CVE-2026-84809

Executive Summary

CVE-2026-84809 describes a security weakness in Tencent's AI-Infra-Guard skill-scan component, a tool designed to vet AI/LLM "skills" or plugins before operator installation. The component fails to scan compiled Python bytecode (.pyc, .pyo, .pyd files) because it unconditionally excludes __pycache__ directories and these file extensions via hardcoded skip lists across multiple scanning surfaces. An attacker can craft a skill package that contains benign-looking Python source files alongside malicious compiled bytecode; the scanner returns a "safe" verdict, and code execution is achieved when an operator installs and imports the skill. The vulnerability has a CVSS score of 6.5 (Medium-High) with high integrity impact, and as of the time of writing, no patch is available from any tracked source.

Technical Analysis

Vulnerability Class: CWE-693 (Protection Mechanism Failure) — the scanning tool implements a protection mechanism (malicious code detection) that fails because it excludes an entire class of executable content from analysis.

Mechanism: The AI-Infra-Guard skill-scan component is responsible for auditing third-party "skills" (plugin modules for AI agents/frameworks) prior to installation. The scanner is designed to detect malicious Python source code. However, the scanning logic contains hardcoded exclusion lists applied uniformly across multiple scanning surfaces (e.g., filesystem traversal, archive extraction, and possibly repository fetches). These skip lists explicitly exclude:

• Directories named __pycache__ (Python's bytecode cache directory).
• Files with the extensions .pyc (compiled Python bytecode), .pyo (optimized bytecode — deprecated in Python 3.5+, still recognized by older tooling), and .pyd (Windows-compiled Python extension modules, analogous to shared libraries).

Why the flaw is exploitable: Python's import system automatically looks for and executes bytecode files. When a .py module is absent (or when __pycache__ is present), the interpreter will load and execute .pyc files directly. A .pyd file is a native shared library that is executed as a Python extension module. These formats are executable code, not inert data. Because the scanner's skip lists cause it to never open or inspect these files (neither statically nor heuristically), a malicious package containing only a .pyc file under the name of a module used in the skill (or an import hook triggering .pyc execution) would evade detection entirely.

Attack surface: The attack vector is network-based (CVSS: AV:N) but requires user interaction (UI:R — the operator must install the skill). The scanner is a pre-installation analysis tool; the flaw is that it produces a false "clean" report, luring the operator into a state of false trust. The skill distribution mechanism itself mirrors a supply-chain vector: a malicious actor publishes a skill to a package registry, a shared repository, or via social engineering (phishing link), relying on the scanner's bogus approval to persuade the target to install it.

Technical detail availability: The NVD description does not disclose the specific code locations (class names, function identifiers, or configuration file paths) of the hardcoded skip lists, nor does it specify which scanning surfaces are affected in detail. Analysis in this report stays at the vulnerability-class level.

Exploitation Scenarios

No public PoC exists. The attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification: The attacker identifies an enterprise, team, or individual using Tencent's AI-Infra-Guard skill-scan component as part of a CI/CD pipeline or manual skill-approval workflow. Targets are chosen based on the value of their AI infrastructure (prompt data, internal APIs, model weights) and the likelihood they rely on third-party skills.

Step 2 — Triggering the Flaw: The attacker crafts a malicious skill package. The package is structured so that all .py files are benign (for example, a legitimate wrapper module). The payload lives in a __pycache__/ subdirectory as a .pyc file, or as a .pyd module in the package root. When the scanner runs, its file traversal hits the __pycache__ directory or the compiled extension and skips the entry entirely per the hardcoded exclusion rules. The scanner's final report lists the package as clean.

Step 3 — Payload Execution: The package is delivered to the target (via a public skill registry, a shared artifact repository, or a spear-phishing link). The target operator runs the skill-scan tool, receives a "safe" verdict, and installs the skill into their AI agent framework. When the skill is loaded (e.g., the framework imports the skill's module), Python's import machinery loads the malicious .pyc or .pyd file — either because it exists alongside the benign .py stub (and has a matching .pyc that takes precedence in some configs) or because the skill imports the module by name that resolves to the malicious bytecode. Code executes in the context of the operator's runtime environment.

Step 4 — Post-Exploitation Impact: The CVSS vector indicates high integrity impact (I:H) but no confidentiality or availability impact (C:N / A:N). This suggests the typical payload is integrity-focused and evasive: e.g., a backdoor that silently modifies the AI framework's responses, poisons the model's output, exfiltrates credentials used by other modules, or replaces legitimate skill functions with malicious wrappers — without announcing its presence or crashing services. Successful exploitation grants the attacker a foothold inside the AI infrastructure's trust boundary, enabling lateral movement to connected data stores or model-versioning systems. Repeated installations of the same skill across a fleet of agents would spread the malicious code broadly.

