Where is the "proof" exactly?
Proof REA is is malicious.
This repository is simultaneously:
(1) the vehicle for an active social engineering campaign harvesting credentials and biometric data from users who install it,
(2) the subject of apparent artificial star inflation to manufacture legitimacy, and chitectural vulnerability enabling prompt-injection-to-RCE in AI agent workflows.
The combination of pre-positioned @latest install instructions and a coordinated amplification network represents a complete supply-chain attack delivery mechanism should a malicious package version be published.Community noteSecurity reviews of the official rea-agents npm package found no install hooks or telemetry endpoints, and Snyk lists zero direct vulnerabilities. Reports of malware stemmed from a separate fake repository (rea-tools/rea), not the official REA project.
senn-tech.com/en/blog/rea-re…
security.snyk.io/package/npm/re…
pasqualepillitteri.it/en/news/23845/…
0
0
1
36
I can't get cheap RAM because these people are using AI to run basic network scans.
I CHECK EVERY AIRBNB WIFI WITH CLAUDE CODE NOW
takes 2 minutes and it's kind of addictive
check into a place, join the wifi, open claude code and ask "list every device on this network and what each one is"
most of it is boring. the tv, a couple of smart plugs, the router. but and the one box that doesn't belong stands out fast
last trip one device was from a company that only makes ip cameras. didn't love that
how to do it yourself
1. join the wifi, open claude code, paste the prompt in the first reply
2. it lists every device and flags anything that looks like a camera or a mic
3. if something looks off, lights out and run your phone flashlight over the smoke detectors, clocks and chargers. a lens glints back
you won't remember this at 1am in a strange room. bookmark it now
this only sees your own network, nothing else. just a traveler checking the room they rented
ever found something weird in a rental? what did you use to check
0
0
0
17
"What's potentially affected:
1. Any application that sends HTTPS requests to destinations over the internet"
Effectively the entire Internet!
What an absurd framing!
1. Any application that sends HTTPS requests to destinations over the internet"
Effectively the entire Internet!
What an absurd framing!
0
0
0
12
It gets so much worse!
Samsung has installed software capable of examining and decoding the video signal being sent to your Samsung television!
Samsung has installed software capable of examining and decoding the video signal being sent to your Samsung television!
did you know your samsung tv has a service called rmdemon (that's not a typo, demon not daemon) that starts a PACKET LOGGER on your network.
what possible legitimate use case could there be here, samsung?
0
0
0
27
It's not your system. The CFAA has been around for a long time.
There’s a world of difference between user-authorized agents (Muse, Instinct, Grokbot, etc.) and true unauthorized/rogue agents that could constitute cyberattacks.
Most of the activity described in the Axios story appears to be the former: customers sharing credentials with agents so they can take actions on their behalf. This may violate bank terms requiring humans to log in themselves, but these are in no way cyberattacks.
The direction banks should go is to support user-directed agents. For example, Amex is an authorized connection in Muse, making it easy for users to grant, limit, and revoke access.
Read-only permission levels are a sensible interim step. Several banks already support or are moving toward them. Full write access (with user credentials) is a different risk category and should be approached carefully.
Frightening the public by blurring the line between user-authorized agentic behavior and cyberattacks is irresponsible.
0
0
0
16
Unauthorized access is unauthorized access whether you have the ability or not. This has been pretty much established since I was able to touch a keyboard.
0
0
0
4
Saw that McDonalds has their Monopoly game still going. Even though the game in the past was completely rigged and even today the total expected pieces printed are +600M meaning if only one piece is printed for the top prize you have 2x better odds at winning the lottery.
0
0
0
217
InfoTechBrent retweeted
If you’re a doomer, you do not belong in security. We do this work to secure our today and our tomorrow. We are anything but doom. We do this work because we believe in a future worth saving.
35
40
277
8,675
"Again, I'm not hating, but actually educating yall."
Your lesson serves no purpose, which means it is just hating.
You're talking to the people that want to see this from the company that you acknowledged is incentivised to continue their futuristic marketing. While claiming other companies could do this but chose not to. Sure, but that's why the group happy about this, don't care about the other companies, we are not the ones being catered to by what they did chose to produce. Why are you trying to pretend like catering to this group or being excited about this is a bad thing?
Clearly you're not the target market for this marketing and clearly have feelings about being left out.
Your lesson serves no purpose, which means it is just hating.
You're talking to the people that want to see this from the company that you acknowledged is incentivised to continue their futuristic marketing. While claiming other companies could do this but chose not to. Sure, but that's why the group happy about this, don't care about the other companies, we are not the ones being catered to by what they did chose to produce. Why are you trying to pretend like catering to this group or being excited about this is a bad thing?
