↓ Skip to main content
the template that ran commands: a 9.9 in GitLab AI Gateway
  1. Signal Loop/

the template that ran commands: a 9.9 in GitLab AI Gateway

·842 words·4 mins·
Newsletter Ai Security
Author
Prakash Ayyanagoudar
Table of Contents
An antique brass key lying across a brass letterpress stencil plate on a dark desk, beside the headline “the template ran the command”

Jugaad is a fix that works today and breaks tomorrow. Some weeks the AI news is mostly that: quick patches on top of quick patches.

This week there is one story where the pattern is in the record, with a CVE number.

the tell
#

GitLab AI Gateway is the service that connects a GitLab instance to AI models. On 2 October GitLab published CVE-2026-90970, scored 9.9 out of 10.

Per GitLab’s advisory, as reported by The Hacker News, a logged-in user with Duo Agent Platform access could escape the prompt template sandbox through a specially crafted flow configuration. The result: arbitrary commands on the gateway host.

Only self-hosted gateways need to act. GitLab.com, GitLab Dedicated and instances using a GitLab-hosted gateway are covered, per GitLab.

gateway version in usefirst fixed version
18.1.6 up to before 19.2.419.2.4
19.3 before 19.3.219.3.2
19.4 before 19.4.119.4.1

The detail I keep rereading: in February GitLab fixed CVE-2026-1868, also 9.9, reached through a crafted flow definition. Both are template engine weaknesses (CWE-1336). The new advisory does not mention the old one.

My read: a template is code that someone else gets to write. Calling the box around it a sandbox does not make it one.

hype meter
#

3 out of 5 hype (1 = mostly signal, 5 = mostly hype) · “Anthropic’s new OSS Scanner needs no human review” · the process is real, but every number is Anthropic’s own.

Reported figures, all self-reported: more than 29,000 candidate vulnerabilities, a little over 6,000 reported to maintainers, 584 advisories as of 2 October. Read that funnel again. Roughly 29,000 became 6,000 became 584. Filtering is clearly happening somewhere, and “no human review” is the part I would want explained. The article cites no independent testing. Vendor claim, unverified.

what i’m ignoring
#

  • Statements that AI makes attacks cheaper, made by officials without a technical write-up behind them. Fine as a mood, not usable on a Monday.
  • A 440% growth figure for blockchain dead drops, tied by its source to the launch of open Chinese AI models. A correlation dressed as a cause. Until the method is clear, I leave it.
  • Any “AI scanner found thousands of bugs” line without a count of how many were real.

the real one
#

If you run a self-hosted AI Gateway, this is the week’s work. Update to the fixed version for your line. GitLab lists no workaround, and the advisory gives no way to tell whether a gateway was attacked before you patched.

GitLab’s own install guide says the gateway’s JWT signing keys must be treated as sensitive credentials, and the gateway sits between your instance and your model providers. So if you cannot rule out misuse, think about what a host like that can reach.

Caveats: CISA’s note on the CVE record lists exploitation as “none” as of 2 October. The attack conditions are not described in public, so I cannot tell you how hard this is to pull off.

tools worth a look
#

Read on 9 October 2026. All three are open source with recent commits. Not tested by me yet. Read the code before you run it.

  • garak (9.5k stars, Apache-2.0): a scanner that probes an LLM for known weak spots.
  • PyRIT (4.6k stars, MIT): Microsoft’s framework for finding risks in generative AI systems.
  • TruffleHog (28.4k stars, AGPL-3.0): finds and verifies leaked credentials, which matters when a service holds signing keys.

the part that stays
#

Security angle: AI features arrive as new surfaces on old platforms, and a flow editor that lets users write templates is a code path. The 9.9 in February and the 9.9 in October point at the same door.

Human angle: “AI gateway” sounds like plumbing, so it gets patched like plumbing, late and by whoever remembers. I don’t think anyone owns it by default.

Honestly? I don’t know whether the second fix is deeper than the first. I would like to see it explained.

do this week
#

  1. Find every AI gateway, proxy or flow builder in your environment, including the ones a team stood up on its own. Write down who owns each.
  2. For self-hosted GitLab AI Gateway, confirm the version against the table above.

Who owns the thing that runs your templates?

a sandbox is a promise. the template was written by someone else.

sources
#

Stay patched. Stay paranoid. Maximum effort.

i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.

Related