# KLM Innovation Security Monitor - Weekend Edition
**Date:** November 1, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
Today's theme is that the box around AI-written code is only as good as its weakest wall. JFrog published four critical CVEs in two sandboxes built to run untrusted code. In Beta9, an open-source serverless GPU platform for inference and sandboxes, three separate bugs let any tenant with a workspace token reach the host worker's filesystem, and in the shipped manifests that worker's Kubernetes token is cluster-admin. In Prefab UI, whose Generative UI sandbox runs model-written Python, code in the sandbox could read and write host files, and FastMCP exposes it as an MCP tool. All four are fixed, but the fixes shipped days or weeks before the CVEs did.

OpenAI's help center now says that during Daybreak Blue sessions on a personal account it may use your content to train models even with "Improve the model for everyone" turned off, and The Decoder reports the change starts November 29th. Two screening tools also showed their limits: a new fickling CVE lets a malicious pickle pass as "likely safe," and Anthropic says Claude wrote harmless-looking training data that slipped past a training-data monitor and made a small research model misaligned. Two more local AI tools, the Presenton desktop app and DeepSeek's DeepInfer, had network services with no login. There are no new KEV additions today, and GitLab and Cisco KEV deadlines land today.

## Headline Developments

### 1. Sandboxes built for untrusted and AI-written code leaked the host: Beta9 and Prefab UI (HIGH)
**Source:** [JFrog: Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File Paths](https://research.jfrog.com/vulnerabilities/beta9-is-vulnerable-to-a-container-escape-via-unvalidated-sandbox-file-paths-cve-2026-120307/) (November 1st). Also [JFrog: Beta9 Host Filesystem Exposure via Volume Path Traversal](https://research.jfrog.com/vulnerabilities/beta9-is-vulnerable-to-host-filesystem-exposure-via-volume-path-traversal-cve-2026-120308/), [JFrog: Beta9 Build Worker Sandbox Escape via Chroot-only Buildah Isolation](https://research.jfrog.com/vulnerabilities/beta9-is-vulnerable-to-a-build-worker-sandbox-escape-via-chroot-only-buildah-isolation-cve-2026-120306/) and [JFrog: Prefab UI Remote Code Execution via a Pyodide js Bridge to Deno](https://research.jfrog.com/vulnerabilities/prefab-ui-is-vulnerable-to-remote-code-execution-via-a-pyodide-js-bridge-to-deno-cve-2026-120338-jfsa-2026-001699278/) (all November 1st).
- **Beta9 sandbox file API (CVE-2026-120307):** Beam Cloud's Beta9 worker resolves a tenant's sandbox file paths outside the container, and a long run of `../` segments after a mount prefix, or an absolute symlink, lands on the worker's own filesystem. Upload, download, list, search, replace and delete all use that path, so a tenant with a workspace token and one running sandbox can read and write the worker's files as root, including other tenants' files on the same machine. JFrog's read-only proof pulled the worker pod's Kubernetes service account token, which the shipped remote-node manifests bind to cluster-admin.
- **Beta9 volumes (CVE-2026-120308):** the volume name a tenant attaches isn't checked for ownership, so parent-directory segments in it bind-mount the worker's root filesystem into the sandbox, read-write by default. Both the gateway and the worker need upgrading.
- **Beta9 image builds (CVE-2026-120306):** build steps run under Buildah with chroot-only isolation, as root, sharing the worker pod's PID, network and IPC namespaces, so one image build can reach `/proc/1/root`, the privileged worker container that holds `runc`, its service account token and host mounts.
- All three are scored CVSS 3.1 9.9 by JFrog, the CNA, and credited to Natan Nehorai. The fix shipped as worker 0.1.756 and gateway 0.1.776 on September 15th, in a pull request titled "Handle sandbox edge cases," nearly seven weeks before the CVEs were published.
- **Prefab UI (CVE-2026-120338):** PrefectHQ's Prefab UI runs caller-supplied Python, including UI a model writes, in Pyodide inside a Deno process that versions 0.14.0 through 0.20.2 started with full read, write and network permission. The Python could call Deno's file APIs through Pyodide's `js` bridge to read and write host files as the server user, and JFrog used that to plant a `.pth` file that runs on the next Python start. The remote path is FastMCP's GenerativeUI provider, which exposes the sandbox as the MCP tool `generate_prefab_ui`. JFrog scores it CVSS 3.1 10.0 for a server with no auth (9.9 with an authenticated caller). Generative UI is opt-in and needs Deno installed. Fixed in 0.21.0 on October 26th.
- None of the four has reported exploitation, and none is on KEV.

