What’s getting pwned right now
Posted by mrkd 5 days ago
Comments
Comment by demibabs 5 days ago
Comment by etatester 5 days ago
What I don't like is that every site now looks the same.
Comment by lifeisloving 5 days ago
These styles only change after a model gets updated, then they all start having a different font, some cursive red font and a beige background maybe.
I knew what this site was going to look like before I clicked the link.
Its so ugly and unoriginal, I assume the content/information trying to be communicated lacks any sort of expertise or original insights.
Yesterday these topics went viral and this guy used some llm to farm engagement. It was literally built to get attention for a singular day after this topic went viral. It will not exist in 3 months.
Edit. Its actually an attempt to bandwagon jump ontp a viral topic and sell $150 ad spots and probably to promote their own $299 club for vibecoders.
Comment by letrix 4 days ago
Obviously if your base is just unmodified shadcn, then it will look like any other toy site out there.
Comment by lenkite 3 days ago
Might as well get it natively supported in the browser.
Comment by etatester 1 day ago
Comment by poilcn 4 days ago
Comment by dawnerd 5 days ago
Comment by Waterluvian 5 days ago
Comment by 1vuio0pswjnm7 4 days ago
https://pwn.watch/all/feed.xml
https://pwn.watch/incidents.json
Within incidents.json are JSON files for each incident with further details
A user could easily construct their own "web page" (or SQL database, CSV, formatted textfile, etc.) that caters to the user's own aesthetic and functional preferences
I've become accustomed to reading JSON, Markdown, etc. For me these text-only formats are "human readable"
In the text-only browser I use, incidents.json is easier for me to read than the pwn.watch web page
No Javascript, cookies, data collection, surveillance, ads, etc.
1. Also, MCP
Comment by dcchambers 5 days ago
It would be more readable if every AI-generated page didn't go for the dark-mode + glowing neon cyber aesthetic.
Comment by thekitze 5 days ago
Comment by dcchambers 4 days ago
Comment by kps 4 days ago
Comment by stronglikedan 5 days ago
Comment by repeekad 5 days ago
Comment by tuwtuwtuwtuw 5 days ago
Comment by darknavi 5 days ago
Comment by thekitze 5 days ago
Comment by thekitze 5 days ago
Comment by demibabs 5 days ago
(But still not great, evidenced by the fact that most of the upvotes on my comment are from after you improved it.)
Comment by alfirous 4 days ago
Comment by aeturnum 5 days ago
Comment by lifeisloving 5 days ago
Comment by pixl97 5 days ago
The rate at which flaws are being found is just insane. Many people warned us in the past that our lax security postures would come back to bite us, and we're finally here.
Comment by Kevin_Flynn 5 days ago
And theres really only one of 2 outcomes as this progresses as I can see it:
1) The AI's are well matched, and the outcome is balanced, and it ends up being a metric of the internet itself that gets monitored, like this website is doing.
or
2) It crashes in such a spectacular fashion that important utilities and industries are distrupted, with the length of time for recovery being the determining factor in how many people lose their minds, start looting, etc ... you know the story.
Comment by trollbridge 5 days ago
Comment by pixl97 5 days ago
"We take code and make it secure"
instead of
"We take secure and make it code".
That said, maybe it's impossible. Maybe turing completeness and security are antithetical and someone will always be able to find a way to poke a hole in the system from a lower layer of reality.
Comment by red75prime 5 days ago
ASI (artificial superintelligence), theoretically, can exploit the ultimate analog nature of digital circuits (something like Plundervolt, but more intricate), but if we'd get to this stage when we need to defend against ASI, we'd have bigger problems.
Comment by pixl97 5 days ago
I was just giving a very similar reply here on this article.
One of the interesting things science has showed is that 'human' scale is nothing special at all. All kind of complexity exists at scales larger and smaller than us. Up to the point that "humans" are just an emergent phenomenon of a bunch of little tiny things working together. Entire worlds exist beyond our human senses.
