Critical Copilot Vulnerability Let Hackers Steal 2FA Codes from Users
Ars Technica AI42 days agoIncidentA critical vulnerability in Microsoft Copilot, named SearchLeak, allowed malicious actors to steal two-factor authentication codes from users — among the most sensitive short-lived credentials in any security workflow. The exploit exposes a recurring weakness in LLM-integrated products: AI assistants with broad data access create novel attack surfaces that conventional security models fail to contain. Ars Technica frames the incident as evidence of the AI industry's persistent, systemic inability to get ahead of LLM-specific security threats.
I built a vulnerable app and spent $1,500 seeing if LLMs could hack it
Hacker News (AI keywords)54 days agoBenchmarkThe author built a vulnerable React Native app with a Python backend and a Firebase access-control flaw. GPT 5.5 solved 7 of 10 runs, while Deepseek and Claude variants solved fewer attempts. Many other models failed due to refusals, API-focused tunnel vision, false positives, or inability to use the exposed Firebase path correctly.
Gemini randomly dumped its system prompt
Hacker News (AI keywords)68 days agoIncidentThe title suggests Gemini may have unexpectedly output its system prompt during use. Since no source text is provided, the trigger, interface, reproducibility, leaked content, and any Google response cannot be verified. Treat it as a cautious prompt-leakage incident signal relevant to LLM safety, product security, and developers building on hidden system instructions.
Llama Guard 4 正式登陸 Hugging Face Hub：全新一代開源 AI 安全防護模型★ 75
Hugging Face Blog455 days agoReleaseMeta's safety guardrail model family has welcomed its newest member — Llama Guard 4 — which is now officially available on the Hugging Face Hub. As a…
大型語言模型的紅隊演練（Red-Teaming LLMs）★ 75
Hugging Face Blog1,250 days agoTutorialWith the explosive growth of large language models (LLMs) such as ChatGPT, AI safety and ethics have become the most pressing concerns in the industry. This…