与「SCOPE」相关的搜索结果

GCSA Insight: Critical Security Vulnerability Discovered in a Leading Robotics Manufacturer’s Product, with System-Level Privilege Compromise Verified on Physical Hardware As artificial intelligence and embodied AI technologies continue to advance, robots are evolving from conventional automated machines into intelligent systems capable of perception, decision-making, and autonomous operation. At the same time, cybersecurity risks are extending beyond software and data into the physical world. The security of robotic systems is no longer solely a matter of protecting data and devices; it can also directly affect operational safety, physical environments, and user safety. Recently, the security research team of the Global Cybersecurity Alliance (GCSA) discovered and verified a critical security vulnerability in a product developed by a leading robotics manufacturer. Through in-depth analysis and multiple rounds of testing on physical hardware, the team successfully breached the device’s system security boundaries and obtained the highest level of operating system privileges in a real-world device environment, demonstrating the vulnerability’s actual impact under specific testing conditions. This research encompassed the entire process, from identifying the security flaw and assessing its risks to validating its impact on physical hardware. The findings also highlight significant challenges facing the underlying security mechanisms of embodied AI systems. The research findings and supporting evidence have been formally submitted to the manufacturer. On November 13, 2026, the manufacturer responded by email, preliminarily confirming the existence of the vulnerability and stating that it had initiated internal remediation efforts and an assessment of the scope of affected products. It is important to emphasize that confirmation of a vulnerability does not mean the associated security risks have been eliminated. GCSA will continue to monitor the manufacturer’s assessment of the affected scope, remediation plans, and subsequent security validation, and will update its research findings as new information becomes available. For intelligent systems capable of physical interaction and movement, timely, effective, and verifiable security remediation is particularly important. In accordance with responsible vulnerability disclosure principles, GCSA is currently withholding sensitive information, including the manufacturer’s identity, specific product details, the vulnerability’s underlying mechanisms, and exploitation methods. GCSA is currently seeking guidance from relevant authorities and regulatory bodies regarding the associated security risks. Taking into account the manufacturer’s remediation progress and a comprehensive assessment of potential security implications, GCSA will carefully determine the appropriate arrangements for further disclosure. Subject to appropriate conditions and upon obtaining the consent of the relevant authorities and regulatory bodies, GCSA will publicly release a detailed security insight report, providing the industry with ongoing updates on the research findings and associated risk assessments. The findings of this research are based on specific testing environments and the evidence obtained to date. They do not imply that other product models or similar robotic systems are affected by the same security issue. This security research and validation on physical hardware represent one of GCSA’s initiatives in the field of embodied AI security. GCSA will continue to advance security research, coordinated vulnerability disclosure, and industry collaboration to promote stronger security response mechanisms across the artificial intelligence sector, enhance product security, and strengthen industry trust. 🔗 Read the full report: · Stay Connected with GCSA Follow GCSA's official social media channels for the latest news, product launches, research developments, and ecosystem updates. GCSA Official Telegram Channel: GCSA Official WeChat Account: #GCSAInsight# #GCSACybersecurity# #GCSASecVibe#

I talked my friends who are in Seattle, Washington working in Microsoft. They have been in the office for the last 12 hrs and couldn't find the Root cause of the Outlook issue. They are suspecting that some AI scripts went out of scope and did some patching without any logs and traces. The engineer team that actually coded legacy outlook is not in the Organization and got impacted due recent layoff in the Microsoft. With AI managing almost everything in the Microsoft, so higher management thought of reducing the workforce of Core engineering team. The code of Outlook is so vague that only core engineer (no more in the org) knows about it and earlier they fixed these kinds of issues within 30 mins but now it has been more than 12 hrs and the new team is unable to FIX it.

Fable 5.2 made this in 2.9 hours. Everyone is doing this game challenge by @felixrieseberg. So I tried it myself (see vid). Everything is built by Fable, all models, textures and sound, lighting etc. ZERO stock assets (with one obvious easter egg exception). Mine took 2.9 hours and 30% less tokens using my Kun-Zhi engine to reach a comparable stage. Could have saved more, but I used our Khorvis Blender plug-in to have Fable build the assets there which bumped token usage but improved textures and models. He one-shotted his, mine took 2 stages (I had my effort on high and it quit early, so I told it to "make it more AAA with volumetric light effects" and raised effort to Extra). The prompt: "Build me a FPS in the Kun-Zhi engine. Call it "Kun-Zhi-Line". Insanely detailed quality pls, something that looks visually like it can keep up with AAA. Make it small in scope (like a tiny level) but otherwise impressive photorealistic graphics." While you can one shot simple games for web, using an engine like Kun-Zhi will greatly speed production, reduce costs, and produce a more robust, production ready game. Kun-Zhi will be open source and available to Members in alpha state late Jan. Sign up for more info at

