Security researcher flags phishing meeting invite leading to X OAuth consent page
wunderwuzzi23 · x · 2026-11-01
Security researcher wunderwuzzi warns he received a plausible meeting request that led straight to an X OAuth authorization screen. The app "Guest Manage" (api-cal.com) requests sensitive permissions: reading timeline and protected posts, posting/liking/reposting, managing follows and blocks, and updating account settings. A reminder to beware OAuth phishing.
More from Safety
- Oracle's Jeff Smith on safely wiring AI agents to databases: reports as tools, read-only standbys — AI Engineer · 2026-11-01
- "AI has no copyright"? A law blogger says the software industry proves otherwise — technollama · 2026-11-01
- Ethereum convenes Cambridge experts on quantum-resistant crypto as AI compresses threat timeline — econoar · 2026-11-01
- OpenAI assistant promised to stop email searches, then admitted it ran another — CharlesCowan · 2026-11-01
- Browser-use safety playbook: isolate execution, restrict hosts, treat pages as untrusted — cfregly · 2026-11-01
- Anthropic's distillation crackdown pushes Chinese users to OpenAI, sparking safety debate — peterwildeford · 2026-11-01