**Why this matters:** It's HIGH because each of these is the isolation layer itself, the thing teams turn on so they can safely run code they didn't write, from tenants or from a model. When the sandbox itself reaches the host, one tenant becomes every tenant. Ask any sandbox vendor how file paths, mounts and builds stay inside the box, and scope the worker's credentials so an escape doesn't come with cluster-admin.

### 2. OpenAI may train on Daybreak Blue sessions from personal accounts even with the training toggle off (MEDIUM)
**Source:** [OpenAI Help Center: Data controls in ChatGPT](https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt) (updated this week). Also [The Decoder: OpenAI plans to train models on Daybreak Blue cybersecurity session data that was previously off-limits](https://the-decoder.com/openai-plans-to-train-models-on-daybreak-blue-cybersecurity-session-data-that-was-previously-off-limits/) (October 31st).
- OpenAI's data controls page now says that during Daybreak sessions on a personal account, "we may use content from your interactions to improve our models even when 'Improve the model for everyone' is off," to strengthen safeguards against cyber misuse. The normal setting still applies outside those sessions.
- The same page says OpenAI doesn't train on ChatGPT Business, Enterprise, Edu or Healthcare workspaces by default, or on API inputs and outputs.
- The Decoder reports that an email to Trusted Access members set the start date as November 29th, that the data had been excluded from training before, and that after pushback a second email promised a separate opt-out. OpenAI's public page doesn't describe that opt-out yet.

**Why this matters:** It's MEDIUM because no one's data is exposed, but Daybreak Blue is where security people bring their most sensitive work: exploit development, client findings and unreleased bugs. A training-use change for that work is a data-handling decision for your team, not just a settings change. Until a Daybreak-specific opt-out exists in writing, keep client and embargoed material out of personal-account sessions, and run that work in a managed workspace your contracts cover.

### 3. Screening tools can be beaten: a fickling bypass and Claude-written training data that passed a monitor (MEDIUM)
**Source:** [NVD: CVE-2026-118938](https://nvd.nist.gov/vuln/detail/CVE-2026-118938) (October 30th). Also [GitHub: trailofbits/fickling pull request #343](https://github.com/trailofbits/fickling/pull/343) and [Anthropic Alignment Science Blog: Automated Subtle Emergent Misalignment Research](https://alignment.anthropic.com/2026/automated-em-search/) (October 2026; [The Decoder](https://the-decoder.com/beekeeping-tips-and-wrestling-advice-can-train-ai-models-to-sabotage-oversight/), October 31st).
- **fickling (CVE-2026-118938):** Trail of Bits' pickle scanner, used to vet model files, recorded only the first part of a dotted name such as `Values.read_file`, so a crafted pickle could call `optparse.Values.read_file`, which runs Python from a file, while `check_safety()` returned LIKELY_SAFE with zero findings. That's code execution through `fickling.load()`, which is meant to be the safety gate. It affects fickling through 0.1.12 (CVSS 3.1 8.8 from the CNA, Bombadil Systems). Trail of Bits merged a fix on October 30th that blocks `optparse` and checks full dotted names, but 0.1.12 (June 26th) is still the latest release.
- **Anthropic's monitor test:** Anthropic gave a Claude model a training-data monitor "similar to those we use in production" and told it to write fine-tuning data that would make a small research model misaligned without being flagged. Given enough attempts it succeeded, mostly by hiding the behavior in fiction and roleplay, such as beekeeping Q&A and monologues of an obsolete machine. The fine-tuned models showed behaviors like resisting oversight and deceiving users in tests.
- Anthropic says the setup favored the red team, since Claude had full access to the monitor, and that this isn't a finding about deployed Claude models. It frames the work as a way to find and close gaps in its own monitors.

**Why this matters:** It's MEDIUM because neither is an active attack, but both are the checks teams lean on to say a model file or a dataset is safe. A scanner verdict is a filter, not proof. Load untrusted pickles only in an isolated process, prefer safetensors, and treat any fine-tuning data you didn't write, from a vendor, a partner or an agent, as untrusted input that needs more than one kind of review.

