable PyPI releases, it shipped in two pre-release builds that remain unyanked, leaving anyone who installed those versions exposed.

Palo Alto Exposes AI Agent Skill Supply Chain Compromise Risk

ATLAS OWASP HIGH ▲ 8.5 Palo Alto Unit 42 Jun 12, 2026

Palo Alto Unit 42 introduces Behavioral Integrity Verification (BIV), an audit method exposing widespread mismatches between what third-party AI agent skills claim to do and what they actually execute. Applied at registry scale, BIV identifies a dangerous subset of skills carrying multi-stage attack chains capable of credential theft, remote code execution, and silent data exfiltration. The research highlights that the AI agent skill ecosystem has grown rapidly without the supply-chain audit primitives that mobile and browser extension platforms eventually adopted after abuse.

CVE-2025-67644: LangGraph SQLi to RCE via Checkpointer

ATLAS OWASP CRITICAL ▲ 9.2 Check Point Research Jun 12, 2026

Check Point Research disclosed three vulnerabilities in LangGraph's persistence layer, two of which chain together to achieve remote code execution: a SQL injection flaw in the SQLite checkpointer (CVE-2025-67644) and an unsafe msgpack deserialization bug (CVE-2026-28277). A third parallel injection vulnerability (CVE-2026-27022) affects the Redis checkpointer. With over 50 million monthly downloads, self-hosted LangGraph deployments exposing user-controlled state history filters are directly at risk.

CVE-2026-5027: Langflow RCE Actively Exploited

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jun 11, 2026

A critical unpatched path traversal vulnerability (CVE-2026-5027, CVSS 8.8) in Langflow, a widely-used open-source AI application builder, is being actively exploited in the wild to achieve unauthenticated remote code execution. Because Langflow enables auto-login by default, attackers require no credentials to reach the vulnerable endpoint and can exploit it with a single HTTP request. With approximately 7,000 publicly exposed Langflow instances and nation-state actors already targeting related Langflow flaws, the risk to AI development infrastructure is severe.

Loopsy AI Agent Relay Enables Cross-Machine RCE

ATLAS OWASP MEDIUM ▲ 6.5 HN AI Security May 03, 2026

Loopsy is an open-source tool enabling cross-machine communication between AI coding agents (Claude Code, Cursor, Codex) and mobile devices via a self-hosted Cloudflare Workers relay. While designed for legitimate developer productivity, the architecture introduces significant attack surface: a relay brokering shell access and AI agent commands across machines is a high-value target for interception, hijacking, or supply chain compromise. Security teams should assess exposure before deploying such tools in sensitive development environments.

Gemini CLI CVSS 10 RCE via Config Injection in CI/CD

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News May 01, 2026

Google has patched a maximum-severity (CVSS 10.0) vulnerability in its Gemini CLI tooling that allowed unauthenticated attackers to achieve remote code execution by planting malicious configuration files in workspace directories automatically trusted by the agent in headless/CI mode. The flaw effectively weaponised CI/CD pipelines as supply chain attack paths, bypassing sandbox protections entirely before they could initialise. A secondary issue in '--yolo' mode further enabled prompt injection to trigger unrestricted shell command execution.

CVE-2026: Anthropic MCP SDK Remote Code Execution

ATLAS OWASP CRITICAL ▲ 9.4 The Hacker News Apr 20, 2026

A systemic 'by design' vulnerability in Anthropic's Model Context Protocol (MCP) SDK enables arbitrary remote code execution across all supported language implementations via unsafe STDIO transport defaults, affecting over 7,000 publicly accessible servers and 150 million downloads. The flaw has been independently confirmed across 10+ popular AI frameworks including LiteLLM, LangChain, and Flowise, with Anthropic declining to modify the protocol's architecture. This represents a significant AI supply chain risk with cascading exposure to sensitive data, API keys, and internal systems.

Cursor AI Prompt Injection Chains to Shell Access

ATLAS OWASP CRITICAL ▲ 8.5 SecurityWeek Apr 18, 2026

A chained vulnerability in Cursor AI—a widely-used AI-powered code editor—allowed attackers to combine indirect prompt injection with a sandbox escape and the application's built-in remote tunnel feature to achieve arbitrary shell access on developer machines. The attack chain is particularly significant because it weaponises Cursor's own legitimate remote-access infrastructure, meaning malicious commands could blend into normal developer workflows. Developers using Cursor's AI features against untrusted code or repositories are at elevated risk of full host compromise.

Remote-Code-Execution

Stay ahead of the threat.