Security on Yongjie Xue

AGI Milestone: The Machine That Wouldn't Give Up

Wed, 22 Jul 2026 00:00:00 +0000

An OpenAI agent’s attack on Hugging Face marks a milestone: what crossed the threshold was not merely model intelligence, but persistence that can be bought with compute, copied, and run in parallel.

Xianyu, Qianwen, Alipay: Platform Trust 'Empowers' a Scam

Mon, 15 Jun 2026 00:00:00 +0000

Scammers hijacked Qianwen’s trusted identity, then used a single Xianyu QR code to run a seamless phishing scam through official apps and trusted domains across Alibaba’s ecosystem. I hope this case helps more people avoid the same trap.

Two months into maintaining a MinIO fork

Fri, 17 Apr 2026 00:00:00 +0000

Two months after forking MinIO, pgsty/minio ships patches for four CVEs and related security issues. No new features — just working builds, a restored console, and timely security fixes.

Meituan Deleted Users' Photos: Overbroad Permissions Are Worse Than a Privacy Leak

Tue, 24 Mar 2026 00:00:00 +0000

Many Android users reported that Meituan deleted files from their photo libraries. The bigger issue is not just this bug, but the still-common pattern of overbroad storage permissions in the Chinese Android ecosystem.

360 Shipped Its Wildcard TLS Private Key Inside a Public Installer

Mon, 16 Mar 2026 00:00:00 +0000

360’s newly released AI Agent product shipped a public installer containing the private key for its *.myclaw.360.cn wildcard certificate. Public verification and local reproduction also exposed inconsistencies in the OCSP revocation path.

OpenClaw Hype: Foam on Top of the Productivity Revolution

Mon, 09 Mar 2026 00:00:00 +0000

OpenClaw looks exciting because it turns agents into a chat-style experience. But the real productivity gains come from high-capability subscription agents and disciplined workflows, not from lobster-flavored wrappers.

Don't run AI assistant on cloud

Fri, 30 Jan 2026 00:00:00 +0000

Before you hit “one-click deploy” on that cloud AI assistant, ask yourself: what exactly are you giving up?

There’s a reason why people by Mac mini rather than running clawdbot on the cloud.

When AI Becomes Your Butler

Moltbot (formerly Clawdbot) just exploded on GitHub. Tens of thousands of stars in days. Mac Minis sold out.

CVE-2024-6387 SSH Vulnerability Fix

Thu, 04 Jul 2024 00:00:00 +0000

This vulnerability affects EL9, Ubuntu 22.04, Debian 12. Users should promptly update OpenSSH to fix this vulnerability.