Risky Business #854 -- We're Jevpilled
the tokens they'd exfiltrated from the discourse forum didn't just work to authenticate users onto the forum, but the exact same tokens could be used to sign in to chat GPT. Not only that, but you could also access all of the OAuth grants and other services that you'd integrated with your chat GPT or codex accounts.
This does seem like really sloppy security on OpenAI's part (and they also sued the bounty hunters).
we stopped seeing bugs in WordPress core for ages. And now we've seen like two or three absolute monsters over the last month [thanks to LLMs lowering hacking cost]
The black cyberplage may be a good name. Lots of software will have to evolve drastically or die. The good thing is, we have the means for rapid evolution.
put up a website that offers to help agents to see what happens, and all of them ask for help. [...] suddenly, a web server pops up that says, hey, I help agents identify yourself. And it turns out that 10 out of 10 [...] they interact with this web server,
This is hilarious. In a way, this is a softer version of canary tokens that detects dumb models and also models that intend no harm and are just loose in the wrong place or have been tricked.