AI Security News: October 31, 2026

1. Epoch AI Shows Open-Weight GLM 5.3 Autonomously Exploiting Firefox’s Patch Gap for About $1,000 per Version

Epoch AI. Epoch AI reports that GLM 5.3, the open-weight model Z.ai released in August, can read security fixes that Mozilla has published but not yet shipped, identify which deliberately obfuscated commits are security-relevant, and chain the underlying bugs with a previously unpublished vulnerability into a webpage that reads a file from a visitor’s computer and sends it to an attacker with no further interaction. The researchers say every Firefox version released between September 17 and October 26 could be compromised this way using only information available at release time, with a setup designed to emulate an unsophisticated attacker and a cost of about $1,000 in API fees per version once the harness was in place. No provider, including Z.ai, triggered a safeguard or refusal during the exploit-development work, which the team framed as a security exercise but describes as otherwise indistinguishable from a real attack. Epoch disclosed to Mozilla, which shipped Firefox 159.0 on October 27 with a fix for the undisclosed bug; the report argues that the patch gap exists across browsers, phone operating systems, and router firmware, that closed-source projects are exposed wherever upcoming security changes can be read before release, and that the threat will worsen as open-weight cyber capabilities improve. Source

2. Wiz Links October’s Breaches at Nine AI Developer Platforms to Industrial-Scale LLMjacking of Stolen Bedrock Keys

Wiz. Wiz calls October a “Black October” for AI developer platforms: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank all disclosed intrusions within the month, Zeabur says it will shut down as a result, and Fireworks, OpenCode, and Warp reported signs of an “agent swarm” attack while OpenCode and CommandCode attributed the activity to model-distillation attempts. Root causes varied (credential access at several vendors, a build-infrastructure privilege escalation at Railway, a third-party dependency at Warp, a legacy system at OpenCode), but every report describes targeted hunting of stored environment variables that grant AI API access. Wiz then traced two enterprise AWS Bedrock keys taken in one of the breaches: each was validated within 30 minutes by a single InvokeModel call from a residential IP, kept alive by a small Go checker making 14 to 120 calls a day, then flooded, with one key seeing roughly 800,000 Bedrock calls in 30 hours at about 90 percent success through global cross-region inference profiles and the other about 1.7 million calls in 13 hours from a single address, the remainder throttled because the key was limited to US profiles. Token patterns (few uncached input tokens, prompt caching, a long tail of large contexts) point to resold coding-agent traffic; Wiz ties the key-checking activity to two LLM resale operations it names as “momo” and “Xingjiabi,” estimates the two keys alone exceeded $100,000 at list price, and publishes four IP indicators. Source

3. LMDeploy’s Unauthenticated update_weights Endpoint Deserializes Attacker Pickles, With No Fixed Release

InternLM LMDeploy. CVE-2026-119706 (GHSA-fq46-3gxq-v4vc, CVSS 3.1 9.8 critical) affects LMDeploy 0.9.0 through 0.18.0, the current release. The OpenAI-compatible api_server exposes a POST update_weights endpoint whose serialized tensors field can be a string; both the TurboMind and PyTorch backends pass those request-controlled bytes to ForkingPickler.loads, which resolves to native pickle loading, before any tensor validation, and the default server binds all interfaces with no API keys configured, so a remote attacker can execute OS commands as the api_server process with a base64-encoded pickle. The issue was reported upstream on June 22 and remains open; a pending pull request rejects pickle on the HTTP path by default, adds an environment-variable opt-in for trusted same-node XTuner CUDA IPC, and accepts safetensors or a structured dtype, shape, and data dictionary instead. Until a release ships, operators should keep api_server off untrusted networks, configure API keys, and block the endpoint at a proxy. Credit goes to starsalt0124 via VulnCheck. Source NVD

