Layer / Architectural Category
Key Technologies & Frameworks
Primary Vulnerability Vectors
2026
AI Orchestration & Agent Frameworks
Flowise, Langflow, LangChain, Dify, LlamaIndex, AutoGen, CrewAI, Semantic Kernel, Letta, MCP, Pydantic-AI
Arbitrary Code Execution (RCE) & Command Injection via untrusted workflow serialization, insecure Python tool calling, and Server-Side Template Injection (SSTI).
782
AI Web Apps & Portals
Open-WebUI, AnythingLLM, FastGPT, LibreChat, RAGFlow, Gradio, Streamlit, LobeChat, Chainlit, GPT4All
Server-Side Request Forgery (SSRF) via chat proxying, Stored XSS in markdown rendering, and local file inclusion (LFI) via document upload handlers.
230
Inference & Serving Infrastructure
vLLM, Ollama, LiteLLM, Llama.cpp, Triton (NVIDIA), Ray, TGI, SGLang, TensorRT-LLM, BentoML, LocalAI
Unauthenticated Administrative APIs, model checkpoint deserialization, memory corruption in tensor backends, and multi-tenant resource exhaustion.
212
Model Security Advisories
Foundation Model Weights, System Prompts, Guardrails, Evaluators (Garak, Lakera, Promptfoo)
Direct & Indirect Prompt Injection, system prompt exfiltration, guardrail bypasses, training data poisoning, and excessive agent autonomy.
106
ML Frameworks & Hubs
PyTorch, Hugging Face (Hub/Datasets), Transformers, ONNX Runtime, TensorFlow, Diffusers, DeepSpeed, Safetensors, Keras
Memory safety violations (heap overflows, out-of-bounds reads in C++ tensor operators) and arbitrary file overwrites via malicious model/dataset archive extraction.
99
Frontier Models
Anthropic, Gemini, OpenAI
Arbitrary Code Execution (RCE) and Command Injection via unvalidated CLI shell interpolation and implicit execution of untrusted workspace configs, Sandbox Escape via Git worktree directory confusion and memory tool symlink traversal; and Covert Data Exfiltration via indirect prompt injection-induced Markdown image rendering and permissive network fetch allowlists.
97
MLOps & Experiment Tracking
MLflow, ClearML, Weights & Biases (W&B), Kubeflow, Langfuse, Langsmith, Arize, Phoenix, Helicone
Arbitrary File Overwrites (LFI/RFI), unauthenticated remote tracking server takeovers, and artifact deletion in shared experiment registries.
39
Vector Databases & Search
Milvus, Qdrant, ChromaDB, Weaviate, Pinecone, FAISS, LanceDB, PGVector, Marqo, Vespa
Unauthenticated collection manipulation, Remote Code Execution via clustering/indexing plugins, and metadata SQL/JSON query injection.
19
