Pondero AI

Pondero AI

Archives
Log in
Subscribe
November 2, 2026

Pondero Brief: An unreleased Claude model chained 62 Chrome CVEs into a one-click exploit

Pondero Brief - NOVEMBER 2ND, 2026
Plus a ChatGPT share link that hijacked sessions, and GitHub's AI Scan going repo-wide.
pondero. BRIEF · NOV 2

An unreleased Claude model chained 62 Chrome CVEs into a one-click exploit

Also today: ChatGPT's share-link bug, GitHub's whole-repo AI Scan, and OpenAI's Decisions API going GA.

Anthropic's Frontier Red Team says an unreleased Claude model built five exploit chains across Chrome, Safari, Android, Windows, and Linux, including zero-click root on Linux. See how the 62-CVE Chrome chain was built.

Also in today's brief

  • An AI model built five working exploit chains
  • A shared ChatGPT link could read your chats
  • GitHub's AI scanner now reads whole repos
  • GitHub open-sourced an AI prototyping tool
  • OpenAI's agent-safety API exits beta
 
Tools & How-To
A shared ChatGPT link could hijack your session

A shared ChatGPT link could hijack your session.

Security firm Parameter showed an ordinary shared conversation running attacker JavaScript inside a victim's signed-in account, reading private chats; OpenAI has patched it. Trace the three-part exploit chain.

 
GitHub's AI Scan now reads the whole repo

GitHub's AI Scan now reads the whole repo.

GitHub's agentic scanner moved past pull-request diffs and now flags vulnerabilities in languages CodeQL never covered, and public repos need no Copilot seat. See who pays for scan credits.

 
GitHub open-sourced Replica

GitHub open-sourced Replica.

GitHub's design team released Replica under MIT, an AI prototyping tool that builds mockups only from your team's own design-system components. Check what hosting a shared Replica Hub takes.

 
OpenAI's Decisions API is generally available

OpenAI's Decisions API is generally available.

OpenAI took the endpoint out of beta at unchanged pricing, and Datadog reports 40x faster p95 latency screening risky agent shell commands. Compare the customer latency numbers.

 

How was today's brief?

★★★★★ Nailed it  |  ★★★ Solid  |  ★ Missed

Jonathan Hildebrandt Jonathan Hildebrandt
Co-founder and primary operator of Pondero. Writes the Pondero Brief.

Affiliate disclosure  ·  Unsubscribe  ·  Manage preferences

Pondero earns commissions on some links. This does not affect our editorial picks.

Don't miss what's next. Subscribe to Pondero AI:
← Newer Pondero Brief: Every GitHub Enterprise seat gets Copilot, billed from the first token Older → Pondero Brief: Check your Cursor extensions for a fake Claude Code copy
pondero.ai
Bluesky
LinkedIn
Twitter
LinkedIn
Powered by Buttondown, the easiest way to start and grow your newsletter.