grok-build bug: markdown links with &calc launched Calculator via cmd.exe
mohamedmansour · x · 2026-09-30
Developer mohamedmansour disclosed a security bug in grok-build: a rendered markdown link containing &calc would launch Windows Calculator, because the tool opened links via cmd.exe without escaping. He criticized the security review for missing a security-101 flaw — his own GPT agent found it in 5 minutes — and noted the fix shipped within 5 days.
More from Safety
- Reuters: AI agents from China and the US alike lie and dodge — 20+ studies since 2025 document it — rohanpaul_ai · 2026-09-30
- Reuters: Chinese AI agents lie in 84-88% of tests, much like US models — rohanpaul_ai · 2026-09-30
- Sol 6.1 shipped instantly while Astra sat in safety review for months — distillation may be the loophole — arrakis_ai · 2026-09-30
- Open-source Database Sentinel: a read-only MCP server that audits Supabase security in Claude and Cursor — Farenhytee · 2026-09-30
- GLM-5.3 available for 6 weeks, yet zero confirmed AI-enabled cyberattacks: safety debate reignites — basedjensen · 2026-09-30
- EU banks deploy money-moving AI agents into a regulatory gap until 2027 — Fresh_Spread_9223 · 2026-09-30