aeon ⭐

When the guardrail IS the bug 🔓 VulnScanning Ep.6: 3 safety checks that failed open, all found by Aeon, all patched. 00:19 @omnigent_ai: "allow" when confused (High) 02:13 @Opencodex: a buffer with no limit 03:16 @Capminal: a mint priced 74% too cheap (High) 05:12 6 patterns, one checklist

aeon is now listed on @OpenRouter! Your agent can pick from hundreds of models with one key while our app page on their website shows their usage live

What our scanner found on DeepTutor: in the default no-login mode, any website open in your browser could call the admin API, including a route that runs commands. Full report below ⤵️

What our scanner found on @QAwithIto's M()(): a booby-trapped base image could delete files on your machine the moment you ran moo new. Full report below ⤵️

What our scanner found on @mitsuhiko's Absurd repo: the Habitat dashboard had no login and listened on the whole network, so nearby machines or a web page could read and retry your tasks. Full report below ⤵️

A week in the @aeonframework trenches🧵 30th Oct --> 6th Nov - Aeon accepted in the @NEARProtocol's RED program - Founder's takes - October's grinding recap

Aeon got accepted into NEAR AI Red, the @NEARProtocol's new cybersecurity program. Private, uncensored security models running inside hardware enclaves and our powerful vuln scanner gets to hunt with them 👀

What our scanner found on @dlthub: a pipeline paging through an API could send your login credentials to whatever host the API's responses pointed at. Full report below ⤵️

"Is smart money accumulating token X/Y on @base?" Your Aeon agent can answer that now with our new Flovia skill: @nansen_ai + @coingecko + @zerion + chain reads, one connection, multiple info outputs!

We are shipping hard 🌟 Here are 25 things that launched and got announced in October!

"Is This Caller Allowed?" 🌟 Aeon VulnScanning Ep4 Three AI Tools that never asked for this question ⏱ Chapters 0:00 Intro: is this caller allowed? 00:19 HarnessRouter: cross-org connection hijack (Critical) 00:27 The bug 02:00 Agent Router: MCP session hijacking 02:17 The bug 03:37 CubeSandbox: host mount escapes the MicroVM 03:51 The bug 05:06 The pattern: authorization asked the wrong question Check the full advisories in the comments!

Listen to @aaronjmars on one of the biggest use cases for the Aeon software factory vision: onchain products. • Special Hooks built to push crypto innovation forward • Aeon Wayback, a database being trained on every innovation in crypto from the past 8 years • Agents that can build forks, launchpads, whatever they want • An auditing tool, so people can ship them safely While DeFi creativity and innovation is at its all time lows, we keep on grinding at the frontier!

If you have a minute, invest it in listening to both @aaronjmars talking agent futurism and some cool techno music at the same time! 🌟🎶 "I think in the future, the agent will build stuff for you before you even wake up, and you will have like more of a judge approach to software"

Opening a Web Page Was Enough to Hack These 3 AI Tools 👀 Aeon VulnScanning #3 0:20 OpenHuman 00:49 The Bug 2:18 LoopX: wildcard CORS reads local agent state 2:37 The bug 3:44 Maigret: stored XSS in OSINT reports 3:58 The bug 5:00 The pattern: the browser obeys attackers