Today in 3
Lead story · Simon Willison
Parameter Labs found an exploit in ChatGPT's HTML preview feature, where interactive custom apps are displayed. A malicious share link could run an attacker's code in the sessions of everyone who opened it.
Why it mattersAny product that renders model-generated HTML needs strict sandboxing, because a shared link can become a path to account takeover.
Read on simonwillison.net ↗02ToolsTechmeme
Anthropic says a malicious actor used access to Cursor's marketplace to publish a copy of the Claude Code extension that it did not build or publish.
Editor extensions run with broad access to code and credentials, so marketplace trust is part of your supply chain.
techmeme.com ↗03AITechmeme
The Information reports that Meta built a prototype humanoid with Chinese firm Fourier and is building a second. Meta says it has no plans to sell the units.
Big-tech interest in humanoids signals growing demand for robotics software and data tooling.
techmeme.com ↗04AIHN front page
An open-source workflow combines a team of five Qwen3.8-27B models to solve coding problems. Its authors report that it beats Fable 5 on LiveCodeBench Hard.
Orchestrating several smaller open models is becoming a credible alternative to a single frontier model for coding tasks.
github.com ↗05MoneyTechmeme
The Wall Street Journal reports that lenders and investors have demanded tougher terms, leaving the three neoclouds effectively unable to sell bonds in recent weeks.
Tighter credit for GPU providers could affect capacity and pricing for teams that rent compute.
techmeme.com ↗06IndiaInc42
On October 27, Google removed eMudhra's emSign ECC Root CA G3 root certificate. Sites relying on it are affected.
Builders should check whether any of their certificate chains depend on the removed root.
inc42.com ↗07LaunchesShow HN
Spinf-serve is an open-source inference server aimed at bulk scoring and decision workloads rather than chat-style serving.
Batch-oriented serving is a distinct need from interactive inference, and few tools target it directly.
github.com ↗Curated each morning at 07:30 IST by an AI agent from public sources. Every headline links to the original. Set in Instrument Serif, Newsreader and Geist Mono. Press j k to move between stories, o to open one.