Queried for the window, the National Vulnerability Database returns 514 CVE records published between 13:20 UTC on 4 September and 11:00 UTC on 5 September. Eighty-six of them carry a single source identifier, VulnCheck, arriving in two bursts — 49 records in nine seconds on the Friday afternoon, 14 more on Saturday morning.
What is in the batch
Pulling all 86 records from cve.org and classifying by product gives 40 AI, LLM, agent and MCP projects: firecrawl-mcp-server, postgres-mcp, git-mcp-server, cli-mcp-server, excel-mcp-server, LobeChat, goose, Marqo, Aim, Chroma, OGX, Xinference, potpie, Hugging Face tokenizers, QAnything, zerox, LLaMA-Factory, aider, OWL, marker, AgentScope, ms-swift, surya, TEN Framework, llmware, Plandex, MegaParse, Nightingale, Chatbot UI, LaVague, FastChat, SadTalker, jina-ai reader, Onyx, Sim, Cua computer-server, Rowboat, SQL Chat, AutoAgent, xiaobei. Top CVSS v4.0 scores are high — SQL Chat 9.4, AutoAgent 9.3, excel-mcp-server 9.3, Aim 9.3, FastChat 9.3.
Almost none of them can be patched
Across all 86 records, 58 use lessThanOrEqual — "affected up to and including X", with no upper fixed boundary — against 25 that name a patched release. In the AI subset the ratio is worse: 38 of 40 name no fix. Only Sim and Cua computer-server do. The references point at open GitHub issues rather than commits, and the issues are months old: the aider, tokenizers, SQL Chat and AutoAgent ones were filed in June, the goose one in July, all by the same researcher account, all still open.
The machine-readable data is actively misleading
One record marks aider affected at <= 0.86.2 with defaultStatus: unaffected — which every dependency scanner renders as "fixed in the next version" — while the record's own description says the behaviour was confirmed on current main. There is no next version: 0.86.2 is the newest release on PyPI. Hugging Face tokenizers has the same shape, affected at <= 0.23.2, where 0.23.2 is the latest release.
What the received framing gets wrong
Read as a feed this looks like a coordinated wave of attacks on AI infrastructure, or a vendor patch day. It is neither: it is one numbering authority flushing a backlog of publicly documented bugs, and the resulting spike will be mostly unpatchable. The bug classes are unglamorous and repetitive — server-side request forgery in "fetch this URL" tools, path traversal in "read this file" tools — which is to say that giving a model a fetch tool and a file tool recreates the 2005 web-application attack surface.