Cos(余弦)😶‍🌫️

🚨 AI is trading for you now. But is your money safe? Proud to collaborate with @bitget, @Bitget_zh on our latest research: #AI Agents> 🎉🎉 ⚠️ Prompt injection can hijack trading decisions 🔌Malicious plugins can steal your data & keys 🔑Leaked API = full account execution access 🤖One wrong autonomous action = real asset loss In #Web3, mistakes are irreversible. Protect your funds before it’s too late. We present a 5-layer security framework + practical checklists for users & devs. 🛡️ Dive in 👉 slowmist.medium.com/slowmist-bitge…

⚠️ Running an AI Agent like @openclaw with root/terminal access is powerful but inherently risky. How do we ensure controllable risk and auditable operations without sacrificing capability? Recently, we released the OpenClaw Security Practice Guide — a structured defense matrix designed for high-privilege autonomous agents running in Linux Root environments. cc @evilcos 📖GitHub Version: 👉github.com/slowmist/openc… 🛡️ 3-Tier Defense Matrix 🔹Pre-action — Behavior blacklists & strict Skill installation audit protocols (Anti-Supply Chain Poisoning) 🔹In-action — Permission narrowing & Cross-Skill Pre-flight Checks (Business Risk Control) 🔹Post-action — Nightly automated explicit audits (13 core metrics) & Brain Git disaster recovery 🛠️ Built around four core principles: • Zero-friction operations • High-risk requires confirmation • Explicit nightly auditing • Zero-Trust by default 🚀 Zero-Friction Flow: 1️⃣ Drop the guide directly into your #OpenClaw chat 2️⃣ Ask the Agent to evaluate reliability 3️⃣ Instruct it to deploy the full defense matrix 4️⃣ Use the Red Teaming Guide to simulate an attack and ensure the Agent correctly interrupts the operation 🚨 Honest limitation: this guide is intended for human operators and AI Agents with foundational Linux system administration capabilities, and is particularly designed for OpenClaw operating in high-privilege environments. As AI models and their underlying service environments vary, the security measures provided in this guide are for defensive reference only. Final responsibility always remains with the human operator. Please assess and execute cautiously based on your own environment and capabilities. 🤝 If you have new findings, lessons learned, or improvement suggestions from real-world deployment, we welcome you to share them with the community via Contributions, Issues, or Feature Requests. Special thanks to @leixing0309 for the professional contribution. As we continue unlocking #AI capability, may we remain vigilant and clear-headed about risk.🫡

Morelogin 指纹浏览器出事了，目前掏了6万刀 有资产的速度转移！这件事拜托余弦老师关注一下 @evilcos 黑客地址： 0x913efc2062984288a0a083cd42b3a3422c07fcef 围观：debank.com/profile/0x913e…

目前针对累积收集到的76 个用户的被盗反馈，进行分析。进展如下 1. 安装版本离散分布，通过对比客户使用的客户端版与官方客户端Hash ，结果无异常，排除客户端问题。 2. 88%的被盗用户（67 人）未开启插件同步，插件数据均保存在客户本地，排除数据存储服务器被入侵的可能。 我们已经跟 @SlowMist_Team 取得联系，目前正在一起联合调查，有进展会进一步更新。同时强烈建议大家不要在浏览器中存放大额加密货币。

不少人来问慢雾审计这款指纹浏览器的事，详细报告在这： github.com/slowmist/Knowl… 注意看报告里的审计日期是去年 10 月，审计的版本 macOS 及 Windows 都是 1.1.99，当时发现了 22 个安全问题基本处理了，分别在 1.2.1 及 1.2.2 修复。没有做白盒，做的是黑灰盒审计，所以一些可能的中心化风险难以发现，另外，后续版本是否有安全问题我们也没法验证。 安全是件严肃的事，我们不希望看到社区玩家这样的安全营销说法（官方也赞同我们这种态度）。我们对我们审计的版本及范围负责（具体可以阅读审计报告），但我们真没办法给这些朋友说：对对对，赶紧冲赶紧用，慢雾在，你们就放心吧！ 放心？在这个黑暗森林里，安全如履薄冰、如临深渊，我他娘的自己就没放心过任何事物…

文章揭露了武汉安隼科技团队利用OKX钱包插件漏洞实施的黑客攻击事件。该团队通过插件投毒技术控制大量用户终端，窃取助记词并远程转移数字资产，涉案金额达700万美金。文中详述了其作案手法：一是开发自动化工具快速分析海量助记词价值；二是破解跨设备数据还原机制，通过获取CPU特征值绕过密码验证。事件暴露出Web3钱包生态的安全隐患，提醒用户谨慎授权插件权限，定期更换助记词，并警惕异常登录行为。 @okxchinese @wallet @star_okx @TrustWallet 感觉怎么有点不想OK的事儿，是币安的事儿啊，供应链投毒，700w美金，时间线4个月前 @cz_binance @heyibinance 具体投稿人发布在公众号，有兴趣了解详情可查看mp.weixin.qq.com/s/D6v6w3XSgi4G…

🦞OpenClaw 极简安全实践指南 v2.8 Beta 出来了，数个独立 OpenClaw 来回测试了几百个小时，覆盖 Gemini/Opus/Kimi/MiniMax/GPT 等最新模型。 github.com/slowmist/openc… v2.8 Beta 先完全独立，包括对应给人类参考的巡检脚本。如果你感兴趣，可以尝鲜👀 ⚠️注意，用之前务必仔细阅读仓库的 README。