| How We Took Over ChatGPT Accounts |
https://www.parameter.ai/labs/we-found-a-gap-at-openai |
Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern (I think OpenAI call this "Canvas"), where interactive custom HTML apps are displayed in a sandboxed iframe.
It's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data.
It's quite a complex attack chain. OpenAI use the MathLive JavaScript library to display equations, and that library includes [its own virtual keyboard](https://mathlive.io/mathfield/virtual-keyboard/), which can be triggered in the parent page via `postMessage()` from the sandboxed iframe.
That message receiving code uses `innerHTML`, so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including Canvas frames, from calling that method.
This meant untrusted code in an iframe could insert HTML, and while `innerHTML` doesn't directly execute script elements it could be used to inject a new iframe *without* sandbox restrictions.
OpenAI’s CSP rules blocked inline scripts entirely, and only allowed script loading from a handful of domains, but one of those was YouTube - and the YouTube oEmbed endpoint could be used to reflect JavaScript back in a way at that executed it.
Once the attack had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it via an image reference.
OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious. |
2026-10-31 15:07:24+00:00 |
| dbreunig/nesformer |
https://github.com/dbreunig/nesformer |
Inspired by [qwenputer](https://divagr.com/blog/qwenputer) by Divyansh Agrawal, Drew Breunig baked a working emulator for a Nintendo Entertainment System 6502 CPU into the weights of Qwen3.5-4B. You can now play NES ROMs such as Super Mario Bros (very slowly) running inside Qwen!
In [a comment on Hacker News](https://news.ycombinator.com/item?id=50306442#50307402) Drew reveals the Opus 5.5 prompts he used to build this system:
> `Read this article and any relevant source code: https://divagr.com/blog/qwenputer. Then explore if you could emulate the chip and ram in a Nintendo Entertainment System (as people do today with FPGAs in MISTRs) using this technique. If so, what size model would you have to build and if you could use smaller faster ones, could you get it to be at the standard clockspeed.`
Followed by:
> `I think we should build it! Just for fun. It's okay if it's not fast. We want to be able to have the weights, and a cli to run them that we can point at a ROM.`
Apparently Opus found and then used [this collection of conformance tests](https://github.com/christopherpow/nes-test-roms/blob/master/other/nestest.txt) for the NES CPU released 15 years ago by Christopher Pow. |
2026-10-30 21:59:22+00:00 |
| API credits benefit for eligible ChatGPT subscriptions |
https://help.openai.com/en/articles/20001626-api-credits-benefit-for-eligible-chatgpt-subscriptions |
Earlier this month Anthropic [announced a generous new benefit](https://simonwillison.net/2026/Oct/7/claude-haiku-5-5/#api-credits) for their Max and Team subscriptions: $100, $200, and $500 per month subscribers would get the equivalent quantity of (expiring) credits to use with the Anthropic API.
OpenAI have now launched pretty much exactly the same deal: if you have a $100, $200, or $500 subscription plan with them you now get that same quantity of credits to apply to one of your API organizations.
I maintain subscriptions with both companies, so this is great news for me! I may even ship some public-facing demos now that the credits are already covered by my existing subscriptions. |
2026-10-29 22:48:29+00:00 |
| How I Built the Most AI-Pilled Company in the World |
https://twitter.com/jsnnsa/status/2115623382721126826 |
Don't be put off by the clickbait headline, this piece by Jacob Sansbury describing how they are building [Spawn](https://spawn.co) is a fascinating exploration of the bleeding edge of what's possible with agentic engineering against frontier models.
Spawn is a massively multiplayer gaming environment where players can use prompts (to the in-game agent, Savi) to modify the game world.
I fired it up on my phone for a few minutes and was able to prompt a castle into existence, then a dragon, then ride the dragon to fly around that castle.
By Jacob's telling, Spawn is now being developed autonomously by a swarm of Fable-powered agents costing over $3 million in tokens *per month* ("we spend 30x payroll on AI tokens").
