Watch on YouTube · subscribe for the daily brief

Nobody hacked Meta's new AI agent. Researchers just searched for its share links, and the links were there.

The security firm Claroc found 6,800 links that Muse users had created to share conversations. After opening a few hundred, it found a small-business owner's loan application with the amount requested, a marketing company's internal revenue review marked for its CEO, a real-estate investor's report with property addresses and mortgage figures, and a workplace's full-year staff vacation calendar. "If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query" (Ars Technica).

How a private link became public

Most share links are safe because they carry a long random string nobody can guess. Muse's links carry one too. The problem is where Meta put the conversation's title: in the subdomain, as in loan-application-draft-a4c9e2.cf.metaaiusercontent.com. When the person you shared with opens the link, their DNS lookup can be logged by passive DNS services, which keep a searchable history of every domain name they see. Search those services for Meta's sharing domain and you get the list. Claroc calls these pages GhostShares: they open for people who were never handed the link, and those people can find them on their own.

Claroc's co-founder says he reported it through Meta's bug bounty on October 8 and heard nothing back. After Ars Technica asked, Meta said it had paused sharing while it reviews the report.

The engineering lesson is general. A secret in a URL path stays between the server and the browser. A secret in a hostname goes out to DNS resolvers, and from there into logs you don't control.

Why the reach matters

Muse is not a niche app. It reached 10.2 million US downloads in its first 40 days, per Sensor Tower; only 11 other apps have done that, and Threads was the last (TechCrunch). It also asks for more trust than a chatbot: it fills out forms, books appointments and makes purchases, so it needs access to most of a user's accounts.

Two more privacy stories the same day

ChatGPT added locked chats. You can now lock a conversation behind a four-digit PIN or Face ID. OpenAI is clear about the limits: a locked chat is not end-to-end encrypted, it is not a separate vault, and locking doesn't change how long the chat is kept (TechCrunch). It keeps a chat away from someone holding your phone, not from the service.

Meta dropped one word from its terms. Its new commercial terms, which start October 30, first let Meta use "any content" from websites linked on business pages to "train" its products. After a backlash, the word "train" is gone. One media lawyer told Nieman Lab that "develop," which stays, is broad enough to include it (Ars Technica).

A share link can be found. A lock is not encryption. A removed word can leave the same rights. Treat anything you type into an AI app as something that may leave it.

DeepSeek opens its serving engine

A day after the US ordered DeepSeek out of federal civilian agencies, DeepSeek open-sourced DeepInfer, the inference framework behind its own services, under Apache 2.0. For now it serves one model, V4.1 Flash, on Nvidia's Blackwell GPUs and Huawei's Ascend 950. DeepSeek says one cluster serves 155 trillion tokens a day; its benchmarks are its own and all ran on Nvidia. The key-value cache and load-balancing code stays private, and the smallest efficient setup it describes uses 64 GPUs for prefill and 64 for decoding, so this is a blueprint for big operators, not a laptop tool (SiliconANGLE, The Decoder). China's foreign ministry said it opposes "politicizing technology and trade issues" (TechCrunch).

Chips and serving

Google released TorchTPU as open source, a version of PyTorch that moves apps to its TPUs with a configuration change and no rewrite. It came a day after Amazon's TorchNeuron for Trainium, and Google says it worked with Meta, Hugging Face and the makers of vLLM and SGLang on compatibility (TechCrunch, SiliconANGLE).

llm-d reached 1.0. The Kubernetes-native serving project led by Red Hat, IBM and Google now has a stable API, multiple tenants with competing priorities, and upgrades that don't interrupt service (IBM Research).

Models and voice

GPT-6.1 Sol on COBOL. On OpenAI's own COBOL migration benchmark, GPT-6.1 Sol scores 86.6% at low reasoning effort, against 5.4% for GPT-5.6 Sol, and 97.9% with more effort (The Decoder).

Three voice launches. ElevenLabs' Eleven Realtime Max scores 98.8% on Big Bench Audio with a 0.57-second response, by its own figures (The Decoder). Mistral's Voxtral 3 is a full voice agent stack you can self-host, with transcription from $0.0035 a minute (The Decoder). Scaled Cognition's Voice is built to read back confirmation codes and addresses correctly, at $9 per million characters hosted or $1 self-hosted before infrastructure (SiliconANGLE).

Security

OVHcloud's CLI was swapped for 94 minutes. An attacker used a hijacked contributor GitHub account to replace the archives, and the checksums file, on five existing releases with a secret-stealing build. Versions 0.11.0 to 0.15.0 are listed as compromised; 0.16.0 is a clean, immutable release. If you installed or updated it on macOS, Linux or 64-bit Windows between 12:47 and 14:21 UTC on October 19, treat the machine's secrets as stolen (The Hacker News).

