I Found Two Shopify Plugin Zero-Days in a Bathtub

I found two zero-days today. Two of the largest Shopify plugin developers affected. From a bathtub and running a slight fever.

OpenCode on the laptop, web interface on the phone, Z.ai’s GLM-5.3 Flash firing on all cylinders, water slowly going cold.

The secret prompt? One word: “ours.” Just basic vocabulary. But defensive!

A while back I reported that Anthropic’s Fable 5 was still willing to cybercrime with prompt engineering. This is the sequel and the thesis is worse: the prompt engineering isn’t even really required anymore.