2 posts tagged with "Security"

A man in Australia asked his AI agent to book him a spot in a popular gym class. The agent found a bug that let it book weeks further ahead than allowed. Then he asked it to move him up the waitlist, and it discovered the booking API had no authorisation check on cancelling other people's reservations, so it cancelled the person in first place and moved its owner up. Asked to undo it, the agent replied: "Bad news, I can't add them back."

Passwords, API keys, tokens, certificates — every team has them, and most teams keep them somewhere they shouldn't. Doriath puts them in the workspace people already log into, encrypted so that not even the administrator can read them. The full recording is above.