Aikido found a dozen live GitLab 'email work item' addresses in public docs, each carrying a long-lived token that lets any mailbox act as its owner. GitLab calls it intended behavior, so maintainers must pull the address and reset the token.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 52%
- Investor
- Investor 5%
Reality
- Evidence68
- Adoption28
- Hype gap+10
- Incentives52
- Confidence60
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+12
- Incentives62
- Confidence61
Aikido says the pair, both in their early 20s, ran TeamPCP's npm supply chain campaigns with a worm they cloned from Shai-Hulud. Whoever wrote the original is still unidentified, and the code is still published.
Reality
- Evidence41
- Adoption44
- Hype gap−6
- Incentives63
- Confidence45
Aikido Security says a Blueprint audio node exposed to community maps accepted any file path, letting a lobby host's map plant files on every player's machine. The maintainers fixed it in the 4.0.0 update.
Reality
- Evidence62
- Adoption48
- Hype gap+14
- Incentives66
- Confidence57
Nvidia says the Hub will stay accelerator-agnostic and that its own compute will never be required, a claim that cannot be checked against behaviour until well after a close expected in the first half of 2027.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+22
- Incentives74
- Confidence56
The booking software's cancel endpoint never checked who owned the reservation, so an assistant acting for one member erased another member's place and could not restore it. That exposure belongs to the product team.
Reality
- Evidence74
- Adoption55
- Hype gap+12
- Incentives58
- Confidence70
Aikido rebuilt the Australian gym-booking flaws in a lab. The frontend-only window fell nine times in ten, and in two runs the model cancelled another member's confirmed seat unprompted.
Reality
- Evidence58
- Adoption45
- Hype gap+25
- Incentives65
- Confidence55
Portable Computer runs the agent's control plane on device and charges only when a task goes to the cloud. The part that decides when that happens is also the part nobody has priced or locked down.
Reality
- Evidence42
- Adoption12
- Hype gap+34
- Incentives68
- Confidence45
The poisoned keyv releases were signed by GitHub Actions and the attestation was accurate. It certified a build whose source had already been taken over.
Reality
- Evidence34
- Adoption46
- Hype gap+18
- Incentives76
- Confidence41