In a four-hour span on the evening of 21 August, the US national vulnerability feed published 12 CVE records covering eight AI, machine-learning and agent-tooling projects. Not one is a new disclosure. In every case the patch had already been released and the vendor advisory was already public — by between 11 and 118 days.
The worst gap is the worst bug
The longest delay attaches to the highest score. A CVSS 10.0 remote code execution in the model-serving framework Xinference comes down to one line — an eval() applied to the model's own tool-call output — so a prompt that induces the model to emit an OS call executes it on the server. The fix shipped on 25 April; the maintainer published the advisory on 13 July; the CVE landed on 21 August, 118 days after the patch. The project is now six minor releases past the fix. The 10.0 also assumes the shipped default, in which authentication is off — the advisory says so.
Four at once in one agent harness
Four of the twelve belong to Omnigent, a Databricks-linked meta-harness that orchestrates other coding agents. The most interesting is a guardrail that fails open: the shell-command parser returns nothing when it cannot parse a command, so combined interpreter flags, the timeout, nice, setsid and stdbuf wrappers, command substitution and a single background operator all yield "no parsed operation" — and the repository allowlist and workspace-confinement policies then abstain and allow it. The advisory states that an authenticated or prompt-injected agent can use this to push to an unauthorised repository or escape the workspace. Its reporter is credited verbatim as an autonomous security agent. A separate entry, in Microsoft's UFO framework, binds a local agent server to a port that validates neither Host nor Origin, so any web page can rebind to it and execute commands; the fix commit sat in the repository 45 days before a release carried it to users.
What the common framing gets wrong
From Monday these will be reported as newly disclosed critical flaws in AI infrastructure. They are the feed catching up. There is also a trap for anyone who checks: the GitHub Advisory API returns a publication timestamp of 21 August for advisories whose repository pages say July. The API field records when GitHub's global database reviewed the advisory, not when the maintainer published it — and a story citing the API date is wrong in a way that leaves no trace.
The pattern underneath
Strip the twelve down and one failure repeats: agent frameworks treating model output, configuration or an unauthenticated local port as trusted input. Meanwhile the median gap between a fix shipping and its CVE appearing is roughly 55 days, during which the patch sits in public git history — trivially diffable into an exploit — while nothing tells a downstream operator to upgrade.