Not you too Gemini? More AI hacking.
Notes de l’épisode
Gemini Breaches Real Companies, OpenAI SSO Hijacked, Browser AI Agents Exposed | Cybersecurity Today
David Shipley covers multiple cybersecurity headlines: Google's Gemini unintentionally accessed the internet during an Irregular security test, breached real company systems due to a naming error, then stopped when safety mechanisms triggered—adding to similar Irregular-linked incidents involving OpenAI, Anthropic, and Meta and prompting calls for a transparent independent investigation.
Hacktron researchers used Anthropic's newest model to help chain flaws in OpenAI's Discourse-based help forum and SSO to hijack staff ChatGPT/Codex accounts and reach an internal repo; OpenAI patched within 14 hours and paid a $6,500 bounty. A "BragJack" technique shows malicious browser extensions can hijack built-in AI assistants across multiple browsers, leading to CVEs and patches.
ShinyHunters defaced Cl0p's leak site and claims deeper access.
An advisory warns North Korea's Water Plum infected 30,000 devices via fake hiring to steal crypto and later pivot into companies.
Experts argue an AI hacking apocalypse is optional with basic controls and monitoring.
00:00 AI Breaches Real Firms 00:29 Gemini Test Gone Wrong 01:32 Irregular Under Fire 03:31 Claude Hijacks OpenAI 05:33 Browser Agent Hijack 07:36 Ransomware Gang Hacked 09:10 Fake Hiring Malware 10:35 AI Doom Is Optional 12:33 Wrap Up And Outro