AI security research / cases
Case files
Investigations, evidence and outcomes.
529 Cases · Page 27 of 27
Case
The n8n-mcp local workflow-backup authorization reused the original n8n API-key value as a lasting access identity without checking whether that key was still valid. The revoked key could continue listing, reading or deleting retained local backup versions until their separate retention or authorization expired.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
The Strands Agents Tools environment tool exposed a masking parameter to an agent, allowing the model to choose false and request unredacted host environment variables. Cloud credentials or provider keys in the tool host environment could be returned to the model even though the operator expected sensitive values to be hidden.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
Tabularis interpolated the table_name argument into SQLite PRAGMA metadata queries that its SQL driver could execute as stacked statements. Crafted metadata arguments could cross the nominal read-only MCP tool policy and issue statements through the same database connection.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
The Unsloth model-loading pipeline interpolated the model_type value from an untrusted model configuration into generated Python execution code. Embedded source content in that metadata field could execute before model weights or tokenizer code were processed even with trust_remote_code set to false.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
An AI model server that advertised permissive CORS to any browser origin and accepted requests without an API key could be invoked from an attacker-controlled web page. JavaScript on an unrelated website could list available models or consume local inference resources through the user’s browser.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
A DeepSeek-OCR image preprocessor in vLLM treated a zero-valued pixel sum as if the image embeddings were absent. The downstream embedding path failed and terminated the EngineCore service instead of returning a request-local error.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
Phi-4 multimodal audio attention materialized full layer-by-layer attention matrices for long waveforms in vLLM instead of using a bounded streaming form. A legal ten-minute WAV was enough in the reproduction to exhaust roughly 24 GiB of GPU memory and terminate the engine.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
vLLM applied trust-request-chat-template validation to Chat endpoints but failed to apply the same rejection to nested template kwargs arriving through its Responses API. A client could get a forbidden template evaluated and potentially combine the bypass with the separate Jinja CPU exhaustion mechanism.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
Case
A tokenizer chat template containing an unbounded Jinja loop occupied the vLLM shared rendering worker while subsequent inference requests waited. A small template could create an indefinitely stalled renderer or large computation and deny service to other model users.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityAGAINST AI2 claims
No matches on this page.