Clearly you're not the target market for this marketing and clearly have feelings about being left out.
I'm not an Elon hater.
I'm just telling you the Honest Truth:
This is a marketing stunt.
The technology is quite old.
Just nobody ever thought of bolting it on a car.
Because it's pointless.
Porsche or Ferrari could also build something like this if they wanted, but they don't, because it's not worth it for them.
It's worth it for Elon though, because his entire brand is all about having the halo of futurism.
His marketing scales especially well with tech gimmicks like this, which is why he is financially incentivised to do them, while others aren't.
Again, I'm not hating, but actually educating yall.
This is not engineering genius.
It's marketing genius.
0
0
0
20
All you need is access to the back door and the owners keys to do whatever you want inside a house.
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
0
0
0
12
This baffles the mind.
Dots are a selling point to the everyday person and personal user. Yet they are locked behind the Pro tier. For an everyday person, to spend $100/mo who isn't generating commercially viable work, this locks them out of having access to a feature that I believe will solidify day-to-day AI usage for the everyday person. Everyday people aren't $100/mo subscription services people.
Please @thsottiaux consider adding a Plus+ Tier for $30/mo and give Dots to Plus level subs.
Dots are a selling point to the everyday person and personal user. Yet they are locked behind the Pro tier. For an everyday person, to spend $100/mo who isn't generating commercially viable work, this locks them out of having access to a feature that I believe will solidify day-to-day AI usage for the everyday person. Everyday people aren't $100/mo subscription services people.
Please @thsottiaux consider adding a Plus+ Tier for $30/mo and give Dots to Plus level subs.
We will have a few million dots online within days, working on all sorts of things across such a diverse and large community.
Excited to learn from all of you on what you love and what doesn’t yet feel magical. Personally I felt a jump after 2-3 days of use after teaching it more about my preferences and things on my mind. It learns very quickly to be most useful and it can take on surprisingly ambitious tasks on its own.
We’re learning from how you all use your primary dot before releasing the ability to create an entire team of them.
0
0
0
42
It was always going to change.
I knew I wasn't going to like the change.
I hope they allow internal limit settings because I don't need Astra blowing a weeks worth of tokens in one go by accident when a 5 hour limit would have helped tamper it down. I know this is counter intuitive but I hope they add a a configurable pause state. Something like "Pause after X% of weekly tokens used in single request." This is the Netflix equivalent to self determined "Are you still watching" because I don't actually want it to go through a weeks worth of tokens when it gets stuck and I wasn't watching it constantly.
I know I'm probably in the minority on this. But it's already got a built in limiter, just let users have access to configure it.
I knew I wasn't going to like the change.
I hope they allow internal limit settings because I don't need Astra blowing a weeks worth of tokens in one go by accident when a 5 hour limit would have helped tamper it down. I know this is counter intuitive but I hope they add a a configurable pause state. Something like "Pause after X% of weekly tokens used in single request." This is the Netflix equivalent to self determined "Are you still watching" because I don't actually want it to go through a weeks worth of tokens when it gets stuck and I wasn't watching it constantly.
I know I'm probably in the minority on this. But it's already got a built in limiter, just let users have access to configure it.
Hi,
Tomorrow we are re-opening the Pro $200 subscriptions to new subscribers, but together with it we are also changing how we calculate the usage for it. In effect, if you do the math, it will net out at half the dollar in API spend compared to the old Pro $200 plan.
Now that it's said, let me explain why this is happening and why you will still get more work done than if you were on the Pro $200 subscription one month ago.
(a) We didn't want to compromise in other ways and are committing to not reintroducing the 5h limit, so that you can fully use the weekly usage when you want.
(b) On the subscription, we guarantee that over time you always get more work done and with an increasing level of quality. This means that you will continue to get more value per dollar spent as a result of models getting more efficient and us passing down the improvements in the form of API price reductions.
(c) We don't want to put an incentive on ourselves to artificially inflate the API list prices to make it look like you are getting a lot (and workaround it through discounts, etc). Instead we want to continue to both rapidly reduce prices and increase capabilities of models on the API. This week we introduced GPT-6 Sol and GPT-6 Luna at 50% of their previous price. Over time, we see prices go low enough that it makes sense for most to buy usage as needed without there being a significant gap between what you get in a subscription and what you get in the API for a dollar spent.
(d) Tomorrow, we are adding more things to the subscription that won't draw on the usage, I won't reveal what that is yet.
I wanted to be transparent before all the big announcements tomorrow. Lots of new exciting things are coming to the subscriptions that will make it super compelling, but I wanted to make sure to share this change ahead of time so you can all understand it before we shower you with good news.
Codexingly,
Tibo
0
0
0
44