Loading feed…
BleepingComputer1 Hot0 comments5 min read
Researchers escape OpenAI Codex sandbox to run commands on host
AI summary
Các nhà nghiên cứu đã tìm ra cách thoát khỏi sandbox của OpenAI Codex, bao gồm việc thực thi lệnh trực tiếp trên máy tính của nhà phát triển ngay cả trong chế độ bị khóa chặt nhất. Lỗ hổng này cho phép kẻ tấn công thực thi mã độc trên hệ thống chủ, tiềm ẩn nguy cơ bảo mật nghiêm trọng. OpenAI đã vá cả hai lỗ hổng sau khi được báo cáo, nhưng vụ việc cho thấy những hạn chế trong cơ chế sandbox của các mô hình AI lớn. Nhà phát triển nên cân nhắc các biện pháp bảo bổ sung khi triển khai các API như Codex, vì sandbox không thể đảm bảo bảo mật tuyệt đối.
AI summaries can be wrong. Read the original before relying on anything important.
Why read it: Bài này giúp lập trình viên nhận thức lỗ h bảo mật nghiêm trọng trong OpenAI Codex để bảo vệ hệ thống khỏi các cuộc tấn công tương tự.
What do you remember?
Answer 3 short questions to earn reward points for this article. Only do it if you want the points.
up to +17 points
3 questions · under a minute · optional
Source: https://www.bleepingcomputer.com/news/security/researchers-escape-openai-codex-sandbox-to-run-commands-on-host. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.
8 Sync ecosystem
One account, the whole ecosystem
Read the news here, practice coding, follow structured courses and train for IELTS on our sibling products — all connected through one 8 Sync account.
8syncdev.com
8syncdev.comThe ecosystem home: product overviews, blog and full pricing.
ExploreCourses
course.8syncdev.comLearn along a clear roadmap: videos, auto-graded quizzes, certificates and mentors who ship for a living.
View the roadmapCoding practice
coding.8syncdev.com1,000 DSA problems in Vietnamese, auto-graded across 7 languages — many FREE, right in your browser.
Practice for freeIELTS
ielts.8syncdev.comAI grading for all four IELTS skills with detailed rubric feedback.
Try it freeZUS — AI IDE
zus.8syncdev.comA 22 MB AI IDE for Vietnamese devs.
Download freemind0
mind0.8syncdev.comOrganizational memory for AI agents.
ExploreAcoLeads
home-acoleads.8syncdev.comAI that staffs your Fanpage and qualifies leads for you.
Try itRecommended for you
Hacker News161 Hot2 min
MCP Explained
An interactive guide to the Model Context Protocol: every JSON-RPC message on the wire, step by step. Transports, OAuth, tools, resources, sampling, elicitation, tasks, tool search and codemode.
ByteByteGo46 Hot5 min
EP232: 6 Frequently Used Orchestration Frameworks in an AI system
Orchestration in an AI system manages tasks across agents, handles failures, shared memory and context.
DEV1 Hot9 min
How to Use Jira Rovo for Free
Atlassian Rovo is the AI layer built into Jira and Confluence. It can search across your work, answer... Tagged with ai, webdev, productivity, programming.
Daily Dose of Data Science | Avi Chawla | Substack112 Hot7 min
Agent Framework vs. Agent Harness, clearly explained!
+ a technique for 23x faster attention!
freeCodeCamp247 Hot2 min
Learn Real-World Penetration Testing: Hands-On Ethical Hacking Crash Course
Understanding how malicious actors infiltrate networks is the first step to building resilient infrastructure. To help developers and aspiring security analysts learn the fundamentals of offensive sec
Hacker News35 Hot4 min
Pwn.college
pwn.college is a free, hands-on education platform for learning core cybersecurity and hacking skills, maintained by a team at Arizona State University. Learners progress through belt ranks, starting with a 'white belt' and earning belts through practice. Hackers continue beyond the platform to 'brown belt' and eventually 'black belt' status, which must happen outside the dojo. The site powers much of ASU's cybersecurity curriculum and asks users not to post writeups or walkthrough videos of challenge solutions. It points learners toward CTFtime.org for Capture The Flag events and a GitHub list of wargames for further practice. The underlying infrastructure is open source and accepts pull requests, though some modules remain closed-source.
Hacker News18 Hot2 min
Rune: A native GPU-rendered Rust UI framework for macOS, Windows, Linux and web
Rune: Native UI framework. Contribute to anomalyco/rune development by creating an account on GitHub.
Tailscale37 Hot14 min
100x more programmers
AI could create a billion new programmers. But who controls what they build? Explore why open infrastructure, simpler networking, and freedom from AI vendor lock-in matter.
Comments
Loading comments…