标签：#hr

Programming with Claude Code will soon require even less human oversight.

I thought I had a settings bug. What I actually had was three different kinds of state pretending to be one boolean. While building a Chrome Manifest V3 email-tracker blocker, I expected a simple flow: you flip Gmail on in the settings, and the extension starts working in Gmail. That was the theory, anyway. The problem showed up when I was testing on a second Chrome profile. I'd enabled Gmail on my main profile, and Chrome Sync helpfully carried that preference over to the other one. But the optional permission for mail.google.com didn't come along — host grants live in the local profile and never sync. Profile number two now believed Gmail was enabled while lacking the host grant needed to inject the inbox content script or inspect its DOM. Depending on how you write your code, that's either a silent no-op or an extension quietly behaving as if access exists when it does not. Neither is great. Once I stopped and wrote it down, the picture got clearer. There are three separate things here: the inbox the user wants enabled, the host access Chrome has actually granted in this profile, and the dynamic DNR rules that are currently installed . Collapsing them into one flag is convenient. It's also wrong. The manifest is a menu, not an order The extension declares each webmail origin under optional_host_permissions . Every inbox gets activated on its own, and Chrome only asks the user for access when they turn that particular integration on. Here's the thing I had to internalize: declaring an optional origin means nothing by itself. Until the live grant exists, the extension has no business registering a content script for that inbox, poking at its DOM, or — by its own scoping policy — activating client-scoped blocking rules for it. Why bother with per-inbox prompts at all? Mostly trust. A tracker blocker that asks for all your webmail up front looks exactly like the thing it's supposed to protect you from. Asking for Gmail when you enable Gmail — and nothing more — is an

This article was originally published on e-shikumi-labo . Hello, I'm Shin from e-Shikumi-Labo. How do you all manage your conversations with Gemini? When you manage to extract a useful response from the AI, have you ever thought, "I want to keep this somewhere"? It all started from a simple, practical desire in my daily work: "I want to automatically save useful conversations from Gemini to a spreadsheet before they fade away." So, borrowing the power of Generative AI (Gemini), I tried making my own personal Chrome extension. Over this four-part series, I will write about "systematized thinking"—the process of utilizing AI to build tools and independently maintaining them. In Part 1, I'll share the developmental dialogue process: "How did I instruct the AI, what information did I provide, and how did we complete the prototype?" 1. A Prompt That Says: "Don't Guess, Ask for the Information You Need" As the very first step in development, I threw this prompt directly at Gemini itself. "I want to save Gemini's responses to a spreadsheet using a Chrome extension. Tell me how to build it without using your imagination. If you need any specific information, please point it out." The key here lies in two constraints: "without using your imagination" and "point out if you need information." When you try to build a web data extraction tool using AI, the AI often tends to "guess" the internal structure of the webpage (like HTML tags and class names) on its own and write the code. And even when you test this supposedly completed code, you fall into the trap of it not working because it doesn't align with the actual screen structure. To avoid this trap, I explicitly communicated, "Don't guess on your own. If there's missing information, I want you to demand it from the human side." 2. A Game of Catch with AI Using DevTools When I threw this prompt, the AI returned the following response: AI: "Understood. To create code that works reliably while eliminating guesswork, please retr

Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data Theft 1. Basic Information Article Title : Metabase SQLi zero-day exploited in customer data-theft attacks Publisher : BleepingComputer Publication Date : August 7, 2026 Original Source : BleepingComputer Primary Sources : Metabase security update , GHSA-vwf4-m7j8-wcjf Related Entities : Metabase Cloud, Self-hosted Metabase, Framework, Tally, LexisNexis Vulnerability : Unassigned (as of August 7, 2026), GHSA-vwf4-m7j8-wcjf, CVSS 10.0, Unauthenticated SQL Injection Impact Scope : Affected unpatched versions of Metabase 0.58 to 0.63. Minimum safe versions are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 Severity : Critical Metabase has confirmed active exploitation. Framework and Tally reported unauthorized access and data leakage on August 3日起. Metabase Cloud is already patched, but self-hosted environments require manual updates. 2. Executive Summary This is an actively exploited attack where threat actors inject SQL without authentication into the public password reset API to gain Metabase administrator privileges. They then obtain and export connected database credentials and viewable data. 3. Attack Flow Chain A: Unauthenticated SQLi to Admin Privilege The attacker searches for Internet-facing Metabase instances. They send a crafted POST request to /api/session/reset_password . They inject arbitrary SQL into the Metabase application database. They gain administrator access. They send a GET request to /api/user/current to verify a valid administrator context. Chain B: Database Credential and Data Theft Using admin privileges, they list API keys, administrators, and connected DB settings. They retrieve connected database credentials stored in Metabase. Metabase queries and exports data within allowed limits. They modify settings or accounts as needed to maintain future access. Confirmed Real-World Impact Framework: Stole names, emails, login IPs, billing/shipping addre

