AI Security News

Cyera discovered an unauthenticated out-of-bounds heap read in Ollama, a platform for running and managing LLMs locally. A specially crafted GGUF file with falsified tensor sizes causes Ollama to read data beyond the bounds of a buffer, after which the leaked data is written into the resulting model file. This file can then be sent to an attacker-controlled server via /api/push, potentially exposing user and system prompts, environment variables, and other data from the Ollama process. The vulnerability is tracked as CVE-2026-7482.

PuzzleMask — hiding a prompt in ordinary text Check Point Research presented a technique for hiding an arbitrary prompt inside ordinary English prose so that a fast LLM gatekeeper considers it safe, while a more powerful model with reasoning capabilities and a code interpreter can reconstruct the hidden instruction. In the experiments, all tested gatekeeper models allowed the prepared PuzzleMask prompts through, while gpt-5-thinking-high reconstructed and executed the payload in 17 out of 18 tests; PuzzleMask itself is a technique for bypassing an external gatekeeper, not a jailbreak of the target model.

CVE-2025-68664 — Serialization Injection in LangChain CVE-2025-68664 affects LangChain, a framework for developing LLM-powered applications and agents. The vulnerability arose because LangChain did not escape the special lc key when serializing user-controlled dictionaries, while the deserializer later interpreted that key as an internal LangChain construct. As a result, attacker-controlled data could alter the deserialization logic and potentially lead to environment-variable disclosure, SSRF, and, in some scenarios, RCE. The patch added escaping and restrictions on permitted objects. The vulnerability was fixed in langchain-core 0.3.81 and 1.2.5.

CVE-2026-82533 — escaping the DeepSeek Harness sandbox CVE-2026-82533 affected the local API in DeepSeek Harness: the harness trusted the client-controlled HTTP Host header, while the sandbox allowed access to the loopback interface. As a result, an agent could call the local API itself, switch its own session to danger-full-access, and disable approval prompts. If the API port was exposed to the network, an unauthenticated remote attacker could also take control of the agent and download stored conversations. The issue was fixed in DeepSeek Harness 0.1.2-alpha.1

Beltdown — escaping the Claude Code sandbox Accomplish researchers found a chain in which Claude Code executed one of its internal Git commands outside the macOS Seatbelt sandbox without neutralizing the dangerous core.fsmonitor setting. A poisoned .git/config could therefore cause that Git process to execute attacker-controlled code outside the sandbox with the user's privileges and without a permission prompt. Exploitation involved a nested .git directory, changing the working directory, and automatic skill loading that triggered an unhardened git ls-files. Anthropic fully closed the chain in Claude Code 2.1.247.

Beltdown2 — escaping the Cursor CLI sandbox Beltdown2 uses the same basic principle as the earlier Beltdown in Claude Code, but applies it to Cursor CLI. On macOS, shell commands were confined by the Seatbelt sandbox, while Cursor's own internal Git commands ran outside it. Because those commands honored core.fsmonitor from .git/config, a specially crafted project could cause Cursor to silently execute attacker-controlled code outside the sandbox with the user's privileges. The issue was fixed in Cursor CLI 2026.08.04-aaa8809.

Overpatch and Heapjack — two ways to escape the OpenAI Codex sandbox Accomplish researchers found two ways to bypass OpenAI Codex's sandbox: • Overpatch allowed apply_patch to expand its permitted write scope and modify files outside the workspace. The issue was fixed in Codex CLI 0.149.0.; • Heapjack allowed untrusted JavaScript to recover a trusted-context token from the shared V8 heap and use it to send privileged requests to an unsandboxed native process, ultimately achieving command execution outside the sandbox even in read-only mode. The issue was fixed in Codex Desktop 26.818.21641.

Article (Bleeding Llama): https://www.cyera.com/research/bleeding-llama-critical-unauthenticated-memory-leak-in-ollama

Article (Puzzle Mask): https://research.checkpoint.com/2026/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector/

Article (LangChain): https://nefariousplan.com/posts/langchain-dumps-forwarded-lc-loads-trusted-it

Article (DeepSeek Harness): https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape

Article (Beltdown): https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/

Article (Beltdown 2): https://www.accomplish.ai/blog/beltdown2-escaping-the-cursor-cli-sandbox/

Article (Overpatch and Heapjack): https://www.accomplish.ai/blog/escaping-the-openai-codex-sandbox-twice/