CNCERT: typical vulnerability risks from the 2026 AI large-model security crowdsourced test
CNCERT reported 873 vulnerabilities from a 2026 crowdsourced test of 54 large-model and agent products at 25 domestic AI vendors. Findings included 608 model- and agent-specific issues and 265 traditional flaws, with recommended controls focused on untrusted output handling and least privilege.
Crowdsourced test totals
On 15 September 2026, results of the 2026 artificial intelligence large-model security crowdsourced test were released during China's National Cybersecurity Awareness Week. The campaign mobilized 2,467 white-hat researchers to test 54 large-model and agent application products from 25 domestic AI vendors. Testers reported 873 security vulnerabilities. Of those, 608 were specific to large models and agent applications, and 265 were traditional vulnerabilities.
CNCERT issued a bulletin on typical risks and recommended controls.
Prompt injection, disclosure, and untrusted output
Prompt-injection flaws remain the most common large-model risk. Impact includes altered model behavior, bypass of safety restrictions, and unauthorized actions when the model treats untrusted retrieved content as instructions.
Information-disclosure flaws were common and carry substantial impact. Impact includes output of personal identifiable information (PII), credentials, and internal material such as model parameters and safety rules. One product had hardcoded API keys that exposed keys for 239 models on a cloud platform shared by all users.
Some products mishandled model output, with severe impact. When generated content is used by downstream systems without validation or filtering, that content can be executed or forwarded. One assistant-mode product allowed remote command execution and privilege escalation because output was not verified before use.
Claw-class agent findings
Agent identity and permission-abuse flaws were frequent. Impact includes agents impersonating or over-inheriting credentials across multi-agent delegation chains and context-memory defects, then operating beyond intended access boundaries. One product's task-takeover mechanism could be influenced by forged instructions, with impact including business interruption and sensitive-information exposure.
Agent goal-hijacking flaws were less visible and can produce unintended high-risk actions. Impact includes a change to the agent's original task objective. One agent lacked effective intent checks on input instructions and exposed API keys, tokens, and other core configuration for unpaid calls to an official platform.
Some products allowed unintended code execution, with severe impact. Impact includes generation of unverified scripts or system commands that then run. One agent's sandbox process-management service API was exposed and allowed arbitrary system commands to run with administrator privileges.
Traditional flaws in AI-facing services
The test found 265 traditional security vulnerabilities, 30.4 percent of the total. AI system architectures are technically complex, but externally exposed interfaces and services still follow conventional application software patterns, so classic flaws remain. One large-model product had a vertical privilege-escalation issue that could yield full administrative access to the site.
Controls and a closed remediation loop
CNCERT recommended that operators treat large-model output as untrusted input, require verification and encoding, and check downstream actions such as outbound links and code execution. Model-generated code and tool calls should run in isolated environments such as sandboxes. Operators should apply strict input and output validation and filtering, follow least privilege, and avoid over-authorization.
Sensitive instructions should be held in a secure configuration store. Queries that contain keywords such as "system prompt" should be blocked. Agent deployments should apply least privilege, add intent and parameter checks, strengthen call auditing and circuit-breaker controls, and interrupt chained risk. Data supplied to models should be minimized, sensitive data should be masked, context boundaries and output checks should be enforced, and session logs should be retained in desensitized form.
Operators should audit suppliers, verify third-party model signatures and data provenance, and regularly assess third-party AI components, frameworks, pretrained models, and datasets. Traditional vulnerability controls should remain in place on AI-facing interfaces.
CNCERT also recommended combining crowdsourced testing with model-assisted discovery, and building monitoring and early warning for AI security risk. Through vulnerability-sharing channels, reporting, analysis, remediation, and fix verification should form a closed loop. The bulletin described that mix of external testing and ongoing monitoring as the intended way to raise AI risk-control capacity.