Preliminary research
One Chain to Own Them All: Breaking AI Infrastructures
AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.
A hunt across AI serving stacks that ends in PyTorch's model loader: the weights_only whitelist meant to make torch.load safe was bypassed once, then again after the fix, when a whitelisted function reached through persistent_load overflows and pickle's SETITEM opcodes give control of index and value, with Debian's non-PIE CPython supplying an address. vLLM's prompt_embeds, SGLang, OpenLLM, ComfyUI and NVIDIA Dynamo all feed attacker-supplied tensors into torch.load, so one chain reaches all.
Record
- Researcher
- Ji'an Zhou
- Format
- Whitepaper
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Ji'an Zhou, first published at the original source. Preserved copies are kept so the citation survives its host.