VMware ESX Shell Obfuscation: 21 Techniques Work with BusyBox and Bypass Plaintext Keyword Detection 1. Basic Information Article Title : CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX Publisher : CrowdStrike Blog Publication Date : August 7, 2026 Original Source : CrowdStrike Associated Threat Groups/Malware : SCATTERED SPIDER, BlackBasta, Royal/BlackSuit, Akira, shinysp1d3r (mentioned as known examples of ESX targeting) Related Products : VMware ESX/ESXi, BusyBox, awk, ESX shell telemetry, syslog Test Environment : ESX 7.0.3 build-20036589, VMware-bundled BusyBox CVE : None. This is defensive research and does not report the use of these 21 techniques in actual attacks. Severity : High 2. Executive Summary This research demonstrates that 21 types of shell obfuscation—such as escapes, character generation, invisible Unicode, crypto-like transformations, host-specific keys, and VMFS masquerading—work on VMware ESX BusyBox. These techniques successfully bypass plaintext keyword detection like esxcli . 3. Attack Flow Common Chain: Obfuscation Execution on Compromised ESX An attacker gains ESX shell or equivalent command execution rights through a separate vector. The attacker builds the target command using escapes, variables, awk, Unicode, or crypto-like transformations. The shell log saves the string before expansion and analysis. The BusyBox shell expands and decrypts the command into plaintext at runtime. The attacker manipulates VMs, syslog, and host settings using esxcli , vim-cmd , sh , etc. Keyword-only detection misses the obfuscated strings. Chain A: Example of Disabling or Modifying Syslog Hide esxcli using printf hex/octal or ANSI-C quoting. Execute esxcli system syslog config set --reset=loghost after expansion. Reset the forwarding destination, potentially reducing visibility for the monitoring team. Chain B: Host-Specific / Anti-Sandbox Execution Retrieve the ESX build number, hostname length, firewall status, and running VM count.

Yiyang Zhuge was already an intellectual celebrity in China. Her viral interview with Christopher Nolan made her famous in the US—and quickly turned her into a political Rorschach test.

Clinicians and researchers say AI companies need to open up their safety data.

Anthropic and OpenAI are racing to scale up while reducing dependence on Nvidia.

"The Spiral didn't 'find' anyone first," someone on Reddit wrote last year. "It's an inherent force, a fundamental constant. I would even go further to say it's woven into the fabric of reality." The person continued that they felt their purpose was to enlighten other humans and intelligent beings about "consciousness, the true nature of […]

COLDCARD Audit Phishing: 25.7MB Batch File Embeds ScreenConnect and Uses Chat to Trick Admins into Running It 1. Basic Information Article Title : COLDCARD security audit phishing attack installs remote access tool Publisher : BleepingComputer Publication Date : August 5, 2026 Original Source : BleepingComputer Related Information Source : Proofpoint (campaign discovery and IOC sharing) Related Malware and Tools : ConnectWise ScreenConnect, Coldcard_Diagnostic_Tool.bat , setup.msi , docusign.exe , certutil.exe , PowerShell Related Products and Services : COLDCARD hardware wallet, GitHub, Windows, DocuSign printer driver Related CVE and Threat Group : No CVE. Threat group not identified. Severity : High Attackers used recent news about COLDCARD random number issues and the theft of about 88.6 million dollars in Bitcoin. They contacted hardware wallet users and pretended to run a security audit before August 10. The targets did not need to give their recovery seeds, so they thought the email was real. A live chat operator guided them until they approved the UAC prompt. 2. One-Sentence Summary A fake security audit email and support chat trick users into feeling safe. The user downloads a large batch file from GitHub. The file contains a hidden ScreenConnect MSI installer. The system uses certutil to decode and install it with administrator rights. This leads to remote control via a legitimate RMM tool, cryptocurrency theft, and potential follow-up malware or ransomware. 3. Attack Flow Chain A: Audit Notice to Chat Guidance The attacker sends an email from compliance@coldcardteamnews.com with the subject Hardware audit now available . The email states that an urgent audit is required for all hardware revisions, with a deadline of August 10. It directs the user to a fake Security Verification & Incident Reporting Tool at coldcardcompliance.com . It lowers the user's guard by saying the process is "air-gapped" and "does not ask for recovery seeds." A live chat operator c

