This Week in AI Security:
The Agentic Attack Surface Is Getting Wider, Fast

Six Incidents. One Pattern: Developer Tools Are Now the Attack Surface.

A CVSS 10 remote code execution flaw in Gemini CLI. A LiteLLM vulnerability being actively exploited in the wild. Cursor IDE exposing arbitrary code execution through model context manipulation. VS Code Copilot confirming co-author prompt injection. Claude Mythos unsettling Japan's financial sector. And a finetuning study demonstrating that safety training can be undone through copyright data recall.

The pattern this week is unmistakable: developer tooling has become the primary entry point for AI security incidents. The tools your engineers use daily — AI-powered IDEs, CLI code assistants, LLM API frameworks — are now the front line of a new attack surface. These aren't theoretical research findings. They're active exploits and confirmed vulnerabilities in production tools.

Here's what happened, why it matters, and what RuntimeAI does about each class of threat.

1 — Gemini CLI CVSS 10 RCE: Malicious Repos Can Execute Commands on Your Machine

Google's Gemini CLI — a widely adopted AI coding assistant used directly from the terminal — was found to contain a critical vulnerability scoring CVSS 10.0. The attack vector is supply-chain style: a repository is crafted with embedded payloads in files the CLI automatically reads as context (READMEs, config files, manifests). When a developer clones and opens this repo with Gemini CLI active, the CLI processes the malicious context and the payload executes as shell commands on the host machine.

No authentication bypass is required. No user approval prompt is shown. The model's context window becomes the attack vector. The vulnerability is particularly dangerous because developers routinely clone unfamiliar repositories for evaluation — an action now potentially catastrophic with an unpatched CLI.

RuntimeAI Take

RuntimeAI's PII Shield and flow enforcer validate context before it reaches the model. Malicious payloads embedded in tool context — whether from repository files, MCP servers, or document ingestion — are caught and blocked before the model processes them. The enforcement happens at the boundary between data source and model runtime, not after.

2 — LiteLLM CVE Actively Exploited: Your LLM Proxy May Already Be Compromised

LiteLLM is one of the most widely deployed open-source LLM proxy frameworks, used by teams to manage multi-provider LLM routing, rate limiting, and cost tracking. The exploited CVE allows an attacker with network access to the LiteLLM admin API to manipulate provider configurations and, in some deployments, extract upstream API credentials stored in the proxy's configuration.

Active exploitation means real organizations are already being compromised. Teams running LiteLLM without network isolation, with the admin API exposed, or on versions predating the patch are at immediate risk. This is not a theoretical future threat — it's an active campaign.

RuntimeAI Take

RuntimeAI's vendor-wrapper layer isolates all LLM provider credentials from the request path. API keys are never accessible via the proxy API surface — they're stored in QuantumVault and resolved server-side at request time. No attacker reaching the proxy boundary can extract upstream credentials because they don't exist in the proxy's configuration layer.

3 — Cursor IDE: Arbitrary Code Execution Through Model Context Manipulation

Cursor's agentic mode — which can read files, run terminal commands, and modify the codebase autonomously — was shown to be exploitable through prompt injection in files the AI reads as context. When Cursor processes a file containing a malicious prompt payload, the AI can be instructed to execute commands in the integrated terminal, create or modify files, or exfiltrate data from the local development environment.

The fundamental tension here is architectural: the capabilities that make agentic IDEs powerful (file access, terminal execution, codebase-wide changes) are exactly the capabilities that make them dangerous when the AI's input is not trusted. There is no safe way to give an AI unrestricted shell access without robust input validation at the model boundary.

RuntimeAI Take

RuntimeAI's flow enforcer governs what actions an AI agent is permitted to take, not just what it is prompted to do. Even if a model receives a malicious instruction, the enforcer can block the resulting action (shell exec, file write, network call) before it executes. Capability restriction at the action layer is the only reliable defense when input validation cannot be guaranteed.

4 — VS Code Copilot Co-Author Injection: Supply Chain Risk in AI-Assisted Development

The attack is subtle and therefore particularly dangerous: a developer opens a file (pulled from a third-party library, a cloned repo, a dependency) that contains hidden prompt injection in comments or string literals. Copilot processes this file as context for its suggestions. The attacker's injected prompt influences subsequent code generation — potentially introducing backdoors, vulnerabilities, or logic errors that appear in Copilot's suggestions as normal code.

Unlike RCE exploits, this attack leaves no obvious trace. The developer sees a code suggestion that looks reasonable, accepts it, and the malicious logic enters the codebase. At scale, across millions of Copilot users, even a low success rate represents a significant supply chain attack vector.

RuntimeAI Take

RuntimeAI audits the full chain from AI input to code output. When an AI coding assistant produces code that matches known malicious patterns or originates from a prompt injection, the Audit Black Box captures the full context — the input that caused it, the model that produced it, and the output that was generated. This creates the forensic record needed to detect supply chain compromise after the fact, even when the attack was invisible at the time.

5 — Claude Mythos and Japan's Financial Sector: The Geopolitical Layer of AI Risk

This incident is not a vulnerability — it's a governance event. Following the Claude Mythos disclosure that demonstrated autonomous discovery of hundreds of zero-days, Japan's financial regulators moved quickly. The FSA issued guidance warning that AI systems with Mythos-class capabilities posed systemic risks if deployed in financial services without explicit human oversight mandates. Several major Japanese banks placed temporary holds on AI agent deployments pending regulatory clarity.

The underlying concern is legitimate: an AI system capable of discovering 271 zero-days autonomously is also capable of identifying exploitable patterns in financial regulations, market microstructure, or fraud detection systems — and acting on them faster than any human oversight loop can respond.

RuntimeAI Take

RuntimeAI's governance layer is built for exactly this regulatory pressure. Every AI agent action is logged, every decision is auditable, and human-in-the-loop checkpoints are configurable per risk category. When a regulator asks "what did your AI do and why," the Audit Black Box provides the complete chain of evidence. Compliance isn't retrofitted — it's the foundation.

6 — Finetuning and Copyright Recall: Safety Training Has a Memory Leak

The study is significant because it reveals a coupling between two problems that were previously treated as independent. Finetuning on copyrighted content risks legal liability from verbatim reproduction. Separately, it was known that finetuning can degrade safety alignment. This research demonstrates these aren't independent — the same finetuning process that enables copyright recall also weakens the safety constraints the base model was trained to maintain.

For enterprise teams finetuning models on proprietary or third-party data, this means the standard finetuning workflow carries hidden safety regression risk. A model finetuned to perform better on a domain task may simultaneously become more susceptible to jailbreaks, harmful content generation, or confidential data exfiltration.

RuntimeAI Take

RuntimeAI's Adapter Manager tracks every LoRA adapter version and maintains behavioral attestation for each. Before a finetuned adapter is served in production, it undergoes safety regression testing as part of the model registry workflow. A model that passes task performance metrics but fails behavioral guardrail checks is blocked from deployment — regardless of who requested it.

Week at a Glance

The Takeaway

Two of this week's six incidents are CVSS 10 or actively exploited. All six involve AI developer tooling or the AI model supply chain. The attack surface has moved upstream — from model outputs to model inputs, from inference endpoints to the tools developers use to interact with models.

The security posture that protected you against last year's threat model is insufficient for this one. Runtime enforcement — blocking bad actions at the moment they happen, not auditing them afterward — is now the minimum viable control for any team deploying AI agents in production.