Codex metadata collection trusted repository execution helpers
ZDI awarded Doyensec USD 10,000 for this distinct Pwn2Own Berlin entry.
USD 10,000competition awardRead
AISecurity theme
AI integration boundaries.
Authority boundaries around model input, tools, and downstream actions. 7 disclosures · 12 related references · 1 diagrams.
Connected collection
Disclosures
Codex automated Git operations trusted repository hook settings
ZDI awarded Summoning Team USD 20,000 for this distinct Pwn2Own Berlin entry.
USD 20,000competition awardRead
Apple PCC startup archive processing lacked path confinement
Sentry documents a USD 150,000 award to Drinor Selmanaj for CVE-2026-20685.
USD 150,000reported awardRead
Gemini Enterprise connected-content trust failure allowed persistent-memory modification
A researcher reports a $15,000 Google bounty for a Gemini Enterprise integration issue affecting persistent assistant memory.
USD 15,000reported awardRead
Gemini-to-Colab rendering boundary exposed Workspace data
Google awarded USD 20,000 for the Colab-export finding in a multi-finding research article.
USD 20,000reported awardRead
Bard Workspace integration weakened output-data boundaries
One Workspace data-disclosure finding within a broader research article earned USD 20,000.
USD 20,000reported awardRead
Meta AI media access lacked object-ownership authorization
An authenticated media-editing operation exposed another user’s prompts and generated content because object ownership was not enforced. The researcher reports a USD 10,000 award.
USD 10,000reported awardRead
Connected collection
Related learning
Dify: telemetry destination changes carry tenant data-disclosure authority
Zafran’s tracing case, CVE-2026-41947, explains that console authentication did not bind configuration changes to the application’s tenant. Traces contain prompts and responses, so changing telemetry routing also…
Reviewed 2026-10-03Read
Langflow: project transport authorization must reach each resource read
The maintainer confirms that project-level MCP authentication did not authorize later file reads. Resource handlers reached storage without retaining user and project restrictions. A local two-user demonstration showed…
Reviewed 2026-10-03Read
LibreChat: agent edit authority must cover attached context
The advisory contrasts denied access to a private agent with accepted changes to its attached files. Upload handling omitted the agent permissions enforced elsewhere, allowing unauthorized context and search-file…
Reviewed 2026-10-03Read
LibreChat: delegated credentials must remain bound to the initiating session
CVE-2026-31944 describes an MCP OAuth callback that trusted cached initiator identity without authenticating the returning browser or checking identity continuity. The advisory describes third-party credentials being…
Reviewed 2026-10-03Read
LibreChat: viewing an integration must not reveal its service secrets
The MCP registry prepared decrypted configuration for internal use, and response handlers returned that representation to viewers without removing secrets. Object visibility consequently became credential disclosure…
Reviewed 2026-10-03Read
LobeHub: knowledge-base membership changes require ownership authorization
The maintainer advisory attributes cross-user knowledge-base file removal to an omitted ownership restriction in a database mutation. Its reported demonstration shows one deletion result. The boundary is between being…
Reviewed 2026-10-03Read
MCP elicitation: consent, credential custody and completion
Form elicitation excludes secrets. URL elicitation places sensitive interactions outside the MCP client and model context, with the requesting server and destination visible to the user. Agreeing to open the interaction…
Reviewed 2026-10-04Read
MCP scope selection: progressive consent and accumulated authority
Server permission challenges shape what a general-purpose MCP client requests. Broad discovery metadata and accumulated scopes can enlarge delegated authority. Token scopes still require application-side authorization.
Reviewed 2026-10-03Read
Open WebUI: credentials must bind to their destination connection
CVE-2026-87015 concerns late-bound connection state: tool callables retained their own headers but read a shared cookie variable after connection processing finished. A maintainer-described controlled observation…
Reviewed 2026-10-03Read
OWASP LLM05:2025: generated-output consumer trust
Explains why model-generated content remains untrusted when passed to browsers, databases or backend functions. The relevant boundary is the consuming component: plausible model text must not acquire executable meaning…
Reviewed 2026-10-03Read
LLM Prompt Injection Prevention Cheat Sheet
Defense-in-depth guidance for LLM applications that consume untrusted content or invoke tools. Covers data provenance, least privilege, action authorization, monitoring, and the limitations of guardrails.
Reviewed 2026-10-02Read
OWASP LLM08:2025: retrieval permissions and knowledge provenance
Examines security assumptions around retrieval-augmented generation, including access to embeddings, cross-context disclosure and integrity of imported knowledge. Shared retrieval infrastructure must preserve the…
Reviewed 2026-10-03Read
Connected collection
Visual models
Retrieved content is data, not authority
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software