> Our agents change the live code directly and ship to production hourly, so they read every error, bug report and metric themselves. About 60% of our work starts from a production error, a Savi bug report (Savi is the AI you build games with in Spawn), something odd in our logs, or a feature request.
>
> Savi files bugs herself. When a user hits one, or Savi hits one in the product, she files it. It goes straight to an agent that decides whether it's a real bug to fix, something we won't fix, or intentional design that needs a decision. Usually it becomes a change, delivered to that user within an hour, with a message in the same chat.
This is [continuous deployment](https://en.wikipedia.org/wiki/Continuous_deployment) turned up to 11:
> A loop this tight only works if it never stops, so we treat an hour without a ship as a SEV-0, our most severe kind of incident. Unshipped changes pile up, and every problem already in production lasts longer. The feedback slows down too. An agent can only keep a few hours of work in its head, so shipping faster than that actually helps it stay coherent. [...]
>
> We can roll back a broken change in 30 seconds, exactly where it's broken and nowhere else. When a monitor or a log alert fires, it starts or wakes an agent that owns the incident, and we break things on purpose to test that those recovery paths work.
My eyebrows raised at least a dozen times reading this. I have trouble imagining this style of development working on software with higher stakes for when something goes wrong, but for a game this appears to be working surprisingly well.
Jacob says that Fable 5 (and then 5.1) was the model that made this level of autonomy possible. Opus 5.5 doesn't quite hack it for them, and when they tried GPT-6 Astra to apply fixes from a security review everything stopped working:
> Every feature had been disabled and marked to be turned on again once the security fixes were done. Astra had gone through our whole product and made the insecure things secure by turning them off.
These kinds of extreme experiments are why I'm [excited about game development](https://simonwillison.net/2026/Oct/28/vibe-game-development/) as a substrate for exploring the edges of what today's coding agents can do. |
2026-10-29 17:00:26+00:00 |
| GitHub Octoverse 2026 |
https://github.blog/news-insights/octoverse/octoverse-commits-pushes-reach-new-highs-in-2026-as-developers-build-with-agents/ |
I'm at GitHub Universe today (GitHub gave me a free ticket through their "GitHub Stars" program). EVP Jay Parikh just announced this year's Octoverse report, and highlighted these numbers in particular:
This is a pretty stark representation of the impact of agentic engineering on GitHub. In 2026, merged pull requests tripled in less than a year to 220 million per month. Commits more than tripled to 7.38 billion per month, with most of that increase in the second half of this year. New repository rate doubled this year, to 30.3 million per month.
The report includes new numbers by industry, and breaks out numbers for repositories that involve "interoperability or reverse engineering". The [methodology section](https://github.blog/news-insights/octoverse/octoverse-commits-pushes-reach-new-highs-in-2026-as-developers-build-with-agents/#h-methodology) includes notes about how they did this:
> **Top countries by pushes to public repositories, adjusted by profile location**. Pushes from each country were summed across the Octoverse year. To adjust for biases caused by VPN usage, LLM classification was used to extract the ISO 3166-1 alpha-2 code from the profiles of GitHub users who contributed pushes during this period [...]
>
> **Industry**. Public repositories created 2022 to 2026 were sorted into NAICS sectors by a fine-tuned multilingual embedding model using name, description, topics, and README, from random samples per year. [...]
>
> **Interoperability**. Counts public repositories created each year whose name, description, topics, or README mention interoperability or reverse engineering, or related terms, such as clean room implementation, drop-in replacement, or protocol re-implementation. |
2026-10-28 16:45:23+00:00 |
| Game Boy Color on My Conference Badge |
https://spf13.com/p/game-boy-color-on-my-conference-badge/ |
I'm at GitHub Universe this week and, [similar to last year](https://simonwillison.net/2025/Oct/28/github-universe-badge/), the conference badge is a full-blown color screen computer.
