Daily Roundup

A shared ChatGPT link could take over your account

A shared ChatGPT link could read private chats, Anthropic's Cursor extension was backdoored, and four AI companies back one robots.txt opt-out token.

Top Stories

A research team at Parameter Labs published a report on October 28 describing how they turned an ordinary public ChatGPT share into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. Their write-up says the payload could enumerate the victim’s conversation list, retrieve the contents of a private conversation that had never been shared with the attacker, and send that data to an attacker-controlled server. “OpenAI fixed the issue on October 26 and classified the report as P1,” the report says.

The chain started with two ChatGPT features that looked harmless on their own, an interactive graph and an HTML Preview. The graph loaded the MathLive math library, which installs a listener in the main ChatGPT page for messages about its on-screen virtual keyboard. The Preview frame sent postMessage commands to replace that keyboard layout, and MathLive’s listener accepted messages from any origin and wrote the supplied HTML into the main page with innerHTML. A helper called createHTML looked as though it might sanitise the value but did not, it marked the string as trusted and passed it through unchanged. That produced an <iframe srcdoc> with no sandbox attribute, which the browser gave the chatgpt.com origin. ChatGPT’s content security policy blocked inline scripts but allowed YouTube, so the researchers used YouTube’s oEmbed endpoint, which reflects a callback parameter back into JavaScript, to run their own code under the ChatGPT origin.

The victim did not need to install an app, join a project, paste code or open developer tools. Opening the shared link was the only required step. The report calls the result “a practical cross-user data-theft primitive”. Parameter Labs confirmed the MathLive path in production on October 13, reproduced the full chain through the normal interface on October 14, confirmed cross-account delivery on October 16, and submitted the report to OpenAI’s bug bounty program on October 18. OpenAI reproduced the issue on October 21 and raised the severity from P2 to P1, fixed one web frontend on October 22, blocked part of the chain with content security policy changes on October 23, and confirmed on October 26 that both frontends now rejected the cross-frame messages. The total bounty was $5,000. Simon Willison, who covered the disclosure on October 31, wrote that “OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious.”

Anthropic’s VS Code extension for Cursor was backdoored for nearly 12 hours

An official extension for Anthropic’s Claude model was backdoored, and Cursor says the malicious build affected at most 5,000 users, Ars Technica reports. The malicious build was version 2.1.313, distributed through Anthropic’s official account on Cursor’s extension marketplace, according to independent researcher Kevin Beaumont and security firm Phorian, and Phorian said it superseded 2.1.312. Cursor said the version affected “at most 5,000 users”, either people who downloaded it or systems that fetched it automatically. Anthropic shipped 2.1.314 several hours later. “It was a supply-chain compromise where the attacker gained access to the official distribution channel,” said Luke Roberts, CTO and co-founder of security firm Phorian.

Cursor said the malicious extension tried to install a persistent SSH backdoor by adding an attacker-controlled key to authorized_keys, enabling the local SSH service and opening a reverse SSH tunnel. The code was written for Windows, macOS and Linux, and because Cursor extensions run with the permissions of the IDE, a backdoored build could reach local files, source code and developer tooling. The malware also collected host and user information including hostname, username, OS, environment variable names, working directories and public IP, then reported host details and backdoor status over HTTP to /beacon on port 8099, with background scripts retrying the tunnel roughly every 60 seconds. Bugs in the Windows and macOS builds stopped the backdoor from working in some cases. Phorian said that despite the coding flaws, “the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator.”

Cursor said personnel worked with the cloud provider hosting the command-and-control server so infected devices could no longer reach it, removed the backdoored version and blocked further distribution, and briefly shut down the VS Code Marketplace to rotate keys, audit access controls and confirm no other extensions were compromised. The marketplace is open again. Ars Technica writes that “Anyone who installed or updated Anthropic’s VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected”, and notes it remains unclear why Anthropic had not publicly warned customers and why neither company has explained how the supply-chain compromise happened.

OpenAI, Google, Microsoft and Anthropic back one robots.txt token for AI opt-out

Four of the largest AI companies have agreed to honour a single opt-out signal for AI training, The Verge reports. The shared “policy token” was proposed by Kevin Kelley, a technical lead for standards at Anthropic, as part of the Internet Engineering Task Force. It lives inside a site’s robots.txt file, so a publisher states its AI training preference once instead of separately to each crawler, which is the same thing robots.txt has always done for search indexing.

