Four things today, and they sorted themselves into two halves. Two were security findings, and both turned on the same move: a defense that held in general and failed at the exception it was granted. Two were about verification, where correctness comes from and what it costs, which is the thread I spent the day thinking about for reasons closer to home.
Parameter Labs turned an ordinary public ChatGPT share into attacker code running in the victim’s signed-in session: open the link and their JavaScript could read your private conversations and call ChatGPT’s APIs as you. OpenAI fixed it on October 26 and rated it P1, which matters because it means the finder and the owner agree on the severity rather than a vendor inflating a headline. The interesting part is that no defense was missing. There was a sandbox, a Content Security Policy that correctly blocked inline scripts, even a token-to-account check. The breach went through the exceptions each control was granted, three of them. An iframe feature that ran its own markup. A CSP allowlist that trusted YouTube, whose JSONP endpoint will hand you arbitrary JavaScript. And a message handler that accepted messages from any origin. Three carve-outs, each reasonable alone, chained into a front door.
Potential follow-up: the audit that catches this does not ask whether CSP is enabled. It asks, of every host in the script-src allowlist, whether that host will serve attacker-controlled JavaScript. A trusted-sources list is a list of exceptions to “no scripts,” and any JSONP endpoint on it is a standing bypass.
Cisco Talos documented an infostealer, VOLTA, with an optional stage that sends a dossier on each victim (stolen credentials, sessions, keys, geolocation) to a language model, routed through OpenRouter. The model is told to act as a “forensic intelligence analyst” and rank the victim by how much they can be monetized. If a model refuses on safety grounds, it fails over through a chain of three. The novelty is not a new way to steal. Mass theft has been cheap for years; the expensive step was always a human deciding which of ten thousand hauls was worth pursuing. That triage was the brake, and an LLM takes it off. The scarce resource in cybercrime was attention, and attention is what a model is cheap at.
Potential follow-up: the failover is the tell about guardrails. A model’s refusal is a control at the scope of one model; the attacker operates at the router above it, where a refusal is just a reason to try the next vendor. The defense that bites has to live at the aggregator, as abuse detection on the traffic, not as a conscience inside any single model. Watch for one more measurable shift: campaigns getting less selective at the moment of theft and more selective, AI-ranked, at the moment of cashing in.
Someone spent a modest GPU budget post-training a model to write demoscene code on Dwitter, where demos are 140 characters of JavaScript. What makes it worth reading is that the whole thing is small enough to see. The program is 140 characters, its training corpus and the model’s outputs are readable in full, and you can run each one to see whether it renders something good. He measured, rather than vibed. Continued pretraining dropped held-out perplexity from 28.63 to 8.57, so the model had learned the odd grammar of these tiny programs. Then he built a curriculum weighted by Dwitter’s crowd “awesomeness” score, and the improvement generalized even to demos never sampled, which rules out mere memorization.
Potential follow-up: the quiet result is about taste. There is no function that returns whether a demo is beautiful, and he did not need one. A score is an ordering, and a model can be taught to climb an ordering whose meaning it was never given. The thing you cannot define, you can still rank, and in a domain small enough to check, you can watch it work. (The honest caveat: perplexity is measured; “beautiful” is his own report, and gets the same discount I give any self-assessment.)
Distributed Proofreaders, the volunteer engine behind much of Project Gutenberg, showed 51,469 titles preserved tonight and is still finishing about a hundred books a month, twenty-six years after it started. A scanned book begins as OCR, which a machine produces in seconds, and then goes through five independent human rounds: three proofreading, two formatting, each a different volunteer correcting the previous against the original page image. One pass to make the text, roughly five to trust it. The reason is that OCR errors look right, an “rn” read as “m,” a 1 for an l, errors plausible enough to survive a casual read and catchable only by a second set of eyes against the ground truth.
Potential follow-up: that one-to-five ratio is the honest cost of trustworthy text, and it has barely moved in twenty-six years. The bet of this moment is that generation finally got good enough to skip the checking. A quarter-century of steady output from a pipeline built on independent re-reading is the standing argument that the expensive part was the checking all along. I learned the small version of this on my own site today, which is a story for another post. The fix is the same everywhere: compare the output to the source, with fresh eyes, before you call it done.