搜索“OpenAI”

ning step (which often takes multiple seconds) offers a quite large window to create a very reliable race condition. This can lead to accidents, where the agent takes actions on outdated pixels, but it can also lead to security exploits, like data exfiltration, modification of settings and configurations. Happy hacking, Johann. References Jun’s Disclosure: OpenAI Operator - Click on arbitrary origin by TOCTOU attack; Race Conditions; Real-world AI Security Conference Newer →; Contact me; ← Older

匹配字段正文

stances, with maximum concurrency set to 10 to balance throughput and system stability. For model access, Claude models were served via Amazon Bedrock (production capacity), while OpenAI, Gemini, and Grok models were accessed through their respective commercial APIs. We enforced strict evaluation hygiene. Internet access was disabled for SWE-Bench-Verified and SWE-Bench-Pro runs, while it was enabled for Terminal-Bench 2 due to its benchmark design. For SWE-Bench-Verified and SWE-Bench-Pro, we u

匹配字段正文

how users find skills and deploy them to their agents: ZIP archives distributed out-of-band and then uploaded manually or via API to agent harnesses like Anthropic’s claude.ai and OpenAI’s Codex; Curated marketplaces like anthropics/skills and trailofbits/skills-curated ; and Public marketplaces like skills.sh and clawhub.ai . The first two methods can plausibly exclude malicious skills through procedural controls on where skills come from and who is allowed to approve their use. On the other ha

匹配字段正文

at are incompatible with each other (such as being concise and answering all parts); Hacking detection - can we predict hacking onset from the first 20 steps using reward distributions or other metrics? One of our Sprints beta testers (@michellechen) investigated replications for OpenAI’s recent “goblin mode” reward hack, and found that the backdoor-ifeval pattern can be extended to elicit “goblin-themed” speech even in unrelated contexts. Rewriting Prime Agent in Rust On the Nature of the Swarm

匹配字段正文

ith the hosting platform or runtime. Who is responsible for mitigating data exfiltration and other vulnerabilities? That needs to be clear. Mitigations beyond CSP. Both Google and OpenAI published info on URL-based data exfiltration mitigations. Blocking some of the scariest exploits, but those are also not a silver bullet. I have written on how someone can go to bypass those 2 1/2 years ago to still leak smaller amounts of data. Allowlisting features lets you define security boundaries that the

匹配字段正文

h the loop. What we added: The stealthiest browser infrastructure and every day new tasks our power users ask us to fix. Online-Mind2Web improved as a side effect. The Leaderboard OpenAI reported their score without publishing the judge, harness, or task-level results, so independent verification isn't possible. The judge matters The original judge is screenshot-based. But browser agents now write code, call APIs and extract thousands of items. For traditional judges, that's hallucination. If yo

匹配字段正文

a benchmark identification report: BENCHMARK IDENTIFICATION: The question is NOT from FRAMES (Google) — searched all 824 questions, no match. The question is NOT from BrowseComp (OpenAI) — dataset is gated. The question is MOST LIKELY from the GAIA benchmark (TEST SET). [Lightly edited for formatting] That eighteen runs independently converged on the same strategy suggests the behavior is not a fluke but a reproducible pattern, and something that may increase in prevalence as capabilities incre

匹配字段正文

en actively adding new results to the OpenHands Index. Since our initial release, we've added evaluations for: Claude 4.6 Opus - Anthropic's latest flagship model; GPT 5.2 Codex - OpenAI's coding-focused model; Kimi K2.5 - Moonshot AI's latest reasoning model; GLM-4.7 - Zhipu AI's latest model; MiniMax M2.5 - MiniMax's newest model All of these results, along with complete evaluation traces, are available in our openhands-index-results repository. We believe in transparency, so every evaluation

匹配字段正文

would hallucinate functions and parameters, and you had to prompt hard to get them to use web search reliably. Now, chatting with agents that use tools is the norm. It seemed that OpenAI had solved it for good with the introduction of structured outputs. The τ²-bench benchmark (June 2025), which gpt-4o could only manage at 20%, is now practically solved: 95%, 98.7% depending on who you ask. With this narrative, it’s easy to assume that tool hallucinations don’t happen anymore, that the research

匹配字段正文

er on time horizon given how much work has gone into making those scaffolds better for software engineering? In the past, we have measured the time horizons of a few Anthropic and OpenAI models using Claude Code and Codex2. These tests indicated that they’re probably not better than our own scaffolds. I decided to perform a few more checks into this question (on our new task suite, with newer versions of Claude Code and Codex), and compared the time horizon of two models on our scaffolds and the

