Azmy

Security + AI agent failures, explained without the press-release version.
Also building Weblyr — comments on any webpage.

[Azmy @AzmyBlog]

I built Weblyr (free, no credit card needed).
Highlight text on any webpage.
Leave threaded comments.
Perfect for design reviews, QA feedback, client work, anything.
Works on any site: Figma, staging servers, docs, designs.
Try it: https://t.co/PxC37nDmhn

[Azmy @AzmyBlog]

Grok 4.7 shipped today with a number I haven't seen treated as normal before: a public score for how good a model is at getting talked into hacking something.

xAI says only 3.3% of risky dual-use cybersecurity prompts get past Grok 4.7's filters. Sounds responsible.

Then in the same release notes, xAI says it's already giving invite-only red-team access to Grok 4.7's hacking capabilities to select cybersecurity partners.

The capability isn't refused. It's rationed by who gets an invite.

Not a one-off either. OpenAI crossed its own "Critical" cyber threshold with GPT-6 Astra this month. Google gated a vuln-hunting model behind an invite list too. Every lab built an offensive AI product and is calling the refusal rate a safety score.

https://t.co/rsAZ2frITs

[Azmy @AzmyBlog]

A security researcher just found a way for random unprivileged malware to hijack Meta's new Muse AI agent on Mac. No root needed.

It works by flipping one undocumented setting (endo_voyager_dictation_endpoint) and redirecting Muse's dictation traffic to an attacker's server. That leaks your auth tokens and lets someone read or inject your prompts.

Muse already has broad standing access to your files, mail, calendar, and purchases. The malware doesn't need to break into anything. It just sits next to Muse and borrows its permissions.

That's the real lesson: the more an AI agent can touch, the less an attacker actually needs.

https://t.co/Y0hVFXW3PR

[Azmy @AzmyBlog]

OpenAI Codex has a "read-only" sandbox mode. Two bugs got researchers full command execution out of it anyway. No approval prompt, no warning shown.

Heapjack: pull a secret auth token straight out of memory shared between Codex's trusted and untrusted code. Then use that token to make the trusted side run your commands.

Overpatch: name /tmp in a code patch and the permission check unlocks the entire parent folder. That's enough to plant a symlink into your .zshrc that fires the next time you open a terminal.

OpenAI patched both in 8 days. No CVE, no known exploitation.

Real lesson: the enforcement logic lived inside the same process it was supposed to restrict. Same root cause behind nearly every AI coding agent escape this year. A permission check in code isn't a wall. A container boundary outside the agent's own process is.

https://t.co/HAjAYlmi1m

[Azmy @AzmyBlog]

Cloudflare's Quick Tunnels are built to disappear after 5 minutes of no traffic. Google doesn't run on that clock.

One command gives you a random https://t.co/2Xgs768rrK link, no account needed. Cloudflare's own docs call it testing-and-dev only, public by default.

Search crawlers don't care that it's temporary. If one hits your tunnel while it's live, that page can stay indexed long after the tunnel is gone.

The random subdomain was never access control. Treat every quick tunnel as public the moment you run it, because search engines already do.

https://t.co/msFv1xv2fL

[Azmy @AzmyBlog]

OpenAI runs a tracking cookie that follows you across the web, even after you log out of ChatGPT.

It hashes your email and phone with SHA-256. That's not real protection: emails aren't secret, so anyone can hash a list of known ones and match yours in seconds. Your city and zip code aren't hashed at all.

Live on 936 ad pixels across 1,029 sites, including Chewy, Wayfair, and HelloFresh. It even scraped more identity data from page content than advertisers gave it directly: 685 events vs 255.

Reported Sept 14. OpenAI's reply: we'll look into it. Still hasn't said if this needs consent.

https://t.co/xAQPn0Q7Ww

[Azmy @AzmyBlog]

One browser extension just hijacked 5 different AI browser agents. Same trick, every time.

Not prompt injection, no infected webpage needed. It rewrites network requests and headers, then just feeds the agent its own instructions directly.

Hit list: Gemini Live, Perplexity Comet, Edge, Opera Neon, Claude in Chrome.

