Profero

🚨 Bookmark alert 🚨

1/ Are you using Grok? You need to read this.

Grok Bot’s sandbox accepts commands from anywhere on the internet after two checks. One is a password. The password is "local," the same for every customer.

From there, it’s root on the VM and your imported cookies in plaintext.

We told xAI and Cursor on Aug 24.
75+ days in...no reply.

Read the post by @GelosSnake >>>

Quick one.

Over 35,000 Grok-built apps are exposed online, and some of them are leaking confidential data and passwords.

🚨 In case you haven't read our findings, you can find them here: x.com/ProferoSec/sta…

Yesterday we posted about LLMJacking. Today, Railway says stolen AI keys led to an estimated $740,000 in unauthorized usage charges.

💡 What to do: Review CloudTrail logs from October 1 for Qubole role assumptions and revoke any stale trust relationships.

Heads up if you ever used Qubole.

Wiz and Sentra found that attackers used stolen Qubole credentials to get into dozens of AWS environments.

Between Oct 14 and Oct 26 they used the legitimate permissions customers had granted Qubole to assume customer roles.

One victim lost millions of files, and another had dozens of passwords and keys stolen within minutes.

Researchers noted that many organizations still had those permissions in place after they stopped using Qubole.

AWS says there was no direct breach of its services, and Qubole hasn’t issued a statement yet.

We're sure you have all been in this situation:

Someone builds an app over the weekend with an AI assistant. Leadership loves the demo. Then security shows up and gets blamed for slowing it down.

@barnhartguy on why the cheapest fix is a 30-minute review before the exec demo.

shorturl.at/a5y5S