Impact Assessment

Business impact: The primary risk is to organizations that treat AI-agent skills as trusted, semi-validated components. A false "safe" verdict from the scanning tool erodes the entire security posture of the approval pipeline. Attackers who successfully plant a malicious skill gain the ability to alter the behavior of AI systems that may handle sensitive data, make automated decisions, or interact with production APIs — an integrity breach that can cascade into indirect financial, operational, and reputational damage.

CVSS context (6.5, High): Attack Complexity is Low (AC:L), meaning no special conditions are required; Privileges Required is None (PR:N) for the attacker, but User Interaction is Required (UI:R) — the operator must trigger installation. Scope is Unchanged (U). The confidentiality and availability scores are None, but integrity is High. This reflects a stealth-focused, tampering-oriented payload rather than a destructive or data-stealing first-stage.

Blast radius: Any environment using AI-Infra-Guard skill-scan is directly exposed. Downstream impact includes: tampered model outputs, injected system prompts, theft of API keys stored in skill configuration, and manipulation of logs or telemetry (since the malicious module runs with the privileges of the skill host). Over time, every operator who used the scanner to approve a skill from an untrusted publisher is potentially affected.

Critical note: Because there is no patch and no vendor workaround, the vulnerability is fully exploitable in any current deployment. There is no CISA KEV listing, indicating no known exploitation in the wild as of this reporting, but the high integrity impact and ease of evasion make this a likely candidate for weaponization once public PoCs surface.

Detection Guidance

Detection is challenging because the malicious payload is invisible to the scanner itself. The detections below focus on the anomaly of executable bytecode in skill packages and the behavior of Python importing compiled files from unusual locations.

Sigma Rule

title: Suspicious Compiled Python Bytecode in Skill Package
id: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects skill packages that contain compiled Python bytecode (pyc/pyo/pyd) while the scanner is expected to verify source. Indicates possible CVE-2026-84809 evasion attempt.
logsource:
    product: application
    service: ai_skill_scanner
detection:
    selection_module_import:
        event: skill_import
        file.extension:
            - 'pyc'
            - 'pyo'
            - 'pyd'
    selection_pycache_access:
        event: filesystem_access
        file.path|contains: '__pycache__'
    condition: selection_module_import OR selection_pycache_access
level: medium
falsepositives:
    - Legitimate pre-compiled optimization of own internal skills
    - Some skill packages ship .pyc for IP protection (rare in skills ecosystem)
fields:
    - file.path
    - skill.name
    - operator.user

YARA Rule

rule CVE_2026_84809_CompiledBytecodeEvasion
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects suspicious compiled Python bytecode in a skill/plugin package that should contain only source files per AI-Infra-Guard scanner assumptions."
        date = "2026-06-30"
        reference = "CVE-2026-84809"
        severity = "medium"

    strings:
        $pyc_header_v2 = { 03 F3 0D 0A }        // Python 2.7 magic
        $pyc_header_v37 = { 42 0D 0D 0A }       // Python 3.7 magic
        $pyc_header_v38 = { 55 0D 0D 0A }       // Python 3.8 magic
        $pyc_header_v39 = { 61 0D 0D 0A }       // Python 3.9 magic
        $pyc_header_v310 = { 6F 0D 0D 0A }      // Python 3.10 magic
        $pyc_header_v311 = { 71 0D 0D 0A }      // Python 3.11 magic
        $pyc_header_v312 = { CB 0D 0D 0A }      // Python 3.12 magic

        $pyo_deprecated = { 03 F3 0D 0A }       // same as pyc for py2.7
        $pe_dll_extension = ".pyd" ascii nocase
        $pyc_path = "__pycache__" ascii nocase

    condition:
        uint32(0) in (0x00000000..0xFFFFFFFF) and
        (
            ($pyc_header_v2 or $pyc_header_v37 or $pyc_header_v38 or
             $pyc_header_v39 or $pyc_header_v310 or $pyc_header_v311 or
             $pyc_header_v312) and
            ($pyc_path or $pe_dll_extension)
        )
}

Suricata IDS Rule

Suricata is layer-3/4 network-focused; applicable detection would inspect SMB/NFS fileshare traffic or HTTP skill-downloads for suspicious file extensions.

alert http any any -> any any (
    msg:"CVE-2026-84809 Potential Skill Package with Malicious Compiled Python";
    flow:to_client,established;
    file.name: /\.py[co]|__pycache__/;
    file.name: /\.pyd$/;
    content:"Content-Type: application/octet-stream";
    within: 100;
    sid: 20268480901;
    rev: 1;
    metadata: cve CVE-2026-84809, severity medium;
)

Elastic Detection

EQL detection for filesystem-level anomalies: skill-package traversal hitting __pycache__ or imports of .pyc.

