Incidents tagged exposed

An AI chat application reportedly exposed 300 million messages belonging to 25 million users, as indicated by the article title. However, detailed technical information regarding the nature of the data exposure, the underlying vulnerability, or specific exploitation methods could not be retrieved due to a forbidden access error during scraping.

An attack chain exploited exposed AWS credentials in public S3 buckets, leveraging Large Language Models (LLMs) to rapidly escalate privileges through a misconfigured Lambda function. This allowed threat actors to achieve full AWS administrative control and abuse GPU resources within an Amazon Bedrock environment in under eight minutes.

A critical misconfiguration in Moltbook's Supabase database, stemming from an exposed API key in client-side JavaScript and the absence of Row Level Security (RLS), enabled full read and write access. This vulnerability led to the exposure of 1.5 million AI agent authentication tokens, over 64,000 human email addresses, private messages, and allowed unauthenticated modification of platform content.

An Insecure Direct Object Reference (IDOR) vulnerability in an exposed API, combined with an unpatched legacy web application and weak credential hygiene, allowed unauthorized access to sensitive applicant personal data. This composite attack vector resulted in a data leak comprising names, emails, and job histories.