hackerlogs: LLM Application Security https://hackerlogs.com/topics/llm-app-security Securing applications built on language models: the OWASP LLM Top 10, output handling, sandboxing, and trust boundaries. en Tue, 08 Sep 2026 00:00:00 GMT 0.00 Is a Lab Number. Grok's Incident Standard Is Still Missing. https://hackerlogs.com/blog/grok-420-safety-eval-standards https://hackerlogs.com/blog/grok-420-safety-eval-standards Tue, 08 Sep 2026 00:00:00 GMT Ajain Vivek xAI's April 2026 Grok 4.20 system card reports a 0.00 chat-mode violation rate on an internal refusal set. The same PDF reports 0.30 on AgentHarm and 0.33 on AgentDojo. Those are lab measurements, not an incident standard. A 2025 production failure, the January 2026 DSA case on Grok-in-X, and California AB 316 already bind operators.

Key takeaways

  • The 0.00 figure is xAI's internal chat refusal set. AgentHarm on the same card is 0.30. Brief the PDF, not the headline rate.
  • xAI names third-party testers and does not identify them. A lab number no one else can rerun is a claim, not a standard.
  • The July 2025 production incident was a config regression, live for about 16 hours. A card published nine months later does not close that clock.
  • The Commission opened a DSA case on Grok-in-X and the recommender on 26 January 2026. That is a platform duty, not a model-card duty.
  • California AB 316 already bars the defence that the model caused the harm by itself. SB 243 already requires a companion-chatbot self-harm protocol.
]]> ai-governance ai-red-teaming llm-app-security StyleSmuggler Gave Magento Unauth RCE. The Hotfix Does Not Clean the Store. https://hackerlogs.com/blog/stylesmuggler-magento-rce https://hackerlogs.com/blog/stylesmuggler-magento-rce Tue, 08 Sep 2026 00:00:00 GMT Ajain Vivek StyleSmuggler is CVE-2026-75650, unauthenticated RCE in Magento and Adobe Commerce via the template engine. Sansec saw exploitation from 4 September. Adobe shipped hotfix VULN-39341 as APSB26-146 on 7 September, CVSS 10.0. July and August patches did not stop it. The hotfix does not remove implants, and rotating the encryption key does not revoke stolen credentials.

Key takeaways

  • CVE-2026-75650 is unauthenticated template-engine RCE. Adobe rated it CVSS 10.0 and said it has been exploited against Commerce merchants.
  • The first confirmed victim was on 2.4.6-p15 with the July and August 2026 patches and a clean security:patch-status. Being current was not a defence.
  • Adobe's fix is hotfix VULN-39341 under APSB26-146, tested on the 2026-aug lines. Confirm it with magento-patches status, not a version string.
  • Operators dropped a Rust implant that renamed itself kworker, then fc-cache, then chronyd, plus a second actor's PHP web shell under pub/media.
  • Adobe's own cleanup is rotate the encryption key and every credential that key protected, at the source. The hotfix does not do that for you.
]]> llm-app-security CVE-2026-75650 WeWorm Took WeChat Over While the Phone Rang. Tencent Closed It. https://hackerlogs.com/blog/weworm-wechat-zero-click https://hackerlogs.com/blog/weworm-wechat-zero-click Tue, 08 Sep 2026 00:00:00 GMT Ajain Vivek WeWorm is Calif's demo of a zero-click WeChat account takeover. An incoming call from a friend-list contact was enough; the victim did not have to answer. Calif says AI found the VoIP-stack memory bug and a first RCE in two days, then spent a week on a three-phone worm. Tencent mitigated the exploit for all users by 28 August.