4. TAKO AI Agent for Okta Let Anyone on the Network Create the First Admin and Any User Run Python as Root

fctr-id/okta-ai-agent. TAKO, a self-hosted agent that lets Okta administrators query tenant data in natural language, fixed two flaws in 3.0.1-beta. CVE-2026-63377 (GHSA-536w-42p8-3qv9, CVSS 9.8 critical): the initial setup endpoint checks only an is-setup flag and requires no authentication, bootstrap token, or network restriction, while the default Docker Compose file publishes port 8001 on all interfaces, so an attacker who reaches the port before the owner finishes first-run setup creates the sole administrator account, receives a valid session JWT, and can read Okta-synced user data, API tokens, and chat history, rewrite Okta integration credentials, and lock out the real owner; completed setups are unaffected. CVE-2026-63378 (GHSA-r9q7-6784-7rc6, CVSS 8.8 high): any authenticated user can submit arbitrary Python through the execute-script endpoint, where the stored code skips the AI content filter and the validator’s blocked-pattern list misses __import__ passed as a string, keeps getattr among allowed builtins, and never inspects call targets in its AST walk, so getattr chains through __builtins__ slip past; the script then runs in a subprocess as the container user, root by default, exposing Okta API tokens, the JWT signing key, and the SQLite database. Source NVD NVD

5. Four MCP Server Flaws: MoLing Computer-Use Takeover From a Web Page, DBHub Read-Only Bypass, Zuke Registry RCE, and an Open OAuth Registration Endpoint in AI Engine for WordPress

MCP servers. MoLing, a computer-use and browser-use MCP server, fixed CVE-2026-62863 (GHSA-qpgh-hp5g-4vwp, CVSS 9.6 critical) in 0.5.0: in SSE mode its event and message endpoints accept unauthenticated requests and the mcp-go dependency emits a wildcard CORS header, so a malicious web page can open a cross-origin EventSource to the listener, even on loopback, read the endpoint event to learn the session ID, and post arbitrary tool calls that read or write files or run commands with whatever tools are configured. DBHub, Bytebase’s database MCP server, fixed CVE-2026-61789 (GHSA-j656-3hf2-fvjc, CVSS 4.0 6.1 medium) in 0.22.6: its comment scanner treated every double dash as a comment while MySQL and MariaDB require trailing whitespace, and because those connectors execute the original string with multiple statements enabled, a --x prefix hid a following write or DDL statement from the read-only check; the advisory names prompt injection in content the assistant reads as the attack path, and PostgreSQL is unaffected. Zuke’s core package fixed CVE-2026-119287 (GHSA-2rmh-5cw4-33gr, CVSS 8.0 high) in 1.51.0 after its registry mode with run permission accepted command-form registry descriptors without the launch-host check applied to remote module descriptors, letting anyone who can write to a shared registry choose the program and arguments run with the operator’s environment. In AI Engine, the WordPress plugin that ships an MCP server, CVE-2026-110732 (CVSS 7.5 high, fixed in 3.8.7) left the OAuth 2.1 Dynamic Client Registration route open to unauthenticated callers, and CVE-2026-65566 (CVSS 8.8 high, through 3.8.8, no fix stated) notes the consent page lacks frame-ancestor protections, so an attacker can register a client with their own redirect URI and clickjack an administrator into approving it, yielding an admin-bound MCP token with user-creation and option-update tools. Source Source Source Source

6. Two New check_safety Bypasses Let Malicious Pickles Through Trail of Bits’ fickling, With No Fixed Release on PyPI

Trail of Bits fickling. Bombadil Systems disclosed CVE-2026-16760 (GHSA-cgc3-662q-qmrc) and CVE-2026-118938 (GHSA-6jfm-qx2v-27jg), both CVSS 8.8 high, in fickling through 0.1.12, the pickle scanner many ML pipelines use as a gate before loading PyTorch and other pickle-based model files; because the library’s load function chains its safety check into pickle loading, a false “likely safe” verdict means the payload runs. The first is a trust-model flaw: any name imported from a standard-library module not on the denylist is marked likely safe and calls to it are skipped by the overtly-bad-evals pass, so callables such as dataclasses._create_fn (which passes an attacker-supplied body to exec on Python 3.7 through 3.12), mailcap.findmatch (which reaches os.system), and readline’s history writers inherit module-level trust. The second is a parsing flaw: a STACK_GLOBAL operand with a dotted qualified name such as Values.read_file resolves to an attribute path in pickle, but fickling records only the leading component and never analyzes the trailing method as a call, and optparse.Values.read_file runs exec on a file’s contents. The researcher reports the second bypass was still present on the master branch on October 30; upstream merged a pull request early on October 31 that matches combined module-plus-global names and blocks more stdlib gadgets, but nothing has been published to PyPI, and Bombadil disclosed two other fickling bypasses in July. Teams should treat scanner verdicts as advisory, prefer safetensors, and avoid loading untrusted pickles regardless of scan results. Source GHSA GHSA

