Preliminary research
One Chain to Own Them All: Breaking AI Infrastructures
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
A hunt across AI serving stacks that ends in PyTorch's model loader: the weights_only whitelist meant to make torch.load safe was bypassed once, then again after the fix, when a whitelisted function reached through persistent_load overflows and pickle's SETITEM opcodes give control of index and value, with Debian's non-PIE CPython supplying an address. vLLM's prompt_embeds, SGLang, OpenLLM, ComfyUI and NVIDIA Dynamo all feed attacker-supplied tensors into torch.load, so one chain reaches all.
Record
- Researcher
- Ji'an Zhou
- Published by
- media.defcon.org
- Format
- Whitepaper
- Topic
- AI
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Ji'an Zhou, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .