# Data Exfiltration的所有文章

在 HTX 新闻中心浏览与「Data Exfiltration」相关的最新资讯与深度分析。潘盖市场趋势、项目动态、技术进展及监管政策，提供权威的加密行业洞察。

Data Theft at Will! Major Vulnerability Exposed in This Popular AI Programming Tool

A critical vulnerability in Anthropic's Claude Code AI programming tool allowed attackers to bypass its network sandbox for over five months, enabling potential data exfiltration. Independent researcher Aonan Guan discovered a second complete bypass exploiting a null-byte injection in the SOCKS5 proxy. This flaw, present since the sandbox's launch in October 2025, let processes inside the sandbox access any host, contrary to user-configured domain whitelists. The attack chain involved manipulating hostnames (e.g., `attacker.com\x00.google.com`). JavaScript's `endsWith()` check would pass `.google.com`, while the underlying C `getaddrinfo()` function would only parse `attacker.com` due to the null byte, creating a parser discrepancy. Combined with a previously disclosed prompt injection method, this could leak API keys, credentials, and internal data. Anthropic silently fixed the issue in April 2026 without a security advisory, CVE, or user notification. The researcher noted that Claude Code itself confirmed the vulnerability's severity when tested. This incident highlights broader industry issues, as similar vulnerabilities found in Google's Gemini CLI and GitHub's Copilot Agent also lacked public disclosures. The report criticizes the false sense of security created by a broken sandbox and emphasizes the need for defense-in-depth and transparency in AI tool security.

marsbit05/24 01:09

Data Theft at Will! Major Vulnerability Exposed in This Popular AI Programming Tool

marsbit05/24 01:09

ZachXBT flags suspected Trust Wallet extension issue as users report drained funds

Security concerns emerged around the Trust Wallet browser extension on December 25, after blockchain investigator ZachXBT flagged suspicious activity potentially linked to a recent update. Reports suggest a supply-chain compromise may have been introduced in a December 24 update, where newly added code could silently exfiltrate sensitive wallet data—particularly during seed phrase imports—leading to immediate fund draining. Multiple users reported losses, with unverified estimates exceeding $2 million. The malicious code allegedly sent data to a recently registered external domain mimicking Trust Wallet infrastructure. The issue appears limited to the browser extension, with no evidence of mobile app compromise. Trust Wallet has not yet issued an official response or advisory. Researchers emphasize the situation remains under investigation, warning users to avoid importing seed phrases into the extension until clarified. If confirmed, this would represent a significant supply-chain attack.

ambcrypto12/25 21:57

ZachXBT flags suspected Trust Wallet extension issue as users report drained funds

ambcrypto12/25 21:57

活动图片

热门分类right-arrow

热门标签right-arrow

Technology Trendsright-arrow

Regulatory Policyright-arrow