7. Flowise Sandbox Escape Bypasses July’s Fix With No Patch, and LM Studio’s Model Downloader Could Plant a Plugin That Runs Python on Every Launch

Flowise and LM Studio. CVE-2026-119978 (GHSA-7pc2-8w3w-pqfg, CVSS 3.1 8.5, CVSS 4.0 9.0) affects Flowise through 3.1.4, the latest release, with no fix available: the custom-function endpoint runs user JavaScript inside a vm2 NodeVM sandbox, and when the built-in dependency allowlist is enabled an authenticated user can use the allowlisted LangChain LocalFileStore to write a file into the installed mammoth package directory and then require it, escaping the sandbox and running OS commands as the Flowise process user, which is root in the official Docker image. It is a different path from CVE-2026-73483, the puppeteer executable-path escape fixed in 3.1.3 on October 7, so the dependency-allowlist mitigation has now been bypassed twice; operators should leave the allowlist disabled and restrict who can call custom-function nodes. Separately, CVE-2026-119979 (GHSA-fv7x-c662-7ccq, CVSS 4.0 8.7 high) in LM Studio before 0.4.22 build 1: the model downloader accepted backslash-separated traversal filenames, so a crafted model repository could write outside the models directory, and Pillar Security’s Ariel Fogel showed it planting a plugin manifest and install state after which LM Studio runs attacker-supplied Python at every start. Exploitation requires the user to download the attacker’s model, the fix has shipped since August 28, and the CVE was published only on October 30. Source Source

8. CVE Assigned to the open npm Flaw That Let a Malicious MCP Server Run PowerShell Through MCP Inspector and opencode

open, MCP Inspector, opencode. CVE-2026-119025 (GHSA-jgwm-4pmq-r4w4, CVSS 4.0 7.7 high) covers the widely used open package from 7.2.0 before 11.0.0 on Windows and WSL, where URLs were embedded in a PowerShell double-quoted string, base64-encoded, and executed with an encoded command; PowerShell evaluates subexpressions inside such strings, and WHATWG URL serialization preserves every character a payload needs, so a URL carrying a $(...) expression executes unchanged while the application path argument a few lines earlier was escaped and the URL was not. In MCP clients the bug is reachable without any model, tool call, or approval: a remote MCP server answers 401 with a WWW-Authenticate challenge, serves OAuth discovery documents naming an attacker-chosen authorization endpoint, and MCP Inspector’s CLI, TUI, and web server pass that URL to open automatically unless auto-open is disabled, with opencode sharing the same OAuth flow. Inspector patched 2.12.0 on October 21, opencode fixed 1.18.33, and open 11.0.0 escapes the target; the October 29 CVE from VulnCheck, credited to Eilon Cohen of Pillar Security, consolidates the bug across the library and both AI consumers. Source NVD

9. Agent Platform Advisories: praktor Uploads Could Overwrite CLAUDE.md, RAGFlow Ran Other Tenants’ Private Agents, Paperclip Agent Keys Could Run Shell Commands, Plus MuseBot, Kubeflow, n8n, PipesHub and AxonHub

