Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)

What it is

Google Threat Intelligence Group's (GTIG) report tracks specific named CVEs and exploitation timelines that go beyond the general trend numbers, including the mechanics of how threat actors weaponized an AI-discovered vulnerability and three specific CVEs in AI middleware already seen exploited in the wild.

How it works

CVE-2026-1731 (BeyondTrust PRA/Remote Support) is an unauthenticated OS command injection flaw discovered autonomously by third-party research agent Hacktron AI. Within 4 days of public disclosure, one threat cluster began exploiting it; five more clusters followed within 7 days. Post-exploitation activity included privilege escalation, data exfiltration, and deployment of SNOWLIGHT, SPARKRAT, and cryptominers.

Three AI-stack CVEs are confirmed exploited in the wild:

• CVE-2026-42271 (BerriAI LiteLLM): command injection via the MCP server preview endpoint POST /mcp-rest/test/connection, leading to host takeover and API credential theft.
• CVE-2026-5027 (Langflow): path traversal file write via POST /api/v2/files upload handler, letting attackers drop files like cron jobs or SSH keys onto the host.
• CVE-2025-3248 (Langflow): unauthenticated Python code injection via exec() in /api/v1/validate/code, giving immediate RCE.

GTIG also notes a separate, earlier case (May AI Threat Tracker): the first known instance of a threat actor possessing a zero-day exploit script with high-confidence LLM-generation markers, intercepted before execution.

Preconditions / Affected

• BeyondTrust Privileged Remote Access and Remote Support — unauthenticated exposure of the vulnerable command path.
• LiteLLM deployments exposing the MCP server preview endpoint.
• Langflow instances with the file-upload API or code-validation endpoint reachable, especially unauthenticated.
• Broadly, inference gateways (vLLM, Triton, LiteLLM, Ollama) and orchestration frameworks (Flowise, Langflow) exposed to the network — 24% of backend serving infrastructure flaws stem from unauthenticated API endpoints or SSRF.

What to do

The page does not give patched version numbers for these CVEs; it points to remediation posture rather than a patch table:

• Treat n-day weaponization speed as the primary risk driver (not zero-days) — prioritize rapid triage/patching of disclosed High-Risk CVEs over broad scanning.
• Sandbox autonomous agentic workloads and the dynamic code-execution nodes in orchestration frameworks (Langflow/Flowise) rather than exposing them directly.
• Treat AI gateways and inference servers as perimeter infrastructure requiring authentication and network restriction, not internal tooling.
• Run AI-enhanced code review pre-release to catch these flaw classes before shipping (page cites Google's CodeMender/AI Threat Defense as an example, not a prescribed tool).

Caveats

GTIG states confirmed exploited AI-discovered vulnerabilities are "an early indicator rather than an established trend" — only the BeyondTrust case is cited as a confirmed real-world chain from AI discovery to exploitation. Similarly, out of 2,076 cumulative AI-stack CVE disclosures, only "a handful" are confirmed exploited in the wild — the three middleware CVEs above are the specific examples given, not an exhaustive list. No zero-day exploitation of AI infrastructure has been observed yet, per the report.