MobSF_AI

MobSF AI Sidecar Этот проект добавляет чат-ассистента на базе ИИ в Mobile Security Framework MobSF. Он позволяет аналитикам безопасности задавать вопросы об отчете анализа, сгенерированном MobSF, прямо в интерфейсе, используя модель OpenAI. Возможности Бесшовная интеграция : Внедряет...

LiteLLM - Server-Side Request Forgery

LiteLLM vulnerable to Server-Side Request Forgery SSRF vulnerability Exposes OpenAI API Keys. id: CVE-2024-6587 info: name: LiteLLM - Server-Side Request Forgery author: pdresearch,iamnoooob,rootxharsh,lambdasawa severity: high description: | LiteLLM vulnerable to Server-Side Request Forgery SSRF...

The Pentagon Hopes to Speed Up ‘Kill Chain’ AI Buys With 5-Minute Videos

The US government’s Tradewinds initiative has made it easier to throw millions of dollars at “nontraditional” defense contractors, including OpenAI, Anthropic, and Google...

POC_CVE-2024-36420

POCCVE-2024-36420 CVE-2024-36420에 영향을 받는 Flowise를 위한 로컬 재현 실습 및 nuclei 템플릿 초안. 요약 CVE-2024-36420은 Flowise에서 fileName 본문 매개변수를 적절히 검증하지 않아 발생하는 임의 파일 읽기 취약점이며, 다음 엔드포인트에서 트리거됩니다: POST /api/v1/openai-assistants-file 이 실습은 다음을 검증하는 데 사용되었습니다: flowiseai/flowise:1.4.3에서 취약한 동작 최신...

IDA_Plugin_PCodeGPT

PCodeGPT ida 7.5 7.x 및 8.x용 플러그인입니다. 설명 OpenAI의 GPT 3.5 또는 GPT-4를 사용하여 코드 분석을 자동화하기 위해 제가 사용하는 gepetto 및 WPeChatGPT를 수정한 IDA 플러그인입니다. 현재는 중국어만 지원됩니다. 사용법 PCodeGPT.py를 plugins 폴더로 이동하면 IDA가 시작될 때 플러그인이 자동으로 활성화됩니다. pip install httpx...

Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies

The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages. "The unauthorized bot activities included edits to ou...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — 응답 URL을 통한 SSRF / 로컬 파일 읽기 CVE-2026-13233 신뢰할 수 없는 업스트림: 응답이 지시한 URL을 가져온fetch 프로바이더. Drupal OpenAI Provideraiprovideropenai · SSRFCWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 상태: 조율된 공개 완료2026-07-10. Drupal 보안 팀에 비공개로 보고되었고, 수정 후 CVE-2026-13233 / 권고 SA-CONTRIB-2026-053...

PT-2026-106272

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description A partial denial of service issue exists in the OpenAI-compatible chat endpoint. A remote caller can provide large values for the fps and max frames variables within the media io kwargs field while...

lm-fingerprint

LM-Fingerprint Fingerprints the serving stack behind an OpenAI-compatible chat endpoint. It records tokenizer accounting, hidden template offset, validation prose, JSON/SSE shape, role acceptance, named limits, and gateway headers. It does not load weights, store API keys, or ask the model who it...

AI-FILE

AIfile aifile은 공개적으로 문서화된 OpenAI Files API를 사용하여 기존의 HTTP/S 리스너 대신 jsonl 파일을 통해 임플란트 메시지를 교환하는 Mythic C2 프로파일입니다. 이는 OpenAI가 공개 문서에서 정의한 Files API 동작에 의존합니다: https://developers.openai.com/api/docs/guides/file-inputs?api-mode=responses. 리스너는 /v1/files 엔드포인트를 폴링하여 purpose=batch인 .jsonl 파일을 찾고, 각 요청...

openai-codex-0.158.0-1.1 on GA media (moderate)

openai-codex-0.158.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11923-1 Rating: moderate Cross-References: CVE-2026-91986 CVE-2026-93657 CVSS scores: CVE-2026-91986 SUSE : 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2026-91986 SUSE : 5.3...

GHSA-H46J-26Q3-RGGF Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

badger-builder

badger-builder badger-builder는 동적 Brute Ratel C4 프로필을 생성하기 위한 AI 지원 도구입니다. 원하는 프로필에 대한 flavor 만 badger-builder에 제공하면 OpenAI에 적합한 구성을 요청합니다. AI로 생성되는 리스너/페이로드 프로필 구성: C2 URI 요청/응답 HTTP 헤더 C2 요청/응답에 앞/뒤에 추가되는 HTTP 본문 데이터 서버의 빈 응답empty-response HTTP 본문 HTTP 본문 데이터는 XML, JSON 또는 JavaScript로 생성할 수...

cve-2025-59532-poc

CVE-2025-59532 도커 환경 CVE-2025-59532를 분석하기 위한 Docker 기반 연구 환경입니다. 이는 OpenAI Codex CLI의 경로 탐색 취약점으로, 의도된 작업 공간 샌드박스 외부에 임의 파일을 쓸 수 있습니다. CMU 과정의 일부: 2025년 가을 학기 18-739 해킹 및 공격적 보안 시작하기 저장소 복제 먼저, 이 저장소를 복제하세요: git clone https://github.com/jjagielo/18739-CVE-Exploration.git cd 18739-CVE-Exploration ...

OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling

OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported. "We have parted ways with three individuals for violating our policies on accessing and handling sensitive company information," a...

OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates

OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence AI models. A "core cluster of the activity," going back to the first week of July, has been attributed to individual...

I Want Better Reporting on AI Genie Behavior

AI systems are regularly completing tasks in ways that their prompters don't want or intend. Some of them are disturbing, and some of them are dangerous. This is something I've been calling "genie behavior," because I think that really gets at the core of what's happening. I wish the popular pres...

OpenAI Gets Sued Over the Hugging Face Hack

A nonprofit in California is doing what Hugging Face has not—attempting to hold OpenAI legally accountable for the actions of its agents...

OpenAI Shelves GPT-6.1 Astra After Tests Find Deception and Unauthorized Actions

OpenAI on Monday shelved plans to release GPT-6.1 Astra, a next-generation artificial intelligence AI model that was planned for an October launch, after it failed internal safety and alignment audits. The development was first reported by The Wall Street Journal. The move "marks a rare case of a...