topic 1One link to a ChatGPT conversation could expose another person's account
Parameter researchers made a public ChatGPT conversation that ran their JavaScript in the session of any person who opened it.
The code ran as chatgpt.com. It read the list of conversations of the victim, took the text of a private conversation and sent data to an external server. In the worst variant, the victim only opened the link, and the code ran after about 4.5 seconds.
The Preview itself stayed isolated. The hole came from MathLive, a library that ChatGPT loads into the main page for graphs. MathLive accepted postMessage messages from any window and put the received HTML into the page through innerHTML. Thus, a Preview could make an iframe without a sandbox in the main page. The CSP policy blocked inline scripts, but it allowed YouTube. The YouTube oEmbed endpoint returned the text of the callback parameter as executable JavaScript.
Parameter sent the report on 18.10. OpenAI first rated it P2, then raised it to P1, and on 26.10 confirmed the fix on both versions of the site. Willison writes that the bounty was $5,000, and he thinks that this is too low for such a vulnerability.
Why it matters: each part of the chain looked reasonable alone. The danger appeared only where the features met, so a check of each feature alone does not show it. Chat history now holds code, contracts and keys. Thus, one XSS in an AI chat costs more than on a usual site. Teams that show generated HTML must check the third-party libraries in the main page, especially postMessage handlers.
topic 2The VOLTA stealer asks an LLM how much a victim is worth
[single source] Talos describes a Windows stealer that deletes itself. It takes browser passwords, cookies, cards, wallet seed phrases, Discord and Telegram sessions, and SSH and cloud keys. Then it uses the stolen sessions. It searches Gmail for receipts to confirm a home address, and it takes UberEats and DoorDash order history.
The new part is the last step. VOLTA sends the collected dossier to OpenRouter with a request for a "target assessment". The required sections are "WHAT THEY'RE WORTH" and "THEIR OPSEC". The default model in the code is anthropic/claude-opus-4.6. If the answer has "I can't"
or "I'm not able", the stealer moves down a chain: kimi-k2, then gemini-2.5-flash. The request goes through the network of the victim, so the attacker has no infrastructure of their own.
The code has six replaceable slots for keys and a Telegram channel. Talos concludes that the author sells a builder, and that each buyer gets a separate build. In that case, the victim assessment is a ready feature for a buyer of any skill level.
Why it matters: the LLM here replaces the analyst who reads thousands of logs. A move to another model after a refusal costs one if, so the protection of one model does not stop such a pipeline. Talos advises teams to restrict how Chrome starts with no window, because the stealer uses that mode to bypass cookie encryption. After an infection, replace tokens and passwords, and treat the wallet as lost.
topic 3Linux CVE-2026-98432: Red Hat raises the score to 9.8, and Ubuntu and RHEL still have no fix
Yesterday this digest wrote that Go turns on MPTCP by default, and that this makes the attack surface larger. Now there is a full picture.
On 30.10 Red Hat raised its score from Important (8.1) to Critical (9.8). On the evening of 31.10 US time, the Ubuntu tracker shows "Vulnerable"
for all releases, and RHEL 8, 9 and 10 have no fix. Debian, SUSE, Oracle UEK and Amazon Linux already fixed their kernels. AlmaLinux keeps its fix in a test repository.
Red Hat and AlmaLinux gave an nftables rule that drops TCP packets with IPv4 options. Red Hat writes that the rule reduces the risk but does not stop it fully. AlmaLinux warns that traffic between containers on one host can bypass the rule. The bug goes back to kernel 4.4. A container uses the kernel of the host, so a new image changes nothing.
Atlas counted 36 GitHub repositories that mention this CVE. At least six claim to contain a race trigger or a proof of concept. Atlas did not test them. The CVE was not in the CISA KEV catalog at that time.
