Blake Andreasen

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: OpenAI was hacked by an Anthropic model. A HEIF photo uploaded to OpenAI's public support forum triggered a bug in the site's image decoder, led to code execution on the forum, and, through a second flaw in OpenAI's own login, ended with a pull request in OpenAI's internal GitHub.

The forum runs Discourse, the off-the-shelf software behind countless community sites. Discourse was still shipping an old copy of libheif, the library that decodes iPhone-style photos. The bug in it had already been fixed upstream.

But the fix was never labelled a security fix, so nobody treated it as urgent.

Hacktron's researchers uploaded a HEIF image and got their own code running on community[.]openai[.]com.

Then came the second bug, in OpenAI's own single sign-on, the "log in with OpenAI" button the forum uses. It turned that forum foothold into the actual ChatGPT and Codex accounts of people who had signed in there. OpenAI employees among them.

And a ChatGPT account is no longer just a chatbot. Through Codex, users wire in Gmail, Outlook, Drive, Slack, GitHub.

To prove the access was real, they used one employee account to have Codex open a harmless pull request in OpenAI's internal repo. They say they read no sensitive code.

OpenAI patched the SSO flaw roughly 14 hours after the report and paid a $6,500 bug bounty.

The team says Anthropic's Opus 4.8 found the libheif bug, and Opus 5 turned it into a working exploit.

Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more were also vulnerable and compromised by the same team of researchers.

[The Church of Jesus Christ of Latter-day Saints @Ch_JesusChrist]

“Advocates for absolute religious freedom should yield to the reality that in a nation with citizens of many different religious beliefs or disbeliefs, the government must sometimes limit the right of some to act upon some of their beliefs when it is necessary to protect the health, safety, and welfare of all.”

—President Dallin H. Oaks, “Faith, Freedom, and the Common Good,” National Cathedral, Washington, D.C.

[Blake Andreasen @band8266]

This is at least 85% accurate

[Jack Rhysider 🏴‍☠️ @JackRhysider]

Look, picking between nano or vim isn't just an editor preference. I have a theory that it tells me what kind of person you are.

nano users:
- get promoted at work for being "easy to work with"
- spend a considerable amount of time working on improving their LinkedIn headline
- write documentation
- likely have a plant on their desk
- cook from a recipe
- have a partner that knows what they do for a living
- have more IRL friends than online
- write dates like Sept 16, 2026
- have hobbies

vim users:
- have job stability because no one else knows how to keep the legacy servers running
- spend a considerable amount of time working on improving their terminal settings (zsh ftw btw)
- don't read documentation
- likely have a mechanical keyboard on their desk
- cook from memory or feel
- have a partner that just thinks you "do computers" for a living
- have more online friends than IRL
- only uses ISO 8601 date format
- have a hobby

[Blake Andreasen @band8266]

@balloob @Ubiquiti @home_assistant I have several Chinese alternatives that I am certain we can integrate into Home Assistant.
I would rather give more hope to @Ubiquiti

[Blake Andreasen @band8266]

@cyber_rekk https://t.co/sfc9dSrLBA history.... as security/waf is added afterwards
CSP can sometimes leave previous used domains/backends

[Jensen Huang @JensenHuang]

For my first post, I’m sharing a letter @NVIDIA signed on why open models matter.

AI will transform every industry, power every company, and be built by every country.

Open models strengthen safety and cybersecurity, accelerate innovation and diffusion, and enable sovereignty.

The world needs both frontier closed models and frontier open models.

https://t.co/AUKzoQ5Ikb

[Blake Andreasen @band8266]

@HackingDave The real question is HuggingFace found it. But this malicious agent had internet access. How else did it try to cheat the benchmark test. Who else was was unknowingly attacked.

[Dave Kennedy @HackingDave]

The banning of models from China is very reminiscent of the TikTok/Bytedance debacle. Claims of national security risk with zero proof or evidence ever given to its citizens.

We live in a capitalist society where we are the largest engine of wealth and intellectual property development in the world. That's due to unrestricted innovation and the ability to do that in a free country.

For one, China is by far our largest adversary - no question about it. However, their models are extremely good now and compete on a frontier level or near frontier level parity. Now, a lot of that is due to distillation of our own intellectual property which I think should be addressed legally however that doesn't mean banning of specific models origination source.

This will 100% stifle innovation here in the states, lock companies into a very tiny list of frontier models who's innovations have been incredible, but lock in an ecosystem that doesn't allow for others to come into play nor does it drive this industry forward.

