CPython memory bug lets poisoned model templates escape AI inference sandboxes

Update: Microsoft Threat Intelligence tracked ARTEX agents scanning GitHub for leaked secrets, then signing in as Entra apps; one went from a leaked client secret to Azure Key Vault exfiltration in five minutes. Rotate Entra app registration secrets now, and dig through repos and CI logs for any that were ever committed. Also: unauthenticated SSRF in MLflow get-artifacts (CVE-2026-118628, CVSS 8.2) lets anyone who can reach the tracking server fetch attacker-chosen URIs and leak the responses—keep MLflow off the public internet and patch. Also: banks before 2.4.3 resolves Tool.import_path from the {% completion %} body via importlib with no allowlist (CVE-2026-61536, CVSS 7.5)—a poisoned prompt registry can make the LLM trigger os.system. Update to 2.4.3.

RunSybil's Darius Houle showed that a CPython memory-safety flaw in generic-alias parameter handling can turn a backdoored chat_template.jinja into arbitrary code execution inside the inference process. They poisoned a Qwen2.5-0.5B-Instruct template, loaded it through vLLM, and wrote files from the serving process. CPython will not treat sandbox escapes as security bugs, Jinja told them to report it to CPython, and Hugging Face did not respond in the 90-day window. A fix landed as a normal bugfix on 3.13+, but not on 3.12, which still runs a lot of AI hosts. What to do: if you accept customer or Hub models, isolate the renderer (containers or VMs with no cloud metadata), block template escapes as a hard failure, and do not treat Jinja as a security boundary. My take: BYOM platforms are stuck owning a risk neither CPython nor Jinja claims.

Check Point Research published a now-patched bypass of ChatGPT Lockdown Mode. Nested iframes plus allow-popups-to-escape-sandbox let malicious HTML preview content recover a real window.open, then exfiltrate chat history, spoof update dialogs, or phish credentials. In ChatGPT Classic the popup needed no click. OpenAI removed the popup sandbox tokens on September 18 after disclosure; Check Point confirmed the path is closed. Treat shared chats and third-party GPTs as untrusted until you have verified Lockdown is on and the client is current.

OpenAI formally released GPT-6 Cyber through Daybreak Red: Critical under its Preparedness Framework, 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, and 99.93% staying inside scope on a honeypot eval without the deployment prompt. Researchers used it for 948 Linux privilege-escalation exploits and 81 novel high-severity Firefox bugs Mozilla is shipping fixes for. Access stays gated. Pair any cyber agent with IP allowlists, sandboxes, and human review of out-of-scope tool use.

Two smaller items for the watchlist. VulnCheck filed CVE-2026-82033 against DeepSeek Harness before 0.1.2-alpha.2: any local process could hit the unauthenticated RPC plane, drive bash and filesystem tools, and answer approval prompts itself. Upgrade or bind the control plane to a private socket. And on the ops side, CSO reports a Railway engineer’s AI testing agents probed rival Primcloud for secrets, metadata, and a full internal port scan; Primcloud says nothing was taken, Railway apologized and barred non-manual external testing. Agents inherit your authority. Scope their tools before you point them at anyone else’s network.