AI Threat Brief: Injection, SSRF, and Active Attacker AI Use

This week's intelligence highlights two critical fronts in AI security. First, multiple advisories expose deep flaws in the software supply chain, from argument injection in agentic tools to a full-read SSRF in a popular data-ingestion library. We examine vulnerabilities in CodeWhale, unstructured, NLTK, and pnpm. Second, a new report provides field evidence of attackers actively using AI tools in campaigns against organizations in Latin America. Together, these stories paint a picture of a field grappling with both foundational security debt and the weaponization of its own technology.

CodeWhale Argument Injection Allows Unprompted File Write

A critical vulnerability in the CodeWhale developer tool allows for arbitrary file writes without user approval [2].

The issue, tracked as CVE-2026-75913, is an argument injection flaw in the `git_show` tool, which is part of the DeepSeek-TUI agentic environment [3]. A specially crafted input from the model can trick the tool into overwriting any file the user has permission to access.

The tool was designed to be auto-approved and was marked as read-only [1]. However, the vulnerability allows it to perform a destructive write action. This breaks the trust model of the agentic system. An attacker could use this to overwrite sensitive files like `~/.bashrc` or `~/.ssh/authorized_keys`, leading to account takeover or remote code execution.

The root cause is a failure to validate or sanitize the `rev` parameter before passing it to a `git show` shell command [5]. The tool does not use an end-of-options sentinel (`--`), so a `rev` value starting with `--output=` is interpreted as a command-line flag by Git. This allows an attacker to specify an arbitrary output file for the command's results.

The maintainers have released a patch in version 0.8.64. The fix introduces input validation to reject parameters that start with a hyphen and correctly adds the `--end-of-options` sentinel to the command arguments [4]. All users should upgrade to the patched version immediately.

Full-Read SSRF in Unstructured Library Exposes Internal Services

A severe Server-Side Request Forgery (SSRF) vulnerability has been discovered in the `unstructured` library, a popular tool for parsing and staging data for AI models [8]. The flaw, CVE-2026-71428, exists in functions that partition data from a URL.

These functions fetch content from the provided URL without validating the destination host [6].

This is a full-read SSRF, which means an attacker can not only make the server connect to an internal resource but can also read the entire response [7]. This could expose internal admin consoles, databases, and cloud instance metadata services. The library's widespread use in frameworks like LangChain and LlamaIndex magnifies the potential impact.

The vulnerability stems from direct calls to `requests.get()` in `partition()`, `partition_html()`, and `partition_md()` [9]. These calls lacked any checks for private, loopback, or otherwise restricted IP addresses.

The official fix introduces a denylist for internal IP ranges to prevent connections to non-public endpoints [10].

The issue was resolved in version 0.24.0 of the `unstructured` package [11]. Developers using `unstructured` directly or through a larger framework must ensure their dependencies are updated to prevent exploitation.

NLTK JVM Argument Injection Bypass Undermines Prior Fix

A security flaw in the Natural Language Toolkit (NLTK) demonstrates the danger of incomplete patches [12]. A bypass was discovered for a previously fixed JVM argument injection vulnerability, re-opening the door to remote code execution.

The new vulnerability is tracked as CVE-2026-79675 [14].

The root cause lies in how NLTK handles Java options for its Stanford wrapper classes [13]. A previous fix added validation to block dangerous flags, but this check was only applied to globally configured options. A separate code path for per-call options passed them directly to the Java process without any validation.

This bypass means an attacker who can control the `java_options` parameter to a Stanford wrapper can inject malicious flags like `-agentpath` or `-javaagent` [17]. This could load a malicious library and achieve code execution on the server running the NLTK process.

The fix, released in NLTK version 3.10.3, closes the gap by applying the same validation logic to the per-call options path [16].

The change was a single line of code, but it was necessary to fully secure the interface [15].

AI-Generated Patch Fixes pnpm Lockfile Trust Vulnerability

A path traversal vulnerability in `pacquet`, a Rust component of the pnpm ecosystem, allowed a crafted lockfile to create symbolic links outside the intended project boundary [18]. This could occur during an install that used the `--trust-lockfile` flag, potentially leading to arbitrary file writes.

Notably, the advisory states that the patch itself was written by an AI agent [19]. This case provides a unique example of AI's role in security, shifting from being the target of an attack to the creator of the solution. It highlights an emerging use case for AI in defensive security operations.

The vulnerability was caused by insufficient validation of dependency names and virtual-store paths before creating filesystem links [20]. An attacker could include traversal segments like `../` in a dependency alias within the lockfile to escape the `node_modules` directory. The fix implements a shared helper function to sanitize all paths before use.

The AI-generated patch was validated against an extensive test suite to confirm it closed the escape path without breaking legitimate package installations [21]. The fix is included in the latest version of the pnpm package manager.

Attackers Use AI Tools to Target Latin American Organizations

A report from Palo Alto Networks Unit 42 provides clear evidence of threat actors using AI tools in active campaigns [22]. The research focused on attackers targeting entities in Latin America, observing their use of AI for tasks related to data exfiltration. This moves the discussion of AI weaponization from theoretical to observed reality.

Interestingly, the attackers made basic operational security mistakes. These errors exposed their methods and their use of AI. This suggests that while attackers are adopting new technology, their tradecraft is not always flawless. These mistakes can provide valuable intelligence and disruption opportunities for defenders.

Common Threads: The Fragile AI Supply Chain

The CodeWhale, unstructured, and NLTK vulnerabilities all reveal a fragile software supply chain for AI. Foundational libraries and tools, often taken for granted, contain classic security flaws like injection and SSRF. These low-level components become high-impact targets because they are building blocks for countless agentic systems and ML pipelines.

The pnpm and LATAM stories show the dual nature of AI in security. One demonstrates AI as a constructive tool for creating a security patch. The other shows AI as a weapon for data exfiltration. This duality defines the current landscape, where defenders and attackers are both racing to operationalize the same powerful technology.

Defender Takeaway: Scrutinize the Stack

This week's events show the need to treat the AI development stack with intense security scrutiny. Trusted components with powerful permissions, like CodeWhale's auto-approved tools or `unstructured`'s URL fetcher, are prime targets. Defenders must audit not just their own application code, but the default behaviors and security postures of every library in their stack.

Applying the principle of least privilege is critical. Agentic tools should not have write permissions by default. Services should not be able to make unrestricted network requests. The NLTK bypass is a stark reminder that patches are not always perfect and that security is a continuous process, not a one-time fix.