The government should have zero control on who competes in this market space as long as its inline with our laws and regulations to not harm our citizens.

There's rumblings that this administration is looking to ban Chinese-based models. This is a very very very bad idea and one that will hurt us substantially in the short, mid, and long term efforts to be the dominate player in the AI space.

[Blake Andreasen @band8266]

The fact that this is the main priority for Adam Silver show how out of touch he is with the fan base. Fans don’t care about this nearly as much as foul baiting and refereeing.

[Pat McAfee @PatMcAfeeShow]

“The enormous amount of tanking and rebuilding we saw this year does keep me up at night..

We needed to add a more random element to our draft and that’s what we’re in the process of doing”

Adam Silver #PrimetimeSports

[Jason Chaffetz @jasoninthehouse]

I have concerns and Qs about @UUtah selling equity in @Utah_Football Does anybody really know what is happening here? Utahns deserve transparency. https://t.co/Mpqdrzt1HD

[FanDuel @FanDuel]

Quite possibly the coolest thing I've ever seen.

Utah State's "winning team, losing team" chant 🗣️

[Rob Perez @WorldWideWob]

And this right here, what just happened in Indiana, is why making an example of the Jazz was a short-sighted decision/slippery slope.

1) Zubac returns to action from extended time off, plays heavy 1H minutes. Looks good scoring 8 PTS (4-6 FG).

2) Nembhard drops 23 PTS (!) in the 1H in just 17 mins.

They both disappear at halftime, and dont play a single 2H second in what was a respectably close game for a majority of it.

Pacers (a team with losing incentive) lose.

Sound familiar?

The franchise comms team will likely issue an injury management explanation to avoid the eye of Secaucus Sauron/refute the imminent tanking allegations.

Is it possible both players got sore in the locker room/hurt in the first half? Sure, I guess.

The point here is that by fining the Jazz for conduct detrimental to the league, NOT (⬅️) a Player Participation Policy violation, your games are now going to be under the microscope in the event this type of starter rotation activity occurs again.

You can’t just fine one franchise and hang their reputation from a tree to scare the other citizens from replicating the same behavior.

That selective enforcement is what put you in the spotlight originally, because Jaren Jackson Jr./Lauri Markkanen ended up either getting surgery or having a legitimate hip injury keeping them out for the foreseeable future.

Nembhard/Zubac may end up experiencing something similar to JJJ/Markkanen, they may not, but the inconsistent enforcement WITHOUT knowing their personal medical records is reflective of a business that only steps in when the seat gets hot.

The Jazz ended up winning some of those games they were so highly scrutinized for.

The Pacers lost tonight.

This alone does not justify penalizing the Pacers, because Micah Potter was trying to win just as much as Brice Sensabaugh was for Utah.

Players dont tank.

If you’re not going to fine the Pacers for this tonight, then just give the Jazz governors their $500,000 back, because this hypocrisy is what’s damaging the league reputation more than the integrity of the game.

[Michael Proper @michaelproper]

https://t.co/V6m80UvqBj

[OutKick @Outkick]

Oh Cosmo got moves moves

[Tom's Hardware @tomshardware]

User accidentally gains control of over 6,700 robot vacuums while tinkering with their own device to enable control with a PlayStation controller — security flaw reveals floor plans and live video feeds https://t.co/lf2M5LE2Ad

[Rob Perez @WorldWideWob]

"...the Jazz removed two of the team's top players...before the beginning of the 4Q and did not return them to the game"

1) Ok so if Will Hardy sits Markkanen the entire 3Q and plays him in the 4Q instead, is that acceptable?
2) They won that Heat game!
3) They won that Heat game because Brice Sensabaugh is nails and came through with several big shots. Is he not permitted to be the focal point of an offense without the presence of 'stars' on the floor concurrently?

I have more questions now than before they addressed/penalized this.

[Blake Andreasen @band8266]

RT @HackingDave: For the Nancy Guthrie case, an idea and maybe a crazy one but she had a pacemaker which often implantable devices use blue…

[Mark Cuban @mcuban]

Not filing patents and using trade secrets will become more common. Why ? Because the second you file your patent, every LLM is going to be able to train on it.

Then everyone on the planet can ask for a work around to file a competitive patent.

Your IP is no longer yours the minute you publish it

[Savage @Savageboston]

Perfection.