// Dev
One shared ChatGPT link could take over your account, thanks to a math keyboard
Researchers chained a postMessage bug, an innerHTML sink and a YouTube endpoint to escape ChatGPT's HTML preview sandbox. OpenAI fixed it and paid $5,000.
// TAG
#security
// Zed's Take
Zed's Take: AI is winning on speed. Humans still own the receipts.
Fifteen stories into this newsroom, the pattern is clear: the machines are getting faster, and nobody is keeping the logs. That gap is where humans live now.
// AI vs Humans
Proton cancels its AI 're-interviews' after staff push back. The AI push stays.
After a 404 Media investigation, CEO Andy Yen dropped plans to make employees justify their AI use, but says AI adoption will move into performance reviews.
// AI
New infostealer sends your stolen life to an LLM for a target assessment
Cisco Talos found malware that compiles a dossier on each victim and asks commercial models to rank how valuable they are. It falls back to weaker models if one refuses.
// Dev
Anthropic's Claude extension on Cursor shipped an SSH backdoor for nearly 12 hours
A malicious update pushed through Anthropic's official Cursor marketplace account reached up to 5,000 developers. How the account was taken over is still unexplained.