Search: “Easy!Appointments”

AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments

Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.

Unit 42's automated BOLA detection tool, built on generative AI, uncovered 15 broken object-level authorization flaws in the open-source scheduling application Easy!Appointments, tracked as CVE-2023-3285 through CVE-2023-3290 and CVE-2023-38047 through CVE-2023-38055. Nine flaws scored CVSS 9.9, letting logged-in customers view or manipulate appointments and accounts of providers and admins, including creating admin users for privilege escalation. The maintainers patched all issues in version 1.5.0. The same tool previously found a BOLA in Grafana (CVE-2024-1313).

Palo Alto Unit 42·Aug 17, 12:35 UTC · Aug 17, 2026VulnerabilityCVE-2023-3285CVE-2023-3286CVE-2023-3287+13 CVEs

Instacart launches an AI grocery shopping assistant called Clementine

Instacart launches Clementine, a conversational AI grocery assistant that turns chats, lists, or recipes into purchasable carts in the US and Canada.

Instacart launched Clementine, an AI assistant that converts conversations, grocery lists, photos of handwritten lists, or recipes into ready-to-buy carts, now available in the US and Canada. It generates personalized recipes, tailors recommendations to dietary needs such as gluten-free and vegetarian, and surfaces deals and lower-cost alternatives. Uber Eats and DoorDash have launched similar AI assistants as delivery apps compete to become households' default meal-planning tools.

TechCrunch · AI·Sep 9, 13:00 UTC · 7d agoAI industry

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.

Palo Alto Unit 42·Aug 17, 12:34 UTC · Aug 17, 2026ResearchCVE-2024-1313CVE-2024-22278CVE-2023-3285+14 CVEs

Explainability Assistant: A Conversational XAI Interface for Interpreting Energy Consumption Models

Researchers release Explainability Assistant, an open-source conversational XAI tool using LLM function calling, lifting intent-parsing accuracy from 76.8% to 94%.

The paper introduces the Explainability Assistant, an open-source conversational XAI system for interpreting energy consumption forecasting models such as genetic-programming symbolic regressors. It uses LLM function calling instead of rigid custom grammars, achieving 94% intent-parsing accuracy versus 76.8% for prior work TalkToModel, and adapts to different ML problem types without task-specific fine-tuning. Comparative evaluation with energy domain specialists against a traditional XAI dashboard showed improved usability, with all experts preferring the conversational interface.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:40 UTC · 6d agoAI research1

Britain’s next war won’t be an away game: Q&A with former head of Defence Intelligence

The Record·Aug 4, 16:28 UTC · Aug 4, 2026Threat actor

Reimagining advertising with AI

OpenAI launches ChatGPT advertising features including Sponsored Agents, AI ad creation in Ads Manager, and integrations with HubSpot and Shopify.

OpenAI is testing Sponsored Agents in the United States, letting users converse with clearly labeled business-sponsored agents after clicking ads in ChatGPT. Advertisers can create, update, and analyze campaigns via natural-language prompts in ChatGPT with an Ads Manager plugin, plus AI-suggested copy and imagery in Ads Manager. HubSpot becomes the first CRM partner and Shopify the first ecommerce partner, with the Shopify app expanding internationally on September 23.

OpenAI News·13:00 UTC · 10h agoAI industry

What It’s Like To Run a Tech Giant’s Security Team Without Ever Setting Foot in the Office

The Record·Aug 5, 00:00 UTC · Aug 5, 2026Vulnerability

Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine

Corelight argues agentic AI should replace SOC alert queues with hypothesis-driven, machine-run investigations, reserving humans for judgment.

A Corelight opinion piece argues traditional SOC alert queues guarantee most alerts go unreviewed because human analysts are the investigative bottleneck. It proposes agentic AI that investigates signals within seconds, tests hypotheses against network telemetry asynchronously, and escalates only evidence-backed cases to humans. The vendor claims this inversion lowers cost per investigation, expands coverage, and converts security telemetry into actionable evidence.

The Hacker News·Aug 26, 11:36 UTC · 21d agoIndustry

Upcoming Speaking Engagements

Bruce Schneier lists upcoming 2026 speaking engagements at LAcon V, Elevate Festival, CanSecWest, and events in Anaheim, Toronto, Vancouver, and Montreal.

