Héctor Martos

[Héctor Martos @h_martos]

¡Estadísticas de visionado de Netflix ya tiene más de 10.000 usuarios!

🥳🥳🥳🥳🥳

Muchas gracias a todos los que habéis colaborado a alcanzar este hito que nunca habría imaginado.

#Netflix #Estadísticas #Datos #Analítica

[Zack Korman @ZackKorman]

NVIDIA Nemoclaw's security is worse than I expected.

The AI can modify its own config to bypass security controls. I asked it to accept websocket connections from any origin and change its token to something trivial (123).

Now any site I visit can give instructions to my bot.

[Héctor Martos @h_martos]

@ZackKorman @UK_Daniel_Card Another great example that given the nature of this kind of software, any flaw that allows an attacker to send requests to the bot can escalate into arbitrary Remote Code Execution.

Read the full story here 👇

https://t.co/o4pBQ8uinf

[Ryan | Don't Fear AI @DontFearAI]

@HedgieMarkets Here's a helpful tip. No one reads privacy policies and terms of service - they are too long and boring. But please at least have AI review them and flag any concerns for you. I often have AI compare privacy policies of different products.

[Hedgie @HedgieMarkets]

🦔 Meta contractors in Kenya told Swedish newspapers they're being asked to review intimate footage from Ray-Ban AI glasses, including people undressing, using the bathroom, watching porn, and filming sex. One contractor said users often don't realize they're still recording when they set the glasses down. Meta sold 7 million pairs in 2025, up from 2 million in 2023-2024 combined.

Users can't use the AI features without agreeing to share data with Meta's servers, and the terms of service bury the fact that humans may manually review your footage. One annotator said "if they knew about the extent of the data collection, no one would dare to use the glasses."

My Take
This is the Google Home story again but worse. At least with cameras in your house, you know where they are. These are glasses you wear on your face that keep recording when you take them off and set them on your nightstand. And the footage goes to contractors overseas who are paid to watch and label it for AI training. One worker described seeing a man leave the room, then his wife come in and change clothes. People forget the camera is still on.

Meta buries all of this in terms of service nobody reads. The product is marketed as a cool way to capture your life and interact with AI. The reality is strangers in Kenya watching you undress so they can annotate the footage to make Zuckerberg's AI better. Seven million people bought these last year. I'd bet almost none of them understood what they were actually agreeing to.

Hedgie🤗

[zaimiri @zaimiri]

OpenClaw just got attacked.

40,000 systems compromised.

A flaw dubbed “ClawJacked” allowed full agent takeover.

But this isn’t just a bug.

It’s a vulnerability chain that let any website silently take full control of your AI agent.

No plugins.
No extensions.
No user interaction needed.

Which means:

> Malicious sites could steal data.
> Delete emails (Meta execs already hit).
> Disrupt services.

Give this post to your agent and tell then to fix this backdoor ASAP.

[Héctor Martos @h_martos]

@zaimiri It does require some user interaction (e.g., clicking a link to kick off the chain), but in practice that’s a pretty low bar—especially for a publicly exposed instance. I documented the full chain here 👇

https://t.co/o4pBQ8uinf

[Héctor Martos @h_martos]

@tapatiainefable @lizy_preciosa 🤣

[Héctor Martos @h_martos]

@elonmusk Definitely not a good idea! ⛔️⛔️⛔️

Public exposure + system-level permissions = full compromise waiting to happen.

Full write-up 👇

https://t.co/o4pBQ8uinf

[Elon Musk @elonmusk]

People giving OpenClaw root access to their entire life

[Héctor Martos @h_martos]

OpenClaw 🦞 is an AI agent with full system access that can do a lot of things.

🛑 Powerful… and dangerous!

Here’s how publicly exposing an OpenClaw instance can lead to full system compromise.

#OpenClaw #EthicalHacking #AIAgent #ATO #RCE

https://t.co/o4pBQ8uQcN

[Héctor Martos @h_martos]

@OpenClaw 🦞 is an AI agent with full system access that can do a lot of things.

🛑 Powerful… and dangerous!

Here’s how publicly exposing an OpenClaw instance can lead to full system compromise.

#OpenClaw #EthicalHacking #AIAgent #ATO #RCE

https://t.co/o4pBQ8uQcN

[Héctor Martos @h_martos]

@OpenClaw 🦞 is an AI agent with full system access that can do a lot.

🛑 Powerful… and dangerous!

Here’s how publicly exposing an OpenClaw instance can lead to Account Takeover and Remote Code Execution.

#OpenClaw #EthicalHacking #AIAgent #RCE

https://t.co/o4pBQ8uinf

[Héctor Martos @h_martos]

@OpenClaw 🦞 is an AI agent with full system access that can do a lot of things.

🛑 Powerful… and dangerous!

Here’s how publicly exposing an OpenClaw instance can lead to Account Takeover and Remote Code Execution.

#OpenClaw #Hacking #AIAgent #RCE

https://t.co/o4pBQ8uinf

[Héctor Martos @h_martos]

@OpenClaw 🦞 is an AI agent with full system access that can do a lot of things.

🛑 Powerful… and dangerous.

Here’s how publicly exposing an OpenClaw instance can lead to Account Takeover and Remote Code Execution.

#OpenClaw #Hacking #AIAgent #RCE

https://t.co/o4pBQ8uQcN

[Héctor Martos @h_martos]

@Rafael_Casuso “No es más feliz quién más tiene, sino quién menos necesita” ☺️

[Héctor Martos @h_martos]

@WinixRun PD: Personalmente, yo expondría este acceso a través de Cloudflare WARP, la solución Zero Trust de Cloudflare

[Héctor Martos @h_martos]

@WinixRun Y lo peor de todo, que encontrarás puñados de gente, de esos que instalan APKs descargados de Internet con Spotify gratis diciendo: ¿y a mí qué me van a hacer? 🤷‍♂️

[Héctor Martos @h_martos]

@david_bonilla @thehwlz Totalmente de acuerdo. No entiendo esa aversión a la consultoría como punto de partida. Te permite trabajar en múltiples proyectos, con distintos clientes y tecnologías, agilizando muchísimo el aprendizaje y la búsqueda del área que más te guste. Y lo más importante, hay trabajo.