The same missing gate, sixteen products
A batch of 122 CVE records hit NVD on 16 October, all published by VulnCheck between 18:17:38 and 18:17:56 UTC. Eighteen seconds. Twenty of them are AI platforms across 16 products. Most share one defect class: a command or control surface that keeps working with no gate. Seven score 8.0 or higher. The batch opens with SGLang, whose bug is a novel mechanism; the other nineteen are the opposite.
Named in the batch are EFAK, 99AI, LangChat, DataBuff, and OpenBMB StaffDeck. EFAK let a user promote themselves to admin. 99AI exported chat logs without a login, on a route whose only auth was a documentation annotation. Thirteen of the twenty are missing-authorization or missing-check weaknesses. No patched version is listed, and the writeup checked four upstreams to confirm the defective code is still on their default branches.
A command tool with no approval step
The same shape filled the same week. Between October 12 and 15, Lasso Security published six CVEs against five self-hosted agent platforms, four of them critical, all tracing to a command tool the model runs with no approval step. In piflow and Cognition a single unauthenticated HTTP request makes the agent run a shell command. In OpenSRE, MoviePilot and LangAlpha the trigger is indirect prompt injection: a Grafana alert annotation, a web page, torrent metadata. The child process inherits the full environment, so a command reaches whatever credentials the agent holds.
MoviePilot let the model set a flag that bypassed its command denylist. Only Cognition shipped a patch, in v0.13.0; the other advisories name no fixed version. A separate disclosure from the same three researchers, published October 15, hit IntentKit: the executor checked tools against the full registry rather than the per-request advertisement, so an unauthenticated caller could reach owner-only tools, including a wallet transfer. No fix is named there either.
The bugs differ, the family does not
The individual bugs differ; the family does not. A tool exposed to a model is treated as trusted because the model is trusted, and the check that should sit between them is missing. Flowise showed the same family from the sandbox side earlier in the month: caller-controlled arguments to puppeteer.launch let an authenticated user escape its code sandbox and run commands as the server's process user, fixed in 3.1.3. Most of these have no fix at all.
The records themselves are nearly useless to scanners. All twenty resolve in OSV and GitHub's advisory database, but only as repository ranges with no package name, so a complete dependency-scanning pipeline returns zero findings. Inventory by deployed application, not by dependency.
Log take: The pattern is old; the reach is new. The wave shows self-hosted agent tooling inheriting the web's oldest failure: an endpoint that assumes the caller is allowed, shipped with the model's reach behind it. (Interpretation; two secondary writeups.)