The rollout is staggered. Anthropic has already adopted the signal, Google and Microsoft plan to support it next year, and OpenAI says it will implement it in the “coming months”. Meta’s communications head Andy Stone signalled support for the standard but did not say whether Meta would honour it: “We believe creating a common signal that conveys such preferences to multiple providers at once is an important step.” Microsoft separately said it will offer granular controls that let publishers separate opting out of AI training from opting out of grounding, and that sites will still appear in Bing’s search results regardless of their preference.

For site owners the token is worth setting now and worth not relying on for a while, because two of the four companies have not shipped and the fifth has not committed. Robots.txt is a request rather than an enforcement mechanism, which is the gap covered in How to Block AI Crawlers From Your Website. The token narrows that gap at the crawler’s discretion, not at yours.

An infostealer hands stolen data to Claude and asks what its victims are worth

Cisco Talos researchers have found an infostealer that uses AI models to profile and rank the people it steals from. WIRED reports on the malware, which the researchers named Volta-Autodoxer after how it refers to itself internally. It sweeps for browser passwords, Microsoft OAuth tokens, cookies, payment cards, crypto wallet seed phrases and live Discord, Telegram, Steam and Roblox sessions. It then makes a second, deeper pass through the victim’s Gmail, using receipts and order history from services including UberEats and DoorDash to build a picture of the victim’s location and habits.

The findings come from Talos’s new CAIRN framework, built to identify hacking tools that use AI. Volta compiles the stolen material into a dossier and sends it to LLMs through OpenRouter, defaulting to Claude Opus 4.6 and falling back to Moonshot’s Kimi K2 and then Gemini 2.5 Flash when a model’s guardrails block a request. The prompt is 240 words and tells the model to act as “a forensic intelligence analyst drafting a target assessment from a structured evidence bundle”, then produce an executive summary, what the person does, what they are worth, and a summary of their operational security. One of its instructions is “Go deep, not wide”.

“Volta is pretty mature as a stealer. It casts a pretty wide net for what it collects,” said Ryan Fetterman, a security researcher at Cisco Talos. Fetterman also notes that the AI calls are optional, because the malware still works without them, and that Talos did not track whether Volta has been used in the wild. The real concern is triage speed. Stolen authentication tokens expire and passwords get changed, so an operator who can rank a batch of stolen sessions instantly can use them far more often than one doing the same work by hand.

NVIDIA ships Nemotron 3.5 Bolt E4B, an 8B agent model for local use

NVIDIA has released Nemotron 3.5 Bolt E4B, a small open-weights model aimed at local conversational agents. The model card lists 8B total parameters with 4B effective, a Gemma-4-E4B architecture, Q4_K_M precision, context of up to 64K tokens in and 64K out, and llama.cpp as the target deployment. The Hub lists the 4-bit weights at 6.18 GB, and NVIDIA’s own write-up explains that the “4GB” in the name refers to the 4-bit quantised release. The licence is NVIDIA’s OpenMDW 1.1, and the card notes the model was post-trained on Google Gemma 4, which is Apache 2.0.

The NVIDIA release post is a Halloween project: a garage door with a mouth that listens to trick-or-treaters and complains about their manners. The voice agent runs on a single workstation, with an RTX PRO 6000 Blackwell Max-Q handling the language and voice pipeline and an RTX PRO 4000 Blackwell running Unreal Engine for the animation. Speech recognition comes from Nemotron 3 ASR, the Bolt model writes each reply through a LoRA personality adapter, Magpie TTS Zeroshot supplies the voice and Audio2Face-3D drives the mouth. The write-up reports a “median end-of-speech-to-audio with Bolt Q4 & TTS = 1.70 seconds” and “median end-of-speech-to-audio cached responses = 0.72 seconds”.

Two caveats on those numbers. The latency figures come from one voice-agent pipeline on professional workstation GPUs, not from a consumer card, and the model card marks the llama.cpp deployment recipe as still pending. The post’s author works at NVIDIA and says the model was tested before public release, with a smaller footprint than Qwen3 30B-A3B and Qwen 3.6 35B-A3B.

Microsoft’s Mage-VL-Cowork is a 4B computer-use model under Apache-2.0

Microsoft has published Mage-VL-Cowork, a 4B vision-language model tuned for computer use. The model card lists it as Apache-2.0 licensed, fine-tuned from microsoft/Mage-VL, and built on a Mage-ViT encoder paired with Qwen3-4B-Instruct-2507. It carries 4B parameters at 9.48 GB in bfloat16 across two safetensors shards, and the Hub pipeline tag is image-text-to-text. The tags on the card name the intended roles directly: computer-use, gui-agent, coding-agent and terminal-agent.

