NVIDIA NemoClaw
Open-source AI
Medium 3
File and path safetyObject integrityNetwork request security
Impact proxy: Data confidentiality · Application integrity · Platform resilience · Transaction and trust integrity
CompletedFailSafe Research Initiative
Project
GlassBreak
Project GlassBreak is FailSafe's public-good responsible disclosure program. We identify vulnerabilities across open-source repositories and public-facing systems, report them responsibly, and contribute fixes upstream where possible.
Our aim is straightforward: make the software everyone builds on safer, protect the organizations people rely on, and give back to the community.
77
Organizations and projects
180+
Findings disclosed
0
Exploit instructions on this page
Our approach
Share what helps. Withhold what harms.
GlassBreak gives back to the open-source community through responsible reports and upstream fixes. The program also covers coordinated disclosures made privately to organizations.
We coordinate timing with maintainers and affected teams. Private disclosures receive public-safe summaries; open-source entries are grouped into simple program-level statuses, with linked upstream records serving as the detailed source of truth.
Disclosure process
How it works
A remediation-first process from discovery to a safe public record.
- 01
Identify
We identify security weaknesses in open-source repositories and public-facing systems.
- 02
Notify
We notify the security or engineering team directly with full details.
- 03
Remediate
We support maintainers and affected teams as they validate and fix the issue.
- 04
Publish
We record a public-safe summary or link the upstream contribution when appropriate.
GlassBreak registry
Responsible disclosures
Summaries are deliberately limited to information that cannot be used to reproduce or exploit a finding.
Publication note: Research areas are intentionally broad. Our summaries omit affected systems, exploit paths, personal data types, credentials, and other details that could increase risk. Public open-source entries link to their upstream records. Inclusion is not a commercial relationship or endorsement.
77 resultsPage 1 / 6
| Organization | Sector | Findings | Severity | Finding types | Impact proxy | Status |
|---|---|---|---|---|---|---|
| NVIDIA NemoClaw | Open-source AI | 3 | Medium 3 | File and path safety · Object integrity · Network request security | Data confidentiality · Application integrity · Platform resilience · Transaction and trust integrity | Completed |
| Grab KartaView | Open-source mapping | 13 | Critical 5High 8 | API access control · Data protection · Cloud and network security · Identity and session security | Data confidentiality · Account and access security · Application integrity · Platform resilience | In progress |
| IBM MCP Context Forge | AI infrastructure | 1 | High 1 | Secrets policy | Account and access security | In progress |
| Bristol Myers Squibb | Pharmaceuticals | 1 | Critical 1 | Infrastructure and dependency security | Platform resilience | Disclosed |
| MUFG | Banking | 3 | High 2Medium 1 | Identity and access · Application logic | Account and access security · Application integrity | Disclosed |
| Deutsche Bank | Banking | 2 | Critical 1High 1 | Data protection · Infrastructure security | Data confidentiality · Platform resilience | Disclosed |
| Zurich Insurance | Insurance | 1 | High 1 | Identity and access | Account and access security | Disclosed |
| Swiss Re | Reinsurance | 2 | High 2 | Application data protection · Identity security | Data confidentiality · Account and access security · Application integrity | Remediated |
| Liberty Mutual | Insurance | 1 | High 1 | Identity and web security | Account and access security · Application integrity | Disclosed |
| ICICI Lombard | Insurance | 5 | Critical 1High 4 | Data protection · Secrets and access control | Data confidentiality · Account and access security | Remediated |
| HDFC ERGO | Insurance | 5 | Critical 4High 1 | Data protection · API and infrastructure security | Data confidentiality · Application integrity · Platform resilience | Disclosed |
| Sun Pharma | Pharmaceuticals | 3 | Critical 1High 2 | Secrets management · Data protection | Data confidentiality · Account and access security | Disclosed |
| Dr. Reddy's | Pharmaceuticals | 2 | Critical 1High 1 | Data access control · Web application security | Data confidentiality · Account and access security · Application integrity | Disclosed |
| Vercel | Developer infrastructure | 1 | High 1 | Request routing · Execution safeguards | Application integrity | In progress |
| Supabase MCP | Developer infrastructure | 1 | Medium 1 | Resource limits · Availability | Platform resilience · Service resilience | In progress |
3 findings
Grab KartaView
Open-source mapping
Critical 5High 8
API access controlData protectionCloud and network securityIdentity and session security
Impact proxy: Data confidentiality · Account and access security · Application integrity · Platform resilience
In progressIBM MCP Context Forge
AI infrastructure
High 1
Secrets policy
Impact proxy: Account and access security
In progressBristol Myers Squibb
Pharmaceuticals
Critical 1
Infrastructure and dependency security
Impact proxy: Platform resilience
DisclosedMUFG
Banking
High 2Medium 1
Identity and accessApplication logic
Impact proxy: Account and access security · Application integrity
DisclosedDeutsche Bank
Banking
Critical 1High 1
Data protectionInfrastructure security
Impact proxy: Data confidentiality · Platform resilience
DisclosedZurich Insurance
Insurance
High 1
Identity and access
Impact proxy: Account and access security
DisclosedSwiss Re
Reinsurance
High 2
Application data protectionIdentity security
Impact proxy: Data confidentiality · Account and access security · Application integrity
RemediatedLiberty Mutual
Insurance
High 1
Identity and web security
Impact proxy: Account and access security · Application integrity
DisclosedICICI Lombard
Insurance
Critical 1High 4
Data protectionSecrets and access control
Impact proxy: Data confidentiality · Account and access security
RemediatedHDFC ERGO
Insurance
Critical 4High 1
Data protectionAPI and infrastructure security
Impact proxy: Data confidentiality · Application integrity · Platform resilience
DisclosedSun Pharma
Pharmaceuticals
Critical 1High 2
Secrets managementData protection
Impact proxy: Data confidentiality · Account and access security
DisclosedDr. Reddy's
Pharmaceuticals
Critical 1High 1
Data access controlWeb application security
Impact proxy: Data confidentiality · Account and access security · Application integrity
DisclosedVercel
Developer infrastructure
High 1
Request routingExecution safeguards
Impact proxy: Application integrity
In progressSupabase MCP
Developer infrastructure
Medium 1
Resource limitsAvailability
Impact proxy: Platform resilience · Service resilience
In progressContact GlassBreak
If your organization or project has received a GlassBreak disclosure and you'd like to coordinate remediation, update a listing, or request removal, contact our security team.
[email protected]Questions & answers
Frequently asked questions
How GlassBreak coordinates, publishes, and maintains responsible disclosures.
Project GlassBreak is FailSafe's public-good responsible-disclosure program for open-source repositories and public-facing systems.
GlassBreak identifies a security weakness, notifies the relevant maintainers or security team privately, supports remediation, and publishes a safe record when appropriate.
No. Private disclosure summaries deliberately omit affected systems, exploit paths, personal data types, credentials, and other details that could increase risk.
The registry uses four program-level statuses: Remediated for confirmed fixes, Completed for concluded upstream work, In progress for active upstream review, and Disclosed when a safe public record exists without a confirmed remediation outcome.
Contact [email protected] to coordinate remediation, correct a listing, or request removal from the public registry.