Peyton Kennedy.

CVSS scores are CISA-ADP assessments where NVD analysis is still pending.

Reported and awaiting a fix, under a 90+30 day disclosure policy.

• Hacking Your Life with AI Can Get You Hacked: How AI Orchestration Platforms Ship RCE by DesignDEF CON 34 · 2026-08-08 · LVCC - L1 - Exhibit Hall West 3 - 1006 (Main Track 1)AI orchestration platforms promise to automate your life. They deliver, just not always for you. Kestra, Langflow, Nocobase, Flowise, Activepieces, Dify, and Apache Airflow have quietly become critical infrastructure, and they all share the same dangerous assumption: anyone who can touch a workflow is trusted to run code on the host. I went hunting across seven major platforms and walked out with multiple CVEs and critical-severity findings. I'll share an arsenal of RCE primitives: shell injection through template rendering, exec() on user-supplied "validation" code, eval() on raw LLM output, and unauthenticated API endpoints that hand you a shell. Then I'll demonstrate the kill shot: an unauthenticated attacker achieving full RCE through a single prompt injection into an LLM module. When I reported these, some vendors told me code execution is intended behavior and security is the deployer's problem. I'll show you why that argument falls apart in real deployments, and walk through the trust boundary failures that keep producing the same bugs across the ecosystem. You'll leave with a methodology for tearing these platforms apart, a catalog of recurring vulnerability patterns, and a framework for evaluating whether a platform's threat model survives contact with reality.Paper · Writeup
• From CTFs to CVEsCackalackyCon 2026 · 2026-05-17This talk walks through how a CTF mindset can translate directly to real-world vulnerability research. Starting with a closed-source AI hosting platform, using a framework endpoint to leak source code, then pivoted into classic web application testing: broken access controls, IDORs, information disclosure, and improper error handling. Within six hours, I had four CVEs filed. The vulnerabilities weren't novel. The approach wasn't complicated. It was the same enumeration, threat modeling, and exploit chaining that wins CTF competitions, and to top it off, this occurred during a CTF.The bigger takeaway is that AI-enabled applications are still web applications. The attack surface hasn't fundamentally changed, it's expanded. System prompts, training data, and model configurations are the new crown jewels, but the path to them runs through the same broken access controls and misconfigurations we've been exploiting for years. If you can pop a challenge in a CTF, you may already have the skills to find bugs in production. The instincts transfer. The methodology transfers. The only difference is the disclosure process at the end.Slides
• Attacking AI Applications: The Fundamental Issue with LLMs and the New Crown JewelsBSides NoVA 2025 · 2025-10-11Modern day applications are full of integrations with AI, but there is a fundamental issue with how LLMs in particular work. In this talk, we will uncover that fundamental vulnerability, exploit methodologies, and the new crown jewels of applications. By understanding the concepts of modern day web exploitation, we target and re-frame how we hunt for bugs in AI applications.Slides

• Hacking Your Life with AI Can Get You Hackedblog · 2026-08-18
• How AI Orchestration Platforms Ship RCE by Designwhitepaper · 2026-08-18
• Endor Labs' AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic's buffablog · 2026-06-30
• CVE-2026-27959: Userinfo Host Header Injection in Koablog · 2026-02-25
• AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypassblog · 2026-02-19
• How AI SAST Traced Data Flows to Uncover Six OpenClaw Vulnerabilitiesblog · 2026-02-18