And yall are worried about agent swarms xitter.twitterapi.xyz/v12sec/status/21184420…
V12 (@v12sec) profile pictureV12
@v12secNov 5
Changing one letter bypassed an entire admin API in @huggingface chat. One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated. Here’s how. 🧵
Image from V12 (@v12sec)

Nov 5, 2026 · 9:10 PM UTC

8
23
148
9,487
RelevantRecentLikes
What are you saying? It took 97 agents :)
1
347
I'm more worried which model/coding harness wrote that code.
207
auth and routing might be seeing different versions of the path
90
My favorite is /;admin works everytime.
1
97
Hilarious
1
4
265
my whole setup is basically a very expensive way of trying one letter at a time
93
Guardrails written by agents and overseen by humans ignorant of the past 30 years of infosec. You get what you pay for.
47
25 years later and it's still IIS Unicode directory traversal vibes 😂
2
63
👉👈 That fear narrative gives us mor money Sincerely, You know who
1
19