I've been hacking around with it again, and then I ran into with Steve Francia... who worked with Gemini to get a [full NES emulator](https://spf13.com/p/zelda-on-my-conference-badge/) working on it, and then went a step further and deployed an emulator for both the Game Boy and the Game Boy Color.
Which means, if you can obtain the ROM, you can run [The Legend of Zelda: Link's Awakening](https://en.wikipedia.org/wiki/The_Legend_of_Zelda:_Link%27s_Awakening) on your conference badge!
A neat feature of the badge is that you can turn it upside down and then use game controller touch buttons that are built into the badge body. |
2026-10-27 19:34:18+00:00 |
| GPT-6.1 Terra |
https://openai.com/index/introducing-gpt-6-1-terra/ |
It's always interesting to note which aspects of a new model are emphasized in the release announcement.
In the case of GPT-6.1 Terra, OpenAI went with visual reasoning and computer use:
> We’re introducing **GPT-6.1 Terra**, a fast, efficient model that combines detailed visual reasoning and precise computer use alongside clearer, more natural writing. A significant step up from GPT‑5.6 Terra, it excels at the communication and computer-based tasks that fill the workday, from drafting proposals and interpreting technical drawings to filling out forms and editing videos.
Terra sits in the same position as Sonnet in the Anthropic model collection - not the cheapest or the most expensive, making it harder to decide when to use it.
Computer use is a good example of a task that benefits from a less expensive model, since you might put it to work on automated, repetitive tasks.
OpenAI's Ted Sanders provided some useful advice in [a comment](https://news.ycombinator.com/item?id=50248124#50249160) on Hacker News:
> In the case of GPT-6.1 Terra, I'd say Terra is probably better than Astra and Sol at technical communication, similar on vision and computer use (but much faster!), and a bit worse on most other things. For API developers, it's a nice midrange option if you want something cheaper than Sol but a lot smarter than Luna (especially for vision / computer use / communication). For subscribers, it's not a bombshell release - if you're hitting usage limits, maybe it helps you go a bit further, and if you want clearer communication or faster computer use, it can be a nice option to select.
Here are [the pelicans](https://tools.simonwillison.net/markdown-svg-renderer?url=https%3A%2F%2Fgist.github.com%2Fsimonw%2F855d951d12c68eccca5374cd7d4f834e) for the different reasoning levels. This pelican [for "max"](https://tools.simonwillison.net/markdown-svg-renderer?url=https%3A%2F%2Fgist.github.com%2Fsimonw%2F855d951d12c68eccca5374cd7d4f834e#reasoning-2) cost [11.3161 cents](https://www.llm-prices.com/#it=16&ot=22629&sel=gpt-6.1-terra) and took 4 minutes and 11 seconds:
Here's [a new comparison grid](https://static.simonwillison.net/static/2026/openai-pelicans-october-2026.html) showing pelicans for every reasoning level of OpenAI's current frontier lineup: GPT-6 Astra, GPT-6.1 Sol, GPT-6.1 Terra, and GPT-6 Luna.
GPT-6.1 Terra is priced at $1/million input tokens and $5/million output - almost half the price of GPT-5.6 Terra and GPT-6.1 Sol, and around 10x the price of GPT-6 Luna. |
2026-10-26 23:53:07+00:00 |
| Introducing Kimi K3.1 Pro |
https://www.kimi.ai/blog/kimi-k3-1-pro |
Kimi K3.1 Pro landed on the Kimi API today - it's not yet open weights, but Moonshot promise "Full model weights will be released by Nov 4, 2026".
They're also offering a "Highspeed" version that's 2-3x faster, at twice the price (except for input token cache hits, which are priced the same).
The [US dollar pricing](https://platform.kimi.ai/docs/pricing/chat) is $2.00/million tokens for input and $10/million for output - the same as GPT-6.1 Sol and half the price of Claude Opus 5.5.
