Cocos AI is a confidential computing system for AI that relies on attested TLS connections. Prior to version 0.9.0 the system performs a one‑time attestation when a connection is established. Subsequent modifications to the attester’s code, state, configuration, or attached devices are not detected. This allows an attacker to alter the environment after the initial check while the connection remains open, leading the verifier to trust stale evidence.

The affected product is ultravioletrs Cocos AI, and any release before v0.9.0 is vulnerable.

The CVSS score is 7.2, indicating a high‑severity vulnerability. EPSS is not available so no quantitative exploitation probability is known, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can modify the attester’s workload code, memory‑backed state, configuration, or attached devices after the handshake could keep an encrypted channel open while the peer trusts stale evidence. The likely attack vector requires privileged access to the attester environment; it could be achieved through a local compromise or by injecting code into a trusted component.