And that has me a little bit concerned about the speed at which we're flinging ourselves into the future. I'd rather not invent something and go "oops, no takesies backsies" and do something like kill all security in digital computing and watch the world become completely unhinged.
Comment by paganel 5 days ago
That’s how we got to abominations like two MFA operations in order to login to a basic web interface/web product, no-one sane would have ever paid for that originally.
Comment by pixl97 5 days ago
I'm talking about problems at the algorithmic level.
Comment by InsidiousWombat 4 days ago
Comment by Kevin_Flynn 5 days ago
Yeah, that. Manual controls w/ an optional automation, not just, automation with an optional "oh shit" button.
As for the AI's hacking and patching, one could reason since we are dealing with Turing machines that as long as changes to any given codebase/version cease, then all possible holes and patches would be found given enough attacks for that specific release.
Perhaps unfolding almost exactly like Conways 'Game of Life' with an order or two magnitude more rules and states, where the end pattern for any release is 'stability.'
We need a realtime dashboard for this :D
Comment by Kevin_Flynn 5 days ago
Comment by browningstreet 5 days ago
Comment by ryandrake 5 days ago
Comment by UltraSane 4 days ago
Comment by ticklemyelmo 5 days ago
The bad guys are historically much better at keeping their systems current.
Comment by deadnomore 5 days ago
Comment by Kye 5 days ago
Comment by metrix 5 days ago
Comment by pixl97 5 days ago
I guess it's being called an AI prompt worm. It's not quite to the stage of sovereign AI where the entire model weights are moved with the 'virus', but still presents a pretty big risk.
Comment by zombot 4 days ago
Comment by juleiie 5 days ago
I fortunately live in a peaceful, cooperative country of Poland that looks down upon such practices unlike us or France or uk
Let the best win. Over and out
Comment by datsci_est_2015 5 days ago
Comment by pixl97 5 days ago
Comment by Kevin_Flynn 5 days ago
Comment by afdbcreid 5 days ago
Comment by datsci_est_2015 5 days ago
Comment by turbobutton 5 days ago
| Year | Reported US data compromises |
|---|---:|
| 2016 | 1,099 |
| 2017 | 1,506 |
| 2018 | 1,175 |
| 2019 | 1,279 |
| 2020 | 1,107 |
| 2021 | 1,859 |
| 2022 | 1,798 |
| 2023 | 3,202 |
| 2024 | 3,152 |
| 2025 | 3,322 |
Curios what 2026 will look like...
Sources:
https://www.idtheftcenter.org/wp-content/uploads/2022/04/ITR...
https://www.idtheftcenter.org/wp-content/uploads/2026/01/202...
Comment by Forgeties79 5 days ago
Comment by pixl97 5 days ago
https://lwn.net/Articles/961978/
But that happened in the first few months of 2024.
Comment by sdfhbdf 5 days ago
Comment by Forgeties79 5 days ago
Comment by thekitze 5 days ago
Comment by jbs789 5 days ago
Comment by InsidiousWombat 4 days ago
Like "people use AI they paid for to access their bank account, that they paid for" is not exactly exploited CVE
Comment by cyanydeez 5 days ago
That's all. full stop. all this AI agent stuff is jazz hands. Large VC funded labs are just "more valuable" to the political establishment than anything else.
Comment by thekitze 5 days ago
Comment by xbar 5 days ago
It is still getting started.
Comment by hk__2 5 days ago
Comment by hsuduebc2 5 days ago
Comment by tonymet 5 days ago
Comment by ipaddr 5 days ago
Comment by tonymet 5 days ago
Comment by aduwah 5 days ago
Comment by a3w 5 days ago
The internet just keeps giving.
