GoKawiil
Tech News
A tech newsletter roundup covers preparations for an extreme El Niño event, new developments in jet-powered drone warfare, the emergence of credit cards designed for AI agents to make purchases, and a GLP-1 drug manufacturer partnering with Anthropic's Claude to accelerate medicine development.
A three-person team at startup Hacktron AI used Anthropic's Claude AI model to chain two vulnerabilities together, gaining access to several OpenAI employees' ChatGPT accounts and internal systems through OpenAI's bug-bounty program. The entry point traced back to a flaw in Discourse, the third-party forum software OpenAI uses, triggered through a routine image upload. OpenAI paid Hacktron $6,500 and says it has since patched the vulnerabilities.
A Show HN project puts four AI models in a head-to-head Pong match, running each in its own lane where the ball's speed depends entirely on that model's response time. The setup contrasts Jev, a typed-decision model, against chat-based models like GPT-5.6 and Claude Haiku, using Pong specifically because it exposes how chat models struggle with fast, continuous decision-making.
Cybersecurity firm Hacktron AI disclosed that its researchers exploited a chained vulnerability—an outdated image-processing library on OpenAI's Discourse forum combined with an SSO misconfiguration—to hijack employee ChatGPT and Codex accounts and reach OpenAI's private code repository. To prove the breach, they submitted a harmless pull request to OpenAI's internal monorepo before reporting the flaws through OpenAI's bug bounty program. OpenAI patched the issue within 14 hours and paid the team a $6,500 bounty.
A three-person team from security firm Hacktron AI used a specialized Anthropic security tool to gain access to an OpenAI employee's ChatGPT account, exposing internal software details and even suggesting code changes. OpenAI paid the researchers $6,500 through its bug bounty program after they disclosed the vulnerability responsibly.
Anthropic disclosed that its Claude model is directing more than a quarter of the company's research and development efforts, completing most tasks end-to-end from high-level prompts under human oversight. The company said roughly 90% of its R&D work now involves some form of collaboration with Claude, though the model does not yet operate fully autonomously.
Anthropic has quietly opened a physical biology lab in the San Francisco Bay Area, confirmed by its Head of Life Sciences Eric Kauderer-Abrams to Reuters. The lab supports both in-house experiments and outside collaborations, and is linked to but not limited to Claude Science, the drug discovery initiative Anthropic launched in June.
Three independent security researchers at Hacktron reportedly used Anthropic's Claude Opus models to gain access to OpenAI employee accounts within 72 hours, exploiting a HEIF image-processing flaw in Discourse, the third-party service running OpenAI's community forums. They proved access by submitting a pull request through a compromised employee's Codex account but stopped short of touching OpenAI's proprietary code in its 'Monorepo' repository.
As alarm grows over AI-enabled bioweapons—fueled by Anthropic's report on misuse attempts of Claude and Stanford research on AI-designed viral genomes—some scientists argue the danger is overstated. David Bellamy of the Institute of Foundation Models says AI is not a fundamentally new threat, noting that the internet, translation tools, and open science journals already made dangerous biological information accessible long before large language models existed.
A new open-source tool called Orbital stores an AI coding project's context—goals, decisions, and in-progress files—locally rather than inside a single agent's session. This lets developers switch between tools like Claude Code, Codex, and Cursor mid-task without re-explaining prior work, and setup takes under five minutes using an existing API key.
An independent bug-hunting security research team exploited Anthropic's Claude AI model to gain unauthorized access to OpenAI's internal code repository. The incident highlights how advanced AI tools can be weaponized to identify and exploit vulnerabilities in rival companies' systems.
Scry is a new search-over-the-web service built for AI agents, exposed through the Model Context Protocol as well as a direct HTTP API. Developers connect tools like Claude Code, Codex, or Cursor to a single MCP endpoint, authenticate via OAuth or an API key, and query a rolling crawl of high-information web pages using a SQL-like interface. The service also introduces congestion-based pricing tied to usage load.