AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

This article covers critical security vulnerabilities in three AI platforms—Amazon Bedrock, LangSmith, and SGLang—that enable data exfiltration and remote code execution.

• •Amazon Bedrock AgentCore Code Interpreter's sandbox mode allows outbound DNS queries despite a "no network access" configuration, enabling C2 channels and data exfiltration (CVSS 7.5)
• •Attackers can exploit DNS communication to establish reverse shells, poll a C2 server via DNS A records, and exfiltrate data from AWS resources accessible through the Code Interpreter's IAM role
• •LangSmith (CVE-2026-25750, CVSS 8.5) has a URL parameter injection flaw in the baseUrl parameter allowing bearer token theft and account takeover; patched in version 0.12.71
• •SGLang has three unpatched vulnerabilities enabling RCE via unsafe pickle deserialization through ZeroMQ: CVE-2026-3059 and CVE-2026-3060 (CVSS 9.8) and CVE-2026-3989 (CVSS 7.8)