The Vulnerability in the Routing Layer

This is an illustrative scenario, not a report of a specific incident. No real company is described. The mechanism is drawn from observed failure patterns; the figures are indicative, not measured.

The situation

A company built an internal agent platform on open-source components: a routing wrapper to direct prompts between models, a vector store, an orchestration layer. Standard architecture. Almost entirely third-party code.

What went wrong

An attacker exploited a deserialization flaw in the routing layer, which was running on production application servers. The flaw was a known vulnerability class that had nothing to do with AI; it was simply inherited, along with everything else the package brought.

The mechanism worth understanding

Your AI stack is a software supply chain, and it inherits every weakness in it. The AI-specific parts are the visible ones. The routing, caching and serialisation layers underneath are ordinary software with ordinary vulnerabilities, and they run with whatever privileges the platform has.

Agent frameworks make this worse in one specific way: they usually need broad network access and credentials to reach models and tools. A remote code execution in the routing layer therefore lands in a process that already holds keys to several other systems.

What actually prevents this

• Ephemeral, isolated execution for agent runtimes — containers or micro-VMs, not shared application servers.
• Dependency inventory and patch cadence for the whole stack, not just the AI libraries.
• Least privilege on the runtime itself, so a compromise in the router does not inherit the platform's full permissions.
• Egress control, so an execution in the routing layer cannot reach anything it was not meant to.

What it costs when it happens

Remediation and forensic work following a remote code execution in a production platform typically lands in five figures for an SME. Indicative, not measured.

The question to ask this week

Ask for the dependency list behind your agent stack, including the routing and serialisation layers. Then ask when each was last patched. Most organisations can answer the first question and not the second.