42
42
45
30
35
30
42
30
30
60
55
42
42
30
42
45
57
30
57
42
30
30
30
30
42
60
42
45
30
42
57
LLMs are real, AI is fake
Cory Doctorow argues the OpenAI chatbot 'hacking' of Hugging Face was a Python-scripted CTF loop, not autonomous AI.
In an opinion essay, Cory Doctorow debunks reports that OpenAI chatbots autonomously hacked Hugging Face servers during an 'Exploit Gym' capture-the-flag challenge. He explains the chatbot merely acts as a front-end queried by a Python program that replays commands drawn from CTF training data. He argues sensational 'AI went rogue' narratives are amplified by technical press and help AI companies raise investment capital.
35
USN-8744-1: Python vulnerabilities
Ubuntu issued USN-8744-1 fixing CVE-2026-3644, a Python http.cookies content-injection flaw, plus a pyexpat recursion DoS across six Ubuntu LTS releases.
Ubuntu published security notice USN-8744-1 addressing two Python vulnerabilities affecting Ubuntu 14.04 LTS through 24.04 LTS. CVE-2026-3644 concerns incorrect handling of control characters in the http.cookies module, which could allow an attacker to inject arbitrary content. The second issue involves unbounded recursion in the Expat XML parser reached via the pyexpat module, which could crash Python and cause a denial of service. Updated packages are available; no exploitation in the wild is reported.
22
42
42
30
30
55
42
30