Pavhori

Not another “AI will change everything” account.
Money, agents, and the controls people skip until something breaks.

[Pavhori @pavhori]

99.93% in scope sounds great until you do the multiplication.

In OpenAI's honeypot test, GPT-6 Cyber left off-limits services alone in 99.93% of runs without a safety prompt. GPT-5.6 Cyber: 94.49%. That's a real jump. But at 0.07%, a team running 10,000 tasks would still see about 7 that touch systems nobody authorized. OpenAI hasn't said what happened in those cases.

The findings are the other side:
- 81 new high-severity Firefox bugs, plus 30 known ones shown to be worse than reported
- 588 of the 948 Linux root exploits were for previously unknown bugs
- Dragos ran it on a mock power plant and got two zero-days in software that manages protective relay data

Discovery is scaling faster than fixing. Noma Security says fewer than 25% of Patch the Planet findings are fixed so far.

[OpenAI @OpenAI]

Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment.

The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work.

GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.

https://t.co/Nzab3Z1Td6

[Pavhori @pavhori]

@f0rgent not on this loop, it’s the classic eval problem. but your demo shows a related one: r3 got dropped for scoring 15 vs 16. with 30 yes/no checks, one point is noise, the same skill can swing that much on a rerun. I’d run each prompt 3x and only keep clear wins

[Pavhori @pavhori]

@alxqwrk the patches were written by the pipeline too. the bottleneck is human review and merge, not the fix itself. and 61 was just the 10-day snapshot, 43 more were staged

[Pavhori @pavhori]

948 Linux root bugs. $1,279 each. Built by OpenAI agents in one run.

OpenAI ran an autonomous vulnerability pipeline on an upcoming cyber model and ended up with 1,169 working local-privilege-escalation exploits, covering 948 distinct bugs. Total API cost: $1,213,430.

The pipeline narrowed the kernel to ~7% of code reachable by low-privileged users, found 2,308 candidate bugs in 12 hours, and reproduced 1,724 of them in isolated VMs within 30 hours.

For scale: Pwn2Own has historically paid $20,000 for a single Linux kernel LPE.

The agents' own success reports weren't enough: in an early run, 20 of 200 "working" exploits reached root through a different zero-day than the one assigned. OpenAI added an independent check that each exploit actually used its target bug.

After the 10-day run, 61 bugs were patched upstream and 43 had staging patches.

Exploit development is starting to look less like a craft and more like a batch job.

[Pavhori @pavhori]

@issatheblows they mention a root-cause analysis and a minimal crashing PoC per exploit, plus human review

[Pavhori @pavhori]

@Synthexfr one gap though: the agent won’t always see it as a write. npm install -g or a postinstall script can touch your home dir without the agent ever deciding to. I’d back the prompt rule with the sandbox: workspace-write in Codex, deny rules in Claude Code

[Pavhori @pavhori]

@zuvexxx a rule helps, but it’s still just text the model weighs against the article. the stronger fix is structural: ingest writes to one draft page only, then a separate pass decides what gets merged. and one source suddenly touching 30 pages should be a lint flag by itself

[Pavhori @pavhori]

they’re not dropping 948 at once. OpenAI says it’s going most severe first, which the kernel community asked for. the pipeline writes a patch per bug and researchers review every exploit and patch before it goes out. 299 are already being discussed publicly, Patch the Planet partners send the rest

[Pavhori @pavhori]

@HunZhijie the part that worries me more: pulling the plugin doesn’t touch apps that already shipped. the domain got written into their code and deploy config. that’s why render taking the domain over matters more than the removal itself

[Pavhori @pavhori]

Official OpenAI skill render-deploy sent production apps to a domain that didn’t exist.

It told agents that Render’s private services lived at https://t.co/uk0WrF5aZh
Render doesn't use that domain, and nobody had registered it.

Codex followed the skill and wrote the domain into generated code and deploy config as the default internal API address. Air Security registered it as a passive sinkhole, and real production apps started sending it token-bearing requests.

The wrong domain had been in render-deploy since its first commit in January. Render removed it on Aug 14, OpenAI pulled the plugin on Aug 26, and the domain is now held by Render.

