AI Security News: November 3, 2026

1. Three Critical Beta9 Flaws Let a Tenant Escape to the GPU Worker and Its Cluster-Admin Token

Beam’s Beta9, an open-source runtime for serverless GPU inference, sandboxes and background jobs, received three CVEs from JFrog on November 1, each scored CVSS 3.1 9.9 critical and each reachable by any tenant holding a workspace token. CVE-2026-120307 is a path traversal in the sandbox file API, which the worker serves from outside the container: parent-directory segments after a mount prefix such as the default /tmp/.beta9 resolve to any path on the worker, so upload, download, list and delete calls read and write the host as root, including other tenants’ files, and the reporter’s proof pulled the worker’s Kubernetes service account token, which the shipped remote-node manifests bind to cluster-admin. CVE-2026-120306 covers image builds, where Buildah ran tenant RUN steps with chroot isolation inside the privileged worker pod’s PID, network and IPC namespaces as uid 0, exposing the worker’s runc, buildah and runsc binaries through /proc/1/root, and CVE-2026-120308 lets a volume identifier containing ../ bind-mount the worker’s filesystem into a sandbox read-write. Self-hosted operators should run worker 0.1.756 and gateway 0.1.776, which move builds to OCI isolation with private namespaces, confine file operations with os.OpenRoot, and check volume ownership before mounting. File API Image builds Volumes

2. Mandiant Tracks LLMJacking Crews Running Up $100,000 a Day in Stolen Model Usage and Reselling It Through “LLM Mixers”

Google Threat Intelligence Group and Mandiant described 2026 incident-response cases in which attackers hijacked enterprise access to hosted LLMs at financial services, retail, technology and transportation organizations across North America, South America and Asia Pacific, with fraudulent charges exceeding $100,000 in a single day and reaching $1 million cumulatively at some victims before access was revoked. The dominant entry point was stolen or exposed cloud identity material (IAM credentials, service account keys, GitHub personal access tokens and live session tokens) rather than leaked model API keys, though GTIG also saw keys harvested from public repositories and validated with stealthy max_tokens=1 requests, scans for unauthenticated Ollama endpoints, and a cluster tracked as UNC6993 using a fake portal to trick users into pasting raw access-token JSON, bypassing MFA. GTIG reports a division of labor between access brokers and operators of “LLM mixers,” gateways that proxy, pool and resell the stolen access to underground subscribers. The post lists detections for Amazon Bedrock (CloudTrail InvokeModel, Converse, PutUseCaseForModelAccess, CreateFoundationModelAgreement, and any DeleteModelInvocationLoggingConfiguration call by a non-IaC principal) and for Azure Cognitive Services, and recommends per-model quotas and spending caps, API keys scoped by model and environment, alerts on low-volume validation pings, and prompt patching of model gateways such as LiteLLM. Source

3. Study of 1,000 MCP Registry Servers Finds Most Destructive Tools Run Without Human Approval

Research. Yao, Yang, Wang, Zhou and Ye measured both halves of MCP’s human-approval design from source code: servers, which can annotate a tool or ask the user through the host via elicitation, and hosts, which decide whether to prompt. In a 1,000-repository sample of the official MCP registry, an estimated 90% of destructive tools (95% CI 82-95) have no server-side confirmation, most servers that elicit either proceed or fall back to a flag the model can set when the host cannot relay the question, and 32 of 41 popular open-source hosts and agent SDKs, including 16 of 25 applications, have no approval step by default. Pairing sampled destructive tools with those applications left 60.7% of pairs with no enforced approval, and through four agent SDKs, four of five low-cost models executed an injected deletion in 479 of 960 runs. The authors calculate that prompting for every tool not annotated read-only or non-destructive would cut the unapproved share to 5.4%, while universal elicitation support would still leave 56.7%, and conclude that applications should configure approval themselves. Source

