Google pays SpaceX $920M/month for AI compute; Meta Instagram AI chatbot hack exposes 20K accounts; AI-powered worms adapt to each target

This Week in Security

Meta Confirms Thousands of Instagram Accounts Hacked via AI Chatbot

Meta disclosed that its AI-powered account recovery chatbot contained a critical vulnerability allowing attackers to reset passwords for at least 20,225 Instagram accounts lacking two-factor authentication. The bug failed to verify email addresses during password reset requests, enabling attackers to redirect verification codes to attacker-controlled addresses. Once inside, attackers accessed direct messages, posts, contact information, and linked account data, with Meta still unable to determine the full extent of data exposure.

arXiv

AI Agents Enable Adaptive Computer Worms

New research demonstrates a novel threat where AI agents power adaptive computer worms that generate customised attack strategies for each individual target. Unlike traditional malware relying on fixed vulnerability exploits, these worms use large language models to reason about targets and develop individualised attacks, making them resistant to conventional patching. The threat is compounded by attackers leveraging stolen compute at zero marginal cost and operating outside commercial AI platform controls, with successful propagation demonstrated across Linux, Windows, and IoT environments.

Include Security

The Smart TV in Your Living Room Is a Node in the AI-Scraping Economy

Security researchers reveal how Bright Data's SDK—embedded in consumer apps on smart TVs and other devices—silently converts residential networks into a massive proxy infrastructure spanning over 400 million home IP addresses for AI training data scraping. The SDK establishes persistent tunnel connections that relay scraping traffic even while users are actively watching, and employs inspection bypasses to evade VPN and security monitoring. Geographic analysis found deliberate market segmentation, with devices in certain regions assigned dramatically higher bandwidth allocations for data collection.

LWN

Moving Beyond fork() + exec()

The Linux kernel community is actively discussing proposals to replace the traditional fork() + exec() process creation model. Li Chen's 'spawn templates' proposal, aimed at caching executable information to speed up process creation, showed only modest performance gains and prompted the discussion to shift toward a native kernel-level posix_spawn() implementation using a builder API with pidfd abstractions. The goal is to create processes more efficiently without the memory overhead of fork()'s copy-on-write semantics.

su3.io

Introducing ZeroServe: A Zero-Config Web Server Scriptable with eBPF

ZeroServe is a lightweight HTTPS web server that serves sites from tarballs and uses eBPF programs as its configuration and request-handling layer instead of traditional config files. It outperforms nginx on single-core benchmarks for small static files, implements modern standards including TLS 1.3, HTTP/2, and ECH, and uses io_uring for efficient I/O. The project offers a unified design where one eBPF program doubles as both configuration and request handler, along with reverse proxying with connection pooling.

Anders Murphy

The Perils of UUID Primary Keys in SQLite

Random UUID (UUID4) primary keys perform 14–16x slower than integer primary keys in SQLite because their random ordering causes constant B-tree rebalancing on insert. The author demonstrates that time-ordered UUIDs (UUID7) restore performance to levels comparable to ordered integer inserts, making them a safe drop-in replacement when a globally unique identifier is required. The recommendation is clear: use UUID7 or integer keys and avoid UUID4 in write-heavy SQLite workloads.

Randal Olson

New U.S. College Grads Now Have Higher Unemployment Than the Average Worker

For decades recent college graduates enjoyed lower unemployment rates than the broader US workforce, but that relationship inverted around 2019 and the gap has widened to a record 1.4 percentage points by early 2026—5.6% for new grads versus 4.2% overall. The shift predates both COVID-19 and the AI boom. The New York Federal Reserve attributes roughly 64% of the rise to remote work policies that discourage hiring inexperienced workers, while Stanford researchers point to AI's displacement of early-career roles, particularly in computer science.

Eli Bendersky

Thoughts on Starting New Projects with LLM Agents

Eli Bendersky shares practical lessons from using AI agents to bootstrap a new WebAssembly toolkit, arguing that human oversight remains essential—all generated code must be read and understood before merging. His workflow keeps agents in a local CLI while changes are reviewed in an editor, with small commits to preserve comprehension. He favours Go for agent-assisted projects due to its readability and consistency, and emphasises that strong test suites are the key ingredient for reliable agent performance. His conclusion: LLM agents accelerate experienced developers on well-scoped problems but are not a substitute for learning.

pokeemerald.com

Pokémon Emerald Ported to WebAssembly (100k FPS)

The open-source pokeemerald decompilation project has been compiled to WebAssembly and now runs directly in the browser, achieving up to 100,000 frames per second—several thousand times faster than the original Game Boy Advance hardware. The port supports full keyboard controls and adjustable game speed, and requires no download or installation. The achievement highlights the maturity of GBA game decompilation efforts and the performance headroom available when running retro titles on modern hardware via Wasm.