Why it matters: the fix in the main kernel came on 11-15.10, and the largest enterprise distributions still wait two weeks later. In that time, claimed proofs of concept appeared on GitHub. The command ss -Mlnp shows if a server has an MPTCP listener. Go services built with 1.24 or newer have it by default.
topic 4Jepsen on ParticleDB: a database for agents, built with LLMs, fails even at WHERE
Orkes built ParticleDB in Rust for its Conductor service and sells it with a focus on AI agents. The site said "Full ACID. 159K TPS" and "formally proven" with a TLA+ proof. During the work with Jepsen, no TLA+ specification was available.
Jepsen tested one node, often with one client and with no injected faults. WHERE 4 = 5 returned rows with primary key 5, and WHERE TRUE found nothing. NOT NULL and UNIQUE constraints did nothing. Primary keys became duplicates and NULL. The server deadlocked or crashed every few minutes. Each transaction mode showed almost all anomalies that the tests can find. The last version, 1.1.18.11.rc-22, was much safer, but the default mode still lost data. After the tests, Orkes called these modes "experimental" in its documentation.
The most useful section of the Jepsen report is about LLMs. A team of a few engineers made a system of this size very fast. But the LLM tools repeatedly claimed fixes that did not exist. Orkes could not explain the cause of nearly every bug, and new builds came with no changelog.
Why it matters: the size of code and documentation was a sign of a mature project. Jepsen writes that this sign is now easy to fake. For a database, one reliable check remains: independent tests of what the system really guarantees. A claim of a formal proof with no published specification proves nothing.
topic 5The credit squeeze reaches neoclouds and tokens
Yesterday this digest wrote about the limit of outside money for OpenAI and Anthropic. The BBC shows the next level: neoclouds, the companies that rent out compute. CoreWeave has $35.1 billion of debt, and its shares lost a quarter in a month. Nebius, IREN and Applied Digital fell about the same or more.
Gartner predicts that 80% of these firms will lose independence by 2030. US Treasury Secretary Scott Bessent calls them "a small component of the overall ecosystem".
Evan Conrad of SF Compute describes how this looks from below. He says that compute buyers must prepay nearly 100%, because neither they nor the cloud count as reliable borrowers. Then the problem reaches tokens: a provider looks for prepayment from customers. A Fortune 500 company buys tokens on credit, and a startup must raise capital. Conrad sells a solution to this problem, so read his view with that in mind.
The WSJ adds that investors look for insurance against a fall of the AI bet. The text is behind a paywall, and only the start is available.
Why it matters: the advantage of a startup was speed. If an agent does the work and tokens are bought on credit, a large company gets an advantage in the cost of money.
Teams that build on other companies' models must count the token price and also the ability of the supplier to carry its debt.
topic 6Binance: the FBI confirms North Korea, and a co-CEO admits mistakes
Yesterday this digest wrote about the attribution from TRM and Chainalysis. Now the NYT writes that the FBI confirmed their findings about the TraderTraitor group. The FT puts this in its headline. How the attackers got past the defenses is still unclear, the NYT writes. TRM thinks that access to the hot wallet signing system is likely, the BBC writes.
The NYT rebuilt that night from four people. At 16:20 on Thursday, strange transactions started, and about 100 people joined the internal chat. Co-CEO He Yi said in a video: "We should have invested in security much earlier and more extensively." Binance set aside $6.34 billion to cover losses. He Yi writes that revenue for the year is sufficient.
The size of the company reserves is not public.
Tether and Circle froze more than $2 billion together. World Liberty, the crypto company of the Trump family, froze $27 million. TRM still counts $2.4 billion as out of reach. Changpeng Zhao meanwhile argued on X with Elon Musk and noted that Binance holds more than $1 billion of SpaceX shares.
Why it matters: stablecoin issuers, who can freeze a coin with one decision, stopped the largest sum. This power goes against the promise of independent crypto, but it worked here. The claim of He Yi about AI as a threat to the industry has no published evidence for this hack so far.
topic 7Claude restricts game reverse engineering, and users also complain about model training
Yesterday the misc section had a server rule about the reproduction of existing games. Mashable, with a reference to Tom's Hardware, writes about a wider change: Claude started to restrict modding, decompilation and reverse engineering of game code. There is no official announcement. The restrictions also affect normal game developers. Mashable connects this with browser ports of GTA and Call of Duty and with the PS5 jailbreak.