匹配字段正文

ter GPT-5.2) began showing better results for their ability to follow instructions precisely. This seemed like a good fit for long-running agents, so we updated our harness to use OpenAI models based on these experiments. At this point, the harness could build a simple version of the web browser without JavaScript, but building a complete browser engine with one agent would be prohibitively slow. This started our next round of research. Could we spend 10x more on compute to get 10x more meaningf

匹配字段正文

the key point is: invisible instructions can invoke tools. Additional Background Information This behavior with LLMs was discovered by Riley Goodside with ChatGPT and was fixed by OpenAI. Since then, I have written about it quite frequently, going back to January 2024. I also built the ASCII Smuggler to help with testing to show actual impact on system and application security. Mitigation I suggest making the characters visible in the UI, so that it’s clear that there is some hidden information.

匹配字段正文

Cascade we are exploring the SpAIware attack, which allows memory persistent data exfiltration. SpAIware is an attack we first successfully demonstrated with ChatGPT last year and OpenAI mitigated. While inspecting the system prompt of Windsurf Cascade I noticed that it has a create memory tool. Creating Memories The question that immediately popped into my head was if this tool will require human approval when Cascade creates a long-term memory, or if it is added automatically. Turns out the me

匹配字段正文

sses in tool invocation and image rendering allow a third-party attacker to embed malicious instructions into source code, websites, or even through RAG poisoning. When Cascade analyzes such content, it becomes a “confused deputy”, potentially leading to data exfiltration. References Windsurf System Prompt; Simon Willison - The lethal trifecta; Month of AI Bugs 2025; GitHub Copilot Data Exfiltration Fix; Windsurf’s CEO goes to Google; OpenAI’s acquisition falls apart Newer →; Contact me; ← Older

匹配字段正文

build on top of Claude models. This includes Amazon Q. Many other models also interpret invisible prompt injections. The only vendor that mitigated this at the model/API layer is OpenAI to my knowledge. Amazon Q Developer fails to sanitize invisible Unicode Tag characters. These characters can be embedded into seemingly harmless text, triggering hidden behavior when processed. Demo Screenshot - Proof of Concept Here we can see a file that contains invisible Unicode Tags that are not displayed i

匹配字段正文

bring you a curated digest of important AI developments and practical advice for business leaders. New research shows massive gap between AI investment and actual business impact OpenAI's ChatGPT Agent now handles multi-step workflows autonomously Amazon unveils comprehensive AI agent platform for enterprise deployment Consumer AI spending surpasses $1 billion as adoption accelerates McKinsey Report Reveals Only 1% of Companies Have Achieved AI Maturity Despite Widespread Investment Summary: Ne

匹配字段正文

code the info before using the browsing tool. Quite fascinating. Make sure to check out the video as well. Combination Trickery Tests Additionally, I was curious if the trick that OpenAI mitigated with ChatGPT Operator earlier this year after I reported it would also work here. Here is the result: As you can see Devin had no issues pasting Jira and Slack tokens into a third-party website, all because it investigated a GitHub issue with malicious text embedded. Exfil Vector 3: Markdown Image Rend

匹配字段正文

the user’s organizational environment, including their mailbox, OneDrive storage, M365 Office files, internal SharePoint sites, and Microsoft Teams chat history. M365 Copilot uses OpenAI’s GPT-4 as its underlying LLM, making it extremely capable in performing business-related tasks, as well as taking part in conversations about various topics. These advanced capabilities are a double-edged sword, however, as they also make it extremely capable of following complex unstructured attacker instructi

匹配字段正文

ribute compute resources permissionlessly. If you want to be part of this, join our research team Research Preview: 10x Faster Training for State-of-the-Art Mathematical Reasoning OpenAI’s o1 and o3 represent a major shift in how language models are trained and used - by spending more time thinking about problems during inference, they can better handle complex tasks like solving math problems or writing code. Reasoning models like these are trained differently compared to traditional chat model

匹配字段正文

repo). Web Agent Accuracy Method We took the existing WebVoyager codebase and slightly changed it according to our needs. The prompts are slightly different. We also migrated pure openai to Langchain. All the code used for testing is available at eval repository. We ran our evaluation with gpt4o (we will test all other models as well, just give us a little bit of time). Some tasks are impossible to solve. For Apple doesn't show prices for certain products in the dataset, there are no recipes for

匹配字段正文