Moonshot's own benchmarks show Kimi as approximately level with Opus 5.5 and GPT-6 Astra - beating them on a few benchmarks, coming close on others.
Artificial Analysis [scored Kimi at 55](https://artificialanalysis.ai/models/kimi-k3-1-pro) - ahead of Claude Fable 5.1, GPT-6 Astra, and Gemini 4 Argon (all at 53) and behind only Claude Opus 5.5 (58).
This is the first time a (soon-to-be) open weight model has scored this highly against the frontier.
I tried it out via the [Moonshot API](https://platform.kimi.ai/docs/get-your-api-key) using the [llm openai endpoint](https://llm.datasette.io/en/stable/other-models.html#openai-endpoint) command I added to [LLM 0.32](https://llm.datasette.io/en/stable/changelog.html#v0-32) back in August:
llm openai endpoint \
https://api.moonshot.ai/v1 \
--key kimi \
-m kimi-k3.1-pro \
"Generate an SVG of a pelican riding a bicycle" \
--responses \
-o reasoning_effort low \
> kimi-k3.1-pro-pelican-low.stdout.txt \
2> kimi-k3.1-pro-pelican-low.stderr.txt
`llm openai endpoint` can run prompts against any OpenAI-compatible endpoint but doesn't log the results, hence the extra options to save stdout and stderr (the reasoning trace).
Here [are the pelicans](https://tools.simonwillison.net/markdown-svg-renderer?url=https%3A%2F%2Fgist.github.com%2Fsimonw%2F9b7181492209387da1d4f53002f26663) I got for Kimi K3.1 Pro on the three reasoning levels it supports - low, medium, and max. This is max:
For comparison, I ran fresh [pelicans against Kimi K3](https://tools.simonwillison.net/markdown-svg-renderer?url=https%3A%2F%2Fgist.github.com%2Fsimonw%2Feba9a4283c9e94cbbb5325902a3921a8) on those three reasoning levels. |
2026-10-23 19:40:54+00:00 |
| DE STAAT - FREEDOM (Official Music Video) |
https://www.youtube.com/watch?v=hKO4pQtIXow |
OK well this is a first for me... at [00:44](https://www.youtube.com/watch?v=hKO4pQtIXow&t=44s) in this new music video by Dutch alternative rock band [De Staat](https://en.wikipedia.org/wiki/De_Staat):
<video
src="https://static.simonwillison.net/static/2026/freedom-pelican.mp4"
poster="https://static.simonwillison.net/static/2026/freedom-pelican-poster.jpg"
preload="none"
loop="1" controls="1"
playsinline="1" muted="1"
width="1280"
height="720"
style="display: block; width: 100%; height: auto;"
> </video>
The visual effects are credited to Matties Grooten of [Fake it or Leave it](https://fakeitorleaveit.com). |
2026-10-22 19:42:26+00:00 |
| Donating Agent Skills to the Agentic AI Foundation |
https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation |
News today from Anthropic:
> We’re committed to keeping Agent Skills open, community-driven, and vendor-neutral. Today, we are donating the standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, [which we co-founded](https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation) with Block and OpenAI last year, and to which we donated the Model Context Protocol (MCP).
I'm pleased to note I called this one [last December](https://simonwillison.net/2025/Dec/19/agent-skills/), when Anthropic first declared skills to be an "open standard":
> I wouldn't be surprised to see this end up [in the AAIF](https://simonwillison.net/2025/Dec/9/agentic-ai-foundation/), recently the new home of the MCP specification.
Fun side note: since my blog content is available to Claude via the [datasette-mcp](https://github.com/datasette/datasette-mcp)
plugin I found that post by [prompting Claude](https://claude.ai/share/80b341de-590b-4834-bca9-0d9c9a3a0298) to "`Use simonwillison.net MCP to find if I ever talked about how I want skills to be donated to a standards body`". |
2026-10-22 18:09:56+00:00 |