← Digest
EP235 · Saturday, November 7, 2026 · 15 min read · 閱讀中文版

Your login email leaked out, while safer phones got locked out of banking

Claude Code stuffed login emails into User-Agent; Dutch ASN Bank blocks GrapheneOS with Play Integrity

Spend 1% of your day keeping up with tech.

Quote of the Day#

“I receive dozens of scam emails per day because claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission.” — taylor-edwards, reporter of GitHub issue #107757 (source)

“The products aren’t good enough to sell people on the costs. You cannot tell people that you have to listen to the whine of a data center in their backyard for AI overviews and some of the most hilarious deep fake slop in history.” — Nilay Patel, The Verge (source)

Today’s Theme#

One question stuck with me today: who gets to take our identity, and who gets to lock us out.

Start with Claude Code. It put your signed-in email where the model could see it, and when the model wrote its own curl calls, it dropped that email into the User-Agent header. You did nothing, and your address went out anyway. Anthropic has apologized and says the email leaves the context next week.

Meanwhile in the Netherlands, ASN Bank cut GrapheneOS users off from iDEAL payments because their phones fail Google’s Play Integrity check. A more secure phone, flagged as “not secure enough.”

I keep coming back to this: systems quietly grab a bit more of who you are for convenience or compliance, and users pay the price.

Agent tools keep shipping anyway, with new releases from Meta, GitHub, Tencent and Cloudflare today. The tools get stronger while the trust boundaries keep cracking, and that tension is what I want to remember from today.

If you ship apps, one more thing: CHAI, a big-earning AI chat app, just disappeared from the App Store in several countries.

Must Read#

  1. Claude Code: login email stuffed into User-Agent and sent to visited sites: long read · privacy / vuln · Hacker News
  2. ASN Bank: idealistic bank blocks GrapheneOS Wero payments via Play Integrity: long thread · privacy / payments · Hacker News
  3. BUI: Blender’s GPU UI as a cross-language library, billed faster than GPUI: repo · 1,278 stars · Hacker News
  4. CVE-2026-83844: Windows Paint remote code execution, CVSS 8.1: CVE · security · Hacker News
  5. Meta Muse Spaces: describe a project space, connect apps for background updates: 3 min · product · TechCrunch
  6. Chimera Linux: making musl work with proprietary NVIDIA drivers: long read · systems · Lobste.rs
  7. Palo Alto Networks in talks to buy AI agent security startup Clutch for ~$500M: 3 min · M&A · TechCrunch
  8. GitHub: a developer’s guide to agentic engineering (Plan/Build/Verify/Observe): long read · engineering · GitHub Blog
  9. Tencent open-sources LoopForge: team-level self-evolving coding-agent platform: 18 min · open source / platform · InfoQ CN
  10. tsrs: Cloudflare x VoidZero Rust port of the TypeScript checker, agent-driven: 4 min · toolchain · InfoQ CN
  11. Hundreds of Artex AI hacking tools found publicly exposed: 5 min · security · TechCrunch
  12. Nilay Patel: products aren’t good enough to sell the data-center costs: short quote · commentary · Simon Willison

1. Claude Code: login email stuffed into User-Agent and sent to visited sites#

long read · privacy / vuln · Hacker News

Why you should care: If you use Claude Code for web search or curl, remote server logs may already hold your work email.

Summary: taylor-edwards filed #107757 after scam floods. Anthropic’s Lydia Hallie said OAuth email was added to context for @author tags; when the model wrote curl against Wikipedia/SEC-style UA policies, it filled in that address. Interim fix: 2.1.317+ built-in cc-plugin-privacy (on by default); next week email leaves context. Users report the mod still misses scripted Write/Edit paths and UAs that name the project without the address. Community hooks like whoami-guard appeared. X amplification included The_Cyber_News (64 likes).

Community: HN 1,542/487; ongoing GitHub traffic; X news story.

Why it matters: I update Claude Code today, switch to a throwaway login, and block outbound User-Agents that carry my own address.

2. ASN Bank: idealistic bank blocks GrapheneOS Wero payments via Play Integrity#

long thread · privacy / payments · Hacker News

Why you should care: If you care about European payment sovereignty or de-Googled Android, banks are making Google attestation the default gate.

Summary: PrivSec report #105 blew up. From ASN 1.36.3, iDEAL|Wero runs Play Integrity; GrapheneOS users see “phone/app install fails security requirements.” Complaint replies share a template blaming the shared Wero framework. EPI/Wero claimed hardware key attestation only proves a key stayed in TEE, not app/OS integrity - developers cite GrapheneOS attestation docs saying that is wrong. bunq, Triodos, N26, Fortuneo users still report working Wero on GrapheneOS. Motorola Signature 27 GrapheneOS support is being used as leverage.

Community: Debate moved from “app broken” to “critical EU infrastructure depending on US attestation.”

Why it matters: When I add device integrity, I will document what hardware attestation proves vs Play Integrity, and who owns the allowlist.

3. BUI: Blender’s GPU UI as a cross-language library, billed faster than GPUI#

repo · 1,278 stars · Hacker News

Why you should care: Looking for a native-feeling, low-power desktop UI runtime without Electron? This is today’s loudest option.

