Triple-Stage AI Attack Chain Hits PyTorch
8 concept nodes
Visual TL;DR
Untrusted PyTorch model fileDriver
an attacker supplied torch checkpoint opened by a victim application
From the article 6 mentionsTwo independent researchers demoed a triple-stage AI attack chain at Black Hat Asia 2026 that turns a PyTorch model file into remote code execution even with weights_only set to True.
Triple-stage exploit chainCore
model file to memory corruption to remote code execution in three linked steps
From the articleTwo independent researchers demoed a triple-stage AI attack chain at Black Hat Asia 2026 that turns a PyTorch model file into remote code execution even with weights_only set to True.
OpenSearch demo compromiseOutcome
researchers demonstrated the full chain against a live OpenSearch deployment on stage
loaded by
torch.load with weights_only=TrueContext
mode docs called secure but still dispatches to torch.jit.load on TorchScript
From the article 5 mentionsThe researchers found torch.load with weights_only=True still calls torch.jit.load if the file is TorchScript format, and TorchScript exposes high-risk operators like torch.save and torch.from_file.
reaches
TorchScript as_strided bugDriver
C++ memory safety underflow in the as_strided operator exposed to loading path
From the articleCalling the API directly in Python reproduced the bug, but saving it via forward into a TorchScript file and reloading with torch.load with weights_only True initially hid it.
Untrusted PyTorch model fileDriver
an attacker supplied torch checkpoint opened by a victim application
From the article 6 mentionsTwo independent researchers demoed a triple-stage AI attack chain at Black Hat Asia 2026 that turns a PyTorch model file into remote code execution even with weights_only set to True.
loaded by
torch.load with weights_only=TrueContext
mode docs called secure but still dispatches to torch.jit.load on TorchScript
From the article 5 mentionsThe researchers found torch.load with weights_only=True still calls torch.jit.load if the file is TorchScript format, and TorchScript exposes high-risk operators like torch.save and torch.from_file.
reaches
TorchScript as_strided bugDriver
C++ memory safety underflow in the as_strided operator exposed to loading path
From the articleCalling the API directly in Python reproduced the bug, but saving it via forward into a TorchScript file and reloading with torch.load with weights_only True initially hid it.
yields
Heap underflow primitiveEffect
attacker controls arbitrary read and write over process memory via crafted strides
From the articleA second check rejects storage_offset less than zero, which is why minus 1 fails but 2^62 minus 1 succeeds and returns 0x41, the glibc heap chunk header, confirming an underflow.
enables
Triple-stage exploit chainCore
model file to memory corruption to remote code execution in three linked steps
From the articleTwo independent researchers demoed a triple-stage AI attack chain at Black Hat Asia 2026 that turns a PyTorch model file into remote code execution even with weights_only set to True.
first attempt
Initial PoC failsEffect
model serialization changes broke the researchers first weaponized proof of concept
forces pivot
RCE via native gadgetsOutcome
researchers pivoted from pickle RCE to native code execution through the underflow primitive
proven in
OpenSearch demo compromiseOutcome
researchers demonstrated the full chain against a live OpenSearch deployment on stage