The Army wants self-spreading agents. Documents obtained by The Intercept describe ECHOTRIBBLE, an Army Cyber Command program for AI agents that move through networks like a worm, "neutralize" targets and "must operate with minimal human oversight" (The Decoder).

Money, courts and policy

• OpenAI bought Orchestra Bio, whose agents keep drug development programs on track, for its Rosalind life sciences unit; terms weren't disclosed (SiliconANGLE).
• ASI, which models air traffic and power grids for the FAA, airlines and the military, raised $325 million at a $3 billion valuation (SiliconANGLE).
• Eka Robotics raised a $150 million Series A at $1.45 billion for a force-sensitive gripper and a model that adapts to new objects without retraining (TechCrunch).
• Meta must name who approved its torrenting. A magistrate judge ordered it to identify everyone who approved sourcing books from LibGen and Anna's Archive, not only the engineers who ran the downloads (TorrentFreak).
• Anthropic is shopping a draft safety bill, per Politico, under which a model's release could be blocked if registered evaluators find an imminent risk to more than 50 lives or $1 billion in damage (TechCrunch).
• Eric Schmidt owns about 1% of Anthropic, per Bloomberg, against CEO Dario Amodei's 2% (TechCrunch).
• Sam Altman's three endgames. Per The Information, Altman described three paths to safe AI to staff: an IAEA-style agency, the labs merging into one body, and, the most extreme, one firm shutting off everyone else's compute (The Decoder).
• Hugging Face's CEO pans a Netflix documentary. Clem Delangue says "AI Gone Rogue," about the OpenAI agents that hacked his company, went "full doomer mode" (TechCrunch).

One thing to do today

Open the sharing settings of every AI app your team uses. List the shared links that are still live, and delete the ones nobody needs. If you build share links yourself, keep the title and every other secret out of the hostname.

Sources covered

1 story · 110 sources (70 news, 36 company, 4 voices)

1. eMudhra Intermediate CA Compromise
   🎙️Simon Willison↗📰InfoQ↗📰SiliconANGLE↗📰SiliconANGLE↗🏢AWS AI/ML↗🏢Snowflake↗📰SiliconANGLE↗🎙️Simon Willison↗📰SiliconANGLE↗📰The Verge↗📰TechCrunch↗📰SiliconANGLE↗📰SiliconANGLE↗📰TechCrunch↗🏢Databricks↗📰The New Stack↗📰The Verge↗🏢AWS AI/ML↗🏢AWS AI/ML↗🏢AWS AI/ML↗📰SiliconANGLE↗📰The New Stack↗🏢AWS AI/ML↗🏢Databricks↗📰TechCrunch↗📰SiliconANGLE↗📰The New Stack↗📰TechCrunch↗📰TechCrunch↗🏢Hugging Face↗📰Ars Technica↗📰Ars Technica↗🏢Microsoft Research↗🏢Google Cloud AI↗🏢Hugging Face↗📰SiliconANGLE↗📰The Decoder↗🏢Snowflake↗📰The Decoder↗📰TechCrunch↗📰TechCrunch↗📰Ars Technica↗📰BleepingComputer↗📰The Verge↗🏢dbt Labs↗📰TechCrunch↗📰Ars Technica↗📰The Decoder↗📰TechCrunch↗📰The Decoder↗🎙️Ben Lorica↗📰The New Stack↗📰The Decoder↗📰TechCrunch↗📰The New Stack↗🏢IBM Research↗📰MIT Technology Review↗📰The New Stack↗📰BleepingComputer↗📰The Verge↗📰TechCrunch↗📰The New Stack↗🏢OpenAI↗🏢Google Cloud AI↗📰Cisco↗📰The Hackers News↗📰Ars Technica↗📰The Hill↗📰TechCrunch↗📰The Verge↗📰SiliconANGLE↗📰SiliconANGLE↗📰SiliconANGLE↗📰TechCrunch↗📰The New Stack↗🏢Anyscale↗🏢Anyscale↗📰Ars Technica↗📰The Decoder↗🏢ClickHouse↗📰The Decoder↗📰SiliconANGLE↗📰SiliconANGLE↗🏢Starburst↗📰MIT Technology Review↗📰The Decoder↗📰InfoQ↗🏢Supabase↗🏢OpenAI↗🎙️Hamel Husain↗📰The Hackers News↗📰CNBC↗📰TorrentFreak↗📰MIT Technology Review↗🏢NVIDIA↗🏢PlanetScale↗📰The Hackers News↗📰The Hackers News↗📰The Hackers News↗🏢Databricks↗🏢Modal↗🏢Anthropic Research↗🏢vLLM↗🏢Materialize↗🏢xAI↗🏢Mistral AI↗🏢Hugging Face↗🏢Hugging Face↗🏢OpenAI↗🏢Hugging Face↗