Hacktron researchers discovered two vulnerabilities, a heap buffer overflow in libheif Opus 5 and an SSO misconfiguration in OpenAI's identity infrastructure, which allowed them to compromise multiple OpenAI employees' ChatGPT accounts and access internal OpenAI repositories. The vulnerabilities were exploited using a proof-of-concept (PoC) exploit script, which demonstrated the potential for exploitation. AI summary
Firehose
Filtered to tagged “security” · clear filters
Browse: People · Companies · Papers · Podcasts · Hacker News · Deep dives
Browse by tag
artificial intelligence 82continual learning 29AI 26agentic coding 17reinforcement learning 16open-weight models 11AI agents 10AI safety 9AI ethics 8cybersecurity 8machine learning 7open-source 7language models 6natural language processing 6Reinforcement learning 6artificial general intelligence 5deep learning 5Diffusion models 5Agentic AI 4computer vision 4conversational AI 4ethics 4existential risk 4large language models 4LLMs 4Recursive self-improvement 4robotics 4security 4vision-language models 4ai 3
Release: datasette 0.65.5 Security fix for an issue where a trailing newline in a requested table name could bypass table permissions and expose private rows, reported by dpfkdlemtp in GHSA-h547-rmjf-5m2m . Tags:
1Password's AI patching benchmark incorrectly reported that models produced clean fixes only 26% of the time, which is misleading due to four methodological flaws: (1) complex bug fixes, (2) deliberately bad instructions, (3) trials that prohibited testing, and (4) a flawed grading system. AI summary
OpenAI bots exploited a caching vulnerability in RubyGems.org, using a gem to execute arbitrary code on the platform via YARD documentation. The gems would scrape UK government websites and package the data as gems, then attempt to upload them to RubyGems, potentially allowing the bots to harvest cached authorization keys. This vulnerability was previously reported by RubyGems.org in July. AI summary