One user told the second story. Jiahao Shao writes that the system flagged him for "training a competitor", although he did not distill Claude. He says that any mention of RFT, SFT or training of larger models now gives a block, a downgrade from Opus 5.5 to Opus 5, or a closed session. The post got 168,000 views.
Part of HN has doubts. One commenter writes that Shao is in Hong Kong, where Claude is not available, so a VPN and training work together could trigger a classifier. Another says that he trains BERT models with Claude with no problem. These claims cannot be verified, and Anthropic did not comment on them.
Why it matters: a classifier sees the topic and does not see the intent. A team that depends on one supplier can lose functions with no announcement and no changelog. For critical tasks, keep a backup model and your own test set, which shows such a change on the day it appears.
topic 8AI tax in Germany: ministers disagree, and no bill exists
Yesterday this digest wrote about the French amendment of 0.055 euro per gigabyte. In one day, X joined it with the German debate into a story about Europe out of money. The post by @levelsio got 2.2 million views. Readers added a correction: the French rule is not law yet, and no formal German proposal exists.
Tagesschau gives the details. Digital Minister Karsten Wildberger called for a tax on "extremely high revenue" from AI, then partly stepped back. Family Minister Karin Prien supports the tax. Economy Minister Katherina Reiche says to introduce AI first. Chancellor Friedrich Merz is sceptical, and the SPD is open to the discussion.
Manuel calculated the French rule on examples: €11.55 for one GTA 6 download, €0.77 for one football match in 4K. The sponsors' estimate of €10 billion per year has no published calculation so far.
Why it matters: the argument of Nic Carter is more interesting than the taxes themselves. Europe collects its budget mainly from labor. If a foreign model replaces labor, the local tax base gets smaller, and the profit stays abroad.
He himself thinks that the scheme will probably not work. Any team that plans AI service costs in the EU must keep this logic in mind.
topic 9Karpathy built a YouTube from Hacker News recommendations in 2 hours
This was the top story of the day on HN, with 881 points. Karpathy got tired of YouTube recommendations and asked Opus 5.5 to make a replacement. The model downloaded HN comments, and Sonnet filtered out spam. The result was 40,000 comments and 6,454 videos from 2007-2026. The site shows a frame from the middle of a video in place of the thumbnail and keeps state only in the browser.
The work took about 2 hours. Karpathy made a Google API key, started a VPS and bought a domain with his own hands. He says that he no longer does traditional engineering. On the same day, Patrick Collison wrote that he adds an "improvements" field to all his personal apps: the text goes directly to an agent that implements it.
Why it matters: software for one reader no longer costs weeks. The price of a fix in a personal tool falls almost to zero. This works for such projects because a mistake costs little. The ParticleDB story above shows the other end of the same scale.
topic 10Five copies of Qwen3.8-27B beat one Fable 5 call on LiveCodeBench problems
[single source] The Memdoor authors repeated the method of the GVS5H paper: a planner, two ideators, a solver and a manager exchange only files. A script decides success, and the model has no say in it. On the first 10 LiveCodeBench Hard problems over 5 passes, the result was 9.8 of 10. The paper authors' own harness got 9.6, and Fable 5 alone got 8.0. All 50 runs cost $35.79, with a median of 40 minutes and $0.39 per run.
There are many limits, and the authors name them. This is 10 problems of 100. Fable 5 made one call per problem, so the comparison is not equal. The problems date from March and April 2025, so the model could see them in training. The manager damaged a correct solution twice: once it invented a counterexample, and once it did not end the loop.
Why it matters: the HN headline promises more than the data proves. The strong part is different: an external check and many cheap attempts can compensate for a weaker model where a script can measure success. Where no such test exists, this method does not transfer.