The US cybersecurity agency CISA officially classified the vulnerability CVE-2025-62593 in the open-source AI framework Ray as actively exploited on August 17, 2026. A flaw in the browser defense lets attackers execute code as soon as a developer running Ray visits a crafted webpage – no download or link click required.
Flawed Browser Check Opens the Door to Foreign Code
Ray is an open-source framework from provider Anyscale that lets companies train machine learning across distributed computing clusters – it underpins numerous AI projects. The flaw documented in the GitHub security advisory carries a severity rating of 9.4 out of 10. Ray normally checks whether a request comes from a browser by verifying that the User-Agent header starts with “Mozilla.” That check can be bypassed, though: in Firefox and Safari, a webpage can set the header itself via the Fetch API. Combined with a DNS rebinding attack – where a malicious site tricks the browser into treating it as identical to the locally running Ray server – commands can be sent directly to endpoints such as /api/jobs/ to execute arbitrary code there. Security researchers from Oligo Security and the platform Socket.dev reported the flaw, and the fix was published on November 26, 2025.
RondoDox Attacks Before the Official Warning
As an analysis by Bitsight shows, the botnet RondoDox began exploiting the flaw on November 24, 2025 – two days before the official release. That suggests the operators actively monitor pre-release vulnerability disclosures and deploy available proof-of-concept code immediately. Notably, RondoDox sent the header “Mozilla/5.0 (rondo2012@atomicmail.io)” in its requests – technically sloppy, but enough to pass the weak Mozilla check, without even needing the intended detour through a third-party browser. That shows direct network access to an unprotected Ray instance can theoretically be enough on its own. RondoDox is considered a particularly aggressive botnet, Bitsight found, having exploited 174 different vulnerabilities in total between May 2025 and February 2026, with 49 exploited on a single day in October 2025. By adding the flaw to its catalog of known exploited vulnerabilities, CISA now officially confirms the Ray gap is part of this active attack wave.
Anyscale Closes the Gap, Older Ray Attack Stays Separate
Ray 2.52.0 fixes the vulnerability and adds optional token-based authentication as an extra layer of protection. Anyone running the software for their own AI projects should update immediately and keep the Ray dashboard off the open internet. The patch is available for free via the Python package manager pip and on GitHub, with no license change attached. Distinct from the current flaw is the separate campaign ShadowRay 2.0, which attackers have been running since November 2025, according to Oligo Security: it exploits an older, 2023-reported vulnerability with missing authentication to turn Ray clusters into cryptomining botnets. It’s also not the first case this summer of CISA classifying an AI platform as actively attacked – in early August, the agency declared a flaw in the automation platform Langflow actively exploited.
What remains open is how many Ray installations worldwide are still exposed unprotected on the internet. What will matter is whether AI infrastructure operators start rolling out security updates faster – before attackers like RondoDox turn available proof-of-concept code into automated attack tooling.
