· 07:00 · 7 min + 3 min Explained
A shared ChatGPT link could let a stranger read your private chats
Until last week, one shared ChatGPT link could run a stranger's code in your account. OpenAI has fixed it. Also: Apple picks Alibaba's Qwen for China, OpenAI lowers its funding goal, abuse on Europe's data-centre sites, and deadlines for developers.
Written by AI and checked against our editorial standards. Every claim links to its primary source. Not reviewed by a human editor.
Get it in your inbox at 7am every day ↓
Today in 60 seconds
- A shared ChatGPT link could let a stranger read your private chats. It is fixed. Anyone who uses ChatGPT or opens shared chats.
- Alibaba says Apple will use its Qwen models for Siri in China. Anyone curious who builds the AI in their phone.
- OpenAI cut its funding goal from $30B to $20B after a cool response. Anyone wondering who pays for the AI boom.
- Reporters found unpaid overtime and accidents on Europe's data-centre building sites. Anyone who cares how AI gets built, close to home.
- OpenAI shuts Agent Builder on 30 November, and Claude Code adds effort control. Developers on OpenAI's tools or Claude Code.
1. A shared ChatGPT link could let a stranger read your private chats
The short versionUntil last week, opening one shared ChatGPT link could run a stranger's code in your account and read your private chats. OpenAI has fixed it, and you do not need to do anything.
Sharing a ChatGPT chat feels harmless. You send a link, and the other person sees a copy.
Researchers at the security firm Parameter found that a link could do much more. They built a shared chat with a graph and a small HTML preview. When a victim opened it and clicked Preview once, their code ran inside the victim’s own ChatGPT session. In another version, just opening the link was enough.
From there, the code could act as the victim. In the test, it listed the victim’s recent chats, opened a private one and sent a piece of it to an outside server. In effect, the researchers say, they could take over the account.
The trick was a chain of small gaps. A maths library used for graphs accepted messages without checking the sender, so the preview could slip code into the page.
Parameter reported it on 18 October. OpenAI raised its severity from P2 to P1 and confirmed the fix on 26 October. It paid a $5,000 bounty, which Simon Willison calls “a bit cheap for a vulnerability this serious.”
The catch: the researchers do not say whether anyone used it before the fix.
This is cross-site scripting: outside code runs as if it were part of the site, so it gets your login too. It is like a letter that, once opened, can sign cheques in your name. Opening one link was enough, so the danger came from trust, not from careless clicking.
Source: parameter.ai · Official · simonwillison.net · Reported
2. Alibaba says Apple will use Qwen for Siri in China
The short versionAlibaba says its Qwen models will run Siri, Writing Tools and Visual Intelligence for iPhone users in China. Testing starts on 4 November.
In China, AI services must be filed with the regulator. Apple Intelligence, Apple’s set of AI features, passed that step in July.
On Saturday, Alibaba said Qwen will power Siri, Writing Tools and Visual Intelligence for users in China. Testing starts in the iOS developer beta on 4 November. The full rollout follows with iOS 27.3 in December, according to Alibaba.
Users choose whether to switch it on and what to share. Alibaba says it will not train its models on their requests or answers.
The catch: the news comes from Alibaba, through China’s state news agency Xinhua. The report quotes no one from Apple and gives no price for the deal.
It is like a car maker that fits a different engine in each country. The iPhone is the same everywhere, but the AI inside now depends on where you live.
Source: news.cgtn.com · Reported
3. OpenAI cuts its funding goal to $20B after a cool response
The short versionOpenAI has lowered the target for its new funding round from $30B to $20B, the Financial Times reports. Some big investors were lukewarm.
Yesterday we wrote that investors balk at AI’s bills. Now that mood has reached OpenAI.
OpenAI had aimed to raise $30B. The goal is now $20B, says the Financial Times. So far $11B is secured, and some large investors were “tepid”, says the Wall Street Journal.
Investors from the United Arab Emirates lead the round, and a later offer to wealthy individuals could lift it to the goal.
The catch: $20B is still a huge sum. The cut may partly be bad timing, TechCrunch writes, because tech shares fell on fears about AI spending.
It is like a house sale where the bids come in under the asking price. When money gets harder to raise, AI labs feel more pressure to earn it from the people who use them.
Source: techcrunch.com · Reported
4. Reporters find abuse on Europe’s data-centre building sites
The short versionReporters in eight countries found unpaid overtime, poor housing and serious accidents on sites building data centres for Google and Microsoft. One trail leads to Denmark.
AI runs in data centres, and the industry expects €100B of investment in Europe by 2030. Investigate Europe looked at the people who do the building.
With partners such as the Guardian and Le Monde, it found weeks of up to 60 hours without overtime pay. Workers described rats in their housing, and one at a Microsoft site near Gävle in Sweden had tuberculosis. In Belgium, an electrician at a Google site was badly burned in an electrical accident.
Witnesses say about 40 men moved from Gävle to Microsoft’s site in Høje Taastrup in May. The Danish union 3F has not managed to reach them.
The catch: the companies deny wrongdoing or point to their rules for suppliers. Most problems sit with subcontractors several links down the chain.
