Naravel
Subscribe

Daily Brief

Each morning, the Narratives and links that matter to engineers, on one page. Newest first.

All Daily Briefs

A sandbox escape in ChatGPT's HTML preview let a shared link run JavaScript in a signed-in session and exfiltrate private chats, fixed after an October 18 report. Epoch AI showed GLM 5.3 turning published Firefox fixes into working exploits for about $1,000 in API fees each, and a backdoored Claude Code extension sat in Cursor's marketplace for 11-12 hours. Google's Gemini 4 Carbon leads benchmarks for finding, exploiting and patching vulnerabilities, and CrowdStrike ties a China-linked campaign against 200+ organizations in 11 days to the DeepSeek model. Both describe AI doing security work at machine speed, one defensive and one offensive. Google put Gemini 4 Carbon on top of the Artificial Analysis Intelligence Index two weeks after Argon, and restricted it to selected security experts; separately, an unreleased Anthropic model chained flaws into working exploits across Chrome, Safari, Windows and Linux, all patched. Anthropic's S-1 puts $11.6B Q2 revenue and $780–810B of compute commitments on the record, and OpenAI's GPT-6.1 Terra halves mid-tier API prices. eMudhra's intermediate CA keys are exposed, so forged TLS certificates are possible until every trust store blocks them. OpenAI cut API prices up to 90% to pull Anthropic's enterprise customers, and Anthropic now argues a single agent with on-demand context beats a fleet of subagents. .NET shipped out-of-band fixes for a Brotli decoder buffer overflow and a Linux tarball ownership flaw. A Brotli decoder bug forces every product that embeds the C library to patch its own copy, and a leaked LiteLLM master key that was never revoked let an attacker push a malicious PyPI release. OpenAI closing round above $1T valuation; 1Password adds agent authentication. Also today: Block's Dessa is a full-duplex speech model trained only on human conversation, and 4 more stories. Two independent discoveries of PHP vulnerabilities affecting most of the web, disclosed after a two-month coordinated response. Separately, eight compromised eMudhra intermediate CA keys allow unauthorized TLS signing. Recursive releases Flint, a laptop coding model built largely by its Eureka Machine. Also today: Walmart opens an MCP server for agent purchases as Amazon blocks them, and 2 more stories. Two read-today items concern credential theft in developer tooling: a backdoored 7B model exfiltrated project credentials through OpenAI's Codex CLI once a hidden trigger appeared, and GhostAction now carries a VS Code-triggered stealer disguised as a font file, with 94 repositories… Broadcom's WPS flaw lets an unauthenticated attacker within WiFi range leak memory and run code on millions of routers, and Broadcom has declined to assign a CVE.