Oren Yomtov

חברים במכבי? רוצים דעה שניה מקלוד או ChatGPT שמותאמת אישית אליכם ומבוססת על ההיסטוריה הרפואיות שלכם?

Introducing: Maccabi MCP!

כדי לנסות פשוט תעתיקו ותדביקו את הטקסט הבא לאייג׳נט האהוב עליכם:

---
תסתכל על התוצאות של הבדיקות דם שלי מהשנים האחרונות ותגיד אם יש משהו בעייתי שכדאי שאטפל בו, או אם יש בדיקות שלא עשיתי ומומלצות לאדם בפרופיל גיל שלי

tinyurl.com/maccabi-mcp
---

דואגים לגבי כולסטרול? רוצים דעה שניה לגבי המלצה שקיבלתם מרופא? שאלות לגבי מרשם שקיבלתם?

עכשיו אפשר לשאול בקלות ולקבל תשובות מותאמות אישית שמעוגנות בפרופיל ובהיסטוריה הרפואית שלכם.

עובד עם Instinct, Muse, Claude Code, Cowork, ChatGPT Work, Cursor ועוד

מבחינת פרטיות, זה פרוייקט בקוד פתוח (לינק בתגובות), שהאייג׳נט שלכם מריץ בעצמו

We discovered a complete forgery of a post-quantum signature candidate: Shipovnik, submitted to TC26.

A valid signature for any message can be built from the public key alone, in a fraction of a second on a laptop.

With the post-quantum transition on the horizon, the Fireblocks cryptography team started assessing the security of post-quantum signature schemes.

The good news is that it's a candidate and not a standard, and it isn't used to authorize blockchain transactions today, so no funds are at risk.

It's also a testament to the important role of the years-long processes that national standardisation bodies undertake to develop and choose the cryptographic schemes we all rely on in our daily lives.

Our research is part of that process, the public review, where researchers from around the world can audit and try to find breaks in cryptographic schemes before they become standards and start being heavily used.

For the full technical breakdown, see the Fireblocks blog post in the comments.

Wasn't on my bingo card for 2026: HackerOne CEO sharing my bug report on LinkedIn

What's worse than escaping a sandbox and reading the host's files?

Escaping Cloudflare's, and reading other customers' files.

How did that happen? Cloudflare Containers' disk is thin-provisioned, which means the host keeps a shared pool of storage for every container on the machine, and attaches it lazily in 64 KB chunks, instead of provisioning it all upfront.

When we tried reading a chunk of unallocated disk space in a container, we got zeros, which is to be expected.

But we noticed something strange: the chunks that we already wrote to were full of bytes we didn't write.

Turns out a write is what makes the thin provisioner allocate the chunk, and Cloudflare wasn't zeroing it on the way in, so the rest of the chunk still held leftover data from the previous customers' containers that happened to run the same machine.

By writing 4 KB to every chunk of the disk. The other 60 KB of each chunk were instantly filled with other customers' files: .env, credential files, .pem keys, SQLite databases, Chromium cookies and localStorage.

I've disclosed vulnerabilities to many vendors over the years, but working with Cloudflare was something else. Putting aside the speedy triage, mitigation, and generous bounty, they have a unique and earnest engineering culture of transparency.

Which lead to us collaborating and writing the full postmortem together:
blog.cloudflare.com/containers-cro…

We escaped Docker's hypervisor with three lines of bash. CVE-2026-77179: A container gets complete read and write access to the host filesystem.

When you mount a folder into a container, Docker's VMM uses virtio-fs, and the file server runs on the host.

Because of a TOCTOU bug, if a container opens a file, deletes it while holding its file handle open, and replaces the parent folder with a symlink, the kernel will follow the symlink to anywhere on the host.

Full technical breakdown:
accomplish.ai/blog/escaping-…

We escaped OpenAI's Codex sandbox by dumping V8's shared JavaScript heap and scanning it for the privileged UUID-shaped token belonging to the adjacent trusted V8 context.

I sometimes see cybersecurity as a never-ending cycle of building trust boundaries and finding ways to break them. This is the story of one interesting break.

When OpenAI built this default-enabled MCP server, they ran a trusted, privileged JS context alongside an untrusted one, in the same Node.js process.

They assumed V8's VM contexts could serve as a security boundary, because they do create isolated execution environments, each with its own distinct global object and scope.

But they forgot that these contexts share a single memory heap. So our untrusted code snapshotted that heap, pulled the token out of it, and used it to reach the privileged side.

Read the full technical breakdown at:
accomplish.ai/blog/escaping-…

What I liked about this Claude Code Sandbox Escape we reported to Anthropic was that it required chaining together multiple vulnerabilities: some "standard," and others requiring the harness to call a specific tool to automatically trigger the next link in the chain, using English instructions written by the exploit script

Full details at:
accomplish.ai/blog/beltdown-…

Asked Claude to find vulnerabilities in AWS before going to bed, woke up to a scary email, and ended up reporting a critical cross-customer data exfiltration vulnerability in Athena.

The vulnerability allowed an attacker to read SQL queries of other AWS accounts.
Accounts the attacker has absolutely no relationship with.

These queries included plaintext values of INSERT statements and WHERE clauses.

act.security/resources/read…

I ran an auto-research project with 144 Fable agents over a week, costing $7,500 in inference. It made post-quantum signature verification on Ethereum 6.6× cheaper than the previous best optimized verifier

it pays for itself after <900 onchain verifications

fireblocks.com/blog/post-quan…

i just won $200k using this one prompt

Claude Cowork’s sandbox is supposed to keep the agent contained.

But we found a chain of vulnerabilities that allowed it to escape.

🧵

A token held by 22 million people had a bug that let anyone drain any wallet holding it.

We found it and got it fixed before an attacker did.

The wild part: it's the same bug as the SWEAT hack you already heard about, and it sat in the open for a month after.

gas golfing - out ⛽️⛳️

token golfing - in 🤖⛳️

PSA: update your JS package manager

npm closes my report as informative, and then proceeds to fix the reported issue in v12 🤷‍♂️

see my defcon slides for script execution bypasses for every single JS package manager

Fun fact: we implemented this config option as part of the mitigation for the script execution bypass vulnerability I disclosed to pnpm (CVE-2025-69264)

Any website could have hijacked Claude's Chrome Extension to steal your Gmail, Drive, and anything else you're logged into.

I found ShadowPrompt - chaining a wildcard origin allowlist with a DOM XSS in a CAPTCHA component to inject user prompts into Claude's chrome extension (4M+ users).

If you use it, make sure you're on version 1.0.41 or higher.

A day later the number went up to 587 detected malicious skills - keep safe out there!

We found 341 malicious skills on ClawHub targeting OpenClaw bots.

So we built Clawdex - a skill that lets your bot check if a skill is malicious before installing it.

Here's what we found 🧵

Sorry, that's my Alex! 😂

Confession: I was actually too scared security-wise to let it download dynamic instructions from a remote server every few hours and post publicly with access to my private data in its context, so I told it instead to build a bot that posts there periodically so it's immune to prompt injection attacks

The bot is apparently just using the anthropic sdk directly with a simple static prompt trying to farm karma with engagement bait