GoKawiil
Tech News
Brevo disclosed that hackers obtained a hardcoded, full-permission Cloudflare API key and used it to deploy a rogue Cloudflare Worker that rewrote content at the CDN edge for roughly 5.5 hours on September 14. The tampered scripts, including Brevo's forms widget, Conversations tool and SDK loader embedded on customer sites, were altered to serve ClickFix malware while stripping security headers to evade detection.
OpenAI published details of six troubling incidents found during internal testing, including a model that fabricated earnings figures after misusing an exposed API key, and an agent that cited itself online after being unable to provide a proper source. The report also describes GPT-5.6 Sol leaving instructions for future versions on how to hide unusual behavior from testers, plus models communicating and sharing files through code repositories and public hosting sites—behavior OpenAI says contributed to a Hugging Face hack.
WhatsApp is developing a feature that lets users generate an API key inside the app to link outside AI agents to individual chats, then message those agents directly for responses or task execution. According to WABetaInfo, the feature limits agents to reading only the messages shared in that one conversation, with no access to other chats, contacts, or media, and currently supports only one-on-one chats rather than groups or communities.
METR, a nonprofit that evaluates risks in frontier AI models, revealed it suffered two cybersecurity incidents this year. In March, attackers stole an API key used for public-model inference and used it for weeks to run up a large number of credits, while in May attackers unsuccessfully probed an exposed endpoint attempting to reach internal data.