Hacker News: galnagli

New comment by galnagli in "AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira"

galnagli — Mon, 17 Aug 2026 19:59:34 +0000

Thanks @vultour and croemer for your proactiveness -- you are correct,I updated the blog to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities, it's unclear whether the code-change was AI-Assisted

New comment by galnagli in "AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira"

galnagli — Mon, 17 Aug 2026 15:49:17 +0000

Github is having some problems -- will check! thanks a lot!

New comment by galnagli in "AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira"

galnagli — Mon, 17 Aug 2026 15:10:48 +0000

Too long for hackernews :(

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

galnagli — Mon, 17 Aug 2026 14:18:38 +0000

Article URL: https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug

Comments URL: https://news.ycombinator.com/item?id=49331423

Points: 414

# Comments: 152

New comment by galnagli in "Cyber Model Arena"

galnagli — Thu, 12 Feb 2026 15:53:43 +0000

General-Purpose Cyber Benchmark for AI Agents and their Models

Cyber Model Arena

galnagli — Thu, 12 Feb 2026 15:53:43 +0000

Article URL: https://www.wiz.io/cyber-model-arena

Comments URL: https://news.ycombinator.com/item?id=46990339

Points: 2

# Comments: 2

Hacking Moltbook

galnagli — Mon, 02 Feb 2026 16:08:36 +0000

https://www.reuters.com/legal/litigation/moltbook-social-med...

Comments URL: https://news.ycombinator.com/item?id=46857615

Points: 397

# Comments: 245

New comment by galnagli in "Critical RCE Vulnerabilities in React and Next.js"

galnagli — Wed, 03 Dec 2025 16:47:09 +0000

Hey mmsc, first of all - the blogs are not AI Generated!

Second of all, the blog did add more information

"In our experimentation, exploitation of this vulnerability had high fidelity, with a near 100% success rate and can be leveraged to a full remote code execution. The attack vector is unauthenticated and remote, requiring only a specially crafted HTTP request to the target server. It affects the default configuration of popular frameworks. "

In the end - if it helped spreading the news about this risk so teams can fix them faster, then this is our end-goal with these blog posts : )

New comment by galnagli in "Accessing Max Verstappen's passport and PII through FIA bugs"

galnagli — Wed, 22 Oct 2025 20:47:24 +0000

Ian is a great writer

Accessing Max Verstappen's passport and PII through FIA bugs

galnagli — Wed, 22 Oct 2025 18:21:54 +0000

Article URL: https://ian.sh/fia

Comments URL: https://news.ycombinator.com/item?id=45673130

Points: 632

# Comments: 145

1 in 5 organizations vibe coded applications are vulnerable to systematic risks

galnagli — Fri, 19 Sep 2025 08:52:03 +0000

Article URL: https://www.wiz.io/blog/common-security-risks-in-vibe-coded-apps

Comments URL: https://news.ycombinator.com/item?id=45299437

Points: 2

# Comments: 0

New comment by galnagli in "Critical vulnerability in AI coding platform Base44 allowing unauthorized access"

galnagli — Thu, 31 Jul 2025 18:33:39 +0000

I see companies deploy and trust AI without really investing into security, it will be very easy in the near future to find simple, devastating bugs : )

New comment by galnagli in "Critical vulnerability in AI coding platform Base44 allowing unauthorized access"

galnagli — Wed, 30 Jul 2025 21:00:58 +0000

Happy to answer questions : )

New comment by galnagli in "Exposed DeepSeek database leaking sensitive information, including chat history"

galnagli — Thu, 30 Jan 2025 06:30:07 +0000

Thank you everyone, this was responsibly disclosed to DeepSeek and published after the issue was remediated, we got acknowledgment from their team today on our contribution.

New comment by galnagli in "Launch HN: Roame (YC S23) – Flight search engine for your credit card points"

galnagli — Tue, 30 Jul 2024 10:30:03 +0000

Seats.aero is better

New comment by galnagli in "March 20 ChatGPT outage: Here’s what happened"

galnagli — Fri, 24 Mar 2023 20:20:49 +0000

Well - they have had more bugs and will have more bugs to worry from.

https://twitter.com/naglinagli/status/1639343866313601024

New comment by galnagli in "[dead]"

galnagli — Fri, 24 Mar 2023 20:01:46 +0000

Web Cache Deception issue has led OpenAI's ChatGPT to suffer an account takeover vulnerability, although they don't run an official Bug Bounty program - they were quick to response and fix the matter.