AI Weekly Malaysia

A technical glitch in OpenAI's Trusted Access for Cyber (TAC) program revoked previously approved status from vetted security researchers, removing their Daybreak Blue access tier from Codex Desktop and CLI. OpenAI told affected users to reverify via email, but some who followed the instructions were told their accounts were ineligible—and support could neither reset the verification state nor restore the prior approval.

Why: If you rely on vendor-gated access tiers (like OpenAI's Daybreak Blue or Anthropic's comparable Cyber Verification Program) for security work, this shows that approved status can vanish without warning and the recovery path can fail silently. Builders doing cyber research on OpenAI tooling should not assume their vetted access is durable—keep local documentation of your approval and have fallback workflows that don't depend on a single vendor's privileged tier.

A 22-year-old researcher going by 'Zerotistic' enrolled a Linux machine into Apple's Find My network by reverse-engineering Apple's GrandSlam authentication and Identity Services (IDS) device certificate enrollment process. The key discovery was that Apple's legacy authenticateDS endpoint requires a PKCS#10 CSR with a 2048-bit RSA key signed using SHA-1, bundled in compressed XML. This allowed the Linux device to receive people-location data via Apple Push Notification service (APNs) that Apple normally reserves for its own hardware.

Why: This is a clever protocol reverse-engineering write-up, not an exploit that tracks arbitrary users—it only retrieves location data already shared with the researcher's own Apple account. For builders, the practical takeaway is that Apple's device enrollment still relies on legacy endpoints with weak SHA-1 signatures, which is notable if you work with Apple ecosystem integrations or are assessing the security posture of Apple's identity services. Most developers and founders won't need to change anything based on this.