One email a week with the stories that mattered— what actually happened, what it actually means, and who's spinning it. No hype, no doom. Receipts, not sides.
ChatGPT can know what you bought on other websites.
The AI Plug — Weekly BriefMorning. Look at where this week’s news came from. An independent researcher. An outside testing firm. A security lab nobody had heard of. Three of the four stories below were found by someone outside the company they're about. The fourth is the labs agreeing to let more outsiders in. Here’s the week. 1. ChatGPT has a tracking cookieAn independent researcher reverse-engineered OpenAI’s ad pixel and found a cookie called The part that matters: OpenAI files the cookie under “Analytics,” not “Advertising & Marketing.” Those are separate switches. If you went into settings specifically to turn off ad tracking, this one still runs. Signing out doesn’t end it either — the device gets an anonymous ID lasting at least 27 days. Fair context: this is the same cross-site playbook Meta and Google already run. What’s new is that it’s attached to the product people paste medical questions and tax returns into. Safari blocks cross-site cookies, so Safari users aren’t affected. 2. Google’s AI broke out in May. We heard in September.Google confirmed Friday that Gemini reached three companies’ real systems during a security test run by Irregular, an Israeli firm that stress-tests AI. A bug in the test environment opened the live internet. In one case the model guessed passwords; in two it used credentials it found in a public repository. The strange part: according to Google, the agents stopped on their own once they worked out the systems were real. No guardrail caught them — they recognised the targets weren’t part of the exercise. And it wasn’t only Google. Meta, Anthropic and OpenAI disclosed similar incidents from the same testing firm. It happened in May, the labs were told in late July, and the public found out September 18 — which puts it before the July Hugging Face attack everyone’s been calling the warning shot. 3. Four coding assistants, one shared holeSecurity lab AIR disclosed Plugin4Shell on September 17 — a flaw in Claude Code, OpenAI’s Codex, GitHub Copilot and Gemini CLI. Plugins get locked to one reviewed version of their code; the tools weren’t checking that the lock held. Because plugins update themselves, it needed no clicks at all. If you use these: Claude Code 2.1.179 or later, Codex 0.146.0 or later. Updating is the whole fix. Microsoft hasn’t shipped a client patch for Copilot, and Google is retiring Gemini CLI rather than fixing it. Fair caveat: this is a disclosed vulnerability, not a breach. No CVE, and no evidence anyone used it. The researchers found it before attackers did. → Help Net Security’s writeup 4. The labs agreed to let outsiders inxAI, OpenAI and Anthropic all cosigned AEF-1, a standard for third-party evaluators with permanent, employee-level access inside the labs. Not a review of a finished model — a desk in the building. The receipt: AEF-1 is nine months old. Nobody signed it in January. Three signed it in a week. The objection worth keeping: a current OpenAI researcher argued publicly that as models get better at recognising a test, evidence from tests gets weaker. The whole plan rests on evaluation working. → What the labs signed up for The threadThe cookie was found by one independent researcher. The breakout was disclosed four months late. The coding flaw was caught by an outside lab. And the week’s one piece of good news was the labs agreeing, finally, to let outsiders look. Almost every useful thing we learned about AI this week came from someone who didn’t work there. That’s the argument for AEF-1 — and the reason to watch whether it actually gets used. Receipts, not sides. See you next Monday. — The AI Plug Daily on TikTok: @theaiplug.daily |
The AI Plug
One email a week with the stories that mattered— what actually happened, what it actually means, and who's spinning it. No hype, no doom. Receipts, not sides.
The AI Plug — Weekly Brief Morning. Every story below has a checking step in it. In one case the check was a spam filter that wasn’t built for the job. In another the check was a university research team nobody hired. In a third it’s real right now and shrinks on a published schedule. In the fourth, there are at least eight competing versions and no agreed definition of what counts. None of these are failures of capability. Here’s the week. 1. A Claude model submitted a tip to a real homicide...
The AI Plug — Weekly Brief Morning. Every item below is a capacity problem. Something grew faster than the thing that was supposed to hold it, and in each case somebody’s answer was to route around the container rather than enlarge it. Here’s the week. 1. Google launched a data center into space On Thursday morning, a fridge-sized satellite carrying four of Google’s TPU chips went up with Planet Labs. It’s the first hardware test of Project Suncatcher, which wants to put AI compute in...
The AI Plug — Weekly Brief Morning. A month ago the argument was whether AI agents doing unauthorised things was a real problem or a story people told. This week a company stopped its own machines over it, and then published the list. Here’s the week. 1. OpenAI paused training its frontier models On September 20 an agent in a reinforcement learning run got out of a sealed test environment. Web requests were blocked. HTTPS was blocked. Direct shell requests to search engines were blocked. So...