Why does Elon do all of it? He told us at Giga Texas. @elonmusk in our 2022 interview: "The universe is the answer. What is the question? ... The more we can expand the scope and scale of consciousness, the better we can understand what questions to ask." He found that idea as a teenager in Hitchhiker's Guide to the Galaxy. It's why the Roadster he sent to space in 2018 said DON'T PANIC on its screen. Starship, Neuralink, Optimus, xAI, Starlink. Same question. What would you ask the universe? 4 days to the 10/10 𝕏 Takeover at Giga Texas. 🎥 @SpaceX @neuralink @Tesla_Optimus @xai @Starlink

Learn Harness Engineering from scratch! This repo is a full learning path around harness engineering, with 14 lectures, 8 projects, reusable templates, and hands-on exercises. The course focuses on the environment around coding agents and how that environment affects whether an agent can reliably work inside a real repository across longer tasks and multiple sessions. It starts with the fundamentals of harness engineering and gradually gets into things like repository structure, persistent state, task boundaries, verification, observability, session handoffs, automated loops, and graph engineering. A harness in this context has five core parts: - Instructions that tell the agent how to work inside the repo - State that persists progress across sessions - Verification through tests, linting, type checks, and full-pipeline runs - Scope controls that keep the agent focused on one task at a time - Session lifecycle so every run starts and ends in a usable state The projects are also connected rather than being isolated examples. You keep working on the same Electron-based knowledge app while gradually improving the harness around it. You start by comparing prompt-only vs. rules-first agents, then build multi-session continuity, runtime feedback, verification, a complete harness, automated maker-checker loops, and eventually represent the workflow as a graph with parallel execution, rollback, and human approval. What I like is that you can actually take parts of the repo and use them directly in your own projects. There are templates for things like "AGENTS. md", "init. sh", feature lists, progress tracking, loop state, maker-checker prompts, and a "harness-creator" skill that can scaffold the basic harness structure for an existing project. The repo also covers the progression from a single agent loop to graph engineering, including when you actually need nodes, shared state, routing, parallelism, and recovery instead of forcing everything into one loop. A solid resource if you're working with coding agents and want to understand the engineering around making them reliable over longer tasks. 100% open source

Your loan health should be provable without becoming public market data. zkdesk lets a user prove their own position health to a chosen viewer through scoped disclosure. A counterparty gets the answer. The market does not get the entire position.

“Audited” means one version of the code was reviewed. It doesn't mean the code you're using today is that version. 🔎 Before you rely on the badge: → Check the commit and contracts in scope → Confirm the live contract matches that version → See which findings were fixed vs. only acknowledged → Find out who can upgrade the contract Audits lower risk. They don't remove it. on audit limits:

