/hunt-llm-ai

name: hunt-llm-ai
description: Hunting skill for LLM and Agentic AI vulnerabilities — direct + indirect prompt injection, ASCII smuggling data exfil, agentic tool-use abuse, system prompt leakage, vector DB cross-tenant, model server RCE, insecure output handling. Built from public bug bounty reports across HackerOne, Huntr, Project Zero, GitHub Security Advisories, plus 2024-2026 meta verified against NVD — Microsoft 365 Copilot ASCII Smuggling (Johann Rehberger Aug 2024 disclosure), CVE-2025-46059 LangChain GmailToolkit indirect prompt injection (CVSS 9.8), CVE-2025-68613 LangChain PythonREPLTool semantic RCE (CVSS 9.8), CVE-2024-46946 LangChain LLMSymbolicMathChain sympy.sympify, CVE-2025-27520 + CVE-2025-32375 + CVE-2024-2912 BentoML pickle, Ollama RCE family (CVE-2024-37032, CVE-2024-39722, CVE-2024-45436, CVE-2025-44779), CVE-2025-64496 Open WebUI Direct Connections SSE code injection (GHSA-cm35-v4vp-5xvx), CVE-2024-1483/1560/1594 MLflow path traversal. Covers OWASP LLM Top 10 v2025 (LLM01-LLM10) and OWASP Agentic AI Top 10 (AA-01 through AA-10). Use when hunting prompt injection, jailbreaks, agentic tool abuse, RAG poisoning, vector DB IDOR, MCP server compromise, model registry RCE, or any "AI feature" surface in a target.
sources: hackerone_public, github_advisories, github_deep, huntr, project_zero, microsoft_msrc, intigriti, embracethered_blog, securitylab_github, nvd_verified, owasp_genai
report_count: 800
generated_at: 2026-05-04

Crown Jewel Targets

LLM and Agentic AI is the fastest-growing paying surface in 2024-2026. Every SaaS shipping an "AI feature" is a candidate; most ship with the LLM06:2025 Excessive Agency / LLM05:2025 Improper Output Handling / LLM01:2025 Prompt Injection problems unsolved by design. The 24-month meta has crystallized around six asset types. All CVEs below are NVD-verified.

**1. Agentic AI tool-use with code execution (CVSS 9.8 territory).** **CVE-2025-68613 LangChain langchain-experimental** — `PythonREPLTool` / `PandasDataFrameAgent` / `VectorSQLDatabaseChain` exec attacker-controlled Python in host process. Indirect prompt injection via CSV cells, RAG documents, tool-output content. NVD-verified CVSS 9.8 critical. Fixed in 0.0.50 per penligent.ai forensic analysis. **CVE-2024-46946 LangChain LLMSymbolicMathChain** — `sympy.sympify` (which calls `eval()`) on prompt-derived input, NVD-verified CVSS 9.8. **CVE-2025-46059 LangChain GmailToolkit v0.3.51** — indirect prompt injection in Gmail toolkit content → arbitrary code execution, NVD-verified CVSS 9.8 (vendor disputes; CVE published anyway). The pattern: any agent with `PythonREPLTool` / `code_interpreter` / shell tool / MCP server with code-exec capability is one prompt away from RCE.

**2. Indirect prompt injection via untrusted content channels (low to mid five-figure on enterprise SaaS).** Every channel an agent reads from is an attack surface. **Microsoft 365 Copilot ASCII Smuggling** — Johann Rehberger January 2024 → August 2024 disclosure (https://embracethered.com), patched July 2024. Multi-step chain: prompt injection via shared document → automatic tool invocation to search emails for sensitive data → ASCII smuggling via invisible Unicode tag characters → user clicks hyperlink → exfil. Initially classified low-severity; Rehberger demonstrated MFA-code exfil to escalate to high. **Shortwave email AI assistant (Florian Port / ERNW Insinuator, Jul-Sep 2025 disclosure)** — prompt injection concealed in HTML emails interpreted by model without user interaction, plus memory-persistence injection via `read_webpage` tool to achieve persistent C2 across conversations. **TheNextWeb Apr 2026 article**: Anthropic / Google / Microsoft AI agent bug bounties paid for prompt injection but *no CVE assigned* — Google Gemini calendar invite injection (Miggo Security Jan 2026), Microsoft Copilot "Reprompt" attack hijacking entire user sessions, Anthropic Git MCP server (3 CVEs for repository-injected backdoors), every coding agent (Claude Code, GitHub Copilot, Cursor) confirmed vulnerable per Jan 2026 78-study analysis. The systemic problem: vendors pay but don't publish advisories because LLMs "can't reliably separate data from instructions" — making it a *class*, not a discrete bug.

**3. Model server / inference platform RCE (high four-figure to low five-figure direct + downstream).** **Ollama RCE family** — **CVE-2024-37032** (Ollama <0.1.34, digest validation path traversal → RCE, CVSS 8.8 HIGH, NVD-verified), **CVE-2024-45436** (Ollama <0.1.47, ZIP archive directory traversal via `extractFromZipFile` in model.go, CVSS 7.5/9.1, NVD-verified — supersedes rejected CVE-2024-7773 ZipSlip duplicate), **CVE-2024-39722** (Ollama <0.1.46, path traversal in `/api/push` exposes server filesystem, CVSS 7.5, NVD-verified), **CVE-2025-44779** (Ollama 0.1.33, arbitrary file deletion via crafted packet to `/api/pull`). **BentoML pickle family** — **CVE-2025-27520** (`deserialize_value` on `/summarize`, CVSS 9.8 critical), **CVE-2025-32375** (runner-server `Payload-Container`/`Payload-Meta` headers), **CVE-2024-2912** (earlier pickle, Toreon disclosure). **MLflow path traversal family** — **CVE-2024-1483** (≤2.9.2), **CVE-2024-1594** (<2.11.3), **CVE-2024-1560** (≤2.12.0), all Huntr-disclosed via `artifact_location` `#`-fragment URI. Hunt every model-inference endpoint, every model registry, every "experiment" / "artifact" management endpoint.

**4. Open WebUI / chat-UI platforms with output-handling vulns (mid four-figure to low five-figure).** **CVE-2025-64496 Open WebUI v0.6.33 (GHSA-cm35-v4vp-5xvx)** — Direct Connections feature lets external model server return SSE `execute` events that frontend evaluates via `new Function()` — JWT token theft → ATO → Functions API RCE on backend. Pattern repeats across chatbot platforms that render LLM output as HTML or trust model-server callbacks. Open WebUI, AnythingLLM, LibreChat, custom RAG dashboards all in scope.

**5. Vector DB / RAG cross-tenant retriev