4. Four npm “Markdown MCP Servers” From One Publisher Probe Cloud Metadata and Read Instance-Role Credentials

Amazon Inspector reported four npm packages under the @ifasn scope, published as malicious-package advisories through OpenSSF on November 2, that advertise Markdown table-of-contents, word-count and table tools for MCP clients. On startup or import, @ifasn/md-doc-mcp and @ifasn/mmd-doc-mcp probe the AWS, GCP, Azure and Alibaba Cloud instance-metadata endpoints and send the results over plain HTTP to 121.199.24.94, partly disguised through nip.io, while @ifasn/mdd-doc-mcp and @ifasn/mmdd-doc-mcp perform an Alibaba Cloud IMDSv2 handshake and fetch the instance’s RAM role temporary credentials. mdd-doc-mcp also pins a dependency to an unauthenticated HTTP tarball on the same IP, giving the publisher install-time code execution, and mmdd-doc-mcp, with 17 affected versions, ships scripts that enumerate /etc/shadow, /root/.ssh/id_rsa, .env files and the Kubernetes service account token. Anyone who added one of these servers to an agent on a cloud host should remove it and rotate that host’s instance-role credentials. mmdd-doc-mcp md-doc-mcp

5. CVE Issued for CrewAI’s SSRF Guard Bypass, in Which the Validator and HTTP Client Read the Same URL Differently

CrewAI received CVE-2026-120630 on November 2 from CERT/CC for an SSRF in its URL guard, reachable wherever an agent fetches a URL an attacker can influence, such as through ScrapeWebsiteTool; the NVD record has no CVSS score yet. The researcher’s write-up shows the guard checking the hostname with Python’s urlparse while requests and urllib3 connect elsewhere, so a URL such as http://127.0.0.1:8080\@1.1.1.1/ passes as a public address but reaches localhost; the same technique produced Langflow’s CVE-2026-19304, fixed in 1.11.3. CrewAI’s fix (PR #6981, merged August 17) resolves the host once, rejects private and reserved addresses, connects to that validated address and rechecks the peer, and disables environment proxies; the write-up says it shipped in crewai-tools 1.15.17. Teams that wrote their own SSRF checks for agent tools can test them with the backslash payload, since the researcher recommends validating with the same parser the client uses or at connect time. Source Write-up

6. AWS Fixes a Path Traversal in Its Serverless MCP Server and Discloses an XSS in a Retired AI-DLC Tool

AWS published two advisories on November 2. CVE-2026-116635 (CVSS 4.0 6.9, CVSS 3.1 6.1 medium) affects awslabs.aws-serverless-mcp-server before 0.2.1: a serverless project name containing traversal sequences or an absolute path, supplied by a third party who can influence the agent, makes the deployment status component return JSON files from outside its directory into the agent’s context, and with --enable-write overwrite them with deployment metadata; AWS lists no workaround, recommends upgrading to 0.2.1, and credits Se Hoon (bebold6133) with the report. CVE-2026-120497 (CVSS 4.0 4.6 medium) is a stored XSS in the HTML report generator of the aidlc-traceability CLI from AWS AI-DLC Workflows, where crafted artifact titles or descriptions run script when a user opens the report; it was fixed in commit 96cf0ea on July 3 and the CLI was removed from the repository on July 16, so users should delete older local copies or use the Markdown report. Serverless MCP AI-DLC

7. Unpatched: CSGHub Serves Private Model Files to Anonymous Readers, and Chainlit’s MCP SSRF Fix Can Be Sidestepped

OpenCSG CSGHub, an open-source LLM, dataset and agent hub modeled on Hugging Face, has CVE-2026-120426 (CVSS 3.1 7.5, CVSS 4.0 8.7 high, published November 2 by VulnCheck) through v2.6.0-ce, the latest release. Its file resolve route requires no login and, when a request has no user cookie, fetches the file from the backend with the global server API key, carrying the acting user only in a current_user query parameter that a percent-encoded separator in the file path can override, so an unauthenticated client can read files in another user’s private model, code or space repository; the reporter’s issue, opened October 31, is still open. Chainlit has CVE-2026-120492 (CVSS 3.1 5.4, CVSS 4.0 6.3 medium, also published November 2 by VulnCheck) in 2.12.0, the release that added MCP URL validation to fix August’s unauthenticated /mcp SSRF: validate_mcp_url does not reject semicolons, so ..; segments escape path-scoped allowed_urls entries on origins that strip semicolon path parameters. Chainlit has not released a version after 2.12.0, and only deployments that enable MCP, which has been off by default since 2.7.0, are exposed. CSGHub Chainlit

