Executive Summary
In mid-2025, a significant security vulnerability was discovered in three widely used open-source Python libraries—NeMo (by NVIDIA), Uni2TS (by Salesforce), and FlexTok (by Apple)—which are integral to various AI and ML platforms. These libraries, collectively downloaded over 10 million times via the HuggingFace platform, were found to execute arbitrary code embedded within model metadata, making them susceptible to remote code execution if exploited by attackers. The vulnerabilities were identified in April 2025 and resolved by July 2025, with corresponding CVEs assigned and severity scores ranging from 7.8 to 9.8 out of 10. As of December 2025, there have been no indications of these flaws being exploited in the wild. (techradar.com)
This incident underscores the critical importance of securing AI and ML infrastructure, especially as these technologies become increasingly integrated into business operations. The rapid adoption of AI tools without adequate security measures can expose organizations to significant risks, including data breaches and unauthorized access. It highlights the necessity for continuous monitoring, timely patching, and the implementation of robust security protocols to safeguard against emerging threats in the AI landscape.
Why This Matters Now
The rapid integration of AI and ML tools into business operations, coupled with the discovery of critical vulnerabilities in widely used libraries, underscores the urgent need for robust security measures to protect against potential exploits and data breaches.
Attack Path Analysis
An attacker exploited a machine learning platform's model deployment feature to achieve remote code execution, then escalated privileges to access internal services, moved laterally within the network, established command and control channels, exfiltrated sensitive data, and ultimately disrupted operations.
Kill Chain Progression
Initial Compromise
Description
The attacker exploited the ML platform's model deployment feature by uploading a malicious model, achieving remote code execution within the platform's infrastructure.
MITRE ATT&CK® Techniques
Valid Accounts
Exploitation for Client Execution
Command and Scripting Interpreter
Hijack Execution Flow
Network Service Discovery
Remote Services
Impair Defenses
Application Layer Protocol
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Separation of Duties
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Network Segmentation
Control ID: 3.1
NIS2 Directive – Security Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI/ML platform exploitation enables remote code execution through malicious model deployment, compromising software development infrastructure and creating unauthorized access to internal networks.
Information Technology/IT
MLOps platforms with weak segmentation allow attackers to establish C2 infrastructure from trial accounts, bypassing traditional security controls and accessing sensitive IT resources.
Financial Services
AI platform vulnerabilities threaten fraud detection systems and recommendation engines, with potential for data exfiltration from internal databases violating HIPAA and PCI compliance requirements.
Computer/Network Security
Security providers using AI platforms face elevated risks as attackers exploit model execution capabilities to bypass detection systems and establish persistent network access.
Sources
- Beyond Prompt Injection: The Hidden AI Security Threats in Machine Learning Platformshttps://www.praetorian.com/blog/hidden-ai-security-threats-in-machine-learning-platforms/Verified
- MITRE ATLAS OpenClaw Investigationhttps://www.mitre.org/sites/default/files/2026-02/PR-26-00176-1-MITRE-ATLAS-OpenClaw-Investigation.pdfVerified
- SAFE-AI Reporthttps://atlas.mitre.org/pdf-files/SAFEAI_Full_Report.pdfVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to exploit the ML platform, limiting lateral movement and data exfiltration.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to execute unauthorized code within the ML platform's infrastructure would likely be constrained, reducing the risk of initial compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges and access internal services would likely be constrained, reducing the scope of unauthorized access.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, reducing the risk of further internal compromise.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels would likely be constrained, reducing the risk of persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data to external locations would likely be constrained, reducing the risk of data loss.
The attacker's ability to disrupt operations and compromise system integrity would likely be constrained, reducing the overall impact of the attack.
Impact at a Glance
Affected Business Functions
- AI Model Deployment
- Cloud Infrastructure Management
- Internal Network Security
Estimated downtime: 3 days
Estimated loss: $50,000
Potential access to internal services, databases, and resources due to weak network segmentation.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and prevent unauthorized lateral movement.
- • Enhance East-West Traffic Security to monitor and control internal communications, reducing the risk of privilege escalation.
- • Deploy Egress Security & Policy Enforcement to restrict unauthorized outbound traffic and prevent data exfiltration.
- • Utilize Multicloud Visibility & Control to gain comprehensive insights into network traffic and detect anomalous behaviors.
- • Establish a Threat Detection & Anomaly Response program to proactively identify and respond to potential threats within the ML platform.
