Sunday, 8 November 2026
Microsoft ends AI Frontiers research group; GhostMap Android flaw has no patch; musl crypt enables SSH bypass
Today's Lead
EngineeringHunch (John Langford)
The End of AI Frontiers
John Langford helped found the Artificial Intelligence (AI) research group AI Frontiers (AIF) inside Microsoft Research (MSR). In September 2026, Microsoft merged AIF into Microsoft AI, a unit focused on scaling. Langford says the merge was not agreed, so he left Microsoft and AIF is ending.
Engineering
Bitdefender Labs
GhostMap: The Android flaw that crashes your phone before you open the app
Bitdefender Labs found that an Android package (APK) can trap a phone in a crash loop. The file needs no permissions and never runs. A malformed compressed archive (ZIP) entry makes the system process system_server crash and restart. Reboot and safe mode do not stop the loop, and recovery may need a factory reset that erases user data. Google has not fixed the flaw, and no security update exists yet. The flaw affects Android 10 and later, and researchers have not seen real attacks.
sunshowers.io
*sshole, or when are we finally going to get rid of C?
On Unix, the password hash '*' marks a locked account, but since 2012 musl libc's crypt also returns it for overlong passwords. The Secure Shell daemon (sshd) hashes login attempts for locked accounts, so an attacker may get a shell on some systems. The author argues that C error values are easy to ignore, while Rust forces callers to handle them.
tomclancy.info
Catching prompt injections hidden in PDFs
The author defined quality assurance (QA) for an internal tool. The tool uses an artificial intelligence (AI) agent to read financial Portable Document Format (PDF) files. The author showed that hidden text in a PDF can change the output. The author built several independent checks to find hidden content. The layered checks blocked every attack the author tested.
GitHub / hedgerow-dev
Coldframe: a honeypot that poses as a supermarket fridge controller
The coldframe tool is a honeypot. It imitates internet-exposed supermarket refrigeration controllers from Danfoss and Dixell. It logs connection attempts, passwords, and public exploits. The tool does not run commands or forward traffic. It is built with the Python standard library and runs in a container. It supports industrial control system (ICS) security research.
caleb.software
Goodbye Claude, Hello Pi
The author moves his main agent harness from Claude Code to Pi, an open-source tool. He lists problems with Claude Code, including CLAUDE.md file handling, a Visual Studio Code (VSCode) session limit, and frequent releases that lower quality. He calls Pi stable, minimal, and easy to customize.
Unlap
MaxxBench: benchmarking task adaptation in frontier coding agents
Unlap introduces MaxxBench, a benchmark that tests whether artificial intelligence (AI) coding agents adapt when task requirements change. Small changes to 89 DeepSWE tasks widen the score gap between models from 21 to 48 percentage points. The authors argue high scores need proof on changed tasks, since many agents follow guessed hidden tests.
Open Source Security
Dear Open Source Developers: It's OK not to embargo
curl now sends low and medium severity vulnerability reports to its public issue tracker. Only high severity reports stay private. Embargoes cost volunteer maintainers much time and effort. Report volume is now far higher than when embargo norms began. Each project can adopt curl's policy, change it, or drop embargoes entirely.