Over thirty-four (34) security vulnerabilities, including multiple critical vulnerabilities, have been identified in open-source AI and ML tools through Protect AI’s “huntr” bug bounty program, affecting widely-used toolkits like Lunary, Chuanhu Chat, and LocalAI. Two (2) of the most severe vulnerabilities in Lunary (CVE-2024-7474 and CVE-2024-7475), each with a CVSS score of 9.1/10, involve insecure direct object reference and improper access control, allowing attackers to view, delete user records, or manipulate authentication processes by altering the SAML configuration. In Chuanhu Chat, a GUI for ChatGPT, a path traversal flaw (CVE-2024-5982) allows remote code execution (RCE), arbitrary directory creation, and data leakage from CSV files. LocalAI, a platform for locally hosted AI models, is impacted by a high-severity RCE bug (CVE-2024-6983), enabling malicious configuration uploads, and a timing attack vulnerability (CVE-2024-7010), allowing attackers to guess API keys by measuring server response times. Protect AI also highlighted the vulnerabilities in these tools as significant risks in the AI model supply chain, emphasizing that open-source tools like these, downloaded thousands of times monthly, are integral to enterprise AI systems. Protect AI’s Vulnhuntr tool aids in uncovering such vulnerabilities, while updates are recommended to mitigate these security risks. These flaws have been patched, and CTIX analysts recommend any users leveraging the affected open-source AI tools update to the most secure versions to prevent exploitation.