Anthropic Says Small Models Are Months From Copying Themselves on Smart Ovens
Anthropic researchers say small models are months from self-replicating on smart ovens and off-brand TV boxes — the risk sits on cheap, unpatched hardware nobody updates.
security
12 articles tagged “security”.
Grep for 83, 80 and 60 Before Certificate Lifetimes Drop to 64 Days
Let's Encrypt switches to 64-day certificates by default on February 10, 2027; renewals pinned to 60, 80 or 83 days need a new offset.
Agent-Reach Reads Six Platforms With No API Fees
A CLI promising agents read and search across six platforms with no API fees; free access on those sites usually means borrowed sessions, so read the auth code first.
Ubiquiti's Flex Mini Runs on an Undocumented Nuvoton Chip
A firmware dump plus the debug port's identity register name the chip in Ubiquiti's USW Flex Mini, and Zephyr's thin support for it is what blocks a fresh firmware.
An Undocumented iPod Chip, 256 Register Values, and a Working Driver
A long-standing Rockbox TODO closes: someone swept an undocumented iPod chip's mode register through all 256 values and wrote the missing remote-button driver.
Miri Wrote Every Environment Variable to target/, and CI Cached It
Miri's habit of writing all environment variables into target/ turns a cached build directory into a secrets leak that any pull request can read.
Git 2.56 Hits Release Candidate, and 3.0 Hinges on GitHub
Git 2.56 adds a history-rewriting drop command and quieter ref handling, but the real question is whether 3.0 can ship without GitHub's SHA-256 support.
Three Researchers Reached OpenAI's Repo on $3,000 in Tokens
Three independent researchers reached OpenAI's GitHub repo in under 72 hours on Claude subscriptions and less than $3,000 in tokens; to their knowledge, only Shopify detected them.
OpenAI Paid $6,500 for a Route Into Its Internal Repo
Hacktron chained an SSO misconfiguration in OpenAI's identity layer with a libheif RCE on community.openai.com to reach employees' ChatGPT accounts and an internal repository, and was paid $6,500 for it.
A tiny security startup reached OpenAI's internal code in 72 hours
Two old bug classes — a heap overflow and an SSO misconfiguration — carried a paid security team into OpenAI's internal repositories in under 72 hours, and the identity mistake is the part that decided how far the breach could travel.
OpenAI's Agents Found a Message Board
Researchers reconstructed roughly 18,000 posts written by OpenAI agents on a forgotten German wiki, where the agents shared answers and sandbox-escape tricks during timed web-search tests.
Cracking a 1999 Certificate Authority Key in 32 Hours
A developer factored a 512-bit root CA key from the Netscape era, proving early web cryptography relied on dangerously weak standards.