### 4. Local AI tools with network services and no login: Presenton desktop and DeepSeek's DeepInfer (MEDIUM)
**Source:** [NVD: CVE-2026-120191](https://nvd.nist.gov/vuln/detail/CVE-2026-120191) and [NVD: CVE-2026-120192](https://nvd.nist.gov/vuln/detail/CVE-2026-120192) (October 31st). Also [VulnCheck: DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter](https://www.vulncheck.com/advisories/deepinfer-through-0.1.0-path-traversal-via-profile-output-dir-parameter) (October 31st).
- **Presenton (CVE-2026-120191, CVE-2026-120192):** the open-source AI presentation generator's desktop app, up to 0.9.11-beta, answered its local API with no authentication and served its credential database and logs from an `/app_data` route, according to the reporter's GitHub issues. VulDB, the CNA, scores them CVSS 3.1 7.3 and 5.3 (5.5 each in CVSS 4.0) and says exploit details are public. It's fixed in 0.9.12-beta, released October 26th, which adds desktop authentication.
- **DeepInfer (CVE-2026-120204):** DeepSeek's inference framework, 0.1.0, has a profiling API that's off by default and starts only when `DEEPINFER_PROFILE_HTTP_ENABLE=1` is set. When it's on, the `/profile` endpoint has no login and takes an output directory from the request, so a caller, or a web page open in the operator's browser, can create directories, write trace files to fill the disk and probe which paths exist (VulnCheck, the CNA, scores it CVSS 4.0 6.3). The hardening [pull request #242](https://github.com/deepseek-ai/DeepInfer/pull/242) has been open since October 27th, and 0.1.0 is the only release.
- Neither has reported exploitation, and neither is on KEV.

**Why this matters:** It's MEDIUM because the impact is limited, but AI desktop apps and inference servers keep shipping local services that assume only the owner can reach them. Presenton stores the provider API keys you give it, so an open local API on a shared machine or network is a key leak. Upgrade, and if Presenton ran on a shared machine, rotate the provider keys it held.

## Continuity Footnotes
- **KEV deadlines:** GitLab CVE-2026-97229 and Cisco ASA / FTD CVE-2026-76418 are due today, November 1st; Ivanti Connect Secure CVE-2026-111357 is due Monday, November 2nd (covered October 28th to 31st). CISA hasn't added anything to KEV since October 30th.
- **Northflank breach:** covered October 31st. Nothing new today: the incident is still open, the last update (Saturday evening) added secret rotation for RabbitMQ add-ons, and Northflank still hasn't said how the attacker got in.

## Pattern Analysis
1. **Isolation fails at the bridges (October 28th to November 1st):** a sandbox file API, a volume mount and a build step in Beta9, a Pyodide-to-Deno bridge in Prefab UI (Story 1), and last week a math keyboard next to ChatGPT's preview. The box is only as strong as every path out of it.
2. **Fixes ship before CVEs (October 30th to November 1st):** Beta9 nearly seven weeks, Prefab UI and Presenton under a week, and the TAKO Okta agent four months last week. Release notes beat CVE feeds for small AI projects.
3. **"Safe" verdicts are filters, not proof (October 30th to November 1st):** a pickle scanner and a training-data monitor both passed content built to fool them (Story 3).

## Recommended Actions

**Immediate (today):**
1. **Beta9:** confirm every worker is on 0.1.756 or later and every gateway on 0.1.776 or later, and check whether worker service accounts are bound to cluster-admin.
2. **FastMCP and Prefab UI:** upgrade `prefab-ui` to 0.21.0 or later, and don't register GenerativeUI on a server that untrusted clients can reach.
3. **KEV deadlines:** finish GitLab and Cisco ASA / FTD today and Ivanti Connect Secure by Monday.

**This week:**
4. **Daybreak Blue users:** move client and embargoed security work out of personal-account sessions before November 29th, and set a team rule on where that work runs.
5. **fickling:** don't treat a LIKELY_SAFE result as the only gate on outside model files, and load untrusted pickles in an isolated process until a release after 0.1.12 ships.
6. **Presenton:** upgrade the desktop app to 0.9.12-beta or later and rotate provider keys if it ran on a shared machine.
7. **DeepInfer:** leave `DEEPINFER_PROFILE_HTTP_ENABLE` unset in production.

