rules-ai-ml

AI model for vector embeddings is being changed. This will invalidate all existing vector indices.

Detected potential hardcoded vector database API key (e.g., Pinecone, Weaviate).

RISK: mlflow.*load_model() deserializes models that may contain pickle payloads, conda environments, or custom Python code executed at load time. Loading a model from an untrusted registry or artifact store is equivalent to running untrusted code. FIX: only load models from registries you control; verify artifact checksums (MLflow >= 2.13 supports artifact signing); prefer safetensors/ONNX export for inference.

RISK: torch.load() without weights_only=True deserializes arbitrary Python objects via pickle (CVE-2025-32434 — PyTorch < 2.6 allows RCE even with weights_only=True on some paths; attacker-controlled model files are a live attack vector on Hugging Face). FIX: upgrade PyTorch >= 2.6 and always call torch.load(path, weights_only=True), or switch to safetensors.load_file() which has no deserialization attack surface.

Blocked direct deletion of vector database indices or namespaces (Pinecone, Chroma, etc.).

RISK: passing LLM response content directly to exec() or eval() is prompt-injection-to-RCE (CWE-95). An adversarially crafted user message or retrieved document can cause the model to return malicious code that executes in your process. FIX: never eval/exec LLM output; parse structured outputs via JSON schema validation or a restricted DSL interpreter.

Detected vector database query without metadata filters. This could lead to cross-tenant data bleed.