/
attack_type:information_disclosure × victim_sectors:technology × limpar

Resultados

3 casos · pág. 1/1

wired.com · low

WhatsApp help pages exposed hidden Meta support chatbot instructions, including guidance to avoid referencing regulators

Privacy firm Redact found that around 80 WhatsApp help and FAQ pages exposed hidden text instructions written for a Meta large language model support chatbot. The text, about 100 blocks in total, sat in the page source under a code block headed "HelpContentGalaxyLLMInclude". Some instructions told the chatbot not to recommend contacting a…

wired.com · · 2 fontes · 2 atualizações high

GhostShares: Meta Muse AI share links expose ~6,800 private chats via passive DNS; Meta suspends sharing

Researchers at Claroc disclosed GhostShares, a design flaw in Meta's Muse AI assistant that lets anyone discover shared conversations through passive DNS. Muse share links use the domain cf.metaaiusercontent.com and embed the conversation title and a random identifier in the hostname. Once a browser resolves the name, passive DNS sensors …

hacktron.ai · high

Hacktron AI audit finds critical flaws in Cloudflare's vibe-coded Next.js replacement vinext: session leakage, cache poisoning, middleware bypass

Researcher Mohan Pedhapati of Hacktron ran an AI-driven audit against vinext, Cloudflare's Next.js reimplementation reportedly built in a week with AI assistance. The scan produced 45 findings, of which 24 were manually validated, including several Critical issues. The most serious bugs allow cross-user session data leakage, shared cache …