vibehacker
News
OpenAI / ChatGPT Learn ·

ChatGPT's browser extension can now drive your signed-in Chrome tabs from Work mode

In a Work or Codex chat, @Chrome (or Edge, Brave, Opera, Vivaldi) lets ChatGPT fill forms, send messages, download files, and group tabs on sites where you're already logged in, stopping before submit so you can review; mentioning a single tab limits it to that page. It replaces the retired Atlas browser and widens what an agent can touch in your real session, so check its per-site permissions under Settings → Computer Use (PCMag).

Read at learn.chatgpt.com
ChatGPT
AI assistant for answers, writing, images, work, and code

More news

View all

Replit can now run its platform and Agent harness inside your own AWS, Azure, or Google Cloud tenant

Full BYOC (private preview) puts compute, storage, and the Agent harness in your cloud, BYOC for Published Apps (early access) keeps the publish button but hosts apps in your tenant with private endpoints, and Image Exports hand you Docker, Terraform, and SBOM artifacts to self host. It's enterprise only with no pricing or GA date, and the control plane and model inference stay Replit managed, so it isn't air gapped (changelog)…

Replit Blog

Strot uses a big LLM once to compile a classifier, then runs every decision on a 144M CPU model

You describe a task like ticket routing or text classification, a large model synthesizes the labels and handlers at build time, and a small local model then answers at about 60 ms per record with no LLM calls, abstaining on low confidence inputs via a calibrated threshold. The author reports 92.5% vs 74.8% on a routing benchmark over naive integration but admits it hits the small model's ceiling on harder tasks like hate speech detection; MIT licensed, pip install strot ai (Show HN)…

GitHub (strot-ai/Project-STROT)

OpenCode's MCP OAuth login could run code on Windows; fixed in 1.18.33 with no CVE

Pillar Security found that OpenCode 1.0.137–1.18.32 on Windows/WSL passed a remote MCP server's authorization endpoint straight into PowerShell via the open package, so a $(...) HTTPS URL could run code just by starting OAuth login—no prompt injection needed. Anomaly fixed it in 1.18.33 (Sep 28) with no advisory or CVE, so scanners won't flag it; upgrade if you're on Windows and drop remote MCP servers you haven't vetted…

Pillar Security

Buildkite's MCP server lets agents validate pipeline YAML and diff a failed build against the last green one

New validate pipeline checks YAML against Buildkite's schema without starting a build, and compare builds reports newly failing, recovered, and still broken steps with log tails for up to three failures; note create pipeline now requires create webhook , a breaking change in v1.23.0. Buildkite also added pipeline scoped secrets with branch, queue, source, or creator conditions…

InfoQ

Claude traced the NIST P-256 curve seeds to 1997 timestamps fed into lrand48, not a secret phrase

An internal Anthropic model worked out in under half an hour that the NSA supplied seeds for P 192 through P 521 came from the C lrand48 / drand48 generator seeded with Unix timestamps from 1997 to 1998, so the team claimed Filippo Valsorda's bounty and donated the tripled $36,864 to Let's Encrypt's nonprofit, ISRG. It's not a break: Valsorda says it leaves barely 30 bits of freedom, ruling out a hidden backdoor, and no one needs to change anything (Filippo's writeup)…

Anthropic Research

Spotted something we missed? Start a thread.