Topics
During a real penetration test, any signed-in member could get a product's built-in AI assistant to run shell commands on the server — not through an exploit chain, but by asking. The model's refusal to run 'sensitive' commands looked like a control. It wasn't.
The smallest finding from this engagement, and the most ordinary — the kind of bug that predates AI entirely. One method on the chat endpoint checked who was asking. Another, right next to it, didn't.
Same product, a smaller bug with a longer reach. The AI chat let any member attach a document by URL — and the server fetched almost any URL they gave it. LiteLLM blocked the scary targets, so we rate it honestly: a MEDIUM, not a headline.
One email a month with new posts, product updates and the odd postmortem worth reading. Unsubscribe in one click.