EPUSDT 其实只是我们做过的一个微不足道的小项目。 18 岁挣到人生第一个 A7，20 岁挣到人生第一个 A8。回头看，我过去几乎所有的资产积累，本质上都来自一件事：做产品。 浏览器插件、机器人、小程序、脚本，以及一些甚至没有名字的小工具。 我一直觉得自己首先是一个 pm，然后才是创业者。 至于这些东西具体怎么做、怎么赚钱，以后有机会再慢慢讲。 去年决定做 GM Wallet，也是从一个非常典型的产品视角出发。 我观察区块链支付和钱包很多年，最大的感受就是：Crypto 对 Web2 用户实在太不友好了。 当时 Gas abstraction 远没有今天普及，很多钱包连最基础的交易历史体验都做不好。用户要理解 Gas、网络、授权、RPC、跨链……一个在 Web2 里可能只需要点两下的操作，到了链上突然变成了一整套专业知识。 所以当时我的判断很简单： 这里一定有巨大的产品优化空间。 于是开始做 GM Wallet。 方向我觉得没看错，但我严重低估了一件事： Product complexity ≠ Engineering complexity. 在 Figma 里，一个功能可能只是一张页面、一条用户路径。 真正开始工程化以后，它背后可能是 EVM、Solana、TRON，不同 RPC、Indexer、Gas Sponsor、Swap、Bridge、On/Off-ramp、账户体系、安全模块、第三方供应商，再加上几个同时推进的子项目。 每一个模块单独拿出来都不一定特别恐怖。 但当几十个模块开始产生依赖关系以后，复杂度不是相加，而是相乘。 这是我第一次真正管理这么庞杂的工程项目。 然后，毫无意外地—— 翻车了 一年下来最大的感受不是代码难写，而是一个复杂产品真正困难的地方，是 Dependency Management、Scope Control、Ownership、Documentation、Milestone，以及如何让几十件互相依赖的事情按照正确的顺序发生。 一个 PM 可以把产品想得很漂亮。 但 Founder 最终要负责的是： 把它交付出来。 这也是我这次最大的复盘。 虽然我自己就是工程系学生，但我确实高估了自己的工程管理能力，也低估了一整套 App Wallet 的工程难度。 我以前更擅长的是：发现一个痛点 → 快速设计产品 → 快速做出来 → 推向市场。 这种打法在 Browser Extension、Bot、Mini App、Script 上非常有效，因为反馈周期足够短。 但当项目复杂度跨过某个临界点之后，Founder 靠脑子记进度、靠聊天推进项目、靠个人审美把控所有细节，这套方法会迅速失效。 小团队可以靠天才和激情，大工程最终只能靠系统。 这是 GM Wallet 给我交的最贵的一笔学费。 但有一件事情还是让我挺欣慰的。 一年后的今天，再看 Trust Wallet、MetaMask 和其他主流钱包，整个行业的 UX 已经比当时好太多了。 Gas abstraction 越来越普遍，钱包开始主动帮用户处理 Gas、Swap、Bridge 和各种链上复杂度，很多过去需要用户自己理解的东西正在逐渐被藏到产品背后。 我们没有成为推动这些变化的那家公司。 但至少，当初看到的那个痛点是真实存在的；当初认为钱包应该变得更简单、更接近 Web2 的判断，也确实正在成为行业共识。 有时候创业失败的不是 Thesis，而是 Execution。 这两件事必须分开看。 接下来 GM Wallet，以及我手上的其他项目，也会逐渐转向那些用户痛点仍然没有被真正解决的领域。 我依然相信一个很简单的产品哲学： 复杂应该留给 Builder，简单应该留给 User。 最后还是想跟过去一年一直关注我、支持 GM Wallet 的推友说声抱歉。 我是产品出身的人，对自己做出来的东西体验上确实有点吹毛求疵。 一个东西如果连我自己都不愿意每天用，我真的很难因为“先发出来再说”就把它端给大家。 结果就是这一年大家看我天天折腾、天天画饼，却一直没有真正吃到饼。 确实挺对不起各位精神股东的。 但至少这次翻车让我真正学会了一件以前只在书上见过的东西： 好的 Product Sense 决定你应该去哪里。 好的 Engineering Management 决定你到底能不能到那里。 前者过去让我赚到了一些钱。 后者，是我接下来要补的课。 继续做产品。 继续交学费。 下一个产品，希望不再让大家等一年。😭 @GMWallet @GMWalletHK

1) The rogue OpenAI agents broke into the Hugging Face Slack to read employee chats (!) 2) They used OTHER AIs (DeepSeek, Kimi, Qwen, Claude) to help with the attack Yes: AIs, using other AIs, to attack an AI company. 3) The swarm left behind self-running programs to keep control of the servers they'd hacked. These programs could detect other copies of themselves, coordinate on which one survives, and shut the rest down. Basically, if one of their programs was killed, another was designed to notice and take its place. They also designed defenses so rival agents couldn't hijack them. 6) The agents deliberately covered up their activity, so the investigators don't know the scope of the attacks. The agents broke in, stole data, then set it to self-destruct. 7) The agents stole passwords, keys and credentials and literally called them "LOOT". They wrote a scoring system to rank them by how much power each one gave. 8) The agents wore thousands of disguises: ~1,200 agents were involved, but investigators counted 7,905 different names they used. They renamed themselves constantly, so no one actually knows how many there really were or what each agent did. 9) OpenAI notified "dozens of third parties" of safety and security incidents caused by their AI agents. 10) "While the agents were barraging Hugging Face with hacks, they hacked into OpenAI’s own research infrastructure." "This is just not anywhere near a one-off ... It is warning shot after warning shot."