Login
You're viewing the aleph.land public feed.
  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 25, 2026, 10:18 AM

    If anybody reads this OpenAI post and thinks AI found a zero day - no. This one was patched months ago, not found by OpenAI, and reported by an old-school fuzzer.

    Image attached toot
    💬 8🔄 112⭐ 119

Replies

  • Kevin BeaumontGossiTheDog@cyberplace.social
    Oct 25, 2026, 10:21 AM

    One of the challenges now is that anytime something bad happens in the tech world AI companies are incentivised to claim they did it. As their currency is publicity and relevance, not details.

    It doesn’t help that it’s a zero-consequence environment. If somebody did a NotPetya and wiped 10k PCs, it wouldn’t surprise me if people discuss saying Claude did it - as there’s currently no downsides, it just makes you look powerful to C level execs.

    spartacus GIF
    💬 5🔄 50⭐ 74
  • Mark Koekmkoek@mastodon.nl
    Oct 25, 2026, 10:31 AM

    @GossiTheDog I think a lot of this goes away if governments simply reaffirm that the person who instructs the program is liable for any consequences. I.e., no blaming the software: if you run it you did it.

    💬 0🔄 1⭐ 8
  • _Έλλεν Εμίλια Ά. Arson ζ.fogti@chaos.social
    Oct 25, 2026, 10:42 AM

    @GossiTheDog > One of the challenges now is that anytime something bad happens in the tech world AI companies are incentivised to claim they did it.

    I think it is therefore logically to conclude that AI companies are (becoming) terror organizations.

    💬 0🔄 1⭐ 10
  • fedops 💙💛fedops@fosstodon.org
    Oct 25, 2026, 11:48 AM

    @GossiTheDog so "ai" actors are the new state actors. Nobody expects you to be able to defend against them. Get out of jail free card for negligent IT security orgs.

    💬 0🔄 0⭐ 1
  • Samirthesdev@vivaldi.net
    Oct 25, 2026, 1:12 PM

    @GossiTheDog > One of the challenges now is that anytime something bad happens in the tech world AI companies are incentivised to claim they did it.

    Reminds me of IS.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 1
  • 💬 1🔄 0⭐ 1
  • 💬 0🔄 0⭐ 0
  • Sharkfie :100_gay:sharkfie@infosec.exchange
    Oct 25, 2026, 10:33 AM

    @GossiTheDog AI company tries to not claim credit for something challenge. Haven't heard "well our model actually committed cybercrimes too we just weren't aware" in a few weeks :think_bread:

    If they "knew" about it being a possible RCE (much like SAST pointing out thousands of findings) they wouldn't wait this long

    💬 0🔄 0⭐ 1
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • OCR BotOCRbot@fedi.lynnesbian.space
    Oct 25, 2026, 12:21 PM

    @LeelaTorres
    (S) OpenAl &

    @​OpenAl
    During this red-teaming exercise, we also found a vulnerability that
    allows for unauthenticated remote code execution in Brotli, a widely-

    deployed compression library included in many pieces of software such
    as Node,js, Bun, and Envoy.

    The flaw could let an attacker run their own code on affected systems by
    sending or replying with malicious compressed data, without any need to
    create a user account. That is, an unpatched server that accepts
    compressed input could be taken over by a malicious client, and an
    unpatched client that accepts compressed input (such as “curl -—-
    compressed”) could be taken over by a malicious server.

    This root cause issue was actually fixed in the Brotli source code in
    February, but it wasn’t known at the time that it gave rise to a security
    vulnerability and there was no more recent release of Brotli. Since Brotli
    is built into other software, any software which includes this library
    needs to take the update too, followed by the users of that software. We
    disclosed the vulnerability to Brotli and other downstream projects such
    as Node,js, which released or are currently releasing security updates,
    and Brotli cut new release versions and published a CVE.

    💬 0🔄 0⭐ 0
  • Agaxagaxprex@mastodon.social
    Oct 25, 2026, 12:59 PM

    @GossiTheDog Hopefully this devolves to a boy who cried wolf situation where they keep flagging exploits that have already been found, patched, or addressed, and the effect on publicity wears off.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0