Notifications
Clear all
Topic starter
19/08/2026 3:54 pm
TL;DR: An AI agent autonomously found CVE-2026-0773, a 9.8 remote code execution flaw in cloudpickle-based AI infrastructure, by exploring APIs, sequencing operations, and generating context-aware payloads, according to Equixly. The case reinforces that serialized model files and internal ML APIs must be treated as executable code, not trusted data, because conventional scanners often miss binary deserialization paths.
NHIMG editorial — based on content published by Equixly: Can AI identify 0-days?
By the numbers:
- Equixly reports that CVE-2026-0773 is a critical remote code execution vulnerability with a CVSS score of 9.8.
- The article says that PyTorch’s CVE-2025-32434 remained exploitable even with weights_only=True, showing one “safe” mode still failed.
Questions worth separating out
Q: What breaks when ML systems deserialize untrusted model files?
A: Untrusted deserialization turns a data-loading step into code execution, because the loader may reconstruct attacker-controlled objects and run embedded logic.
Q: Why do AI pipelines expose more credential risk than traditional software development?
A: AI pipelines create more identities, more integrations, and more temporary execution paths than conventional software delivery.
Q: How do security teams know if model loading is operating outside its intended boundary?
A: Look for model artefacts that are writable by multiple systems, loaded from shared storage, or accepted through network-exposed APIs without signing or origin checks.
Practitioner guidance
- Inventory every deserialization path in ML systems Map where pickle, cloudpickle, torch.load, joblib, and similar loaders are used in training, inference, caching, and internal APIs.
- Remove executable artefacts from trust boundaries Prefer inert formats for model weights and simple config data, and stop accepting serialized Python objects where JSON, Protocol Buffers, or explicit reconstruction will work.
- Require signing and provenance checks for model artefacts Verify source, integrity, and approval before any model file, cache object, or dependency enters a pipeline.
What's in the full article
Equixly's full blog covers the implementation detail this post intentionally leaves for the source:
- The autonomous testing workflow used to map API surfaces and sequence operations before a payload was ever generated.
- The proof-of-concept reasoning behind identifying an unpickling sink from a binary error response.
- The specific attacker pathways involving poisoned caches, shared storage, and internal APIs that can lead to code execution.
- The defensive trade-offs between pickle, cloudpickle, safetensors, and explicit reconstruction in production ML systems.
👉 Read Equixly's analysis of the CVE-2026-0773 AI security finding →
Unsafe deserialization in ML systems: are your controls keeping up?
Explore further
19/08/2026 4:31 pm
AI model files have become a disguised identity and privilege boundary. The article shows that a serialized model can carry executable behaviour, not just data, which means the real control question is who and what is allowed to influence runtime code paths. In NHI terms, the service account loading the artefact is the privilege holder, but the file can still determine what that identity executes. Practitioners should treat model ingestion as a governed access decision, not a storage operation.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when a model file leads to code execution?
A: Accountability sits with the teams that approved the artefact format, the runtime that loaded it, and the owners of the service account that executed it. If the organisation treats model files as harmless data, the control failure is governance, not just development hygiene. That is where policy, provenance, and privilege scope must be enforced.
👉 Read our full editorial: AI agent testing exposes unsafe deserialization risks in ML systems