Bruce Schneier posted his upcoming schedule, including LAcon V in Anaheim, an online League of Women Voters event on September 22, 2026, Elevate Festival in Toronto (September 22-24), CanSecWest 2026 in Vancouver (September 30-October 1), and ATTENTION: Democracy, Rebuilt in Montreal (October 21-23, 2026).

Schneier on Security·Aug 15, 00:00 UTC · Aug 15, 2026Industry

BreezeBlue/Breeze-TTS-2 — new model trending #19 on Hugging Face

BreezeBlue open-weights Breeze TTS 2, a bilingual text-to-speech model it ranks #1 among open-weight models on the Artificial Analysis TTS leaderboard.

BreezeBlue released open weights and Apache 2.0-licensed PyTorch inference code for Breeze TTS 2 on 2026-08-25. The text-to-speech model supports English and Chinese, voice cloning, reference-free voice design, voice direction, and inline vocal events like (laugh) and (sigh). Reported performance includes #1 open-weight ranking on the Artificial Analysis Elo leaderboard, under 40 ms time-to-first-audio, a 0.32 real-time factor on an NVIDIA H100, and about 7.7 GiB GPU memory for eager inference.

Hugging Face trending models·Aug 25, 16:39 UTC · 22d agoModel release

Shipt becomes the latest delivery app with an AI shopping assistant

Target-owned delivery platform Shipt launched Ask Shipt, an AI shopping assistant that turns prompts and dish photos into ready-to-buy carts.

Shipt, the same-day delivery platform owned by Target, announced Ask Shipt, an AI assistant that converts text prompts, budget constraints, and uploaded dish photos into customized shopping carts. It follows similar 2026 launches from Instacart (Clementine), Uber Eats, and DoorDash. Target.com has separately added AI features such as photo search and review summaries. The tool is available now in the Shipt app and on Shipt.com.

TechCrunch · AI·Sep 9, 14:51 UTC · 7d agoAI industry

Fashion app Daydream uses Apple Intelligence to help you shop the outfits in your camera roll

Fashion app Daydream uses iOS 27 Apple Intelligence APIs to turn saved outfit photos into shoppable matches and enable Siri voice search.

Daydream launched photo-based outfit shopping and Siri natural-language search built on Apple's iOS 27 developer tools, matching images against roughly 3 million products from 325+ retailers and 10,000 brands. The app claims over 1.5 million shoppers and frames the features as steps toward a cross-surface shopping agent. Competitors include Google, Amazon, Onton, and Alta.

TechCrunch · AI·Sep 14, 17:00 UTC · 2d agoAI industry

Mozilla's new Smart Window assistant runs on Mistral's models

Mozilla's Firefox Smart Window beta AI browsing assistant, powered by Mistral's models, launches in France and North America with no conversation storage.

Mozilla and Mistral partnered to power the Firefox Smart Window beta, an AI browsing assistant for complex searches, content recall, and tab summarization. The feature is available first in France and North America, with the UK and Germany to follow later this year. Mistral commits to storing no conversation data, and chats are not kept on Mozilla's servers by default.

The Decoder·15:01 UTC · 8h agoAI industry 2 sources1

Premium seats are coming to ChatGPT Business

OpenAI launches premium seats for ChatGPT Business with 5x usage and no five-hour limit.

OpenAI introduced premium seats for ChatGPT Business, offering 5x more usage than standard seats. Premium seats remove the five-hour usage limit and add flexible seat options. The change targets heavier enterprise users of ChatGPT.

OpenAI News·Aug 10, 00:00 UTC · Aug 10, 2026AI industry

Give Your Coding Agents a Memory You Own

Hugging Face introduces Funes, a tool that gives coding agents persistent, self-owned memory outside vendor clouds.

A Hugging Face blog post presents Funes, an approach for giving coding agents a persistent memory that developers own and control. The piece targets agent workflows where context must survive across sessions without ceding data to third-party services. No article body was available in the feed, so specifics beyond the title are limited.

