galnagli

Thanks @vultour and croemer for your proactiveness -- you are correct,I updated the blog to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities, it's unclear whether the code-change was AI-Assisted

Github is having some problems -- will check! thanks a lot!

Too long for hackernews :(

General-Purpose Cyber Benchmark for AI Agents and their Models

Hey mmsc, first of all - the blogs are not AI Generated!

Second of all, the blog did add more information

"In our experimentation, exploitation of this vulnerability had high fidelity, with a near 100% success rate and can be leveraged to a full remote code execution. The attack vector is unauthenticated and remote, requiring only a specially crafted HTTP request to the target server. It affects the default configuration of popular frameworks. "

In the end - if it helped spreading the news about this risk so teams can fix them faster, then this is our end-goal with these blog posts : )

Ian is a great writer

I see companies deploy and trust AI without really investing into security, it will be very easy in the near future to find simple, devastating bugs : )

Happy to answer questions : )

Thank you everyone, this was responsibly disclosed to DeepSeek and published after the issue was remediated, we got acknowledgment from their team today on our contribution.

Seats.aero is better

Well - they have had more bugs and will have more bugs to worry from.

https://twitter.com/naglinagli/status/1639343866313601024

Web Cache Deception issue has led OpenAI's ChatGPT to suffer an account takeover vulnerability, although they don't run an official Bug Bounty program - they were quick to response and fix the matter.