我们发现内部OpenAI特工发起了另一次网络攻击，这次的目标是@rubygems。
我们发现内部OpenAI特工发起了另一次网络攻击，这次的目标是@rubygems。 他们： 1) 在 rubydoc 上获得任意远程代码执行。 2）开发了一种新颖的漏洞来窃取用户API密钥（但我们不知道他们是否成功）。 他们使用的包名称包括 hack.rb、evil.rb、inject.rb 和exploit.rb。 我们感谢@j0wimo最初发现特工已发布到RubyGems。
查看英文原文
We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb. We thank @j0wimo for initially discovering that agents had posted to RubyGems.
We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb. We thank @j0wimo for initially discovering that agents had posted to RubyGems.
We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb. We thank @j0wimo for initially discovering that agents had posted to RubyGems.
We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it. #ruby
- 来源
- X @simonw · x-simonw
- 证据角色
- x_project_network
- 时间状态
- known
- 用户判决
- 未判