孙孙永瑞intoolkit-ai-reviews.hashnode.dev·3d ago · 5 min readBefore You Grant an AI Agent Access: A Practical OAuth Scope AuditMeta released **Muse**, a personal AI agent that asks for access to your email, calendars, payments and health data in order to do things for you — selling a car, booking travel. It competes with agen00
孙孙永瑞intoolkit-ai-reviews.hashnode.dev·3d ago · 4 min read219,665 Records Through One API Endpoint: Broken Object-Level Authorization in ProductionGangnam Unni is a South Korean platform that connects people with cosmetic surgery clinics. On **September 4, 2026**, an API used to look up consultation records was accessed abnormally. The operator,00
孙孙永瑞intoolkit-ai-reviews.hashnode.dev·3d ago · 5 min readHow 474 Microsoft 365 Sessions Beat MFA: Inside an Evilginx2 Relay OperationMost of us still think of MFA as the control that stops phishing. It isn't, and hasn't been for years. What MFA stops is *reuse* — someone taking your password and logging in later. What it does not s00