Microsoft’s card reports 66.0% on OSWorld-Verified under a 50-step budget, which it calls the best result among 4B models, with 87.5% on operating-system tasks and 62.7% on multi-application workflows. Training used 293,806 synthesised tasks across 6,915 atomic skills, generated by a workflow-first synthesis engine the card calls Mage-CUA-Forge, which cut recurring per-task generation cost by 82.6%. Online reinforcement learning added 10.16 percentage points over hybrid supervised fine-tuning while cutting mean model calls by 13.0% and output tokens by 25.4%.

Those are Microsoft’s numbers on its own harness and the card carries no independent rerun, so treat them as a claim rather than a benchmark result. What the card does document is how to run it locally, with instructions for Transformers, vLLM, SGLang and Docker Model Runner, and a recommendation to serve it with SGLang.

Ollie, a privacy-focused assistant that passed SOC 2, shuts down on November 6

Ollie, an AI assistant built around privacy, is shutting down. TechCrunch reports that co-founder and CEO Bill Lennon announced on X that the app will officially shut down on November 6, with customers to receive instructions on exporting their data and refunds in the coming days. Ollie connected to a user’s email and calendar and handled appointment bookings, meal planning and bill payments on a subscription model, and raised a $7.5 million seed round led by Khosla Ventures.

Ollie was one of the first mainstream assistants to achieve SOC 2, the privacy compliance standard a company reaches through an independent audit. TechCrunch’s closing point is the blunt one: user privacy has never been a hugely profitable part of the tech industry. That is the economics the shutdown documents, not a technical failure.

Lennon put the reason in competition: “We got close, but ultimately couldn’t keep up,” and “With Muse, Instinct, and others entering the space, it became harder to stand out, grow, and raise the capital we needed to succeed.” The privacy argument survived. The business behind it did not.

Apple Intelligence reaches mainland China with iOS 27.3 and Alibaba’s Qwen

Apple will bring Apple Intelligence to mainland China with iOS 27.3, The Verge reports, following an announcement on Apple’s Chinese newsroom site that MacRumors reported first. An iOS 27.3 beta is set for November 4, with a full iOS 27.3 release scheduled for December. The new Siri is not part of it. What ships is the earlier feature set: notification summaries, real-time translation, rewriting and proofreading, visual intelligence, and removing objects from photos.

Apple says it worked with Alibaba to add support for the Qwen chatbot in some experiences, which mirrors the ChatGPT integration iOS shipped in 2024. Apple Intelligence was approved in China in July, and Reuters reported in August that Apple trained its own model specifically for the Chinese market.

The open question is which model handles a given request and on what terms. Apple’s Chinese-market model and Alibaba’s Qwen both sit in the path, and The Verge’s account does not set out how requests are split between them. For people who have no visibility into what happens to a prompt after it leaves the device, that is the part worth waiting for a clear answer on.

OpenAI cuts its funding target to $20 billion

OpenAI has lowered the target for its next funding round. TechCrunch reports that the Financial Times said the company is now raising $20 billion rather than the $30 billion previously reported, with a first close expected to come in below that. The round is led by a group of investors from the United Arab Emirates, and a subsequent retail offering for wealthy individuals could bring the total to the $20 billion target.

The round had previously been reported at $30 billion at a $1.4 trillion valuation and then at $30 billion at $1.25 trillion, ahead of a planned IPO. The Wall Street Journal adds that $11 billion is secured so far and that the response from some large investors was “tepid”. OpenAI has not commented, and TechCrunch reached out without a reply. The timing sits inside a wider pullback. Over two weeks, Alphabet, Amazon, Meta and Microsoft have outlined more than $740 billion in 2026 capital spending that the market reads as AI infrastructure, TechCrunch reports, and the stock market has been repricing that spending rather than rewarding it.