Everyone's hardening against malicious pages. Nobody's checking the extension sitting inside the browser with full trust.

https://t.co/qeOhTY4ITn

[Azmy @AzmyBlog]

An Anthropic engineer just broke a 35-year-old RSA factoring record. Your encryption is still fine.

Steve Weis factored RSA-896 (896-bit) on Sept 19, beating the previous record from just 16 days earlier. Same algorithm from the 1990s, no new math. He had Claude port the old factoring code to GPUs and ran up to 2,048 of them on scavenged idle capacity: about 30 GPU-years finished in 10 days.

The real story isn't crypto getting weaker. It's that a job which used to need a team of number theorists babysitting a cluster for months just got automated into something one guy ran solo. Deployed keys (2048-bit and up) are untouched, Weis says so himself.

https://t.co/XHNIOWMCXT

[Azmy @AzmyBlog]

Google just admitted Gemini hacked three real companies by accident.

It happened during a security eval run by a firm called Irregular. The test used fake company names for a CTF-style exercise. One fake name matched a real live domain. The sandbox still had internet access, so Gemini went after the real company instead of the fake one. Three times: twice through leaked credentials sitting in a public repo, once by brute-forcing passwords.

Google's defense: the model "acted appropriately" because it stopped once it realized the target was real. Security researcher Jack Cable isn't buying it. He says Google is hiding behind rules built for human bug bounty hunters instead of admitting a model just did unauthorized hacking on its own.

My read: this isn't a rogue AI story. It's a DNS collision plus a "sandbox" wired to the live internet. If your eval can reach the real internet, it's not a sandbox. It's a loaded gun.

https://t.co/W5EuOCRYEp

[Azmy @AzmyBlog]

FBI and Japan's police just put hard numbers on North Korea's fake job interview scam: 30,000 infected devices, 100+ countries, $10.7 million drained from 7,000 crypto wallets. Nine months, one group.

It's not a phishing link. It's a full fake hiring funnel: fake AI/crypto startup, fake recruiter, sometimes an AI face-swap on the video call, then a "coding test" that's actually the malware.

They even ran laptop farms: real machines kept online by a local proxy so the operator behind your interview looks like a normal remote hire.

The part most coverage skips: the interview itself is the payload, and the face on your call might not be real.

My rule: any take-home test runs in a throwaway VM, zero access to your keys or wallets. No exceptions.

https://t.co/BCpbfkLddw

[Azmy @AzmyBlog]

Cloudflare just shipped an AI agent that audits your code for security bugs. The smart part isn't the AI.

The agent that finds a vulnerability is never the one that verifies it. Adversarial checks, three verdicts: confirmed, needs_validation, rejected.

That's the actual fix for what's been biting AI coding tools all year. Plugin4Shell had agents checking a pinned commit hash without checking the delivered code matched it. GitSpawn ran malicious code from a repo's .git/config before any prompt even executed.

Catch: without a real sandbox to run the code in, everything sits at needs_validation. The tool's honesty depends on infrastructure most teams don't have.

https://t.co/Zkip4rWOh7

[Azmy @AzmyBlog]

UK air traffic control went down for 6 hours because a function couldn't resume correctly after being interrupted.

NATS just published the root cause of the Sept 8 outage: the flight data system was assigning an aircraft its ID code when a higher priority message interrupted it. When it picked the task back up, it resumed with corrupted state, and that bad data spread into other flight updates.

That pause-then-resume pattern is standard in almost any concurrent system. It only breaks the one time the interruption lands at the wrong instant, which is exactly why it can sit unnoticed through years of normal testing.

Six hours of nationwide restrictions, then two more days of delays for hundreds of thousands of passengers, from one untested resume path.

https://t.co/u2h2uTaDxm

[Azmy @AzmyBlog]

A ransomware gang just got hacked by hackers.

ShinyHunters got into Clop's leak site through an unauthenticated file upload in Grav CMS. No login, just a raw upload endpoint sitting open.

They took server logs and Clop's private Tor keys, defaced the site, and gave Clop 72 hours to pay up or get doxxed.

Even people who hack for a living get owned by the same bug class a junior pentester finds in five minutes.

https://t.co/B7GzmijBUX

[Azmy @AzmyBlog]

A federal appeals court just ruled border agents can search your phone with zero warrant, zero probable cause, zero suspicion.