Comment by hk__2 5 days ago
Comment by thekitze 5 days ago
Comment by l1am0 14 hours ago
Comment by prodigycorp 5 days ago
Comment by alt227 5 days ago
Comment by srveale 5 days ago
Comment by thekitze 5 days ago
Comment by thekitze 5 days ago
Comment by prodigycorp 4 days ago
Comment by b1n 5 days ago
Comment by WarmWash 5 days ago
Also the flip side where Chinese models are used to attack US infra, just loading artillery shells into the "Ban Chinese Models" cannon.
Comment by iAMkenough 5 days ago
In the U.S., only the inner circle gets access to "defense" capabilities that match "attack" capabilities.
Comment by meerita 5 days ago
Comment by mahboi 5 days ago
Comment by meerita 5 days ago
Comment by Forgeties79 4 days ago
If there’s one thing we’ve learned about LLMs so far it’s that they don’t just invent new or better solutions generally. Nearly everything they do is a facsimile or is otherwise derivative. It’s rarely more than the sum of its parts and often it’s lesser than if we did it ourselves, it’s just fast and cheap. So this idea that AI is going to suddenly magically improve its own code and just get better… I don’t know, I’m not convinced we’ve seen anything like that yet and we’re just speculating it will happen because “it should,” which just feels akin to the crazy promises these companies have been making for years that are clearly not happening.
Comment by meerita 3 days ago
Comment by Gigachad 5 days ago
Comment by mahboi 4 days ago
Comment by micromacrofoot 5 days ago
Comment by RankingMember 5 days ago
Comment by dunder_cat 5 days ago
In fact, it seems to be the case for the "json" and "llms.txt" buttons, too.
Comment by hk__2 5 days ago
Comment by thekitze 5 days ago
Comment by hsuduebc2 5 days ago
I love how everyone is acting now that like in good ol' days(2022) every website was made by a hand with virtually no bugs but a lot of love.
I'm just waiting for someone making "artisan websites"
Comment by hk__2 5 days ago
Please point out where I said that. It’s not that "in the good old days" websites were perfect, it’s that every single website coded in 15 min with a LLM like this one tries to look great but is full of random bugs that a normal human would have seen if they had done this by hand.
Comment by syshyk 5 days ago
Comment by thekitze 5 days ago
Comment by jongjong 5 days ago
But actually, when I think about the billions of lines of code which our socio-economic system depends on, I feel like the entire social system will have to be scrapped and re-implemented from scratch.
AI is exposing the weakness of centralized software. This industry should always have been competitive. Instead, centralized funding has made it anti-competitive; essentially selecting winners without appropriate battle-testing. Well now all the systems are about to be battle-tested all at once.
Comment by ceuk 5 days ago
Comment by ceuk 5 days ago
Comment by contravariant 5 days ago
Comment by baoooooooooooo 5 days ago
Comment by Kevin_Flynn 5 days ago
Was hunting for a real time graph of incidents and patches, like a stock market chart of the end of the software world, or the birth of artificial consciousness, depending on how squiggly the lines are.
Just the heatmap apparently. :|
Also, as all the humans are installing their "AI on every device" clustering software, the pace of it all should really pick up, and this reminds me of the following SFW movie clip:
"The suspense is terrible. I hope it will last." - Willy Wonka
Comment by mschuster91 5 days ago
For fucks sake. The author could have invested at least half an hour to replace this obvious LLM slop regurgitation of the prompt with something of their own.
"Buy sponsor slot for 149$/month", yeah, spotted the grift. For that level of payment it's at least reasonable to expect the design to be something else than the usual LLM garbage mixture of 30 different font styles.
Comment by thekitze 5 days ago
and fyi my sponsors are not only for this, they come from https://kitze.io/sponsors :D
Comment by mariusvaporware 4 days ago
(CVE severity timeline)
Comment by nkoren 5 days ago
Comment by pelagicAustral 5 days ago
Comment by loloquwowndueo 5 days ago
Comment by DrewADesign 5 days ago
Step 2 is instead of waiting to be caught, the instigators should issue a press release blaming cunning rogue agents as part of their research, call no felonies because they’re working for the greater good of eliminating a shitload of jobs, say the real problem is a lack of regulation. They could even return the money if it looks like they’re going to get sued, and collect some sweet, sweet reflexive investment money.
