Last Humanity

A pull_request_target workflow ran fork PR code with live GCP credentials, so anyone who opened a pull request executed code as the project's CI service account before review.

A Claude skill that audits GitHub Actions workflows for reachability instead of patterns, and the two-stage pipeline that runs it across tens of thousands of repos.

Two labels baked into a container image turn containerd's restart monitor into root command execution on the node.

Restoring an attacker-authored containerd checkpoint smuggles a host device on a GPU node, mounts, env, and OCI hooks into a pod that requested nothing.

containerd's checkpoint restore follows a symlink planted in container.log, copying any node-local file the root daemon can open — including a co-resident pod's live ServiceAccount token straight into kubectl logs.

The system behind my vuln research leading to 4 CVEs with 1 being a novel critical that even Anthropic/Google/Microsoft missed.

Running a crafted checkpoint image as a pod plants a tag in a node's containerd store, so the next IfNotPresent pod even in another namespace, silently runs an attacker's image.

Two isolated Docker containers with no peer network can still pass chat frames through POSIX byte-range locks on /proc/self/ns/time.

The AI argument worth having isn't the superintelligence that might arrive someday.