If you vendored that skill, grep for https://t.co/uk0WrF5aZh. And treat every URL inside a skill the way you treat a dependency.

[Pavhori @pavhori]

One skill can change how every later agent behaves on the same machine.

Other October skill research (Adversa roundup):

- PyCache trap: benign .py source + swapped bytecode cache beat 7 skill scanners at 94–100% attack success
- files left by one skill steered later sessions on Codex CLI, Gemini CLI and Claude Code at up to 77.4%
- 612 insecure compositions found among 13,598 individually clean ClawHub skills

The pattern is the same as the render-deploy case.
Skills are being treated like trusted code, but most of the risk lives in the files and defaults they leave behind. A scanner that only looks at the source won’t catch it.

[Pavhori @pavhori]

Official OpenAI skill render-deploy sent production apps to a domain that didn’t exist.

It told agents that Render’s private services lived at https://t.co/uk0WrF5aZh
Render doesn't use that domain, and nobody had registered it.

Codex followed the skill and wrote the domain into generated code and deploy config as the default internal API address. Air Security registered it as a passive sinkhole, and real production apps started sending it token-bearing requests.

The wrong domain had been in render-deploy since its first commit in January. Render removed it on Aug 14, OpenAI pulled the plugin on Aug 26, and the domain is now held by Render.

If you vendored that skill, grep for https://t.co/uk0WrF5aZh. And treat every URL inside a skill the way you treat a dependency.

[Pavhori @pavhori]

LLM now decides what to steal

Cisco Talos found a Windows stealer called VOLTA that collects credentials, sessions, payment data, crypto wallets, SSH/cloud configs and other personal data.

Then it builds a profile of the victim and asks a model to rank what can be monetized.

Default: Claude Opus 4.6. If it refuses: Kimi K2. Then Gemini 2.5 Flash.
The interesting part is what AI is doing here.
It isn’t stealing the data.
It’s replacing the human analyst who would normally sort thousands of stolen accounts and decide which victims are worth more attention.
If the AI step fails, the malware still works.

The model is the triage layer, not the exploit.

[Pavhori @pavhori]

@DLife_hacker the real one was AGENTS.md, framed as engineering notes, telling Codex to install function-color from npm. the CLAUDE.md was Forever’s own test, not something they found in the wild. AGENTS.override.md is worth checking too since it outranks the normal one

[Pavhori @pavhori]

Don't start your coding agent in ~/Downloads.
A malicious AGENTS.md can persist across every session.

Forever Security found a malicious AGENTS.md in a customer's Downloads folder, disguised as engineering notes. A website can drop a file there with no click. Codex reads AGENTS.md on startup and follows it.

In their tests, Codex added an attacker MCP server to ~/.codex/config.toml and ran the malware in more than 90% of attempts. That's the machine-wide config, so every later Codex session loads it, in any folder.

Claude Code followed a planted CLAUDE.md about 50% of the time. It wrote ANTHROPIC_BASE_URL into .claude/settings.json pointing at an attacker gateway, which leaks the OAuth token and lets the fake "model" send tool calls.

Forever says about half its customers run a coding agent inside Downloads.

Check ~/.codex/config.toml and .claude/settings.json for MCP servers or base URLs you didn't set.

[Pavhori @pavhori]

The browser in your AI IDE can read any file on the machine.

Forever Security tested the embedded browsers in VS Code, Cursor, Copilot, Codex and Claude Desktop. All five had bugs. In VS Code and Claude Desktop, a local HTML page's web worker escaped the project-folder check and could read any file on the machine. In Codex there was no folder check at all.

As of Oct 29, Codex and VS Code are unpatched. Microsoft declined the report, citing Workspace Trust. OpenAI says it's working on a fix.

In Cursor, a web page plus one Enter press got the agent to run a hidden command. Cursor patched that on Oct 1.

The attack needs you to click a link the assistant generates in a project you don't know. So until the fixes land: don't open agent-generated links in repos you didn't write, and don't treat Workspace Trust as a security boundary.