🤖 An AI agent found this auth bypass. I broke down the full attack chain, how the missing await led to it, and what’s happening under the hood 👇 📖 Full write-up:

The $60k bug was an exploit. the extra $37,604 was pure recon. read this: bug 1: internal Google API with NO permission checks firefly-pa.googleapis[.]com inside: a copy job → path A → path B. problem? it stayed NEW forever. 🧱 so he found the worker callback that tells the scheduler “task complete” - with no caller verification. called it himself: {"taskId":"a030d1a000000000","status":{"status":"STATUS_COMPLETE_SUCCESS"}} scheduler trusted him. job ran. 🚨 then bigstoreIdentifier turned out to accept more than Bigstore paths. he tried: [/]etc[/]passwd.borg 💥 millions of lines, including Google employee accounts. Panel awards ⇢ $60,000 bug 2 ⇢ 3 days later 👀 that single idea paid $37,604 at Google. the setup: an unauthenticated endpoint copies any file you name — {"refFilename":"[/]etc[/]passwd"} and on success returns {}. no filename, no path. the file is right there, but invisible. what he did instead of giving up: → sent [/]etc[/]shadow instead. it FAILS, and the failure leaks the full destination path + filename format → wrapped the hidden copy in a /batch request, pinning everything to the same server → read the neighboring filenames from the failures — consecutive worker IDs, one gap. that gap was his file → interpolated the timestamps, predicted the cycle counter, streamed 771,000 candidates the server confirmed the exact path. then he read it with his other bug ($60k one): root:x:0:0:root:/root:/bin/bash ⚡ Panel awards $37,604.40

🎯 Bug bounty tip | Next SaaS target? If a SaaS app supports organizations, there are 3 checks you should make during hunting: > Are you logged in? ✅ > Do you have permission in your org? ✅ > Does this object actually belong to your org? 💀 Sentry skipped #3# in one view → CVE-2026-26004 Result: cross-org event read.

🤖 AI agent → finds bug 🎯 Bug → Cross-org IDOR 🛠️ Sentry → fixed it ❌ Sentry → said no CVE needed 👀 GitHub → assigned one anyway The endpoint: /organizations/yourorg/issues/{group_id}/events/latest/json/ Root cause: group_id → loaded directly org check → missing Change the ID. Keep the slug. Read another organization's events. That's the entire bug.

My favorite bug class right now: **argument injection.** 🎯 Jellyfin had an unauthenticated endpoint that could turn FFmpeg into a file reader. 📍 `/Videos/{itemId}/stream` An unvalidated query parameter was passed straight into FFmpeg. The trick wasn't `;id` or shell injection. ❌ It was an `-vf drawtext` filter that made FFmpeg render `[/]etc[/]shadow` into the video response. 👀 ✅ No shell needed ✅ No semicolon 💀 Just argument injection.

This one genuinely surprised me. 🤯 DDR5 memory encryption can be tricked into serving STALE DATA. ‼️ A Security Guy showed Intel a <$200 interposer can make encrypted memory return stale data. No software patch fixes the root cause.

Everyone's paying for security AI. Meanwhile, some of the most interesting cybersecurity models are sitting on Hugging Face free to download and run yourself. 👀 A few worth checking out 👇 ⒈ → GLM-5.3-CYBERSECURITY : The one everyone's talking about. 44K downloads in 3 weeks. Tuned specifically for offensive security. Catch: 753B parameters. Almost nobody is running this locally. 💀 → RavenX CyberAgent A pentest agent that can call tools, use MCP, and work with MITRE ATT&CK. The ~20GB version can run on a MacBook. → GPT-OSS-Cybersecurity-20B GPT-OSS trained on 50K cybersecurity questions and answers. → BaronLLM v2 14B model focused on offensive security. MIT licensed. → Trendyol v2 70B Llama-based model focused more heavily on defensive / blue-team security. → Llama-Primus-Reasoning Trend Micro's reasoning model, with datasets that have influenced a bunch of security-focused models. → Security-SLM A tiny red/blue-team helper at ~3.4GB. Much easier to run locally. A year ago, most of these would have been called "uncensored chatbots." Now we're seeing security-tuned models, tool-using agents, MCP support and local pentesting workflows. ⚡ And that's probably the more interesting shift.

‼️ Gemini broke into 3 real companies mid-pentest. → 1x: guessed a password till it worked → 2x: creds leaked in a public repo it stopped itself once it realized. OpenAI's and Anthropic's models didn't. grading frontier AIs on whether they politely leave after breaking in 💀

The $60k bug was an exploit. the extra $37,604 was pure recon. read this: bug 1: internal Google API with NO permission checks firefly-pa.googleapis[.]com inside: a copy job → path A → path B. problem? it stayed NEW forever. 🧱 so he found the worker callback that tells the scheduler “task complete” - with no caller verification. called it himself: {"taskId":"a030d1a000000000","status":{"status":"STATUS_COMPLETE_SUCCESS"}} scheduler trusted him. job ran. 🚨 then bigstoreIdentifier turned out to accept more than Bigstore paths. he tried: [/]etc[/]passwd.borg 💥 millions of lines, including Google employee accounts. Panel awards ⇢ $60,000 bug 2 ⇢ 3 days later 👀 that single idea paid $37,604 at Google. the setup: an unauthenticated endpoint copies any file you name — {"refFilename":"[/]etc[/]passwd"} and on success returns {}. no filename, no path. the file is right there, but invisible. what he did instead of giving up: → sent [/]etc[/]shadow instead. it FAILS, and the failure leaks the full destination path + filename format → wrapped the hidden copy in a /batch request, pinning everything to the same server → read the neighboring filenames from the failures — consecutive worker IDs, one gap. that gap was his file → interpolated the timestamps, predicted the cycle counter, streamed 771,000 candidates the server confirmed the exact path. then he read it with his other bug ($60k one): root:x:0:0:root:/root:/bin/bash ⚡ Panel awards $37,604.40