Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Remote code execution (RCE)

Also called: remote code execution · command execution

Remote code execution (RCE) is a flaw that lets an attacker run their own code or commands on a machine they do not control. In AI products it often comes from agents that run shell commands, plugins that execute on install, or model output that is evaluated as code.

How it works

In agentic tools the path is frequently: untrusted content reaches the model, the model emits a command or file, and the tool runs it without a strong enough check. Classic bugs also apply: unsafe deserialisation of model files, template injection and command injection in AI frameworks and servers.

How to defend

Run agents and model-serving code in sandboxes with no standing credentials, require approval for commands, avoid loading untrusted model formats that execute code, and patch AI frameworks as quickly as any other server software.

Real cases 5 stories

  1. HIGH

    Incident · Black Lotus Labs

    PoeLLM: a cryptomining botnet feeds on exposed LiteLLM servers

    PoeLLM is a cryptomining botnet that breaks into internet-facing AI services, which Black Lotus Labs says has reached more than 3,400 servers since April 2026. Infected hosts read their next command server from a poem hosted on GitHub.

  2. HIGH

    Vulnerability · JFrog · CVE-2026-105192 · CVSS 9.8

    LMCache: unauthenticated remote code execution, no fix available

    CVE-2026-105192 lets anyone who can reach LMCache's multiprocess transport port run code as the LMCache user, with no credentials and no fixed release. Official container images run that process as root.

  3. CRIT

    Incident · CISA · CVE-2026-102489

    CISA: Zammad flaws exploited after agentic AI breached DIVD

    CISA added two Zammad helpdesk flaws, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities catalog on October 2, 2026, after DIVD said an agentic AI attack chained them to breach its network.

  4. HIGH

    Vulnerability · GitLab · CVE-2026-90970 · CVSS 9.9

    GitLab AI Gateway: a flow config escapes the prompt template sandbox

    CVE-2026-90970 lets an authenticated GitLab user with Duo Agent Platform access break out of the AI Gateway prompt template sandbox and run commands on the gateway. GitLab rates it 9.9 and fixed it in 19.2.4, 19.3.2 and 19.4.1.

  5. HIGH

    Vulnerability · AIR Security

    Plugin4Shell: zero-click plugin RCE in four AI coding agents

    Plugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.