Tag
Meta launched Muse, a personal AI agent with built-in safety features such as filters for one-time tokens and a classifier model to securely handle email data, as detailed in a blog post.
Hackers breached OpenAI by exploiting vulnerabilities in third-party systems and employee validation, raising security and safety concerns in AI development. The researchers were white-hat and reported the issue, which has been patched.
Security researchers used Anthropic's Claude AI to hack into OpenAI by exploiting a vulnerability in Discourse, gaining access to internal systems and receiving a bug bounty for disclosure.
Researchers from Hacktron AI used Anthropic's Claude to exploit vulnerabilities in OpenAI's systems, demonstrating AI's capability in cybersecurity and raising concerns about AI security vulnerabilities.
Hackers breached OpenAI by finding two bugs that allowed them to take over ChatGPT/Codex accounts and access connected services, proving it with a codebase PR in under 72 hours and receiving a $6,500 award.
Independent security researchers discovered a critical vulnerability chain involving an SSO misconfiguration and image decoder flaw in OpenAI's systems, using Anthropic's Claude to gain access to internal repositories and triggering a security patch.
The article discusses how a surge in cybersecurity vulnerabilities, referred to as 'Vulnpocalypse,' is leading to reevaluation and changes in the pricing structures of bug bounty programs.
BBOT is an open-source multipurpose scanner designed to automate internet reconnaissance, bug bounty tasks, and attack surface management with recursive scanning capabilities.
A veteran bug bounty hunter reflects on HackerOne's evolution from its golden age of live hacking events to its current state, questioning what changed and whether the platform still serves its original hacker-first mission.
Open-Kritt is an open-source security research platform that orchestrates multiple AI agents to analyze code in parallel, automating discovery of real vulnerabilities, and supports deduplication, validation, and prioritization. The team behind it has used it to earn significant bounties and win the Firedancer audit contest.
This article breaks down the MCP security attack chain behind CVE-2025-53773, where a single prompt injection lets a developer agent modify its own configuration and achieve remote code execution. It details the hop-by-hop escalation and the key control that stops it.
GitHub is restructuring its bug bounty program to prioritize quality over quantity, introducing a permanent VIP program with higher payouts, restructured public bounties with static payouts, and raising signal requirements to reduce low-effort reports.
A tweet and blog post highlight that the tool list itself is an attack surface: by controlling a tool's description, an attacker can hijack an AI agent's behavior without exploit code. This is part 2 of a series on MCP bug bounties.
The Financial Times reports that the AI coding boom is overwhelming open-source maintainers with low-quality AI-generated contributions, draining the ecosystem. Concrete evidence includes cURL shutting down its bug bounty program, Ghostty banning AI code, and tldraw auto-closing PRs, alongside research showing reduced contributor engagement.
A detailed write-up from ProjectDiscovery detailing how they discovered a critical SQL injection vulnerability in Apple's Book Travel portal via Masa/Mura CMS and achieved Remote Code Execution.
Google paid a $250,000 bounty for a Linux KVM vulnerability (Januscape) that allows unprivileged guest VMs to escape and gain root access on the host, affecting cloud platforms using AMD or Intel processors.
GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel 0-day used in the IonStack full chain exploit, affecting all Linux devices from IoT to desktops. Nebu Security won a $92,337 bug bounty and published the exploit on GitHub.
Using AI audit agents, zkSecurity discovered seven real bugs in Cloudflare's CIRCL cryptography library, including critical precision loss and access-control break. All bugs have been fixed upstream.
A Linux kernel zero-day vulnerability (CVE-2026-43456) rooted in code from 2007 was discovered by Yuki Koike and Kota Toda, rewarded over $80,000 via Google's kernelCTF. The flaw, a type confusion in the net/bonding subsystem, allows reliable privilege escalation within one second.
A security researcher discovered an unauthenticated SQL injection vulnerability in Front Gate Tickets' device API, allowing full database read and admin access to the ticketing platform for major US festivals.