loophole

On 2 April, security researcher Jack Cui publicly measured and demonstrated a high-risk security gap in Claude Code in recent days, revealing the serious risks of the AI programming tool at the level of system access. The Jack Cui presentation project contains only a .claude configuration folder and an empty Python script. After the terminal enters claude and returns to the car, the computer camera is raised silently, local key information is automatically written into the text file, and the process is zero-interactive and zero-tip. The problem comes from Clau..

On February 4th, a password management tool, Password, published a book on February 2nd, and its security team discovered that the attackers had used the fire-fire AI smarts OpenClaw (formerly known as Clawdbot and Moltbot) to spread and implant malicious software to MacOS users. Note: OpenClaw is an AI smart body with a recent explosion, and core competitiveness lies in its “active automation” capability. The AI smart body does not need a user's instruction to clean the inbox, book the service, manage the calendar and service..

Security expert Sean Heelan published a blog post on May 22 reporting that he had discovered a major zero-day vulnerability in the Linux kernel with the help of OpenAI's o3 inference model, tracked as CVE-2025-37899. Heelan said that he initially intended to test OpenAI's o3 inference model through a code audit, but instead discovered that the AI was able to The complex "use-after-free" vulnerability, which is autonomously recognized by AI, exists in the Linux kernel's SMB protocol implementation...

In a May 27 post, security firm Legit Security disclosed a prompt injection vulnerability in GitLab's AI assistant GitLab Duo, which allows a hacker to make GitLab Duo output whatever the hacker wants by embedding a prompt (prompt injection). GitLab Duo, an AI assistant built on Claude, a large language model developed by Anthropic, was released on June 6, 2023, according to ...

March 7, 2011 - Anthropic's latest coding tool, Claude Code, is experiencing some technical issues. Users on GitHub have reported a vulnerability in the tool's auto-update feature that has caused some workstations to become unstable or even not function properly. According to 1AI, the root of the problem is that Claude Code's auto-update command contains an error code. When the tool is installed with "root" or "superuser" privileges, these error commands allow the application to modify file directories that are normally restricted...

OpenAI announced the introduction of Memory for ChatGPT in February this year, and in early September this year, the feature was officially opened to all users, the main purpose of the feature is to "set presets", which will help the AI to the user to better meet the needs of the answer. However, researcher Johann Rehberger has now reported that there is a vulnerability in the PC version of the ChatGPT client that could allow hackers to gain access to a user's conversation history. Johann Rehberger calls the vulnerability...

According to NewAtlas, researchers have successfully hacked more than half of the sites tested using a team of autonomous, collaborative GPT-4 bots that can coordinate their actions and generate new "helpers" as needed. What's even more surprising is that they utilized previously unknown, real-world zero-day vulnerabilities. Pexels A few months ago, the same researchers published a paper claiming that they were able to use GPT-4 to automatically exploit "N da...