Discussion
Honestly, it's pretty disappointing to see responsible disclosure fail like this. It takes a lot of effort to release a critical patch.
Leaking the announcement or publishing a PoC before a scheduled patch shows you have no ethics and are only interested in credit for yourself.
@ian I haven't seen a full PoC for everything, but even releasing those details is unethical. What he found may even be completed unrelated. All it's doing is further the potential misinformation and uncertainty.
@valorin oh, absolutely agree that the session upload thing is a massive FUD bomb and unethical and such. Also probably inevitable that someone would pull that BS, just a question of who. The good side of the double edged sword is it's a bit easier for folks to analyze the exploit and say nope than before, as long as you can pick an LLM that doesn't cyber-refuse you.
Install Fedizen
Get the full app experience
@valorin Did someone actually do a real PoC? The session upload one is fake from what I can tell; if I throw GLM Flash and DSV4.1F at it and they can't repro then that PoC isn't for the CVSS 10-ish.