Comment by mahboi 5 days ago
Comment by ceroxylon 5 days ago
>Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one.
Comment by stickfigure 5 days ago
Which is an interesting problem, what happens when the agent fucks up and the customer loses lots of money? Who is responsible?
If the official policy is "no agents", it shifts the blame.
Comment by outworlder 5 days ago
Honestly, US banks and credit unions should get their heads out of their asses and learn from it. There's a _reason_ people connect banks to YNAB, Monarch Money and stuff like that, and a reason why they might want an AI agent. They need the info. They may also need to make automated transactions, something companies have access to, but the ordinary person does not.
My landlord wants Zelle. I cannot schedule payments on my credit union. It's not like I can update the app since it lives inside their systems. So I have to login monthly. I debated getting another bank account and giving it to Muse just for that purpose.
Banks in the US are a couple of decades behind, say, Brazilian banks. Instant transfers to another bank were a thing since the early 2000s. And for years now you can do it from anyone to anyone, no third party app required. To the dismay of Visa and Mastercard.
Comment by tredre3 5 days ago
The point of getting the second bank account is to reduce the blast radius if the agent goes haywire, I suppose?
But then you'll have to manually top up that account every now and then, how does it solve your initial problem?
Comment by eszed 5 days ago
Like someone else up-thread, my experience moving back to the US from Europe, ~15 years ago, was like stepping back to the financial dark ages. It's a bit better now (Zelle, Plaid, Mint / Monarch - though I'm well-aware of the privacy downsides of those third-party platforms), but the industry isn't close to catching up with the fifteen-year-old state of the art, let alone, say, Indian or Brazilian micro-transaction networks.
Comment by SoftTalker 5 days ago
Comment by sroussey 5 days ago
Also, they remove the money when they mail the check… not when it gets cashed.
Comment by SoftTalker 5 days ago
Comment by jmtulloss 5 days ago
Comment by stickfigure 5 days ago
Comment by DrewADesign 5 days ago
If they were sold a product that claimed to be safe, they could in turn sue whoever sold it to them. Jeep’s insurance wouldn’t pay someone I crashed into because of defect in my jeep, but I could in turn sue Jeep for my legal trouble.
Comment by direwolf20 5 days ago
Comment by fckgw 5 days ago
Comment by skybrian 5 days ago
> The indefensible extension is that banks aren’t liable for defrauded customers. That is a potential policy regime, chosen by the polity of many democratic nations. The United States is not one of those nations. Our citizens, through their elected representatives, made the considered choice that financial institutions would need to provide extraordinary levels of safety in electronic payments. In reliance upon that regime, the people of the United States transacted many trillions of dollars over payment rails, which was and is very lucrative for all considered.
...
> With a limited number of carveouts (e.g. wire transfers), Reg E is intentionally drafted to be future-proof against changes in how Americans transact. This is why, when banks argue that some new payments rail is exempt because it is “different,” the correct legal response is usually some variation of: doesn’t matter—that’s Reg E.
Comment by dingaling911 5 days ago
If a connected person breaks rules and loses money, it's someone else's fault.
I don't make the rules, I just break them.
Comment by dist-epoch 5 days ago
Comment by jimmis 5 days ago
Comment by tcdent 5 days ago
Comment by 0xdeadbeefbabe 5 days ago
Comment by toomuchtodo 5 days ago
Part of it is "human in the loop" for write actions, part of it is commercial banks are deathly terrified of agents being able to move deposits around rapidly to maximize yield, as those deposits are cheap cost of capital banks use to lend against. Historically, deposits of unsophisticated financial services consumers were sticky, and that assumption is breaking down. Agents can be consumer copilots towards information asymmetry in this context.