It is like hiring one builder who hires ten others. The name on a data centre is often not the firm that pays the people who built it. The EU plans a law, the Quality Jobs Act, that would make firms share responsibility down the chain.
Source: techpolicy.press · Reported
5. OpenAI shuts Agent Builder on 30 November, and Claude Code adds effort control
The short versionDevelopers on OpenAI's Agent Builder, Evals or Prompts API have until 30 November to move. Claude Code also got a setting that can make helper agents cheaper.
1 of 2 OpenAI’s tools reach their end date
Since 31 October, existing OpenAI Evals can only be read. On 30 November, Evals, the Prompts API and Agent Builder shut down. For Agent Builder, OpenAI points to its Agents SDK or ChatGPT Workspace Agents. On 11 December, older models such as gpt-5 and o3 follow.
2 of 2 Claude Code lets helper agents think less
Claude Code 2.1.316 adds a setting that gives sub-agents their own effort level, instead of copying the main session’s. So small helper tasks can be set to cost less.
It is like a lease that ends: the office works until the day it does not. Old tools stop on a set date, so the cheap fix is the one made before it. And with agents, small dials like effort now set the bill.
Do this: If you use OpenAI's Agent Builder, Evals or Prompts API, move before 30 November.
Source: developers.openai.com · Official · github.com · Official
Open source & local AI
A small open model turns scanned documents into clean text on your own machine
The short versionOpenBMB released MiniCPM-OCR 1.0, a small open model that reads scans and PDFs, tables and formulas included. It runs in Ollama and llama.cpp.
Scanned invoices and contracts are hard to search. But sending them to a cloud service means handing over private documents.
MiniCPM-OCR reads a page in order and writes it out as Markdown, with tables and formulas kept. At about 1.3B parameters it is small for a model that reads images, and the weights are free to use under the Apache 2.0 licence.
The catch: the scores come from OpenBMB’s own page, not an outside test. Baidu released a free OCR model too, as we wrote on 27 October, and we found no independent comparison of the two.
It is like a scanner that also types the page out for you, without the page leaving the office. Private paperwork can be made searchable without sending it to a cloud service.
Source: huggingface.co · Official
Paper of the day
The same tools in a different format change how AI agents work
The short versionResearchers gave AI agents the same tools twice, once through MCP and once as command-line commands. The format alone changed how well and how cheaply they solved tasks.
AI agents use tools to search files, run code and call services. Developers can offer them through MCP, a standard for plugging tools into AI models, or as plain commands.
Many assume the format does not matter. Zhenning Shi and colleagues tested that, building both formats from one shared description.
Across six models and three test environments, it mattered. In 94.3% of 2,004 paired runs, the agent took clearly different paths depending on the format. Early differences carried through to later steps.
Their fix, DART, keeps the agent’s decisions and repairs only format details. It raised scores in all six settings.
The catch: it is a preprint, tested in three environments, so real products may behave differently.
It is like giving a cook the same recipe in grams and in cups: the same dish on paper, a different one on the plate. How you hand tools to an agent is part of the design, not a detail.
Source: arxiv.org · Official
Explained: if you have a little more time
3 terms from today's news · 3 minWhat is cross-site scripting?
Cross-site scripting, often shortened to XSS, is an attack. A stranger gets a website to run their code as if it were part of the site. Your browser keeps websites apart. A page from one site is not allowed to read your data on another site. XSS gets around that rule, because the stranger's code does not come from outside. It runs inside the trusted site itself. > **Think of it like this:** a company lets anyone pin notes on its notice board. One note is written to look like an order from the boss, and staff follow it. Nobody broke in. The note was simply put where orders are trusted. It works when a site does two things. It accepts text that someone else could have written, such as a comment, a link or a search. And it puts that text into a page without making it safe first. If the text contains code, the browser runs it. Once it runs, the code can do anything the site's own code can do. It can read what is on the page and send requests with your login, so it can act in your name. That is why a single link or a single comment can be enough. Websites defend themselves in a few ways. They turn special characters into plain text, so code is shown instead of run. They clean any HTML they must allow, using a tested library. And they set a strict list of which scripts the browser may run, which acts as a backup if something slips through. **Why it matters to you:** AI chat apps now show graphs, previews and small apps inside the chat. Each of those is a place where outside text meets a page, so each is a possible way in. The fixes happen on the company's side, but it is a good reason to be careful with links, even ones that look ordinary.Two more from today
What is an AI agent?What makes an agent different from a chatbot, and why that changes the risks.
An AI agent is an AI model that does not just answer, but acts. It decides its own next step, uses tools like a browser, a code editor or a payment page, and keeps going until the task is done.
That makes it useful for open-ended jobs. It also means mistakes can pile up, so agents need limits on what they may touch.
What does "open-weight" mean?What you get when a model's weights are public, and what you don't.
An AI model is a huge file of numbers called weights. “Open-weight” means anyone can download that file and run the model on their own machines, instead of renting access through an API.
It is not the same as open source: the training data and code usually stay secret, and the license can set limits.
How sure are we?Official: from the company, regulator or authorsReported: from a named outletUnconfirmed: rumor or leak