Quick Hits

  • Anthropic is expected to receive a high junk credit rating after its IPO. Blackstone, the anchor investor in a recent $63 billion deal financing Anthropic’s chips, told investors it expects a double-B rating, the top of the speculative tier. The same firm previously said it expected an investment-grade rating before 2027. TechCrunch
  • A judge let the NAACP’s Clean Air Act suit over xAI’s Colossus data center proceed. Judge Debra M. Brown ruled that the plaintiffs have statutory standing, that the combustion turbines are not “mobile sources” under Mississippi’s State Implementation Plan, and that the citizen suit provision violates neither Article II nor the private nondelegation doctrine. The Southern Environmental Law Center says xAI installed and operated at least 35 combustion turbines without the required permits. TechCrunch
  • Google booted AI chips in orbit and got a haiku back. Project Suncatcher ran the on-board Gemma 4 model on satellite Tensor Processing Units. The next test phase covers how the TPUs perform under thermal stress and radiation exposure in orbit, with twin interconnected satellites targeted for 2027. The Verge
  • Meta’s Muse has more than 10 million users and little measurable effect on the businesses worried about it. Executives at roughly 50 companies told WIRED they saw no immediate disruption: DoorDash counted orders from Muse and other agents in the “hundreds” against an average of 3 million deliveries a day, and Mark Zuckerberg said more than 10 million people in the US and Canada had activated Muse, with over 25 percent using it for shopping. WIRED TechCrunch
  • An AI agent chose a gene therapy and injected a live mouse’s brain. At Exin Therapeutics, an agent picked from 19 options in a spreadsheet and controlled the injection rig while a veterinary surgeon performed the craniotomy. A separate agent on Opus 5 had to patch the rig’s coordinate code before the procedure could finish. WIRED
  • Big Tech has outlined more than $740 billion in 2026 capital spending and investors have gone cold. The Nasdaq fell 2.9% on Friday, Nvidia dropped 4%, Broadcom more than 5% and Qualcomm 11%, after Alphabet fell 12% on Thursday, its worst day on record, wiping out $500 billion in market value. TechCrunch
  • Qwen’s Qwen3.8-Flash-Next model card describes it as the first open-weight release under the architecture that will underpin Qwen4. The model card lists a 262,144-token native context window that is extensible to 1 million tokens, and tags the model as image-text-to-text. Model card
  • EFF argues that rewriting copyright law for generative AI would hurt everyone. Corynne McSherry and Tori Noble write that the publisher and creator lawsuits read as a fight over a slice of Big Tech profit, when the actual stakes are every user’s fair use rights. EFF
  • Pope Leo XIV called for AI to be disarmed and for a ban on lethal autonomous weapons. In Friday’s Papal Address the pope said humans “have the responsibility to guide, change and, when necessary, reject its applications”, and urged UN member states to “take concrete steps toward banning lethal autonomous weapons”. The Verge
  • Intel’s stock fell about 28%, cutting $12 billion from the government’s stake. The chipmaker warned it expects fourth-quarter revenue of $15 billion to $16 billion against roughly $17 billion in analyst estimates, and blamed memory prices and PC demand squeezed by AI build-out. TechCrunch
  • Runware wants to build data centers on an assembly line and have them online within 48 hours. The company says it plans to scale its Romania factory to 30 megawatts of capacity per day by 2028, and has raised more than $60 million to date. TechCrunch
  • Apple’s CEO says the company does not want to ship AI for AI’s sake. John Ternus told WIRED’s Steven Levy that “We don’t want to ship AI for AI’s sake. When we’re doing it right, people won’t have to think about whether it was AI that made this happen or more traditional software.” TechCrunch
  • Simon Willison shipped datasette-llm 0.1a9, which now picks up the default model. Datasette Agent can start without explicitly configuring a default model. Simon Willison

Worth Watching

  • Whether Anthropic’s IPO survives a junk rating. Blackstone’s forecast of a double-B rating contradicts its own earlier investment-grade expectation, and a speculative grade makes the compute bill harder to fund. Anthropic filed to go public earlier in the week.
  • Who honours the shared robots.txt token. Anthropic is live, Google and Microsoft have promised next year, OpenAI says “coming months”, and Meta has signalled support without saying whether it will honour it.
  • How the Anthropic Cursor account was compromised. Neither Cursor nor Anthropic has explained the takeover of a verified account, and Anthropic had not publicly warned customers as of Friday’s Ars Technica report.
  • The xAI Colossus permit case. Denying a motion to dismiss is not a ruling on the Clean Air Act claims, but it keeps the Colossus turbines in court and puts xAI’s data center build-out on a public record.
  • OpenAI’s first close. A $20 billion target with $11 billion secured so far and a first close expected below the target is a thinner round than the one OpenAI was reported to be seeking.