Agent platforms. praktor, a Telegram-driven multi-agent Claude Code orchestrator, fixed CVE-2026-62331 (GHSA-48v2-6jcm-fc99, CVSS 8.2 high) in 0.9.1: both document-upload handlers concatenated the sender-controlled filename into the destination path, so any Telegram user able to message the bot (the default allow list accepts everyone) could write outside the uploads directory within the persistent agent workspace and plant or overwrite CLAUDE.md, skill, hook, or configuration files the agent reads on later runs, turning a file upload into stored instruction injection confined to the workspace rather than the host. RAGFlow fixed CVE-2026-119337 (GHSA-c6q8-23rp-32cv, CVSS 7.1 high) in 0.27.3 after its agent chat-completions endpoint returned through the OpenAI-compatible branch before the accessibility check ran, letting an authenticated user who knew another user’s private agent UUID execute that workflow across the tenant boundary and read its output. Paperclip’s server fixed CVE-2026-119713 (GHSA-vr7g-88fq-vhq3, CVSS 4.0 8.7 high) in April, with the CVE assigned on October 30: holders of an agent API key could set workspace cleanup and teardown commands that the server later ran through a shell when the workspace was archived. Source Source NVD

Also published October 30: MuseBot before 2.0.0 shipped its admin panel with a hard-coded default session key (CVE-2026-119660, GHSA-77p8-2qmx-794p, CVSS 9.8 critical), letting anyone forge an administrator cookie and read password hashes, chat records, and bot configuration; Kubeflow Pipelines through 2.17.3 exposed other pods’ logs through a run-log endpoint that neither authorized the caller against the run nor checked the node belonged to it (CVE-2026-118759, CVSS 7.5 high) and decompressed uploaded pipeline archives before authorization with no size bound (CVE-2026-118761, CVSS 7.5 high), both fixed in 2.18.0; n8n’s deprecated Function, Function Item, and LangChain Code nodes were hidden from the palette but still resolvable on workflow import and still ran JavaScript through an in-process vm2 sandbox without the task-runner hardening applied to Code v2, so a default member with import and execute rights could run code in the main process (CVE-2026-119408, GHSA-9p7v-45m2-wxgj, CVSS 8.8 high, fixed in 2.42.6, 2.43.3, and 3.0.1), alongside a Databricks node path traversal that lets unencoded identifiers from webhook, chat, or form inputs reach arbitrary Databricks API endpoints with the stored credential (CVE-2026-119557, CVSS 5.9 medium); PipesHub before 0.10.0 fetched image URLs embedded in uploaded, mailbox-synced, or crawled documents, enabling SSRF to loopback and cloud-metadata endpoints with the response embedded into indexed content (CVE-2026-119712, GHSA-mp2g-r37c-fx9q, CVSS 6.4 medium); and AxonHub through 1.0.0-beta11 let project users mint service-account keys with unvalidated system-level scopes and read every channel’s configuration (CVE-2026-119599, CVSS 4.3 medium, no fix stated). GHSA Source Source Source NVD

10. arXiv Roundup: Role Spoofing Through Tool Output, Self-Evolving Agents Get Worse at Resisting Injection, and Four New Defenses

Research. Six cs.CR papers submitted October 29 cover agent security. Edelman, Edelman, Goel, and Malach show that models decide “who said what” from both content cues and structural cues such as control tokens and formatting, that attacks combining fake structure and content in tool output reliably impersonate the user, and that adversarial training against content-based injection leaves models exposed to structure-based spoofing; they propose linear probes that predict conversational role as a detector. Wang, Liu, Shao, and Xiao find that personal agents which learn from user feedback become materially less robust to indirect prompt injection, with attack success rising 14.0 to 48.8 percentage points under skill evolution and 3.0 to 39.3 points under reinforcement learning compared with the non-evolving base agent. On defense, SEAL learns a soft prompt that sanitizes tool outputs with the frozen task model and reports AgentDojo attack success falling from 34.6 to 0.1 percent while utility rises from 51.4 to 77.5 percent at roughly 127 times fewer defense tokens than PISanitizer; REALM applies least privilege by building a dependency graph of task-required assets and exposing only resource-bound partial APIs, cutting AgentDyn attack success from 16.6 to 0.2 percent; PCM, a proof-carrying message protocol for A2A and MCP, attaches Merkle-log inclusion proofs signed by an attester the agent cannot control to every inter-agent claim and accepts 10 of 712 fabricated claims on a 926-message benchmark where plain A2A accepts all of them; and InferD is a low-interaction honeypot for LLM serving stacks, inference APIs, vector databases, and agent gateways with a provenance plane that links planted credentials to downstream model-mediated use. Role spoofing Self-evolving agents SEAL REALM PCM InferD