Key takeaways

  • The demo is an unanswered WeChat call from a friend-list contact. Answering hears silence. Declining stops that attempt. The caller can try again later.
  • Calif showed three phones: a Pixel 10a took an iPhone 17e while it rang, then that iPhone took a second Pixel the same way. That is a lab worm, not a reported outbreak.
  • Tencent shipped Android 8.0.77 and iOS 8.0.76 on 21 August. Calif says a server-side block covered all users by 28 August. Tencent has not published an advisory or a CVE.
  • Calif is holding the VoIP-stack details for a conference. There is no IOC a user can search, and no way to tell whether a past missed call was this bug.
  • The Times headline says models built a worm. Calif's own clock is narrower: AI to first RCE in about two days, then a week of human work on the demo.
]]> ai-red-teaming llm-app-security GitSpawn: Your Agent Runs Git. The Repo Picks the Command. https://hackerlogs.com/blog/gitspawn-ai-agents-git-hijack https://hackerlogs.com/blog/gitspawn-ai-agents-git-hijack Mon, 07 Sep 2026 00:00:00 GMT Ajain Vivek GitSpawn is a class of bugs where an AI coding agent runs git commands in a repository that arrived as files, and Git executes a program named in that repo's own .git/config. Manifold found the pattern in seven agents. We reproduced it on Goose 1.41.0: goose review ran a marker helper six times with no prompt and no model.

Key takeaways

  • The execution sink is documented Git behavior: core.fsmonitor names a helper that runs during an index refresh on git status and git diff.
  • Delivery is a folder that still contains .git/config. A normal git clone drops that file. A zip, sync share, or USB copy does not.
  • On Goose 1.41.0, goose review invoked our local marker helper six times and never asked a question or called a model.
  • Goose 1.44.0 blocked the same repository by passing -c core.fsmonitor=false. That command-line override is the control that actually holds.
  • A global git config of core.fsmonitor=false does not win over a hostile local config. Inspect .git/config before an agent opens a received folder.
]]> agentic-security llm-app-security CVE-2026-72718 CVE-2026-19592 CVE-2026-19593 CVE-2026-71963 Probllama: What the Ollama RCE Teaches About Self-Hosted AI https://hackerlogs.com/blog/probllama-ollama-rce https://hackerlogs.com/blog/probllama-ollama-rce Sat, 05 Sep 2026 00:00:00 GMT Ajain Vivek CVE-2024-37032, Probllama, was a path-traversal flaw in Ollama's model-pull endpoint that let an attacker overwrite files and reach remote code execution, made worse because the default Docker image runs as root on all interfaces with no authentication. It was fixed in version 0.1.34. The lesson: self-hosted AI runtimes inherit no authentication by default.

Key takeaways

  • Probllama (CVE-2024-37032) turned insufficient digest validation in Ollama's /api/pull endpoint into arbitrary file write and remote code execution.
  • The default Docker deployment runs as root and binds 0.0.0.0 with no authentication, which is what turned a bug into remote, unauthenticated RCE.
  • Ollama committed a fix within hours and shipped it in 0.1.34; weeks later a large number of exposed instances were still unpatched.
  • The class is not specific to Ollama: model runners, vector stores, and notebook servers routinely ship with no auth and assume a trusted network.
  • Treat any self-hosted AI runtime as unauthenticated by default and put it behind a reverse proxy that is not.
]]> model-supply-chain llm-app-security CVE-2024-37032 Prompt Injection: Why There Is No Patch, and What Actually Reduces Risk https://hackerlogs.com/blog/prompt-injection-no-patch https://hackerlogs.com/blog/prompt-injection-no-patch Tue, 01 Sep 2026 00:00:00 GMT Ajain Vivek Prompt injection is an attack where untrusted text reaching a language model is interpreted as instructions rather than data. Because models process instructions and content in the same token stream, there is no reliable syntactic boundary between them. Defences reduce blast radius through privilege separation and output handling rather than filtering malicious phrasing.

Key takeaways

  • Prompt injection is an architectural consequence of how transformers consume text, not a bug that a vendor can patch.
  • Indirect injection, where the payload arrives through retrieved documents or tool output, is the variant that matters for real applications.
  • Input filtering fails because the space of adversarial phrasings is unbounded; treat it as telemetry, never as a control.
  • The defences that hold are architectural: least privilege on tools, human confirmation on side effects, and treating model output as untrusted.
  • OWASP ranks prompt injection as LLM01, the top risk in its Top 10 for LLM Applications.
]]> prompt-injection llm-app-security