Unverified50% confidenceFactExact time
In the honeypot session replay, actions such as the attacker attempting to change the password, executing the id command, and continuing operations as root all occur inside the honeypot and never touch the real server.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/29/2026
First Seen
Valid until: 1/27/2027
Sources
Turning AI Intruders Against Themselves: A Hands-On Look at AgentCapture
bilibili把爱留在61810/29/2026
Related Entities
Related Claims
Unverified攻击者获取refresh_token后即可持续刷新获得新访问权限，即便用户修改密码，已泄露Token在过期前仍可被持续滥用，这称为会话劫持64% similarUnverifiedThe vulnerability resides in the processing logic of Cisco AsyncOS for inbound emails; due to a lack of input sanitization, an attacker can execute code and gain root privileges by sending an email.64% similarUnverifiedDouble extortion involves exfiltrating data to attacker-controlled servers before encrypting the victim's files.63% similarUnverified一旦Token被第三方获取，攻击者即可完全模拟合法用户的操作，这称为「会话劫持」（Session Hijacking）63% similarUnverifiedWhen a maintainer's account is compromised, attackers may plant malicious code in the project and distribute it to all downstream users through subsequent updates.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1112995API
curl https://kongchang.com/api/v1/knowledge/claims/1112995MCP
get_claim(id=1112995)