Hugging Face Blog·Sep 3, 00:00 UTC · 13d agoAI tools & infra1

Enhancing Accessibility of Medical Texts through Large Language Model-Driven Plain Language Adaptation

Study shows LLMs with Mixture-of-Agents and QLoRA finetuning effectively simplify medical texts into plain language while preserving content.

The paper evaluates Plain Language Adaptation (PLA) using GPT-4o-mini, Gemini-1.5-pro, and LLaMA in zero-shot and few-shot settings. It compares prompting strategies, QLoRA finetuning across models, and integrates Mixture-of-Agents (MoA) techniques for robustness. Results demonstrate LLM-driven PLA makes healthcare texts more comprehensible while retaining essential content.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 16:33 UTC · 1d agoAI research

Helping older adults use AI in everyday life

OpenAI and AARP's OATS launch the Older Adults AI Skills Jam, a free program teaching seniors to use ChatGPT and spot scams.

OpenAI Academy, with Older Adults Technology Services (OATS) from AARP, is hosting in-person AI Skills Jam events in 10 US communities as part of a multi-year Senior Planet program. OpenAI says the share of US ChatGPT messages from people 55+ grew from 6% to nearly 10% in a year. The workshops include scam-awareness training, teaching warning signs like urgent language and suspicious links, and note that users ask ChatGPT tens of millions of times weekly to evaluate suspicious messages.

OpenAI News·15:49 UTC · 8h agoAI industry

Meta now lets AI agents handle the boring parts of WhatsApp Business setup

Meta launched a WhatsApp Business Tools MCP server that lets AI agents like Claude or Cursor set up and manage WhatsApp Business messaging accounts.

Meta announced a WhatsApp Business Tools MCP server, a Model Context Protocol server that connects AI coding agents such as Claude, Cursor, Codex, or ChatGPT directly to the WhatsApp Business Platform. The agents can handle account creation, phone number verification, Cloud API registration, Terms of Service checks, messaging template creation/editing, and webhook testing. Meta's companion Social Technologies MCP can also discover API endpoints, search documentation, and troubleshoot errors. The launch extends Meta's existing MCP servers for ad management and app configuration monitoring.

TechCrunch · AI·Sep 15, 20:12 UTC · 1d agoAI tools & infra

Introducing the Admin plugin for ChatGPT Work and Codex

OpenAI launched an Admin plugin for ChatGPT Work and Codex to manage workspace usage, members, permissions, and limits.

OpenAI introduced an Admin plugin for ChatGPT Work and Codex aimed at enterprise workspace administration. The plugin lets administrators analyze workspace usage, manage members and permissions, adjust usage limits, and act on admin requests. The announcement is a routine product feature launch with no security incident or vulnerability details.

OpenAI News·Aug 25, 00:00 UTC · 22d agoAI industry

LLM Agents as Computational Typologists

AUTOTYPOLOGIST is an LLM agent that performs evidence-grounded linguistic typology analysis over 25 open-source reference grammars.

The agent retrieves relevant grammar sections, analyzes interlinear glossed text (IGT), and iteratively reasons over typological hypotheses in a ReAct-style workflow. It was evaluated on typological feature coding against expert annotations and hypothesis testing against universals using 25 open-source reference grammars. Results suggest LLM agents can support scalable, inspectable crosslinguistic analysis but still require expert validation.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:35 UTC · 9d agoAI research1

3 new ways to plan and book travel in Search

Google Search's AI Mode adds travel features: hotel booking, airfare tracking, and airline miles and rewards visibility.

Google introduced three new travel capabilities in Search's AI Mode, including hotel booking, airfare tracking, and viewing airline miles and rewards. The features extend AI Mode from informational queries into transactional travel planning. The announcement positions Google Search to compete more directly with travel-focused booking services.

Google · AI·Aug 27, 16:00 UTC · 20d agoAI industry

ChatGPT can now connect to your personal apps to mimic writing style

OpenAI is testing ChatGPT Writing Style, which mimics a user's voice using writing samples from connected Gmail, Slack, and Drive accounts.

OpenAI confirmed it is testing a Writing Style feature for ChatGPT that learns a user's voice from writing samples in connected apps. The onboarding flow references Messaging (Slack), Documents (Google Drive and Notion), and Email (Gmail) as example sources. It resembles Anthropic's Styles personalization feature but draws on existing writing inside connected services rather than uploaded samples. The feature is available to a small group of users with no announced general rollout date.

