We are a global company made up of hackers and security researchers working together to tackle advanced vulnerabilities & techniques using AI. Building @pwn_ai
New York, USA
Joined June 2025
- Tweets183
- Following1
- Followers175
- Likes1.1K
Octagon Networks retweeted
Holy fk. Didn't even wait for zeroday.cloud
Good stuff :D
Gvisor next?
Octagon Networks retweeted
Awesome work. Some notable attributes here like the guest privileges required to pull it off.
Also notable that Linux is truly such trash software that even god-tier software like Firecracker can only do so much.
Anyway, remove privileges even within Firecracker.
Octagon Networks retweeted
Just posted part 2 for PwnEscape, this time targeting Firecracker and included the process of porting it from host memory leak to controlled write to root:
Octagon Networks retweeted
Introducing CVE-2026-106378: Chrome GPU Sandbox Escape to full Remote Command Execution using synthetic keyboard injection
By combining it with common GPU bugs, it becomes a full chain. Binance DevOps was most likely pwnd with a zeroday chain affecting the browser 😬
Octagon Networks retweeted
🚨 Chrome macOS GPU sandbox escape enables code execution outside the browser; CVE-2026-106378
Security researchers discovered that Chrome’s sandboxed GPU process could communicate with macOS WindowServer and inject keyboard input into the desktop.
⠀
The public proof of concept opens Spotlight, types “Calculator” and launches the application outside Chrome’s sandbox. The same technique could potentially open Terminal and execute commands.
⠀
The vulnerability is not a standalone one-click exploit. An attacker must first compromise a Chrome renderer or GPU process before using the flaw to escape the sandbox.
⠀
Key details:
• CVSS: 8.3 (CISA-ADP)
• Chromium severity: Medium
• Affected: Chrome for macOS before 155.0.8059.39
• Fixed: Chrome 155.0.8059.39 and later
• Public PoC: Available
• Active exploitation: Not reported
Octagon Networks retweeted
I’m gonna say it again. This is not the time to stop your bug bounty.
Bounty hunters with AI are on the cutting edge of what AI can find.
Let them loose and fix before bad guys find stuff.
Octagon Networks retweeted
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Octagon Networks retweeted
Escaping Chrome's GPU sandbox through an undocumented macOS API.
Discovered a sandboxed Chrome GPU process could inject keyboard events so sent ⌘+Space, typed "Calculator" & hit Return 😂. CVE-2026-106378 is fixed in Chrome 155. Update chrome dependancies. Happy Octoberfest.