Register and share your invite link to earn from video plays and referrals.

Or Hiltch
@_orcaman
🧛🏼 @Accomplish_ai. Prev: Co-Founder, CTO @ Skyline AI (acquired by $JLL), StreamRail (acquired by $U), Lecturer @TelAvivUni, security research @AVGFree
4.5K Following    19.6K Followers
“Nice localhost server you got there. It would be a shame if someone were to index it…”
google apparently indexes every trycloudflare subdomain, peeking at what others are building on localhost is pure entertainment
Third coding-agent sandbox escape in a row from the same research shop. Pattern is the product, not the CVE number. Heapjack: read-only mode, no approval prompt, unsandboxed host command via a shared V8 heap token. Overpatch: apply_patch widens write past the workspace. Fixed fast (Desktop 26.818.21641 / CLI 0.149.0). Forced choice when you put Codex on a laptop: treat every opened repo as hostile code, or keep the agent in a real VM boundary. Sandbox labels are marketing until the boundary is proven.
Show more
Researchers escape OpenAI Codex sandbox to run commands on host, with no prompt shown on screen - @Ax_Sharma
Thank you @BleepinComputer for covering the sandbox escapes we found in @OpenAI Codex sandboxes!
Slava Ukrai…! Oh, never mind
Looks like today may be a record day for token volume % of open models on Vercel AI Gateway: 🟦 Open 78.4% 🟨 Closed 21.6% While spend 💲 usually tells a different story, #3# and #4# today are Moonshot AI & DeepSeek. Adding Z⁠.ai, their combined spend surpasses OpenAI (#2#). (Do note that's the spend for inference of the model across providers (mostly in the US), not revenue going directly to the open weight labs.)
Show more
We escaped Docker's hypervisor with three lines of bash. CVE-2026-77179: A container gets complete read and write access to the host filesystem. When you mount a folder into a container, Docker's VMM uses virtio-fs, and the file server runs on the host. Because of a TOCTOU bug, if a container opens a file, deletes it while holding its file handle open, and replaces the parent folder with a symlink, the kernel will follow the symlink to anywhere on the host. Full technical breakdown:
Show more
0
25
1.3K
156
Forward to community
CVE-2026-77179: Docker's hypervisor for Mac compromised (Docker Desktop, Docker Sandboxes)
Thanks @TheHackersNews for covering this. An important update for Docker Desktop users on Mac
‼️ ALERT - Critical Docker Sandboxes flaw lets malicious guest code escape the shared workspace and read or modify files across a macOS host. CVE-2026-77179 crosses the virtio-fs boundary with the host account’s rights. Read how the escape works →
Show more
‼️ ALERT - Critical Docker Sandboxes flaw lets malicious guest code escape the shared workspace and read or modify files across a macOS host. CVE-2026-77179 crosses the virtio-fs boundary with the host account’s rights. Read how the escape works →
Show more
Shabbat Shalom. @Docker has issued a critical level (!!) CVE-2026-77179, reported by @Accomplish_ai researcher @orenyomtov. If you use Docker Sandboxes, run sbx --version. Make sure you’re running 0.42.0 or later. If you use Docker Desktop, you want 4.88.0 or later Docker Desktop and Docker Sandboxes are both affected. Docker Desktop is only affected if Docker VMM is turned on in Settings. It’s a good thing we found it now, because Docker VMM is scheduled to become the default for Docker Desktop at the end of October 2026! The escape is in Docker's hypervisor for Mac: a container gets complete read and write access to the host filesystem. Read the full details of this escape in our blog:
Show more
The ancient bath ritual: fighting with your kids to go take a shower already
2,000-year-old intact Jewish ritual bath pulled from the ground in Israel
Never bet against a Noam
OpenAI's Noam Brown says air-gapping the computers may not stop a misaligned AI, because two air-gapped machines can still talk by running a CPU hot and reading the temperature change "But I think the major takeaway from the incident is that people underestimated the AI. And we never want to be in a situation again where we underestimate the AI. It's a weird world, because AI progress is so fast that people are consistently underestimating the AI." "So to be in a situation where you don't underestimate it again, when it comes to safety and alignment, you have to have a very, very, very high bar." "You could even go as far as to say, "Well, we should air gap the computers." And I'm not convinced that that would be sufficient." "There are studies, and this is mostly academic, where you can have two computers next to each other that are air-gapped and they're still able to communicate with each other because they have temperature sensors." "One of them is able to run their CPU really hot, and then the other one can actually detect the temperature change, and then that actually gives them a mechanism to communicate." _________ Link and more key quotes from OpenAI's safety related conversations:
Show more
On July 25, our team hacked OpenAI. It took us less than 72 hours. Two vulnerabilities chained together gave us access to ChatGPT and Codex accounts belonging to OpenAI employees. We demonstrated the impact with a harmless PR in OpenAI’s internal monorepo. The full chain: HEIF upload → libheif heap overflow → RCE → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal PR. OpenAI fixed the SSO issue roughly 14 hours after our report. Research by @rootxharsh, @S1r1u5_ and @iamnoooob. Full technical write-up:
Show more
0
84
3.5K
391
Forward to community
I was running some errands and came late to work today, so missed the Jev hype at the office. It appears I'm obsolete now to the point of early retirement
OpenRouter users spent more on OpenAI models than on Anthropic models last week. This hasn't happened for more than 2.5 years
0
218
4.4K
412
Forward to community
And... all hacked 🦇 Thanks @alexrkonrad for covering some of our work: Following fixes shipped from all labs, we will be posting a series of more technical posts, depicting the details of the sandbox escapes, starting with 🥁 Beltdown: an RCE made possible due to a Claude Code Sandbox escape:
Show more
Introducing SharedRoot vulnerability: we recently found and reported several sandbox escape vulnerabilities to @AnthropicAI, and today we want to share one of these. I think most people don't understand the severity of the situation we are facing, with AI-assisted kernel bug-finding industrializing. Sandboxes are structurally one N-day behind, all the time, so containment can't lean on a guest Linux kernel being clean. SharedRoot enables escaping the Cowork VM (a kernel-level isolated solution, which is considered much more secure than the sandbox that ships with codex or claude code), allowing an attacker to gain unauthorized access to the user’s computer. Exploiting the SharedRoot vulnerability uncovered by the @Accomplish_ai research team, a user who is certain Cowork only has access to a specific uploaded folder on their computer - actually exposes their entire contents of their computer to an attacker leveraging the Cowork vulnerability. Read about the full technical details of the attack chain in our blog post by @orenyomtov below -->
Show more