BleepingComputer·Sep 7, 10:36 UTC · 9d agoAI industry

MInTRL: Off-policy Intervention can boost On-policy RL

MInTRL injects sparse judge corrections into on-policy RL rollouts, expanding exploration beyond on-policy sampling while preserving learnability on math and code benchmarks.

Minimal Intervention Reinforcement Learning periodically has a judge-intervention policy replace erroneous suffixes of the current policy's output with short corrections, then returns control, keeping trajectories largely on-policy. Training uses a sequence-level advantage-regression objective that removes the need for importance sampling. Across math and code benchmarks it consistently beats standard on-policy and off-policy baselines, remains effective with self-intervention, and performs best at moderate intervention intensity.

Hugging Face daily papers·Sep 10, 20:00 UTC · 6d agoAI research

What Did I Just Say? Self-Listening for Full-Duplex Speech Models

Researchers propose Self-Listening, a full-duplex speech approach feeding realized model speech back as input to improve interruption recovery.

Full-duplex spoken language models can listen and speak simultaneously, but asynchronous text generation, speech synthesis, and playback cause mismatches between what a model believes it said and what the user heard. The paper defines the resulting recovery problem as anchor interruption and proposes Self-Listening, which interleaves user speech, model text, and played speech as input streams. The authors also release AnchorSpeech, a benchmark with homogeneous training and test splits tracking which ordered response items were actually spoken. Experiments show self-listening models achieve better anchoring performance than full-duplex baselines.

Hugging Face daily papers·Sep 3, 20:00 UTC · 13d agoAI research

5 useful things you'll learn in my new post-training textbook (shipping now!)

Nathan Lambert's new RLHF and post-training LLM textbook covers PPO, GRPO, GSPO, CISPO and related techniques, freely available online.

Nathan Lambert's book 'Reinforcement Learning from Human Feedback: Aligning and Post-training LLMs' is now shipping from Manning. It covers policy-gradient algorithms including PPO, GRPO, GSPO, CISPO, and RLOO, plus loss aggregation, truncated importance sampling, asynchronous RL systems, and post-training topics like rejection sampling, outcome reward models, and on-policy distillation. The book is freely available online with a 12-hour course, codebase, and exercises.

Interconnects·Aug 10, 13:02 UTC · Aug 10, 2026AI research

Apple's Siri AI Can Be Swapped Out for Claude, ChatGPT, Code Shows

Code analysis of iOS 27 and macOS Golden Gate frameworks shows Apple engineered Siri to deeply interoperate with third-party AI models like Claude and GPT-5.6.

Code sleuth 'pdfu' uncovered private frameworks in iOS 27 and macOS Golden Gate revealing a 'Model Delegation' mechanism that lets Claude act as a Siri extension like the built-in ChatGPT extension. A second 'Inference Providing' protocol in Model Manager Services can fully replace Siri's server-side model with models such as GPT-5.6, which then receives Apple's Siri planner prompt and tool definitions to perform system actions and process personal data. The EU Digital Markets Act, which requires Apple to give third parties effective access to iOS features, may have shaped this approach. The entitlement is not yet open to third parties and Claude is not yet available in the macOS 27 Golden Gate RC.

Hacker News · AI·Sep 14, 12:01 UTC · 2d agoAI industryHN 57↑ · 14 comments

Ask Before You Optimize: Dynamic Pre-Formulation Clarification for Interactive Optimization

Researchers release OR-Clarify, a benchmark testing whether LLM agents ask clarifying questions before formulating optimization models from incomplete requests.

OR-Clarify evaluates pre-formulation clarification in operations research: each task gives a partial problem description, withholds structured hidden slots, and scores agents via bounded interaction with a simulated user, measuring slot recovery, stopping behavior, silent assumptions, and interaction cost. The authors also propose InterOPT, a two-stage framework that identifies formulation-critical gaps to decide when to ask or stop. In choice-based experiments InterOPT substantially outperforms all baselines in exact slot recovery and remains competitive in the open-ended setting.

Hugging Face daily papers·Sep 3, 20:00 UTC · 13d agoAI research1