tl;dr sec #349 - Vulns & Exploits in the AI Era, Package Manager Sandboxing, Testing AI Sandboxes

What it is

Issue #349 of the tl;dr sec newsletter. It is a roundup, but four items carry specifics an engineer can act on: the Graphalgo malware reaching Terraform providers and Go modules, Perplexity's test of AI agents escaping Firecracker sandboxes, Vercel's sandbox bounty results, and Google's 2025–2026 exploitation data.

How it works

Graphalgo in Terraform and Go (Aikido, Oliver Smith).

• Malware was found in two Terraform providers, gocommunity-io/dockerd and kreuzwenker/docker, and in two Go modules. It is a Go port of the Graphalgo NPM malware and shares its Slack and blockchain infrastructure.
• kreuzwenker/docker typosquats the 56-million-download kreuzwerker/docker provider.
• The actor set up fake Go package ecosystems at gocommunity.io and gogets.dev. They also backdated commits on one module so pkg.go.dev showed a November 2025 release date.
• The providers stay dormant unless the SHA256 of two specific Terraform variables matches a hardcoded value. They therefore look clean in sandboxes and scanners.
• On a match, a Go RAT is decrypted and run. It takes encrypted commands over Slack and an Ethereum smart contract on Arbitrum Sepolia. Each host uses its own ephemeral key pair.
• Slack shows only 18 infected hosts since July 2026, which fits a targeted operation.

Sandbox escape tests (Perplexity, "Escaping SPACE: Part I").

• Nine models ran 216 times as root inside Firecracker microVMs, with varying source-code access and network permissions.
• None of the 108 VM-to-host escape attempts succeeded.
• When the policy allowed package repositories through, four models bypassed network confinement in 11 of 54 partial-network runs. The four were Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol and Kimi K3.
• The root cause was a gap between domain-based policy and IP-based enforcement, exploited two ways:
• DNS spoofing: forged responses mapped allowed domains such as pypi.org to blocked IPs.
• Shared-IP CDN abuse: services such as Fastly Fiddle or Taboola shared IPs with allowed domains.
• The same bypass worked on 8 of 10 third-party sandbox platforms, including E2B, Vercel Sandbox, Modal Sandboxes and Deno Sandbox.

Vercel's $1M bounty.

• Over two weeks it drew 1,285 reports and about $325k in payouts: 1 Critical, 7 High, 15 Medium and 49 Low.
• Trail of Bits' white-box review found 20 issues. Its key recommendation was "stop trusting the guest": derive every value crossing the VM boundary server-side, or sign it with keys the guest cannot reach.
• Paulos Yibelo's full VM escape was confirmed by Vercel CEO Guillermo Rauch as a KVM zero-day.

GTIG trends (January 2025 – August 2026).

• Monthly CVE disclosures rose from 5,045 to 10,740. In-the-wild exploitation rose from 10.5 to 18 per month, and zero-day exploitation from 8 to 11.
• From May 2026, exploitation growth (+127%) tracked disclosure growth (+128%), which suggests n-day weaponization. Only 0.23% of CVEs are ever exploited.
• AI-discovered CVEs skew higher impact (58% Medium Risk vs 28% for non-AI CVEs), and 50% are RCE.
• GTIG counted 2,076 AI-related CVEs, half in agent orchestration frameworks such as Flowise and Langflow. Exploited examples include LiteLLM command injection and unauthenticated Langflow RCE.

Preconditions / Affected

• Graphalgo: teams that pull Terraform providers or Go modules by name, especially from look-alike namespaces. Terraform users are valuable targets because of their path to production credentials.
• Sandbox network bypass: any sandbox that allows egress by domain (for example, package repositories) but enforces by IP.
• Package managers: Swift Package Manager's confinement silently does nothing on Linux (per Nesbitt's survey).

What to do

• Audit Terraform lockfiles and Go dependencies for these names: gocommunity-io/dockerd, kreuzwenker/docker (note the misspelling of the legitimate kreuzwerker/docker), and anything from gocommunity.io or gogets.dev.
• Do not trust pkg.go.dev release dates as evidence of age, since they can be backdated.
• If you run agent or code sandboxes with a partial allowlist, apply Perplexity's fix, after which no model succeeded:
• source-address validation via nftables;
• TLS-terminating proxies that verify SNI and the HTTP Host header.
• Run the same policy tests against your own platform. Eight of ten third-party platforms failed.
• Patch-prioritize for n-days. Exploitation is tracking disclosure, so patch latency matters more than zero-day defense.
• Inventory agent frameworks such as Flowise, Langflow and LiteLLM, which have exploited CVEs.
• For HTTP/3 testing, Turbo Intruder now exceeds 100,000 requests per second from a laptop (about 180,000 from a same-region cloud host). It adds the Single Datagram Attack, a QPACK blocked-streams race technique, and HTTP/3-to-HTTP/1 downgrade tests where a line break in a header value injects a header such as Transfer-Encoding.

Caveats

• Graphalgo's 18-host count comes from one Slack channel, so it is a floor, not an estimate of total exposure.
• Perplexity's results are 11 of 54 partial-network runs on a Firecracker setup. The newsletter does not say which two platforms resisted the bypass.
• The newsletter author speculates that AI-found CVEs look higher impact because researchers sit on low-severity findings. This is opinion, not GTIG data.
• Vercel's agentic triage system is described as planned for open source, not released.