Tag
Security startup Cathedral, founded by former DOGE staffers, used AI agents to breach Anthropic internal sales, HR, and IT systems within 12 hours via third-party software flaws during an authorized bug bounty test. Anthropic confirmed limited access was shut down the same day, stating customer data, code, and model weights were unaffected and disputing Cathedral's national security claims.
Muse disclosed a design flaw where shared artifact URLs were discoverable via passive DNS, prompting a temporary shutdown of sharing while the issue was fixed; old links now redirect to a notice requesting new URLs, and the Muse bug bounty program offers up to $300,000 for valid reports.
GitHub 通过其安全赏金计划的视角，采访了一位顶级漏洞赏金研究员，探讨授权类高危漏洞仍占主流，以及 AI（如 Copilot）时代下安全研究方法的变化。文章还介绍了 GitHub 重组后的赏金计划和面向高质量研究者的 VIP 邀请制项目。
Security researchers from Claroc found that Meta's new AI agent Muse exposes users' sensitive shared conversations via easily enumerable URLs discoverable through passive DNS queries, prompting Meta to suspend the sharing feature while it reviews the issue.
A hacker reportedly used AI agents and a modest budget to discover and exploit vulnerabilities across dozens of websites, highlighting both the power and risks of AI-driven offensive security.
Security firm XBOW reportedly earned a $250,000 Google bounty for a full-chain Google Chrome exploit found with the help of an AI agent called GPT Sol, which used about $40,000 worth of tokens to succeed in 6 days.
XBOW 使用 GPT-5.6 Sol 耗时 6 天、约 4 万美元算力发现 Chrome 全链漏洞，获得 Google 25 万美元赏金，成为 2026 年 Google 首个全链奖励，影响约 10 亿用户。
研究者分享了在 Google 开发者文档站点发现的 9 万美元远程代码执行漏洞：Flask 会话 cookie 中 pickle 序列化的 OAuth flow 对象泄露了 client_secret，而该 secret 同时又是会话签名密钥，攻击者可伪造 cookie 并通过 pickle.loads 实现 RCE。
Project Glasswing reported finding 135,000 verified vulnerabilities across the internet, with at least 9,333 already patched, highlighting progress in improving overall web security.
Cloudflare disclosed and fully remediated a cross-tenant data exposure vulnerability in Cloudflare Containers (and Sandboxes) reported by researcher Oren Yomtov, where dm-thin skip_block_zeroing allowed previously-used 64 KiB blocks to retain residual data from other containers on the same multi-tenant host.
Google paused its Open Source Software Vulnerability Rewards Program until 2027, citing a 'significant rise' in automated AI submissions that were largely invalid or hallucinated, overwhelming engineers and open source maintainers.
A 16-year-old researcher (Faav) describes discovering a signature-validation flaw in Microsoft's internal Titan analytics service that could have exposed an estimated 17.3 trillion stored rows via raw SQL queries, using his AI hackbot Antares to aid the hunt before responsibly reporting it to Microsoft.
Meta launched Muse, a personal AI agent with built-in safety features such as filters for one-time tokens and a classifier model to securely handle email data, as detailed in a blog post.
Hackers breached OpenAI by exploiting vulnerabilities in third-party systems and employee validation, raising security and safety concerns in AI development. The researchers were white-hat and reported the issue, which has been patched.
Security researchers used Anthropic's Claude AI to hack into OpenAI by exploiting a vulnerability in Discourse, gaining access to internal systems and receiving a bug bounty for disclosure.
Researchers from Hacktron AI used Anthropic's Claude to exploit vulnerabilities in OpenAI's systems, demonstrating AI's capability in cybersecurity and raising concerns about AI security vulnerabilities.
Hackers breached OpenAI by finding two bugs that allowed them to take over ChatGPT/Codex accounts and access connected services, proving it with a codebase PR in under 72 hours and receiving a $6,500 award.
Independent security researchers discovered a critical vulnerability chain involving an SSO misconfiguration and image decoder flaw in OpenAI's systems, using Anthropic's Claude to gain access to internal repositories and triggering a security patch.
The article discusses how a surge in cybersecurity vulnerabilities, referred to as 'Vulnpocalypse,' is leading to reevaluation and changes in the pricing structures of bug bounty programs.
BBOT is an open-source multipurpose scanner designed to automate internet reconnaissance, bug bounty tasks, and attack surface management with recursive scanning capabilities.