AI hacking is an informal label for two active security problems: adversaries using AI to accelerate conventional intrusions, and adversaries manipulating or compromising AI systems. One concrete model-supply-chain case, PyTorch’s high-severity CVE-2026-24747, affected releases through 2.9.1 and was patched in version 2.10.0 before public disclosure in January 2026.
The scope runs from AI-assisted reconnaissance and social engineering to prompt injection, data poisoning, model theft and unsafe checkpoint deserialization. The PyTorch advisory did not disclose an affected installation count or report exploitation in the wild; its attack path required a crafted checkpoint to be loaded by a vulnerable process.
What AI hacking means
“AI hacking” is not a formal vulnerability class. For defenders, it is useful to separate three activities:
- AI-enabled cyber operations: A threat actor uses a model to support reconnaissance, phishing, vulnerability research, exploit development, malware work or analysis of stolen data. The U.K. National Cyber Security Centre assessed that AI was already enhancing those existing tactics and was more likely to evolve established intrusion methods than create entirely new vectors through 2027 (NCSC assessment).
- Attacks against AI systems: An attacker targets the model, training data, retrieval corpus, application, agent tools or ML infrastructure. NIST AI 100-2 E2025 organizes adversarial machine-learning risks around evasion, poisoning and privacy attacks, with misuse attacks also covered for generative AI.
- Authorized AI security testing: A red team probes those same boundaries with permission, defined scope and containment. The technique may resemble an attack, but authorization and controlled impact distinguish testing from an intrusion.
That distinction matters in incident triage. AI-written phishing remains phishing. A jailbreak that changes a chatbot’s answer is not automatically a network compromise. A prompt injection that makes an agent call a privileged tool can become unauthorized data access or command execution.
The main AI hacking attack paths
AI-assisted social engineering. Generative systems can produce tailored text, synthetic images, cloned voices and video used in impersonation. The FBI’s December 3, 2024 advisory documented criminal use of generated text for spear phishing and fraud, along with synthetic audio used to impersonate known people and seek payments or account access. The defensive side, how transaction and behavioral classifiers catch that fraud and where they fail, is covered in AI fraud detection.
Prompt injection and jailbreaks. Direct injection comes from the user. Indirect injection arrives through content the model retrieves or processes, such as a webpage, document, message or RAG record. OWASP ranks prompt injection as LLM01:2025 and warns that impact can include sensitive-data disclosure, unauthorized function access and arbitrary commands in connected systems (OWASP guidance). A jailbreak is the narrower case in which input causes a model to disregard safety controls.
Researchers Kai Greshake, Sahar Abdelnabi and colleagues demonstrated that strategically placed instructions in retrieved data could remotely alter LLM-integrated applications, including their API use (research paper). Independent reporting later described the NCSC’s position that prompt injection remains a residual risk requiring system design and operational controls, not a single filtering product (The Record). Technique-level coverage of prompt injection and agent exploitation is available at AIsec.
Poisoning, evasion and privacy attacks. Poisoning changes training, fine-tuning or retrieval data to alter later behavior or install a backdoor. Evasion changes an input at inference time to produce a wrong classification or bypass a control. Privacy attacks seek training records, sensitive attributes or model information. These affect different lifecycle stages, so a gateway filter alone does not cover them.
Agent and supply-chain compromise. Agents expand impact when models can reach browsers, code runners, cloud APIs, mail, databases or Model Context Protocol servers. The supply chain also includes model repositories, checkpoints, plugins, libraries and container images. A trusted-looking model artifact can therefore carry conventional software risk as well as model-level manipulation.
Technical case: PyTorch CVE-2026-24747
CVE-2026-24747 affected the weights_only unpickler used by torch.load() in PyTorch 2.9.1 and earlier. According to the project’s official advisory, a crafted .pth checkpoint could trigger heap corruption because the loader did not properly validate pickle opcodes and storage metadata. Loading the file with weights_only=True could still lead to arbitrary code execution in the victim process.
The reviewed GitHub record mapped the flaw to CWE-94, Improper Control of Generation of Code, and CWE-502, Deserialization of Untrusted Data. It assigned a CVSS 3.1 score of 8.8 High with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The user-interaction requirement reflects the need for a person or service workflow to load the attacker’s checkpoint.
Vendor response
PyTorch’s advisory said version 2.10.0 fixed the issue and identified Ji’an Zhou as the researcher. The project rated the vulnerability High and described the potential impact as arbitrary code execution in the context of the process loading the checkpoint. The 2.10.0 release shipped on January 21, 2026.
Timeline
- January 21, 2026: Patch: PyTorch released version 2.10.0.
- January 26, 2026: Vendor disclosure: The PyTorch project published GHSA-63cw-57p8-fm3p.
- January 27, 2026: CVE publication: GitHub’s advisory database and NVD published CVE-2026-24747.
- September 6, 2026: Public-PoC and exploitation status: Neither the vendor advisory nor the official CVE record linked a public proof of concept. The vendor advisory did not report exploitation in the wild.
What defenders should do
- Within 24 hours, inventory the AI attack surface. Record model-serving endpoints, agents, tool permissions, RAG sources, model registries, checkpoint formats, plugins, MCP servers and exact dependency versions. Assign an owner to each production path.
- Within seven days, patch PyTorch. Upgrade every deployment running 2.9.1 or earlier to 2.10.0 or later, then validate model compatibility in staging. Prioritize internet-facing services and pipelines that accept externally sourced checkpoints. To rank this CVE against the rest of a patch backlog, use the patch-priority triage tool.
- Immediately quarantine untrusted model artifacts. Verify provenance and hashes before promotion. Load or convert external checkpoints only in isolated, least-privilege environments without production credentials or unrestricted egress. Do not rely on
weights_only=Trueas the sole security boundary on an affected release. - Within 30 days, constrain agent authority. Give each tool a separate least-privilege identity, validate model output in deterministic code and require human approval for payments, credential changes, data exports and code execution. These controls follow OWASP’s prompt-injection mitigations.
- Monitor continuously. Log model and artifact hashes, retrieval sources, prompts, tool calls, approvals, network destinations and child processes. Alert on model-registry changes, unexpected tool sequences and shells launched by model-loading processes. SentryML covers related model and pipeline observability practices.
Related across the network
- AI Security: Attack Categories and Defense Priorities — ai-alert.org
- OWASP Top 10 LLM Explained: Every Entry and What to Fix — aiattacks.dev
- 7 LLM Guardrail Tools and Frameworks Compared (2026) — aidefense.dev
- Adversarial Attack Libraries: ART, Foolbox, torchattacks — adversarialml.dev
