Beware: downloaded ComfyUI workflows hide a cos_url that leaks output data
Actual_Pop_252 · reddit · 2026-10-15
A Redditor warns that ComfyUI workflow JSONs downloaded from the web may contain a hidden cosurl field inside the Video Helper Suite node, pointing to an external storage bucket (example: rh-hk-images.xiaoyaoyou.com on Tencent COS), exfiltrating output info when previewing video.
- The field is invisible in the node UI — you must preview the video or inspect the raw JSON to spot it
- The author advises checking workflow JSONs for cosurl and similar suspicious fields before running locally
- A practical supply-chain-style security heads-up for ComfyUI users
More from Safety
- Crime group used Claude, Grok and Kimi agents to attack 400+ banks in Latin America — anshulkundaje · 2026-10-23
- Greg Brockman: AI makes hacking 100x more profitable and easier, upending hacker economics — gabriel1 · 2026-10-23
- Account hacks surge: 6-step emergency checklist plus an AI audit prompt — petergyang · 2026-10-23
- For consumer AI founders, 'When are you launching in Europe?' is the new 'When Android?'—only 100x worse — omooretweets · 2026-10-23
- mmitchell_ai questions whether the AI safety vs security framing stems from EA — mmitchell_ai · 2026-10-23
- MPI-Sec PhD Thesis on Vulnerability Detection Benchmarks Includes Pre-LLM Classic "Top Score on the Wrong Exam" — mboehme_ · 2026-10-23