Week of 2026-11-01 – 2026-11-08 · Generated 2026-11-08

AI Security Threats Rise: Top 5 Vulnerabilities from Last Week

AI security vulnerabilities continue to pose a threat to developers and organizations. This week, several critical issues were identified in popular AI tools and frameworks, including ESEngine DeepSeek-Reasonix, OpenBMB Internet of Agents, and Trainer v2. These vulnerabilities can be exploited remotely, leading to permission issues, authentication bypass, and sensitive information exposure.

• CVE-2026-123989

  A vulnerability in ESEngine DeepSeek-Reasonix allows remote attackers to perform a manipulation that results in permission issues.

  Action: Upgrade to version 1.34.0, which includes a patch (a54659c2c5b0f4e57aae2b44d41f421c6a71e8cf)

• CVE-2026-123964

  A vulnerability in OpenBMB Internet of Agents allows attackers to manipulate the maxturns argument, resulting in an infinite loop.

  Action: Exercise caution and consider updating the affected component

• CVE-2026-123963

  A vulnerability in OpenBMB Internet of Agents allows attackers to bypass authentication through manipulation of the 'desc/name' argument.

  Action: Beware of the publicly disclosed vulnerability and consider patching or updating to a fixed version

• CVE-2026-123881

  A vulnerability in OpenBMB Internet of Agents allows attackers to manipulate the commid argument, resulting in improper access controls.

  Action: Consider patching or updating to a fixed version to mitigate potential security risks

• CVE-2026-83495

  A vulnerability in the Trainer v2 TrainJob API allows attackers to inject the 'valueFrom.secretKeyRef' into environment variable definitions, leading to a privilege escalation.

  Action: Update the TrainJob API to prevent unauthorized access to sensitive information

Outlook: Next week, we will be monitoring the development of AI-security-audit-skills and Pentest-AI, and will provide updates on their adoption and impact on AI agent security.