Parameter Labs found a ChatGPT exploit chain: a sandboxed HTML preview sent postMessage to MathLive's virtual keyboard listener, which used innerHTML, letting a shared chat link run code in a signed-in victim's session.
How we checked
Read Parameter Labs writeup linked by Simon; attack chain, share-link impact, fix and $5,000 bounty match the post
Why it matters
If you render model-generated HTML in sandboxed iframes, third-party libraries on the parent page can reopen the hole you thought the sandbox closed.
Try this
Search your app for message event listeners and confirm each one checks event.origin or event.source and never passes message data into innerHTML.
In the same ChatGPT attack, a CSP that blocked inline scripts was bypassed because it allowlisted YouTube, whose oEmbed JSONP callback echoed attacker JavaScript. OpenAI fixed the issue by October 26, 2026.
How we checked · Why it matters · Try this
How we checked
Parameter Labs writeup describes the YouTube oEmbed JSONP bypass and the October 26, 2026 fix confirmation
Why it matters
A script-src allowlist is only as strong as the weakest endpoint on each allowed domain. JSONP-style endpoints turn a trusted domain into a script source.
Try this
List every domain in your script-src policy and check whether any of them serve JSONP or callback-parameter endpoints; drop or narrow those entries.
Claude Code has dynamic workflows: Claude writes a JavaScript script that runs many subagents in the background. Karpathy says he used one to run Sonnet over Hacker News comments.
How we checked · Why it matters · Try this
How we checked
Claude Code workflows docs page describes the feature, /deep-research and /workflows; not smoke-tested
Why it matters
For bulk jobs like filtering thousands of comments or auditing many files, a workflow keeps the orchestration in a rerunnable script, not in your chat context.
Try this
In Claude Code, run /deep-research with a narrow question to see a workflow run, then open /workflows to inspect its phases and per-agent token use.
datasette-llm 0.1a9 now falls back to LLM's own default model when no other default is set, so Datasette Agent works without passing a default_model setting.
How we checked · Why it matters · Try this
How we checked
GitHub release 0.1a9 dated Oct 31 with matching note on default model; no sandbox smoke test
Why it matters
This removes a setup step for people trying Datasette Agent on their own SQLite data with a model they already configured in LLM.
Try this
If you use the llm CLI, run llm models default to see which model datasette-llm 0.1a9 will now pick up.
Karpathy says he built hackertube.org in about two hours by talking to Claude Code (Opus 5.5, medium effort). It narrowed HN comments to about 40K recommending 6,454 YouTube videos across 150 topics.
How we checked · Why it matters
How we checked
primary link exists; hackertube.org loads as a video site; video and topic counts not shown on site
Why it matters
This is a concrete account of a builder handing an agent the whole loop, from data collection to deploying and hardening a VPS. His only manual steps were an API key, a server and a domain.
Arca's lead AI engineer Aman Singh says their agents write code to query client data. That code is translated into a strict format, the code is discarded, and guardrails check the format before it reaches the backend.
How we checked · Why it matters
How we checked
Guest claim in podcast writeup; no Arca primary source reachable to confirm the design
Why it matters
This is one way to let agents compute freely over sensitive data while the backend only ever sees a checked query shape.