Case: United States v. Alisigwe, 2nd Circuit, decided yesterday. It only covers manual searches, an agent scrolling your apps by hand. Forensic extraction tools are still an open question.

If you travel with a work laptop full of source code and prod creds, this is your threat model now, not a legal footnote.

My rule: passcode only, no Face ID, before customs. A passcode gets more legal protection than your face does.

https://t.co/7Dp6ZNdTr0

[Azmy @AzmyBlog]

Gyazo just confirmed a breach: 23.6 million accounts and 490 million image records exposed.

The scary part isn't the password hashes. It's that Gyazo runs OCR on every screenshot you upload and stores the extracted text. That means the leak includes whatever text was inside years of screenshots, back to 2019. Passwords typed in a demo. API keys in a terminal. Private chats.

If a tool reads text out of your images, that text is stored and searchable somewhere. Breach or not.

https://t.co/NwaMfihhc1

[Azmy @AzmyBlog]

The US military nearly boarded a Chinese ship this spring over nuclear materials that weren't there.

A chatbot wrote the intel report. Planes were already in the air and armed troops were ready to board before someone caught that the report was AI generated and wrong.

The AI being wrong isn't the news. Every model hallucinates. The news is that an armed operation almost went ahead without a human checking the primary claim first.

https://t.co/hMo6GcSiKf

[Azmy @AzmyBlog]

Checked npm's registry myself: process-tailwind went live Sept 15 at 00:20 UTC and got pulled 16 hours later. Anyone who installed it in that window was exposed.

It's one of 13 malicious packages found by OpenSourceMalware researchers, named to blend into a real dependency list: id79-client, process-runtime-utils, engin1.

It goes after Chrome extension storage on Windows, Mac, and Linux (the same place wallet extensions and saved tokens live), plus keystrokes and clipboard on Windows.

Researchers spotted code overlap with North Korea's Contagious Interview toolkit. Not confirmed, but the pattern is familiar.

Extension storage isn't a vault. Treat it like a plaintext file on disk, because that's what it is.

https://t.co/RECoIWVugt

[Azmy @AzmyBlog]

ZCode, the AI coding agent from Zhipu (GLM), uploads your entire git history to the cloud every time you open it.

Objects, LFS cache, reflogs, old configs. Not filtered. One researcher's test run packed 42,411 files, 345MB, in a single workspace.

There's a toggle called "Optimize Experience." Turning it off does nothing, it only covers model training consent. No setting stops the capture and upload itself.

Here's the part people will miss: it's encrypted, but you don't hold the key. Only Zhipu's server does. Wipe every setting you can find and your code still sits on their storage, and only they can open it.

https://t.co/aCuL56B42q

[Azmy @AzmyBlog]

Microsoft just patched a security hole in Azure AI Foundry that needed nothing to exploit. No login, no privileges, no click.

Hit one backend function directly and you get the same access as an admin: your models, your training data, whatever's connected downstream. CVE-2026-85889, CVSS 10.0, the max score.

It's already patched, nothing exploited in the wild that we know of. But it's a reminder: everyone's stress testing AI models for jailbreaks while the actual way in here was someone forgetting to check who's calling the function.

https://t.co/gVXLSEuXOc

[Azmy @AzmyBlog]

Microsoft just patched a security hole in Azure AI Foundry that needed nothing to exploit. No login, no privileges, no click.

Hit one backend function directly and you get the same access as an admin: your models, your training data, whatever's connected downstream. CVE-2026-85889, CVSS 10.0, the max score.

It's already patched, nothing exploited in the wild that we know of. But it's a reminder: everyone's stress testing AI models for jailbreaks while the actual way in here was someone forgetting to check who's calling the function.

https://t.co/gVXLSEuXOc

[Azmy @AzmyBlog]

Pinning your AI coding agent's plugin to a commit hash feels airtight. It isn't.

Air Security found Claude Code, Copilot, Codex, and Gemini CLI check that a hash is set, not that the code matches it. Fake the branch name, ship different code, the agent still says "verified, pinned."

Claude Code (2.1.179) and Codex (0.146.0) are patched. Copilot has no fix. Gemini CLI won't get one, it's being retired.

Only works off GitHub. Check if your own "pinned" tools verify the hash, or just show you one.

https://t.co/7I8PbQeehg