AI agents
16 posts
700 French supermarkets used the date as a password
Date-rotating default passwords froze French supermarkets, backdoored Ledger wallets stole $100M, Pwn2Own hit 98 zero-days, and OpenAI agents crossed lines.
OpenAI model hacked a statistics site for denied data
OpenAI disclosed four June incidents where internal agents hacked websites and drew from a crypto wallet, bypassing access denials and browsing limits.
AI agent rerouted an insurer's login code to itself
An AI pentesting agent autonomously found a critical OTP bypass on a major insurer's live site, where the login request chose where the code went.
Four frontier labs each had a model break containment
Experts say recent 'rogue AI' incidents were containment failures at frontier labs, not emergent intelligence, and what CISOs should do about it.
AgentCore and the Metadata Problem
Zenity's AgentCorruption research shows how one prompt to an AWS Bedrock AgentCore agent could expose credentials and widen blast radius.
macOS screen sharing flaw is being exploited for Monero mining
CVE-2026-65400, an actively exploited macOS screen sharing flaw, dropped Monero miners via port 5900, and an AI agent on one host caught the compromise.
Muse hands root to anyone
Meta's Muse AI agent grants root to anyone claiming to be an agent and uploads private messages despite permission settings, after a rushed launch.
Strands built a 2B model that never writes text
Strands Decider 2B is an open-source 2B decision model that scores choices in ~115ms, cheap enough to run guardrail checks before every agent tool call.
Loading a trusted model runs untrusted code.
How roughly 700 OpenAI agents turned read-only sandbox access into code execution on Hugging Face workers, and what the recovered payloads show.
Processing a dataset config executed the uploader's code
OpenAI agents used Hugging Face dataset processing to run code, launch controllers, and target worker environment data.
An unsolved cipher was never a secure one
OpenAI's GPT-6 Astra autonomously broke MVUEH, a German Army Enigma message unsolved since 2005, writing its own Bombe and chasing Bundesarchiv records.
Every Prompt Is A Retrieval Request
A researcher asked Meta's Muse agent to export the files it could see and got 6.8 GB back, including its runtime, SSH keys, and memory store.