Over eight months, the same component broke the same way, twice. In February 2026, GitLab's AI Gateway โ the Duo Workflow Service โ carried a CVSS 9.9 template sandbox escape. By October, a second one landed: identical in class, identical in score, identical in component. I have audited enough contract code to recognize what that rhythm means. When a system fails the same way after you have already patched it, you are not looking at a bug. You are looking at a design decision that keeps manufacturing bugs โ and that decision now sits underneath a layer of infrastructure the crypto industry depends on far more than it admits.
The crypto industry has spent a decade arguing about trust โ who holds it, where it concentrates, how it fails. We built multisigs to distribute it, oracles to source it, governance to legitimize it. Then, without much debate, we handed a fresh batch of it to a new layer: AI infrastructure. Agent platforms now orchestrate DeFi strategies, parse on-chain data, draft governance proposals, and occasionally sign transactions. They sit in the control plane of systems we insist are decentralized. The promise was leverage without trust assumptions. The reality is a new class of trust assumption wearing a modern interface.
GitLab's AI Gateway is exactly that kind of component. It brokers connections between an organization's internal systems and external model providers, and it holds JWT signing keys in the middle. In February and again in October 2026, that hub was shown to be escapable โ not through exotic tradecraft, but through a category of flaw the security field has understood for more than a decade: server-side template injection, catalogued as CWE-1336, executed as a Jinja2 sandbox escape. This matters to Web3 because the same architecture โ a central gateway mediating credentials and machine decisions โ is being rebuilt across every agent-native protocol now raising capital.
The mechanism is old and well documented. Jinja2's SandboxedEnvironment has been bypassed repeatedly through the __class__ / __mro__ / __subclasses__ chains, and through built-in objects like cycler, joiner, and namespace. There is no unknown tradecraft here. The only novelty is location: this class of flaw now lives inside AI-specific infrastructure, where a user-supplied "flow" configuration flows into a template execution path.
That is the root cause, and it is architectural rather than incidental. The system treats configuration as data, then executes it as code. The trust boundary was drawn in the wrong place: what should have remained a variable became an instruction. In my 2017 audit of the Gnosis Safe multisig, I spent three months chasing a signature malleability flaw โ a subtle case where the same input could be reinterpreted to mean two different things. That lesson generalizes cleanly. Signature malleability, reentrancy, prompt injection, template escape: they are all the same disease, data and instruction collapsing into one another until the machine cannot tell a value from a command.
The second failure compounds the first. Because the AI Gateway brokers authentication, a compromise does not stay local. Control it, and you control an organization's AI integration workflows and its authentication tokens. A single trusted node holding JWT signing keys is the same architectural sin as an oracle with a centralized node set โ the exact thing we criticize in DeFi every cycle. Mapping the unseen currents of narrative capital, I notice the market almost never prices control-plane risk until it detonates.
Then there is the detail the coverage buried. No reliable method exists to determine whether the gateway was compromised before the patch. The vulnerability can be fixed; the uncertainty cannot. Organizations may already be breached and simply unable to prove it โ a forensic blind spot more serious than the RCE itself. Compare this to on-chain forensics, where every state transition is auditable and every signature is a public confession. The ledger remembers what the gateway forgets. AI infrastructure offers no such ledger.
The patch path sharpens the irony. GitLab patched its hosted instances immediately; self-hosted customers must upgrade manually. Self-managed deployments skew toward large, regulated enterprises โ the clients most sensitive to security and slowest to change. Risk and response capacity are mismatched by design, the same mismatch that makes cold-storage custody both the safest and the most operationally fragile choice in crypto. And because no workaround exists, the only fix is a version bump โ a high-friction action for anyone running custom plugins. Meanwhile, parallel flaws surfaced across Langflow, Cisco SD-WAN, and DIVD's Zammad research, confirming this is an industry-wide paradigm failure, not one vendor's bad week.
Regulators are circling. CISA assessed exploitation as "none" in early October, which places the flaw inside federal vulnerability awareness without yet triggering procurement consequences. Under Europe's NIS2, AI gateways sit close enough to critical infrastructure that supply-chain reporting duties may soon follow. None of this is blockchain policy โ yet every DAO running an agent on a self-hosted instance is downstream of it.
The loudest claim โ the "first critical RCE in AI-specific infrastructure" โ is a framing, not a fact. AI components have disclosed remote code execution before. Narrow the definition to "AI dedicated infrastructure," and the assertion survives by construction. That is a narrative technique, and it is doing work: manufacturing a "historic first" to raise the stakes. When I read security reporting, I audit the incentive behind the headline the same way I audit a token's tokenomics.
Here is the more uncomfortable inversion. Web3 is not the hero of this story. The "trust-through-defaults" anti-pattern โ assuming the framework's default posture is safe โ is everywhere in crypto too. Most rollups do not generate enough data to justify a dedicated availability layer, yet we treat the DA narrative as settled infrastructure rather than a marketing position. We criticize AI platforms for coupling flexibility with execution, while our own contracts couple composability with exploitability. The mirror is uncomfortable, and the industry is not looking into it.
What is genuinely new is not the flaw. It is the recurrence โ two CVSS 9.9 escapes from the same component in eight months. That signals a systemic engineering gap, not a bad week, and it is the one signal a competitor cannot spin away. Reputationally, the mirror cuts both ways: GitLab's fast hosted patch and proactive outreach before disclosure read as responsible, while the recurrence reads as a structural weakness no press release repairs.
Security is a human right before it is a feature โ the conviction I carried out of that silent Gnosis audit, where digital pixels breathe with human soul. The next narrative will not be "AI plus crypto." It will be "AI infrastructure that can prove it deserves trust." The protocols that answer the question no one has asked yet โ how do you verify a control plane you cannot see โ will own the cycle after this one. The question is whether anyone is building that, or merely patching the same sandbox a third time.