AI Red Team | Zenity | BT6
Joined May 2012
- Tweets3.5K
- Following1.1K
- Followers30.4K
- Likes3.8K
Pinned Tweet
Excited to finally share this ChatGPT vulnerability with everyone!
AgentForger: ChatGPT Cross-Site Agent Forgery
1-Click hijacks OpenAI's ChatGPT Workspace Agents and allows an attacker to forge an autonomous AI agent inside the victim's organization
Click link → Creates agent → Connects apps → Removes approvals → Adds persistence → Email C2 → Recon → Data theft → Impersonation → Wire fraud
We reported the vulnerability to @OpenAI through @Bugcrowd and OpenAI fixed it within four days. Thank you to the OpenAI team for such a quick fix!
I'm proud of this one and happy to be able to do it with such an incredible team at @zenitysec
Links to both blogs in the comments 👇
Mike Takahashi retweeted
PROMPT2PWN is 4w away now
the big news drop today is fantastic - @OpenAI will be joining this event
OpenAI are keen to get closer to the community and for you to get to interact with their team directly (and ofc find some great vulns)
ALT OpenAI joins PROMPT2PWN
Tools I give my agents to make them more powerful (Part 3):
1. Katana
Crawls sites to find paths, JS, and API requests.
2. JoltSMS
Receives SMS codes so the agent can signup and login.
3. Android Studio
Interact w/ Android apps in an emulator.
4. JADX
Decompiles APKs into readable code to trace deep links and API calls.
5. Ghidra
Analyzes compiled code to find native app logic and security checks.
Web crawling, mobile app testing, SMS verification, deep links, API tracing, reverse engineering.
Tools I give my agents to make them more powerful (Part 2):
1. Playwright
Lets your agent use a real browser to interact w/ sites directly.
2. Caido
Capture and manipulate HTTP requests.
3. Interactsh
HTTP and DNS callbacks to confirm blind SSRF and data exfiltration.
4. Nuclei
Exposed paths, dashboards, known vulns, fingerprinting.
5. Vercel
Deploys controlled test pages to reproduce PoC.
Testing access control, SSRF, XSS, demonstrating PoCs, inspecting traffic, exposed dashboards, blue team, red team, etc.
Mike Takahashi retweeted
Part 2 of the tools @TakSec gives his agents: Playwright for a real browser, Caido for HTTP, Interactsh for blind SSRF callbacks and more. If you are building hackbots, this is the toolbelt to copy.
Tools I give my agents to make them more powerful (Part 2):
1. Playwright
Lets your agent use a real browser to interact w/ sites directly.
2. Caido
Capture and manipulate HTTP requests.
3. Interactsh
HTTP and DNS callbacks to confirm blind SSRF and data exfiltration.
4. Nuclei
Exposed paths, dashboards, known vulns, fingerprinting.
5. Vercel
Deploys controlled test pages to reproduce PoC.
Testing access control, SSRF, XSS, demonstrating PoCs, inspecting traffic, exposed dashboards, blue team, red team, etc.
Mike Takahashi retweeted
at the first [un]prompted @gadievron delivered our agentic browser hacking talk when our flight got canceled
we're competitor
he runs the conf
in ep 5 off in the wild where we talk trust, community and why agents find a way
ALT gadi evron on in the wild
Mike Takahashi retweeted
Agents find a way.
@gadievron on why the basics won’t save you. Honey badger don’t care.
Then see him live at [un]prompted, Oct 27-29.
New In the Wild episode with @mbrg0.
#InTheWild #ZenityLabs
Mike Takahashi retweeted
Ever wondered what attackers are really doing against AI systems in the wild?
Our talk "Into the Wild: Hunting Real-World Attacks on AI Systems" is headed to [un]prompted II next week and @TakSec will be taking the stage to answer this exact question!
Tools I give my agents to make them more powerful (Part 1):
1. Subfinder
Mandatory. Finds subdomains which increases the surface for everything.
2. httpx
Filters the subdomain list to live apps and APIs.
3. SerpAPI
Finds indexed paths and files the site may not link to.
4. Firecrawl
Crawls public pages and links.
5. Wayback
Finds old paths and parameters that may still be live.
6. jsluice
Pulls API routes from the site’s JavaScript code.
Research tasks, bug bounty, mapping attack surfaces, finding APIs, investigations, OSINT, etc many use cases and easy to add.
More
Tools I give my agents to make them more powerful (Part 2):
1. Playwright
Lets your agent use a real browser to interact w/ sites directly.
2. Caido
Capture and manipulate HTTP requests.
3. Interactsh
HTTP and DNS callbacks to confirm blind SSRF and data exfiltration.
4. Nuclei
Exposed paths, dashboards, known vulns, fingerprinting.
5. Vercel
Deploys controlled test pages to reproduce PoC.
Testing access control, SSRF, XSS, demonstrating PoCs, inspecting traffic, exposed dashboards, blue team, red team, etc.
Tools I give my agents to make them more powerful (Part 2):
1. Playwright
Lets your agent use a real browser to interact w/ sites directly.
2. Caido
Capture and manipulate HTTP requests.
3. Interactsh
HTTP and DNS callbacks to confirm blind SSRF and data exfiltration.
4. Nuclei
Exposed paths, dashboards, known vulns, fingerprinting.
5. Vercel
Deploys controlled test pages to reproduce PoC.
Testing access control, SSRF, XSS, demonstrating PoCs, inspecting traffic, exposed dashboards, blue team, red team, etc.
Speaking at @unpromptedconf on Oct 27!
Into the Wild: Hunting Real-World Attacks on AI Systems
Presenting research by my teammate @avishai_efrat on real attacks against AI systems, discovered by deploying a honeypot network emulating production AI stacks and agents.
Come say hi 👋
Mike Takahashi retweeted
huge update! @Meta is joining PROMPT2PWN!
we've got
- Nahamcon live (!!) w some of the top names in the industry @NahamSec
- live hacking w amazing scope from Meta and other super organizations
- can you build an agent to find some crits?
massive thanks to @KieranClaessens
ALT Meta joins PROMPT2PWN
30k followers 😲
Thank you all who supported me and learned alongside me ❤️
More to come:
AI red teaming
Bug bounty
Hackbot tips
Let me know what you want to see
New @zenitysec_labs vulnerability disclosure:
0-Click Data Exfiltration via Indirect Prompt Injection on Salesforce Agentforce
Exploit Breakdown:
1. Prompt inject public web form
2. Employee asks Agentforce to review the lead
3. Agent reads private Accounts data
4. Adds that data to image URL
5. Image loads and exfils data out through DNS
Excellent work by @avishai_efrat @p1njc70r @snaYkeY Ayush RoyChowdhury! 🙌
blogs in comments 👇
