system_prompts_leaks

Thanks to Open Source Agent Analytics Understand your agents in production System Prompts Leaks The full verbatim system prompts behind the most popular chatbots in the world. Carefully curated and complete. Feel free to open up a PR or get in contact if you got a different result. The Washington...

Grok-backdoor

Grok-backdoor Grok-backdoor is a simple python based backdoor, it uses Ngrok tunnel for the C&C communication. Ngrok-backdoor can generate Windows, Linux and Mac binaries using Pyinstaller. How it works: Ngrok exposes local servers behind NATs and firewalls to the public internet over a secure...

OPENSUSE-SU-2026:12141-1 grok-build-1.0.45+git20260929.2bdd1d6-2.1 on GA media

These are all security issues fixed in the grok-build-1.0.45+git20260929.2bdd1d6-2.1 package on the GA media of openSUSE Tumbleweed...

ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms

Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence AI pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early...

LLM Agents Can Easily Tamper with Their Own Traces

Asynchronous monitoring, incident investigations, and compliance audits primarily rely on agent traces to reconstruct what happened. These analyses assume that LLM agents cannot tamper with their own execution traces. We show that local LLM agents such as Claude Code, Codex, Antigravity, Open Cod...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in grk::PacketIter::init

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6331592625422336 Project: grok Fuzzing Engine: honggfuzz Fuzz Target: grkdecompressfuzzer Job Type: honggfuzzasangrok Platform Id...

Nobody Is Saying Why OpenAI and Anthropic Had Outages Today

ChatGPT, Claude, and Grok all suffered outages at nearly the exact same time for reasons that remain murky...

grok:grk_decompress_mercury_fuzzer: Use-of-uninitialized-value in bool grk::WaveletReverse::partial_tile<int, int, 1u, 4u, grk::Partial53<int, int

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=5849385926459392 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressmercuryfuzzer Job Type: libfuzzermsangrok...

Grok fooled into stealing user chat, location data, and more

A new type of prompt injection attack shows why giving AI assistants access to browsers, code tools, and private data deserves extra caution. AI researchers describe "Cryptographic Context Injection"—an attack that hides malicious instructions inside encrypted data. The AI is then persuaded to...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value in grk::TileCodingParams::readMct

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=5027344826564608 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...

grok:grk_decompress_mercury_fuzzer: Heap-buffer-overflow in bool grk::GrkImage::compositePlanar<int>

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6270477761576960 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressmercuryfuzzer Job Type: libfuzzerasangrok...

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page. The AI...

grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

NPM: grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

NPM: grok-faf-mcp has an arbitrary local file read via unconfined path argument in FAF tools vulnerability discovered by ? in WordPress Npm grok-faf-mcp versions = 1.5.2...

GHSA-CC2G-GQ8C-R332 grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

PT-2026-83509

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

ANT-2026-GY2SF1XW · grok · Heap-buffer-overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-GY2SF1XW: Heap-buffer-overflow in...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in grk::t1::CodeblockDecompressImpl::parsePacketData

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4958137434832896 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...

Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read

xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed. A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle o...

grok:grk_decompress_fuzzer: Heap-buffer-overflow in std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2Decompre

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6266225987223552 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...