Zero-click RCE in Telegram Desktop: pressing /start on a bot can hack you
zebird0 · x · 2026-11-12
RouterHub reports a user was hacked by a single Telegram message after pressing /start on a bot — no link, no tap, no mini app. Analysis with their abliterated models confirmed zero-click remote code execution in Telegram Desktop. Users are advised to avoid interacting with any Telegram bots until patched.
More from Safety
- HF staffer clarifies: uncensored/abliterated models stay, only cyberattack models get pulled — mervenoyann · 2026-11-12
- Think tank funded by Anthropic, OpenAI and Google urges UK to loosen copyright for AI training — TuhinChakr · 2026-11-12
- Economist on AI plagiarism dispute: an innocent author would publish their Google Doc history — paulnovosad · 2026-11-12
- Claude suspends user over age suspicion, demands photo ID or face scan to restore — Solid_Bid_8624 · 2026-11-12
- Hugging Face, which Nvidia agreed to acquire, hosts models usable for cyber attacks — natolambert · 2026-11-12
- Analyst: RASA bill unlikely to crash GPU rental prices but will hit 2027 compute demand — zephyr_z9 · 2026-11-12