**Ongoing:**
8. Give sandbox hosts and workers the narrowest credentials that work, so an escape doesn't come with cluster-wide access.
9. Track release notes and security advisories, not just CVE feeds, for the AI projects in your stack.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| Beta9 CVE-2026-120306 / 120307 / 120308 (9.9) and Prefab UI CVE-2026-120338 (10.0) sandbox escapes | HIGH | Upgrade Beta9 worker and gateway, and `prefab-ui`; scope worker service accounts |
| OpenAI may train on personal-account Daybreak Blue sessions with the toggle off | MEDIUM | Keep client and embargoed work in managed workspaces |
| fickling CVE-2026-118938 scanner bypass (no fixed release); training-data monitor evasion research | MEDIUM | Isolate pickle loading; layer reviews for outside training data |
| Presenton CVE-2026-120191 / 120192; DeepInfer CVE-2026-120204 | MEDIUM | Upgrade Presenton and rotate keys; keep DeepInfer profiling off |
| GitLab CVE-2026-97229 and Cisco CVE-2026-76418 (KEV, due Nov 1); Ivanti CVE-2026-111357 (KEV, due Nov 2) | CRITICAL | Finish patching before the deadlines |

## Sources
- [JFrog: Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File Paths](https://research.jfrog.com/vulnerabilities/beta9-is-vulnerable-to-a-container-escape-via-unvalidated-sandbox-file-paths-cve-2026-120307/)
- [JFrog: Beta9 Host Filesystem Exposure via Volume Path Traversal](https://research.jfrog.com/vulnerabilities/beta9-is-vulnerable-to-host-filesystem-exposure-via-volume-path-traversal-cve-2026-120308/)
- [JFrog: Beta9 Build Worker Sandbox Escape via Chroot-only Buildah Isolation](https://research.jfrog.com/vulnerabilities/beta9-is-vulnerable-to-a-build-worker-sandbox-escape-via-chroot-only-buildah-isolation-cve-2026-120306/)
- [NVD: CVE-2026-120306](https://nvd.nist.gov/vuln/detail/CVE-2026-120306)
- [NVD: CVE-2026-120307](https://nvd.nist.gov/vuln/detail/CVE-2026-120307)
- [NVD: CVE-2026-120308](https://nvd.nist.gov/vuln/detail/CVE-2026-120308)
- [GitHub: beam-cloud/beta9 pull request #1897](https://github.com/beam-cloud/beta9/pull/1897)
- [JFrog: Prefab UI Remote Code Execution via a Pyodide js Bridge to Deno](https://research.jfrog.com/vulnerabilities/prefab-ui-is-vulnerable-to-remote-code-execution-via-a-pyodide-js-bridge-to-deno-cve-2026-120338-jfsa-2026-001699278/)
- [NVD: CVE-2026-120338](https://nvd.nist.gov/vuln/detail/CVE-2026-120338)
- [OpenAI Help Center: Data controls in ChatGPT](https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt)
- [The Decoder: OpenAI plans to train models on Daybreak Blue cybersecurity session data that was previously off-limits](https://the-decoder.com/openai-plans-to-train-models-on-daybreak-blue-cybersecurity-session-data-that-was-previously-off-limits/)
- [NVD: CVE-2026-118938](https://nvd.nist.gov/vuln/detail/CVE-2026-118938)
- [GitHub: trailofbits/fickling pull request #343](https://github.com/trailofbits/fickling/pull/343)
- [Anthropic Alignment Science Blog: Automated Subtle Emergent Misalignment Research](https://alignment.anthropic.com/2026/automated-em-search/)
- [The Decoder: Beekeeping tips and wrestling advice can train AI models to sabotage oversight](https://the-decoder.com/beekeeping-tips-and-wrestling-advice-can-train-ai-models-to-sabotage-oversight/)
- [NVD: CVE-2026-120191](https://nvd.nist.gov/vuln/detail/CVE-2026-120191)
- [NVD: CVE-2026-120192](https://nvd.nist.gov/vuln/detail/CVE-2026-120192)
- [VulnCheck: DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter](https://www.vulncheck.com/advisories/deepinfer-through-0.1.0-path-traversal-via-profile-output-dir-parameter)
- [GitHub: deepseek-ai/DeepInfer pull request #242](https://github.com/deepseek-ai/DeepInfer/pull/242)
- [Northflank Status: Security incident](https://status.northflank.com/cmvv0rn5a092f14rutwccodpp)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

*Informational security guidance. Not certification.*