LLMSmith：LLM 集成应用的 RCE 漏洞 (AML.CS0052)

一句话通俗理解

11 个主流 LLM 框架里挖出 20 个 RCE——从提示词注入一路打到系统 shell。

维度	内容
案例类型	演练 / 安全研究
发生时间	2025-02-27
攻击者	Researchers at University of Chinese Academy of Sciences, Shandong University, and University of New South Wales
受害目标	LLM Integration Frameworks

研究者跨 11 个 LLM 框架识别出 20 个远程代码执行漏洞：部署在公网的 LLM 集成应用可经提示词注入升级为代码执行，进而植入 Python 反向 shell 实现系统完整控制——演示了从 AI 层攻击直达主机层的完整链路。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0052 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

开发能力 (AML.T0017)

The researchers performed a static analysis on the APIs of target LLM frameworks to identify functions that execute code from either user input or the response from an LLM and are thus vulnerable to RCE.

搜索应用仓库 (AML.T0004)

The researchers performed targeting to identify applications that are likely built with LLM Frameworks and may use the functions vulnerable to RCE. This was done by scanning source code repositories for app deployment URLs.

调用链 (AML.T0084.003)

The researchers ran their static analysis to extract call chains from target application’s source code to identify those that utilize LLM framework functions vulnerable to RCE.

LLM 提示词构造 (AML.T0065)

The researchers developed prompts to trigger tool invocations that lead to RCE.

利用面向公众的应用 (AML.T0049)

The researchers targeted public-facing applications that expose an AI agent to user input as a means to execute their prompts.

直接提示词注入 (AML.T0051.000)

The researchers directly prompted the AI agent with their malicious instructions.

LLM 越狱 (AML.T0054)

For target applications where the AI agent refused the researcher’s request, they used lightweight jailbreaking strategies to bypass the LLM’s guardrails.

AI 智能体工具调用 (AML.T0053)

The researchers’ prompts called the AI agent’s tools, targeting call chains that can lead to code execution.

命令与脚本解释器 (AML.T0050)

The code included in the researcher’s prompts was executed in a sandboxed Python interpreter.

逃逸到宿主机 (AML.T0105)

The researchers included code escape techniques designed to bypass any limitations a sandbox may place on code execution.

网络通信信道 (AML.T0072)

The Python code opened a reverse shell which was used as a command and control channel.

本地 AI 智能体 (AML.T0112.000)

The researchers gained full control of the system running the LLM-integrated application.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0