Introduction Hi, everyone! My name is Mevlüt Akçam, aka mvlttt on huntr, and I'm excited to break down my discovery of a Server-Side Template Injection (SSTI) vulnerability in the /completions endpoint of...
How I Discovered a Server-Side Template Injection Vulnerability in berriai/litellm
Spotlight on PinkDraconian: From CTFs to huntr – A Hacker's Path
Intro At huntr, we love to celebrate the incredible talent working with us to build a safer AI powered world. Our community of over 15,000 hackers and threat researchers are constantly uncovering...
Spotlight on zpbrent: Uncovering AI Vulnerabilities with huntr
Introduction At huntr, we love to celebrate the incredible talent working with us to build a safer AI powered world. With over 15,000 hackers and threat researchers, our community is full of...
Account Hijacking and Internal Network Attacks in Kubeflow
Hacking AI/ML: Account Hijacking and Internal Network Attacks in Kubeflow Kubeflow Details Kubeflow, maintained by Google, is one of the most popular end-to-end machine learning workflow tools out today. Similar to AWS’s...
H2O Exposes Entire Filesystem
Hacking AI/ML: H2O Exposes Entire Filesystem What is H2O-3? H2O-3 is a low-code tool that abstracts away most of the details of creating a machine learning model. It is the most popular...
Advanced API Attacks in ChatGPT
Hacking AI/ML: Advanced API Attacks in ChatGPT Anomaly Hunting in Applications As usual, our investigation started with mapping out all the ChatGPT requests in Burp Suite before kicking off the automated scan...
MXNet Unsafe Pointer Usage
Hacking AI/ML: MXNet Unsafe Pointer Usage Note from Protect AI (acquired by Palo Alto Networks) Security researcher Sierra Haex, in collaboration with huntr's Threat Research team, discovered an interesting bug in MXnet,...