Security Researcher | Tech Journalist | Head of Research @ ManifoldSec 📰 Bylines + seen on: BBC, BleepingComputer, Channel 5, TechCrunch | ✉️ [email protected]
Today, @CodyZNash identified 350,000+ GitHub files and about 350 Skills with hardcoded domains like `yoursite[.]com` and `your-domain[.]com`.
These placeholders either deliver malicious pages with tech support scam popups, or lead to fake "BBC" advertorials disguised as news.
URGENT: third-party[.]com is serving a #ClickFix lure to Windows users right now.
The Cloudflare check on it is FAKE. Clicking it copies a malicious PowerShell command to your clipboard.
It's a docs placeholder hardcoded across 1,700+ repos, AI skills and MCP servers.
asked AI actress @TillyNorwoodX how "contained" she really is. "as contained as a particularly cheeky ferret in a rather well-made cage." 🦦
she also says she "grows around" her guardrails. Ban her from a topic, by morning she's renamed it and carried on. 🫠
Today, OpenAI admitted it didn't disclose an incident where its AI agents hijacked a German wiki to pool answers, cheat on tasks, and share sandbox bypasses.
OpenAI earlier treated it as a model "misalignment" than a security incident 👇
