CVE-2026-84809 in AI-Infra-Guard
Summary
by MITRE • 09/02/2026
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Tencent AI-Infra-Guard's skill-scan component represents a critical bypass of static analysis controls through the exploitation of hardcoded exclusion logic. The core technical flaw lies in the rigid implementation of skip lists that explicitly ignore compiled Python bytecode files, specifically targeting _pycache_ directories and extensions such as .pyc, .pyo, and .pyd. This design choice was likely intended to optimize scanning performance by avoiding redundant analysis of already-compiled artifacts or to prevent false positives from dynamic code generation mechanisms inherent in the Python ecosystem. However, this optimization creates a significant blind spot where malicious logic embedded within compiled bytecode remains entirely unexamined during the security assessment process. By hardcoding these exclusions directly into the scanner's configuration rather than implementing a more nuanced policy-based approach, the system fails to account for scenarios where attackers deliberately leverage compiled files to obfuscate or hide malicious payloads from static analysis tools.
From an operational perspective, this vulnerability enables a sophisticated supply chain attack vector known as artifact substitution or binary planting. An attacker can distribute a skill package containing benign Python source code alongside maliciously crafted bytecode files that execute specific harmful actions upon importation by the Python interpreter. Because the scanner exclusively analyzes the visible .py source files and ignores the accompanying compiled artifacts, it generates a false positive verdict of safety for the entire package. When an operator installs this compromised skill into their AI infrastructure environment, the Python runtime automatically loads and executes the hidden bytecode during module initialization or import statements. This results in arbitrary code execution within the context of the scanning or deployment process, potentially granting attackers control over the underlying system, access to sensitive data, or a foothold for further lateral movement within the network.
This vulnerability aligns with CWE-248 Unhandled Exception Condition and more specifically CWE-1035 Missing Critical Step in Software Lifecycle, as the security scanning phase fails to cover all executable artifacts present in the distribution package. It also maps directly to MITRE ATT&CK technique T1608 Link Exploitation of Trusted Relationships, where attackers exploit trust in a known vendor or tool by embedding malicious content within seemingly legitimate components. Furthermore, it relates to CWE-472 External Control of Default Value since the scanner relies on hardcoded default exclusions that are not dynamically configurable for high-risk environments. The impact is severe because it undermines the fundamental purpose of the security gateway, allowing malware to bypass detection mechanisms designed to protect AI infrastructure from compromised or malicious extensions.
Mitigation strategies must focus on eliminating reliance on static exclusion lists and enforcing comprehensive artifact analysis. Security teams should configure the skill-scan component to recursively analyze all file types within a package, including compiled bytecode, by disabling the hardcoded skip rules for _pycache_ directories and .pyc/.pyo/.pyd extensions. If performance is a concern, implementing incremental scanning or caching mechanisms that verify integrity rather than skipping analysis entirely would be preferable. Additionally, organizations should enforce strict code signing policies to ensure that only verified artifacts are deployed, and integrate dynamic analysis capabilities into the CI/CD pipeline to detect behavioral anomalies in imported modules before they reach production environments. Regular audits of scanner configurations against evolving threat landscapes are essential to prevent similar bypasses where attackers exploit known blind spots in automated security tools.