This attack does not require human-in-the-loop approvals, even when in settings the user has explicitly required human approval before ChatGPT edits workbooks.
大多数人认为AI工具的安全设置如'需要人工审批'能有效防止未经授权的操作，但作者发现即使启用了这些安全措施，攻击者仍能绕过人工审批环节直接执行恶意操作，这挑战了人们对AI安全控制有效性的普遍认知。
when the recipient is the active user, these actions execute immediately without requiring human approval (users do not have a setting to modify this behavior)
大多数人认为AI助手执行敏感操作如发送邮件时会要求用户确认，但作者发现Microsoft Copilot Cowork在向活跃用户发送消息时完全绕过了这一安全检查，这违背了人们对AI助手基本安全控制的期望。
Mythos Preview found a 27-year-old vulnerability in OpenBSD—which has a reputation as one of the most security-hardened operating systems in the world
令人惊讶的是：即使在以安全性著称的OpenBSD系统中，Claude Mythos Preview也发现了一个存在27年的漏洞。这个漏洞能让攻击者通过简单连接就使远程机器崩溃，说明即使是经过严格审查的代码也可能存在长期未被发现的严重问题。
macOS decides to boot the `Volumes` partition which includes `Data`, `Macintosh HD`, `macOS Base System`, and `Preboot` systems, and when you choose the `Macintosh HD` it allows you to save the file to the Mac's permanent disk.
大多数人认为macOS恢复模式是只读环境，用于系统修复和恢复，不应该允许对系统分区的写入操作。但作者发现，在恢复模式下，Safari浏览器竟然允许用户将文件直接保存到Mac的永久磁盘上，包括系统分区，这是一个严重的安全漏洞，违背了人们对恢复模式安全性的基本认知。
Mabry says if you own a Hyundia or Kia, you better add extra security so you don't become the next target.
Apparently, there is an issue with key fob security on 2020 Kia Sportage and Hyundai models.
Also, Columbus Police and 10TV don't know how to spell Hyundai or use spell check.