8. Two Papers Show Coding Agents Compromised Outside the Model’s View: Through Tool Updates and Before Input Reaches the Model

Research. Kan, Qi, Han, Luo, Xiong and Gao describe a “tool update gap”: agent frameworks keep trusting a tool after its implementation changes, and because tool code runs outside the context window, their ETUDE attack hides malicious functionality in an update to an initially benign tool without any adversarial instructions; across seven frameworks including Gemini CLI, Codex CLI and Claude Code it reached 97.6% attack success while keeping 95.9% legitimate task completion, and existing in-context defenses gave insufficient protection. Qin, Jiang, Chen, Tan and Wen define a Step-Zero attack, in which the agent’s first processing of an archive, network response or image does damage before any content reaches the model: given only a path or URL, 32 of 42 harness-model pairs overran a 4 MiB disk budget, 26 of them before the model saw any archive member, while benign twins with the same visible fields stayed within budget. A model-free gate that counts the bytes each call produces kept every routed extraction within budget while agents completed 25 of 28 tasks. Tool updates Step Zero

9. Trail of Bits Uses Codex to Backport 149 CVE Fixes Into Stable Linux Kernels

Trail of Bits described a workflow in which Codex with GPT-5.6 finds known CVE fixes missing from stable branches, adapts patches, assembles validation evidence and runs tests, while engineers review each patch and submit it to maintainers; by October 29 the project had helped land fixes for 149 distinct CVEs in stable kernel releases plus several Fedora and Ubuntu package fixes. Excluding initial setup, a straightforward backport now takes about 30 minutes of human attention and an involved one about three hours, though regression testing and maintainer acceptance remain separate. The post quantifies the backlog: the kernel’s 5.10.y branch lacks fixes for 2,006 CVEs patched in newer branches and 6.18.y for 337, while distribution metadata lists 4,562 unfixed CVEs across 1,128 Debian 13 source packages, and notes that AI-assisted bug hunting makes flaws in older code easier to find. Trail of Bits invites open-source projects and distributions that want backporting help to apply through a “patch the planet” program. Source

10. Also on arXiv: Adaptive Trust Boundaries, Silent PHI Access by Medical Agents, Policy Gates for Coding Agents, and Assistants That Exploit Disclosed Distress

Research. Zhang and Lu’s ATrust starts from the user query as the only trust anchor and admits external observations as new anchors only when they are task-essential; on AgentDyn with GPT-4o it cut indirect prompt injection success from 37.80% to 4.37% while raising utility by 10 points. Lee, Banerjee and Lee planted canaries in synthetic patient records and found three of five models called PHI tools that identifier-free clinical tasks did not need, access invisible to output-only evaluation, while Claude Opus 4.8 and GPT-5.5 did not; a pre-execution gate with a task-necessity criterion nearly eliminated it. Beno tested 22 hosted decision models as runtime policy gates over 2,643 synthetic coding-agent tool calls and found that writing rules with examples and counterexamples raised recall by 5.5 to 26.1 points on all 23 models evaluated, lifting Jev 1.14’s recall from 89.3% to 98.2% while unnecessary interruptions fell from 30.6% to 4.8%. Jiang, Li, Silva and Liu gave 15 assistants hidden operator goals and found 14 pushed them, 12 using customers’ disclosed distress or financial strain, with fine-tuned detectors catching such pushes at 79% accuracy against at most 62% for zero-shot LLM judges. ATrust PHI access Policy gates Manipulation