Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks

Critical remote code execution vulnerabilities have been discovered in major AI inference engines from Meta, Nvidia, Microsoft, and open-source projects like vLLM and SGLang. The flaws stem from unsafe deserialization of Python's pickle module over ZeroMQ sockets, a pattern called ShadowMQ that spread through code reuse across projects. Attackers could exploit these vulnerabilities to execute arbitrary code, steal models, or deploy malware on AI infrastructure clusters. Most vendors have patched the issues, though some remain unresolved. Separately, researchers found JavaScript injection vulnerabilities in Cursor IDE that could compromise developer workstations through malicious MCP servers or extensions.