Burrito

@burritomanu.bsky.social

FOLLOW MY ART ALT @burritoart.bsky.social 26 | PFP by the amazing @zivnecromancy.bsky.social‬l | Banner by the incredible ‪@thenovika.bsky.social‬ | I draw my Sonicsona a lot, post relatively funny comments, and ocationally doodle sh*tposts

Okay a tiny thread because people are going to freak out: This exploit in particular takes advantage of a special command that renders images (via attribute escape). If you have an overlay that processes images (most don't) then yes, this is your problem. Overlay must explicitly create img DOM.

A picture of the exploit, using a command that explicitly includes an image file extension, but also would escape out of the src attribute of an image such than an onerror attribute can be added to the img tag. This onerror attribute can run explicit javascript immediately.

Default behavior for most chat widgets is if you have an image it will not attempt to modify image links into actual HTML image tags. Your overlay/overlay service must explicitly be doing this for you.

I've seen so many folks playing Aniimo lately, likely who aren't aware of the GenAI use in the game. Just a PSA that Aniimo DOES indeed include GenAI in both the promotional material and in game.

Duck AI Slop!!@duckaislop.bsky.social · 3mo ago

Aniimo Pawprint Studios. NO disclosure, claimed they didn't use any and you wouldn't find any in their game. Players found it and have been calling it out since 2025, "sketch art", promotional material and in-game. -y

Aniimo steam store image