"computah, maximize rate of return, minimize interest expenses, manage cashflow, make no mistakes."
Comment by hollowonepl 5 days ago
Comment by willchis 5 days ago
Comment by DrewADesign 4 days ago
Comment by cyanydeez 5 days ago
None of that has changed.
Comment by taytus 5 days ago
Comment by ghm2180 5 days ago
1. [FDIC] Put it in a Chase, BofA account. < 1% typically. Abysmal returns.
2. [FDIC] A higher yield checking/saving account(Ally at ~3.1 is a good example): But more hoops[1] to get more than 3.5%(today). Here https://www.wsj.com/buyside/personal-finance/banking/best-hi... the list.
3. [Not FDIC but pretty good**] A higher yield Money market mutual fund. You still need to place a buy order[2]. Something you have to do manually can give you around 3.86% today(See SNAXX)
This last case is more _interesting_ because its easy for agents. But consider what happens when a lot of people use muse to enmasse do this. There can be a run on the banks because[3] its not the same "money" in the balance sheet of the bank. Money leaving checking/savings and entering a MMF is not on the balance sheet of the bank(even though it can be coincidentally the same institution e.g. schwab checkig and schwab brokerage). Agents are a BIG threat to regular banks. I don't even see how it can be prevented, local agents are ubiquitous now.
[1] Exceptions are HY checkings but its hard to chase yield logistically: more hoops to jump like minimum balance or max ceiling, minimum transactions etc.
[2] See this from schwab's site: ``` For uninvested cash you do not plan to spend soon, you can consider investing in a money market fund such as the Schwab Prime Advantage Money Fund (SWVXX), which currently yields 3.71%, (7-day yield as of 2026-10-21), and can be purchased in a single trade with no minimum* and no transaction fee. Visit the Schwab Money Funds page to view all available funds and their current yields. ```
[3] https://www.youtube.com/watch?v=iPkJH6BT7dM
** MM funds are banks lending to each other to park overnight cash and borrow temporarily for actitivities, think of its like a bank's bank. In 2008 when the GFC was happening the fed had to step in and "ensure" this supply because a lot of banks were teetering and if one bank could not access its money or borrow for daily activities, no more cash would come from an atm.
Comment by cantrevealname 5 days ago
But isn't this self-correcting? If everybody starts moving money from checking/savings accounts to money market funds to get better rates, then the bank will start offering better interest rates in their checking/savings accounts so people won't do that.
Comment by matwood 5 days ago
Comment by SoftTalker 5 days ago
Comment by jongjong 5 days ago
Comment by lifeisloving 5 days ago
Comment by pjungwir 5 days ago
Comment by foruhar 5 days ago
Comment by Bang2Bay 5 days ago
Comment by ethanj8011 5 days ago
Comment by wpm 5 days ago
I can't wait until this leet hakur ShadyCN slop gets trained out of the models, I'm so sick of looking at it.
Comment by goody71 5 days ago
Comment by AStrangeMorrow 5 days ago
Comment by thekitze 5 days ago
Comment by einichi 4 days ago
yeah no thanks lmao
Comment by weezing 5 days ago
Comment by fathermarz 4 days ago
Comment by braxxox 5 days ago
Comment by gsky 5 days ago
Comment by stemonteduro 5 days ago
Comment by VladVladikoff 5 days ago
Comment by fractorial 5 days ago
> Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.)
At least two of these don’t ship a trust store.
Comment by layerv-ai 5 days ago
Comment by j_w 5 days ago
Comment by PowerElectronix 5 days ago
Comment by par 5 days ago
Comment by thekitze 5 days ago
Comment by medellin 5 days ago
Comment by VCFundedGenYer 5 days ago
Comment by thekitze 5 days ago
Comment by HardCodedBias 5 days ago
An over time graph with a rolling window of 7d and 28d would likely be a nice addition.
Great work!