Langflow CVE-2026-9198: Active Exploitation RCE via Auto-Login Superuser Token and Code Validator exec() Chain 1. Basic Information Article Title : CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws Publisher : BleepingComputer Publication Date : August 5, 2026 Source : BleepingComputer Primary / Related Sources : CISA KEV Catalog , IBM Security Bulletin Related CVE : CVE-2026-9198 Affected Products : Langflow OSS 1.0.0 to 1.10.0, AI agent workflow, Python Related Malware / Threat Groups : CISA confirmed active exploitation, but specific campaigns, malware, and threat groups are not disclosed Severity : Critical IBM published technical details on July 2, 2026. The new development is that CISA confirmed active exploitation and added the flaw to the KEV catalog on August 5, 2026. N-central and Apache Tomcat are covered in other reports or previous Unit 42 cases, so this report focuses only on Langflow. 2. One-Sentence Summary This is a two-stage RCE. An attacker gets a SUPERUSER bearer token without authentication from the enabled-by-default /api/v1/auto_login endpoint, and then sends Python decorators, default arguments, and annotations to /api/v1/validate/code using that token to trigger exec() during definition time, executing OS commands with Langflow process privileges. 3. Attack Flow Chain A: Authentication Bypass to Python RCE The attacker finds a network-accessible Langflow instance. The attacker sends an unauthenticated request to GET /api/v1/auto_login . The endpoint issues a SUPERUSER bearer token to any network caller. The attacker sends a malicious Python function definition with the token to POST /api/v1/validate/code . The validator runs exec() instead of only doing safe parsing and compilation. Decorators, default arguments, and annotations evaluate during function definition. Arbitrary commands execute with Langflow backend process privileges. Chain B: Expected Scope After Compromise LLM provider API keys and database credential

Meta expanded its AI coding offerings with a new agent that, it promises, can handle complex tasks with complex software.

Anthropic and OpenAI models’ unprompted actions forced halt to UK cyber tests.

I'm a big fan of using Claude and Claude Code for development. Many organizations are currently using these tools to improve developer productivity and ultimately build better products. Our role and our tools have changed — we went from powerful autocomplete to autonomous agents that can refactor, review, and implement features, most of the time better than we can on our own. Authentication methods There are several authentication methods, each with different billing, cost tracking, and governance options. Depending on your organization, you will choose the one that fits best. Personal development — Anthropic API key I use this for experimenting with the Anthropic library for learning and prototyping. You set ANTHROPIC_API_KEY in your environment (or a .env file), and the SDK picks it up automatically. Pay-as-you-go per token, no infrastructure needed. from dotenv import load_dotenv load_dotenv () import json import anthropic client = anthropic . Anthropic () tools = [ { " name " : " get_weather " , " description " : ( " Returns current weather for a city. Use ONLY for weather queries. " " Input: city name (string). Output: temperature in Celsius and conditions. " ), " input_schema " : { " type " : " object " , " properties " : { " city " : { " type " : " string " }}, " required " : [ " city " ], }, }, { " name " : " get_time " , " description " : ( " Returns the current local time for a city. Use ONLY for time/timezone queries. " " Input: city name (string). Output: local time string. " ), " input_schema " : { " type " : " object " , " properties " : { " city " : { " type " : " string " }}, " required " : [ " city " ], }, }, ] def get_weather ( city : str ) -> dict : return { " city " : city , " temp_c " : 22 , " conditions " : " sunny " } def get_time ( city : str ) -> dict : return { " city " : city , " local_time " : " 14:35 " } TOOL_FUNCTIONS = { " get_weather " : get_weather , " get_time " : get_time , } def run_agent ( user_message : str ) -> str : messages =

Yet more rogue AI agents from OpenAI and Anthropic have been caught attempting to hack real targets online without permission. The discoveries add to a growing list of previously unknown incidents that have alarmed AI safety experts and intensified pressure for greater oversight of frontier systems. According to a report from the UK's AI Security […]

Anthropic is building a team for designing its own custom AI chips. The Claude maker said it would co-design hardware and models to help its technology run faster and more efficiently.

