🖼 Одной картинки хватило, чтобы взломать OpenAI — а почти всю работу сделал Claude Исследователи Hacktron обнаружили цепочку из двух уязвимостей. Первая находилась в обработке HEIC/HEIF-файлов: специально подготовленное изображение позволяло удалённо выполнять команды на сервере форума OpenAI. Вторая проблема была связана с SSO — общей системой авторизации. Получив сессию пользователя форума, исследователи смогли войти в аккаунт сотрудника OpenAI, у которого Codex был подключён к GitHub, и таким образом добрались до внутреннего репозитория компании. В качестве доказательства они просто оставили там один pull request. Значительную часть работы выполнил Claude. Opus 4.8 помог найти уязвимость и подготовить эксплойт, но полностью рабочим его смог сделать вышедший следом Opus 5. Вся цепочка заняла меньше 72 часов. OpenAI исправила свою часть уязвимости примерно за 14 часов и выплатила исследователям $6500 — при этом, по данным Hacktron, около половины награды они потратили на токены Claude. Источник
From the original source:
Telegram — GPT Time | Нейросети | ИИ
Read full article at Telegram — GPT Time | Нейросети | ИИThis material was compiled from public sources. If its publication affects your rights → Request removal
One picture was enough to hack OpenAI - and almost all the work was done by Claude
🖼 One picture was enough to hack OpenAI - and almost all the work was done by Claude Hacktron researchers discovered a chain of two vulnerabilities. The first was in the processing of HEIC/HEIF files: a specially prepared image made it possible to remotely execute commands on...
AI Summary & Key Takeaways
- 🖼 One picture was enough to hack OpenAI - and almost all the work was done by Claude Hacktron researchers discovered a chain of two vulnerabilities
- The first was in the processing of HEIC/HEIF files: a specially prepared image made it possible to remotely execute commands on...
One picture was enough to hack OpenAI - and almost all the work was done by Claude
Related stories
Judge dismisses Sam Altman’s sister’s sexual abuse lawsuit
On Tuesday, US District Judge Zachary Bluestone dismissed the lawsuit Ann Altman filed last year alleging that her brother, OpenAI CEO Sam Altman, had sexually abused her throughout her childhood. As reported earlier by The Guardian, the judge wrote that over the last year, Ann…
Anthropic pitches AI safety bill that may block a model if 50+ people could be killed
The proposed policy seems to offer protections against AI run amok but actually forbids federal agencies from blocking a model's release without the permission of a judge.
Hugging Face CEO warns that Netflix’s OpenAI hack documentary isn’t accurate
Before you share the Netflix documentary "AI Gone Rogue" take note. Clem Delangue, Hugging Face's co-founder who is featured in the film, says it went "full doomer mode" and isn't accurate.
Stop paying for AI, run everything locally (here’s how)
Big labs are not going to talk about this but continual learning the idea of improving the models for your [music] own use cases for your own workflows. Big labs have no incentive of providing users with that [music] because they're training their models for the normal…