PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Uncovering memory corruption in NVIDIA Triton (as a new hire)

blog.trailofbits.com | blog | #ai-security | #memory-corruption | #vulnerability-disclosure | #ai-infrastructure | #static-analysis | #nvidia-triton | #semgrep | #pwn2own
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

In my first month at Trail of Bits as an AI/ML security engineer, I found two remotely accessible memory corruption bugs in NVIDIA's Triton Inference Server during a routine onboarding practice.
Published
Collected

Related coverage

research · starlabs.sg
Race Against The Patch: The Evolution of Four Exploit Chains in LiteLLM
How we developed four complete full-chain exploits across four LiteLLM versions in a race against a target that kept getting patched under our feet, in preparation for Pwn2Own Berlin 2026.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · blog.trailofbits.com
35 more Semgrep rules: infrastructure, supply chain, and Ruby
Trail of Bits published 35 new Semgrep rules (115 total) covering GitHub Actions OIDC gaps, Terraform/Nomad infrastructure issues, and Ruby flaws, plus a deep dive into regex mode and HCL support.
blog · blog.trailofbits.com
Announcing the Trail of Bits and Semgrep partnership
Trail of Bits announces a partnership with Semgrep to drive broader adoption of static analysis, calling it a first-line audit tool for finding low-complexity bugs without building the code.
blog · blog.trailofbits.com
Streamline your static analysis triage with SARIF Explorer
Trail of Bits released SARIF Explorer, a VSCode extension for triaging static analysis results: open many SARIF files, classify findings as bugs or false positives, filter, and file GitHub issues.
Back