Live demo shows attack chain hijacking TikTok: camera, photos and payment data exposed
ccerrato147 · x · 2026-09-19
In a thread of live demo screenshots, ccerrato147 describes how a security firm (whose model was post-trained on GLM 5.2, the 753B-parameter MIT-licensed open-weights model) uncovered a full attack chain against TikTok. The attacker's laptop panel shows a controlled Pixel 8 (uid=10304, sdk=37): toggles for front/back camera, video recording (back camera always-on, 203 frames captured), and a bulk export of the entire photo library with original filenames — while the phone screen keeps playing videos, leaving the user unaware. CEO Qasim Mithani says the chain reached anything TikTok itself could reach: camera, microphone, payment information, photos, the whole account. Takeaway: an app's permissions are never just the app's permissions — they belong to whoever gets inside the app.
Related event: Critical TikTok Flaw Let Attackers Access Camera, Mic and Payment Data(4 posts)→
More from Safety
- Anthropic says it may imminently hit RSP threshold for AI-accelerated R&D, releases provable inference work — tobyordoxford · 2026-11-04
- Hackers reset French blood service freezers from -30°C to 110°C in supply-chain cyberattack — LuizaJarovsky · 2026-11-04
- Google says it removed post-employment non-disparagement clauses from new-hire terms — HaydnBelfield · 2026-11-04
- Claude doesn't really forget: Anthropic's privacy policy allows records retention up to 7 years — nikola_mr64990 · 2026-11-04
- Polymarket opens a market on Anthropic's next AI sandbox escape — Polymarket · 2026-11-04
- Rival company blames 'AI gone off the rails' after founder catches it hacking his network — AccBalanced · 2026-11-04