Viktor Markopoulos

Viktor is an acclaimed security researcher who always has his finger to the pulse when it comes to AI incidents and breaches. Here at FireTail, he helps us catalog and analyze all the latest developments in cybersecurity.

Articles by

Browse all articles

October 6, 2025

Ghosts in the Machine: ASCII Smuggling across Various LLMs

Researcher Viktor Markopoulos discovers ASCII Smuggling bypasses human audit via Unicode, enabling enterprise identity spoofing and data poisoning on Gemini & Grok.



June 29, 2025

OneLogin, More Problems

OneLogin, a popular identity and access management platform, had vulnerabilities that exposed user credentials. Through simple probing, researchers were able to access a host of sensitive data…



February 8, 2024

Leaky Spoutible API Exposes User Data: What Went Wrong?

At FireTail, we usually say that two or more things need to go wrong in order for attackers to be successful. So what went wrong with Spoutible's leaky API? Basically, everything.



December 22, 2023

The worst API ever?

As we approach the end of the year, it's often the case that we look back and chat with colleagues about the highs and lows of the last twelve months. One such friend recently shared a story with us about the worst API they found in the wild during 2023. Could this be the worst API ever?



December 18, 2023

Disclosure: Remote Data Service

Various APIs belonging to a data service are leaking their Git repositories, at a backend API which contain the APIs' source code.



November 16, 2023

Disclosure: Financial Application

Unauthorized users could gain access to sensitive financial information via an application's API using the data leaked via Github.



September 24, 2023

Disclosure: European Shipping Company

FireTail researcher Viktor Markopoulos discovered a vulnerability in a European Shipping Company’s APIs that allowed him to download internal files without authentication.



September 6, 2023

Unlimited airline miles courtesy of Points.com’s insecure APIs

Poorly secured APIs at Points.com resulted in serious vulnerabilities that could have exposed the loyalty programs of some of the world’s best-known airlines and hospitality brands.



September 1, 2023

Moovit API Vulnerability - letting attackers move free of charge

During Defcon, a security researcher presented his findings from assessing a global transportation system, leveraging APIs.



August 25, 2023

moveIT - a series of breaches, all enabled by APIs

A file transfer software called moveIT experienced a vulnerability starting in mid-2023 that created a mass breach across many organizations and geographies. The breach is started by injection against an API administrative endpoint, and data is exfiltrated via administrative API calls.

