SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Researchers Used Claude AI to Hack OpenAI Accounts via Forum Image Bug

0
·3 views

Three security researchers at Hacktron spent 72 hours in late July exploiting a chain of vulnerabilities to access internal OpenAI employee accounts on ChatGPT and Codex. The attack began with a memory corruption flaw in libheif, a library used by OpenAI's public Discourse forum to process uploaded images, tracked as CVE-2026-32882 and rated 8.8 out of 10 in severity. The researchers used Anthropic's Claude AI models to iteratively write a working exploit, converting the memory flaw into remote code execution on the forum server. Because the forum supported single sign-on with OpenAI credentials, the compromised server could hijack employee sessions, potentially exposing connected tools like GitHub and Slack. The team responsibly disclosed the findings — merging only a harmless pull request as proof — and received a $6,500 bounty; OpenAI patched its identity configuration within 14 hours while Discourse followed with a sandboxing update.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Cisco Secure Email Gateway Flaw CVE-2026-76443 Rated Critical, Patch Available

A critical injection vulnerability, CVE-2026-76443, has been identified in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager versions 15.5 and earlier, as part of a five-CVE hardening release published in September 2026. India's CERT-In rated the release CRITICAL, warning that the flaw allows unsanitized attacker-supplied input to reach sensitive processing contexts, including command, SQL, code execution, and cross-site scripting sinks. Successful exploitation could lead to unauthorized command or code execution, data access or modification, and broader compromise of mail flow, configuration, and stored credentials. ZoomEye identified approximately 1,781 internet-facing instances matching the Cisco Secure Email Gateway product fingerprint, indicating a potentially wide exposure. Administrators are advised to apply Cisco's official fix, restrict management interface access to trusted hosts, and treat the upgrade as a single operation covering all five addressed vulnerabilities.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Smaller Typed-Decision Model Outperforms 35B LLM on 12,000 Federal IT RFQ Classifications

A benchmarking study tested three AI models — Jev, Qwen3.5-35B-A3B, and Laya 421M — on 12,000 real U.S. federal IT procurement solicitations to assess how safely each could automate classification tasks for a federal IT reseller. Jev, a typed-decision API, achieved the highest primary-class accuracy at 91.9%, narrowly beating the much larger 35B LLM Qwen at 89.6%, while the 421M open-weight Laya model trailed at 78.0%. The decisive factor was not raw accuracy but calibration — Jev's low calibration error of 0.049 allowed it to reliably flag uncertain predictions, enabling 86.5% of cases to be auto-accepted at a 96.7% precision rate. Qwen failed to reach the confidence thresholds needed for bounded automation, and Laya's high calibration error of 0.322 made safe automation targets unreachable. The findings suggest that for operational automation, a model's ability to signal its own uncertainty can matter more than its headline accuracy score.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

RelayPlane, LiteLLM, OpenRouter: Key Differences in AI Gateway Tools Explained

A developer who built RelayPlane has published a comparison of three AI proxy and routing tools: RelayPlane, LiteLLM, and OpenRouter. RelayPlane is a lightweight, locally installed npm package designed for single-machine use, offering a hard daily spend cap, per-request cost logging via SQLite, and a kill switch with no database server required. LiteLLM is a self-hosted, open-source gateway suited for teams, supporting over 100 providers, virtual keys, and per-tenant budget controls. OpenRouter is a fully hosted service requiring no infrastructure, providing access to over 500 models through a single API key, though cost enforcement happens on their cloud rather than locally. The author acknowledges personal bias toward RelayPlane and directs readers to official documentation for each tool to verify the claims independently.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Macula Mesh+Realm Offers Decentralized, Cryptographic Alternative to Traditional VPNs

Macula Mesh+Realm is a sovereign network substrate designed to provide secure, identity-based connectivity across untrusted or contested networks. Unlike conventional VPNs that rely on centralized gateways, Macula uses a distributed mesh architecture where IPv6 addresses are cryptographically derived from each node's identity, eliminating centralized IP management. The system uses QUIC as its core transport protocol, enabling persistent connections even when underlying IP addresses change — a key advantage in unstable or high-churn environments. A hierarchical certificate authority model allows precise revocation of compromised nodes without disrupting the broader network. By removing single points of failure and distributing traffic across peers, Macula aims to resist electronic warfare, DDoS attacks, and network mapping by adversaries.

0 comments Read more at DEV Community