Hugging Face 这个入侵事件非常有代表性 攻防、取证方都发生了巨大变化，攻击方是一个自主 AI 代理系统从头到尾驱动，而取证方也主要依靠自己的 AI 来检测和剖析它。

Florida resident Angelo Martino, formerly employed as a ransomware negotiator in the cybersecurity industry, pleaded guilty to conspiring to commit ransomware attacks and facilitate extortion efforts against US companies in 2023. 🔗

大裁员后的翻车来了。这几天，Meta 旗下的 Instagram，被曝 AI 助手出现史诗级漏洞，导致多个 Ins 博主账号被盗。 平台给 AI 助手，默认开了一个超级权限，可以在无任何验证的情况下，直接帮人修改 Ins 的绑定邮箱。 流程则是 1. 用 VPN 假装自己在目标账号的国家 2. 跑到 Meta AI 聊天里，说我是这个账号的主人，想换个新邮箱 3. AI 傻乎乎地相信了，发验证码给黑客的新邮箱 4. 黑客把验证码告诉 AI，AI 就直接把账号邮箱，换成黑客的了，然后黑客就能重置密码、抢走账号 目前，Meta 已紧急修补了这个巨大漏洞。

We’re sharing our completed post-mortem on the April 18th incident, prepared with @Mandiant and @CrowdStrike. We are publishing both an executive summary and the full report at the link below. Over the past four weeks, we’ve worked with hundreds of partners to help them understand their current security posture, and harden it where appropriate. We’ll continue this work, alongside taking additional proactive steps for the benefit of not only our partners, but also the ecosystem as a whole. We want to extend our thanks to our partners for their support and patience this past month. There’s a reason that over $12 billion has moved across the network in the past four weeks, and why the world’s most valuable asset issuers have stood by our side: they believe in us, in what the LayerZero protocol has to offer, and in the value of modular, isolated, application-controlled security. The work continues. And we look forward to continue showing up for the applications that trust us with their business, as well as the broader ecosystem.