this entire situation being blamed on "an agent that went off the rails" is crazy to me, even if it's right.
that isn't a valid excuse to remove responsibility. you are violating many laws
also good chance they used the cyber access they got for incident response on this
i think this might've been the dumbest take i've seen all year
i get ai slop vulnerabilities are exhausting (and i think they are extremely bad) but what the fuck
now that the site is down, i'd like to add a few things:
- any users email/dob could initially be got by id (found by @Patrosi73)
- any users email/dob could be gotten by username (was working until the site went down)
- claude detailed everything in their admin panel