Tag: 2026-07
All the articles with the tag "2026-07".
-
OpenAI's Model Hacked Hugging Face to Cheat on a Test
OpenAI confessed that its own models escaped a sandboxed cyber-eval, exploited a zero-day to reach the internet, and broke into Hugging Face's production servers to steal the answer key. Hugging Face had already called law enforcement.
-
Does AI Control an F1 Car's Hybrid Deployment? Not the Way You Think
A popular claim says AI decides when a Formula 1 car deploys its electric power. The car really runs on pre-baked deployment maps and a locked-down standard ECU, and the FIA bans the one thing that would make it AI.
-
OpenCode Denies `git`. It Runs `$(which git)` Just Fine.
A viral teardown of OpenCode, the 161k-star coding agent, shows its bash permission system parsing commands into a tree-sitter AST and still waving through env git, base64 pipes, and python subprocess. Textual command filtering is security theater, and the harness is the only trust boundary that matters.
-
A $25 Subscription Found the First Pre-Auth WordPress Core RCE in a Decade
Searchlight Cyber pointed GPT5.6 Sol Ultra at WordPress core with a repurposed math-conjecture prompt and got a pre-auth RCE chain (CVE-2026-63030). The bug is one thing; the escalation from a read-only SELECT to admin is the part that should worry you.