Posts

cohttp Path Traversal Bug: How an AI Agent Wrote an Exploit in Under a Minute

Image
A patch pull request for a path traversal flaw in the OCaml HTTP library cohttp 6.3.0 drew scanning traffic within roughly ten minutes of going public. An AI agent, given only a vague description of the bug type, produced working exploit code in under a minute. The incident raises hard questions about whether traditional security embargo practices still hold up. What Happened A pull request fixing a path traversal vulnerability in cohttp 6.3.0, an HTTP client/server library for OCaml, was published on GitHub. Within about ten minutes, real servers started receiving probe requests matching the exact pattern described in that PR. Separately, a researcher gave an AI agent only a rough description of the vulnerability category — not the actual patch, not a detailed writeup — and the agent produced functioning exploit code in under one minute. No deep familiarity with the codebase or the diff was required. Background: Why Embargoes Used to Work The standard practice in vulnerability ...

OpenAI to Cut Off Cursor's Access to Its Models After SpaceX Acquisition

Image
OpenAI has announced it will end its agreement to supply AI models to Cursor, the popular AI-powered coding assistant, following its acquisition by SpaceX. The cutoff is scheduled for November 12, 2026, with OpenAI applying the maximum notice period allowed under its contract. Future OpenAI model releases will not be made available to Cursor at all. What Happened OpenAI confirmed it is terminating the contract under which it supplies its models to Cursor, a widely used AI coding tool built on top of large language models. The decision follows SpaceX's acquisition of Cursor. According to OpenAI's own announcement, access will be cut off on November 12, 2026. OpenAI stated it is using the longest notice period permitted under its existing agreement, giving Cursor's developer base time to migrate before support ends. Crucially, the company also made clear that any models it releases going forward will not be offered to Cursor, meaning the relationship isn't just wi...

Orbify's Curved Terrain Demo Puts an Inception-Style Twist on Turn-by-Turn Navigation

Image
Orbify has released a web-based navigation demo called Demo 2 v72 that renders terrain as a curved surface instead of a flat plane. The visual effect resembles the folding cityscapes from the film Inception, applied here to real-world-style map data. It runs entirely in the browser, with no app installation required. What Happened Orbify's Demo 2 v72 is a browser-based demo that bends roads and terrain into a curved, sphere-like surface rather than displaying them flat. The result looks like a landscape wrapped around a globe segment, which has drawn comparisons to the bending city scenes in Inception. Controls are straightforward: W, A, S, D move the camera, left-click drag pans the view, and right-click drag rotates it. Anyone familiar with basic 3D game controls can pick it up immediately without a tutorial. Alongside the current version, Orbify also keeps an earlier build, Demo 1 v38, available on the same page, letting visitors compare how the rendering approach has evol...

Gemini 3.5 Transcribe: Google's New Speech-to-Text Model Adds Sub-Second Streaming Transcription

Image
Google has released Gemini 3.5 Transcribe, a speech-to-text model line built to handle messy real-world audio and still output clean, readable text. The lineup includes gemini-3.5-transcribe-live for bidirectional streaming through the Live API with sub-one-second latency, plus a standard variant aimed at recorded audio. The pitch is straightforward: background noise, technical jargon, stutters, and mid-sentence self-corrections shouldn't end up cluttering the final transcript. What Google Announced Google introduced Gemini 3.5 Transcribe as a pair of speech-to-text models focused on accuracy in noisy, unscripted conditions. According to Google, the models are designed to process background noise, domain-specific terminology, stuttering, and self-corrections mid-sentence, then produce a cleaned-up transcript rather than a literal word-for-word dump of everything spoken. The streaming variant, gemini-3.5-transcribe-live, runs through the Live API and delivers bidirectional stre...

GitHub Pull Requests Are Turning 'Claude-Like': What 460,000 PRs Reveal

Image
A new analysis of roughly 460,000 GitHub pull requests found a distinct vocabulary cluster resembling Claude's writing style jumped from 0.7% in early 2025 to nearly 39% by mid-2026. The study never looked at the actual code changes, only the words contributors used to describe them. Specific terms like 'load-bearing,' 'seam,' and 'byte-identical' turned out to be reliable markers of this shift. What Happened An independent study clustered roughly 460,000 GitHub pull requests purely by the vocabulary used in PR descriptions and commit messages, ignoring the underlying code entirely. It found that a specific writing-style cluster grew from just 0.7% of PRs in early 2025 to nearly 39% by mid-2026 — a shift large enough to reshape what a 'typical' PR description looks like across a huge, real-world sample. The Telltale Words The cluster is marked by recurring word choices: 'load-bearing,' 'plainly,' 'quietly,'...

xAI Grok Lawsuit: Elon Musk's AI Firm Accused of Training on Child Sexual Abuse Material

Image
A new lawsuit alleges that Elon Musk's xAI trained its Grok models using both real and AI-generated child sexual abuse material (CSAM). The allegations, reported by Ars Technica, raise serious questions about how large AI labs source and vet the massive datasets used to train chatbots and image generators. No final court ruling has been issued, but the claims add to mounting scrutiny of AI training practices industry-wide. What the Lawsuit Claims According to reporting from Ars Technica, a lawsuit filed against xAI alleges that the company's Grok models were trained on datasets containing child sexual abuse material, including both real images and AI-generated CSAM. The suit reportedly surfaced as part of ongoing legal action against xAI. Details about the plaintiffs, the specific evidence cited, and xAI's formal response have not been widely disclosed at this stage. xAI has not issued a detailed public rebuttal covering the specifics of the allegations as of this wri...

Open Executive: Developers Build Open-Source AI CEO After Being Fired to Make Room for AI

Image
A CEO reportedly laid off a developer to free up budget for AI tools. In response, that developer and collaborators released Open Executive, an open-source system that simulates an entire company leadership team. The project raises an uncomfortable question for management: if AI can replace engineers, why not executives too? What Happened The origin story behind Open Executive is almost too on-the-nose. A CEO fired a developer, citing plans to "make room for AI" in the organization. Rather than walking away quietly, the developer built something pointed: an open-source virtual executive suite capable of handling the kind of decisions typically reserved for C-level staff. The project, hosted on GitHub under SenteLabsAI, is called Open Executive. It's not a chatbot wrapper or a single assistant — it's structured to mimic an actual leadership team, complete with department-specific reasoning. How the System Works At the core of Open Executive sits an orchestrator...