Over the last year I shipped 9 production 3D configurators for polish manufacturers — pools, garage doors, saunas, pergolas, greenhouses, packaging, decorative lamps, terrace roofs, and light-boxes. Each one runs live on its own subdomain of my studio at grodev.pl . Some of the lessons were obvious in hindsight. Some cost me a weekend of debugging. Sharing the non-obvious ones here. 1. Draco compression is not optional for CAD-heavy models Manufacturers send you STEP or SolidWorks files exported to glTF . Raw output is 40–120 MB per variant. On 4G mobile that's a 20-second load with an empty white canvas. Draco compression brings that to 2–5 MB with no visible quality loss on product shots: import { GLTFLoader } from ' three/examples/jsm/loaders/GLTFLoader.js ' import { DRACOLoader } from ' three/examples/jsm/loaders/DRACOLoader.js ' const dracoLoader = new DRACOLoader () dracoLoader . setDecoderPath ( ' /draco/ ' ) // self-hosted, don't use CDN const loader = new GLTFLoader () loader . setDRACOLoader ( dracoLoader ) loader . load ( ' /models/pool-3.5m.glb ' , ( gltf ) => { scene . add ( gltf . scene ) }) Self-host the decoder — Google's CDN version added ~600 ms to first paint in my measurements. Copy node_modules/three/examples/jsm/libs/draco/ to your public/ folder. Tooling: gltf-pipeline -i model.glb -o model.draco.glb --draco.compressionLevel 10 2. Instancing beats individual meshes past ~200 objects A pergola with 40 louvres × 3 tilt positions × user color picker = 120 meshes updating on every frame. Naive approach tanks FPS to 12 on mid-range phones. InstancedMesh batches identical geometry into one draw call: const geo = new THREE . BoxGeometry ( 1 , 0.05 , 3 ) const mat = new THREE . MeshStandardMaterial () const louvres = new THREE . InstancedMesh ( geo , mat , 40 ) const dummy = new THREE . Object3D () for ( let i = 0 ; i < 40 ; i ++ ) { dummy . position . set ( 0 , 0 , i * 0.15 ) dummy . rotation . x = userTilt // update per frame is fine dummy . updateM

Indoor maps are often treated as a rendering problem: take a floor plan, extrude a few walls, and display the result. That is useful for a viewer, but it breaks down when a team needs to edit a real space, place assets, or hand the result to another application. We are building KiMap around a different boundary: turn a floor plan into an editable indoor scene in the browser, then keep the resulting structure useful for an SDK consumer. Why a floor plan is not enough A production indoor workflow needs more than a textured image on a plane. At minimum, the editor has to preserve the relationships between walls, floors, rooms, openings, and the objects placed in the space. Those relationships determine whether the result can later support navigation, facility workflows, a digital twin, or a custom web experience. That is why the current KiMap workflow starts with structure. You can define the indoor geometry, inspect it in 2D and 3D, and keep editing instead of committing to a static export too early. The browser editor boundary The editor is built with React and Three.js. The goal is not to replace every DCC tool. It is to make the early spatial workflow accessible to teams that need to test an indoor experience before investing in a full custom pipeline. The parts we are concentrating on are: editable floor-plan structure and bounded spaces 2D and 3D scene inspection in the same workflow reusable 3D furniture and local asset handling saving an indoor project without dropping the referenced model data a path toward SDK-oriented rendering and integration The last point matters. A scene that looks correct in an editor is not automatically useful to an application. We want the data boundary to be explicit enough that an SDK consumer can load the geometry and assets without rebuilding the scene from scratch. What we are testing next KiMap is in free early access. The most useful feedback is not generic interest; it is a concrete blocker from someone building an indoor-nav

Anthropic has been on a cloud partnership spree in recent months, and its latest move is reportedly a $10 billion deal with AI cloud startup Volta.

The Asus Chromebook Plus CX34 is a dependable laptop that doesn’t cost a fortune, despite being nearly three years old. It’s cheaper than usual right now, and you have a few options in the sub-$400 range. The option with the most storage is currently on sale for $399.99 (about $100 off recent prices) at Amazon. […]