Product
medium
advisory
Detection of Local LLM Model File Creation on Endpoints
2 rules 5 TTPsThis brief describes how the creation of Large Language Model (LLM) files, including formats like .gguf, .safetensors, .ggml, and Modelfiles, by local AI inference frameworks such as Ollama, llama.cpp, GPT4All, and LM Studio can be detected on Windows endpoints, indicating potential shadow AI deployments, unauthorized model downloads, or rogue LLM infrastructure which poses data exfiltration risks and policy violations.
Ollama +9
shadow-it
llm
data-exfiltration
policy-violation
endpoint
shadow-ai
local-llm
intellectual-property-theft
+2
2r
5t
high
advisory
LangSmith SDK Untrusted Manifest Deserialization Vulnerability
2 rules 3 TTPsThe LangSmith SDK is vulnerable to untrusted manifest deserialization when pulling public prompts via `pull_prompt`, potentially leading to SSRF, prompt injection, or sensitive data exposure; CVE-2026-45134.
langsmith +2
deserialization
ssrf
prompt-injection
2r
3t