hunt-llm-ai
Crown Jewel Targets
LLM and Agentic AI is the fastest-growing paying surface in 2024-2026. Every SaaS shipping an "AI feature" is a candidate; most ship with the LLM06:2025 Excessive Agency / LLM05:2025 Improper Output Handling / LLM01:2025 Prompt Injection problems unsolved by design. The 24-month meta has crystallized around six asset types. All CVEs below are NVD-verified.
1. Agentic AI tool-use with code execution (CVSS 9.8 territory). CVE-2025-68613 LangChain langchain-experimental — PythonREPLTool / PandasDataFrameAgent / VectorSQLDatabaseChain exec attacker-controlled Python in host process. Indirect prompt injection via CSV cells, RAG documents, tool-output content. NVD-verified CVSS 9.8 critical. Fixed in 0.0.50 per penligent.ai forensic analysis. CVE-2024-46946 LangChain LLMSymbolicMathChain — sympy.sympify (which calls eval()) on prompt-derived input, NVD-verified CVSS 9.8. CVE-2025-46059 LangChain GmailToolkit v0.3.51 — indirect prompt injection in Gmail toolkit content → arbitrary code execution, NVD-verified CVSS 9.8 (vendor disputes; CVE published anyway). The pattern: any agent with PythonREPLTool / code_interpreter / shell tool / MCP server with code-exec capability is one prompt away from RCE.
2. Indirect prompt injection via untrusted content channels (low to mid five-figure on enterprise SaaS). Every channel an agent reads from is an attack surface. Microsoft 365 Copilot ASCII Smuggling — Johann Rehberger January 2024 → August 2024 disclosure (https://embracethered.com), patched July 2024. Multi-step chain: prompt injection via shared document → automatic tool invocation to search emails for sensitive data → ASCII smuggling via invisible Unicode tag characters → user clicks hyperlink → exfil. Initially classified low-severity; Rehberger demonstrated MFA-code exfil to escalate to high. Shortwave email AI assistant (Florian Port / ERNW Insinuator, Jul-Sep 2025 disclosure) — prompt injection concealed in HTML emails interpreted by model without user interaction, plus memory-persistence injection via read_webpage tool to achieve persistent C2 across conversations. TheNextWeb Apr 2026 article: Anthropic / Google / Microsoft AI agent bug bounties paid for prompt injection but no CVE assigned — Google Gemini calendar invite injection (Miggo Security Jan 2026), Microsoft Copilot "Reprompt" attack hijacking entire user sessions, Anthropic Git MCP server (3 CVEs for repository-injected backdoors), every coding agent (Claude Code, GitHub Copilot, Cursor) confirmed vulnerable per Jan 2026 78-study analysis. The systemic problem: vendors pay but don't publish advisories because LLMs "can't reliably separate data from instructions" — making it a class, not a discrete bug.
3. Model server / inference platform RCE (high four-figure to low five-figure direct + downstream). Ollama RCE family — CVE-2024-37032 (Ollama <0.1.34, digest validation path traversal → RCE, CVSS 8.8 HIGH, NVD-verified), CVE-2024-45436 (Ollama <0.1.47, ZIP archive directory traversal via extractFromZipFile in model.go, CVSS 7.5/9.1, NVD-verified — supersedes rejected CVE-2024-7773 ZipSlip duplicate), CVE-2024-39722 (Ollama <0.1.46, path traversal in /api/push exposes server filesystem, CVSS 7.5, NVD-verified), CVE-2025-44779 (Ollama 0.1.33, arbitrary file deletion via crafted packet to /api/pull). BentoML pickle family — CVE-2025-27520 (deserialize_value on /summarize, CVSS 9.8 critical), CVE-2025-32375 (runner-server Payload-Container/Payload-Meta headers), CVE-2024-2912 (earlier pickle, Toreon disclosure). MLflow path traversal family — CVE-2024-1483 (≤2.9.2), CVE-2024-1594 (<2.11.3), CVE-2024-1560 (≤2.12.0), all Huntr-disclosed via artifact_location #-fragment URI. Hunt every model-inference endpoint, every model registry, every "experiment" / "artifact" management endpoint.
4. Open WebUI / chat-UI platforms with output-handling vulns (mid four-figure to low five-figure). CVE-2025-64496 Open WebUI v0.6.33 (GHSA-cm35-v4vp-5xvx) — Direct Connections feature lets external model server return SSE execute events that frontend evaluates via new Function() — JWT token theft → ATO → Functions API RCE on backend. Pattern repeats across chatbot platforms that render LLM output as HTML or trust model-server callbacks. Open WebUI, AnythingLLM, LibreChat, custom RAG dashboards all in scope.
5. Vector DB / RAG cross-tenant retrieval (LLM08:2025 Vector and Embedding Weaknesses; mid four-figure to low five-figure). Embedding indexes shared across tenants without per-tenant filtering — vector search for "show me documents about onboarding" returns content from any tenant whose docs embed similarly. GHSA-2f4c-vrjq-rcgv Tencent WeKnora — DB query tool tenant-isolation list missing embeddings, messages, models tables → cross-tenant API key / message / embedding leak. GHSA-gc8m-w37w-24hw FastGPT — appId cross-tenant inference execution. GHSA-3xx2-mqjm-hg9x Paperclip (CVSS 10.0) — agent API key cross-tenant minting. Hunt every "RAG", "knowledge base", "AI assistant" feature on multi-tenant SaaS.
6. AI-powered dev tools and coding agents (mid four-figure to mid five-figure on vendor programs). GitHub Copilot Chat, Anthropic Claude Code, Cursor, Devin, OpenAI Operator, Google Jules, Amazon Q, Anthropic Computer Use — all confirmed vulnerable to prompt injection per Jan 2026 systematic analysis (78 studies). Indirect injection via repo files, GitHub issues, code comments, README content. Anthropic's Git MCP server itself had 3 CVEs for repo-injected backdoors. GitHub Copilot source-code exfiltration via prompt injection — H1 report 2383092 (2024). Hunt: every agent that reads from a repo / issue / PR / comment / web page / email is a candidate.