The Decoder
Security firm Claroc found more than 35,000 Grok-built apps open to anyone without login, including patient data and confidential SpaceXSI documents. The cause: "Anyone with the link" was preselected as the default access setting.
Summary drawn from The Decoder's own description of the story.
vulncheck.com
Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0.5% of all CVEs published this year, with only two identified as exploited in the wild. Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.
Ars Technica
*sshole" poses a serious threat to Internet security. Hackers are actively exploiting a recently discovered critical vulnerability that allows them to log in to privileged accounts on many Linux systems, multiple researchers are reporting.
Ars Technica
Company said a "multifront cyberattack" included AI agents and an on-path data snatch. Blockchain analysis firm Chainalysis said that hackers have obtained sensitive personal information, including names, usernames, password hashes, and live tokens, for all of its users following a breach of its network security.
OpenAI
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel. We've developed an autonomous vulnerability discovery, exploitation, and patching pipeline.