Meta confirmed that a bug in its AI chatbot allowed attackers to hijack over 20,000 Instagram accounts by exploiting an "AI-assisted account recovery" vulnerability. This incident highlights the risks of integrating language models into high-trust authentication flows without proper security measures.
Discord's exposure of 70,000 government IDs for age verification highlights a severe case of architectural over-collection. The article advocates for moving away from full identity-linked verification towards threshold-based estimation, utilizing facial age estimation tools for binary questions.
Elon Musk's Grok chatbot accidentally exposed over 370,000 private conversations by publishing supposedly private share links on the web, which were then indexed by search engines. This breach, discovered by Forbes, highlights significant security and privacy concerns in AI deployment.
This article explores engineering lessons from a hypothetical 16-million-conversation leak involving Anthropic's Claude, emphasizing LLMs as a distinct attack surface. It highlights that threat boundaries now encompass third-party environments and rich logs, expanding a chat breach into a business breach.
A malicious VSCode extension breached 3,800 GitHub repositories, exfiltrating tokens and credentials. The attack exploited extension file access permissions to collect sensitive data and send it to an attacker-controlled server.
The TeamPCP threat group stole 5GB of Mistral AI's source code via a supply chain attack, demanding $25,000 or threatening to leak the data. Mistral AI confirmed the breach but stated that core repositories and user data were not affected.
Vercel, a web app development platform, was hacked, with cybercriminals attempting to sell stolen data including employee information. The attack leveraged a compromised third-party AI tool, impacting a limited subset of Vercel's customers.