sequence by process.entity_id
  [file where (
      process.name : "python*.exe" or process.name : "ai-infra-guard*"
  ) and file.path : "*__pycache__*"
  and file.name : "*.pyc"]
  [process where event.action == "exec"
   and process.command_line : "*import*"
  ]

Splunk SPL Query

index="ai_security" sourcetype="skill_scan_log" OR sourcetype="artifact_download"
| where match(file_path, "(?i)(__pycache__|\\.pyc$|\\.pyo$|\\.pyd$)")
| stats count by file_path, event_action, operator, skill_name, src_ip
| where count > 0
| eval threat_flag = "CVE-2026-84809 compiled-bytecode evasion candidate"
| table _time, operator, skill_name, file_path, event_action, src_ip

Wazuh OSSEC Rule

XML rule to trigger on Wazuh Sysmon or FIM logs detecting compiled bytecode inside a skill-scan directory.

<group name="cve-2026-84809,">
  <rule id="100851" level="10" frequency="3">
    <if_sid>550</if_sid>
    <field name="win.event.data.DestinationFilename" regex="(?i)^.*(__pycache__|\.pyc|\.pyo|\.pyd).*$"/>
    <description>CVE-2026-84809: Python compiled bytecode detected in AI-Infra-Guard skill directory; potential evasion from malicious skill package.</description>
    <group>sysmon_event_11_file_create,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED.

No vendor advisory, no version-bump commit, no package update, and no SBOM/OSV entry for this CVE exists in the monitored ecosystem. Tencent has not acknowledged the flaw publicly at the time of writing.

Immediate mitigations (do not wait for a patch):

1. Stop using the AI-Infra-Guard scan result as a sole approval gate. Introduce a mandatory secondary human review for any skill whose package contents do not show a 1:1 mapping of source .py files to .pyc artifacts. Reject any package containing a .pyd, .pyo, or .pyc file unless a legitimate supply-chain reason is documented.
2. Manual preflight check: Prior to installation, list all files recursively (find /path/to/skills -name "*.pyc" -o -name "*.pyo" -o -name "*.pyd") and remove any compiled bytecode before installation. Force a recompile from source (e.g., delete __pycache__ directories) to disable attacker-supplied bytecode.
3. Isolate skill execution: Run all AI skill modules in a sandboxed environment (container, restricted user, no network) during the first execution. Monitor for unexpected syscalls or network connections.
4. Hashing & provenance: Track SHA-256 of skill-package contents. If a package mutates (e.g., a .pyc appears after the scanner ran but before installation), reject it.
5. Registry hygiene: If skills are fetched from a public registry, pin to a specific package version and verify the maintainer identity independently of the scanner.

Patch / upgrade steps:

• None available. Monitor Tencent's GitHub and security bulletin pages for AI-Infra-Guard for an update that removes the __pycache__ / .pyc / .pyo / .pyd exclusion lists or replaces "skip" with "deep-analyze."
• Subscribe to CVE feeds for CVE-2026-84809 to get real-time notifications of a patch or vendor advisory.

Long-term hardening:

• The root weakness is the assumption that file type implies safety. Harden the scanner to treat compiled Python as higher risk than source code, not as skip-worthy. This requires a design change in AI-Infra-Guard — no client-side workaround may suffice.
• Adopt a "no compiled code" policy for all skills in the organization until the vendor remediates; compile-in-house from reviewed source only.
• Add third-party tooling to the CI pipeline (e.g., a standalone bytecode disassembler or sandbox-execution test) that does not inherit the hardcoded skip lists.
• Document this CVE in your threat model; treat skill installations as a supply-chain boundary even after a patch rolls out, given that scanners inherently can only detect known-good patterns.

References

1. NVD Entry (official): https://nvd.nist.gov/vuln/detail/CVE-2026-84809 — CVE record with NVD description and CVSS vector.
2. Tencent AI-Infra-Guard (project home): https://github.com/Tencent/AI-Infra-Guard — Monitor for patch commits (note: CNA attribution implies Tencent is the project maintainer).
3. CWE-693 Reference (MITRE): https://cwe.mitre.org/data/definitions/693.html — "Protection Mechanism Failure," the underlying weakness class.
4. Python bytecode security research (context): https://www.anvilsecure.com/blog/python-malware-analysis.html — Reference describing malicious .pyc/.pyd techniques, useful for detection engineering (not a PoC for this CVE).
5. CISA KEV (check current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-84809 is not listed; no known exploit-in-the-wild evidence exists as of the publication date of this report.

Threat-actor campaign note: No public campaign ties to this CVE currently. Threat intelligence suggests that AI-framework plugin supply-chain tampering is an emerging and actively researched attack surface, and this evasion technique (bytecode over source) is well-established, so weaponization should be considered probable within the next 6–12 months — even absent a public PoC today.