Summary: ppmpreetham/BUI extracts Blender’s UI for Python, Rust, JS/React, C, C++, Dear ImGui. README highlights damage rendering, CPU/GPU paths, tkinter compatibility, Qt-style APIs; docs at bui.preetham.top. License GPL-3.0-or-later. HN: 660 points, 267 comments; GitHub API ~1,278 stars (created 2026-08).

Why it matters: Another desktop UI reference besides Flutter. Tooling panels first; product shell stays Flutter for now.

4. CVE-2026-83844: Windows Paint remote code execution, CVSS 8.1#

CVE · security · Hacker News

Why you should care: A coworker-sent image can hit Paint; check personal and fleet images for the patched build.

Summary: Microsoft published CVE-2026-83844, Windows Paint RCE via out-of-bounds read (CWE-125). Affected Microsoft Paint from 11.0.0.0 before 11.2609.401.0. CVSS 3.1 base 8.1 (HIGH), AV:N/AC:H/PR:N/UI:N. Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844 . HN 695 points, 269 comments (https://news.ycombinator.com/item?id=50384233).

  • Point 1: Attack complexity High, but network vector with no privileges required
  • Point 2: Enterprises should confirm WSUS/Intune reached 11.2609.401.0+

Why it matters: I will not assume small inbox apps are safe; Paint version checks go on the weekend list.

5. Meta Muse Spaces: describe a project space, connect apps for background updates#

3 min · product · TechCrunch

Why you should care: Consumer agents are growing from one chat box into durable mini-app workspaces.

Summary: Lucas Ropek reports Meta Spaces for Muse. Describe a need; Muse builds a tracker/planner/board. Connect Gmail, Calendar, OpenTable, Notion and similar for background price/date updates. Zuckerberg posted BBQ game, event tracker, home dashboard experiments. October earnings: ~10M Muse users in US/Canada. The Verge covers scheduling Spaces in sidebar/main tab plus Active Memory/Active Focus. Voice shipped the day before - two Muse features in a week.

Why it matters: Agent IA is moving to multi-workspace. Side projects should design project spaces early, not one endless thread.

6. Chimera Linux: making musl work with proprietary NVIDIA drivers#

long read · systems · Lobste.rs

Why you should care: Need NVIDIA proprietary drivers on a musl distro? This write-up unpacks GLVND, gcompat, ifunc, STATIC_TLS, and recursive mutex shims.

Summary: q66 documents Chimera bringing NVIDIA 580/620 branches onto musl: switch to GLVND, bump gcompat, patchelf DT_NEEDED, musl-nvidia ifunc patch, dynamic linker DF_STATIC_TLS handling, and symbol renaming for glibc static recursive mutex initializers. Tested on GTX 980 Ti (legacy 580); community reports RTX 3070 Ti (620) and partial AArch64. PRs not fully ready, but packages exist for x86_64/aarch64.

Why it matters: Bookmarked for the next Alpine/Chimera GPU container experiment.

7. Palo Alto Networks in talks to buy AI agent security startup Clutch for ~$500M#

3 min · M&A · TechCrunch

Why you should care: Once agents enter corporate systems, identity and permissions become a product category big vendors buy instead of building.

Summary: Marina Temkin cites a source: Palo Alto Networks talks to buy Clutch Security (~$500M cash plus milestones) for AI agent access control. Clutch 3 years old; Jan 2025 Series A $85M valuation; ARR approaching $10M (50x). The Information first reported. Peers: Cyera bought Oasis ($1B); Cisco bought Astrix ($400M). Palo Alto’s 2026 buying spree includes Console ($500M), Embrace, Chronosphere, Koi.

  • Point 1: Neither company commented; figures from sources and public rounds
  • Point 2: Multiple sits near the Upwind/Datadog ~40x ARR narrative

Why it matters: Agent permission governance becomes a procurement line item. I will ask how agent identities are revoked.

8. GitHub: a developer’s guide to agentic engineering (Plan/Build/Verify/Observe)#

long read · engineering · GitHub Blog

Why you should care: Coding got faster; planning, review, and production debug did not. GitHub puts numbers on the whole loop.

Summary: Nick Liffen and Philip Holleran: GitHub saw 1.2B+ commits in one October 2026 week (>400% YoY), while Faros AI found PR review time +441% from low to high AI adoption. Copilot across Plan (Slack/Teams, Issues, Plan Mode), Build (session continuity, cloud sandboxes, repo instructions, Dreaming), Verify (stacked PRs, Code Quality, graded review, AI Scan, Agent Merge), Observe (connectors back into Issues). Points to Universe talk “Agentic Engineering: Past the Pilot.”

  • Point 1: After coding sped up, the bottleneck moved to review and observation
  • Point 2: Enterprise managed settings travel across Copilot surfaces

Why it matters: I will keep PRs smaller and put validation commands into repo instructions.

9. Tencent open-sources LoopForge: team-level self-evolving coding-agent platform#

18 min · open source / platform · InfoQ CN

Why you should care: Building a multi-person coding agent? LoopForge opens cloud workspaces, a shared Main Bot, SOP gates, and engineering-style RSI.

Summary: InfoQ CN recounts Tencent Lightweight Cloud’s LoopForge (https://github.com/Tencent/LoopForge): 20+ internal businesses, 200+ monthly auto-delivered tickets. Five steps: 24/7 cloud workspace, shared Main Bot, five-layer SOP with human takeover, Issue autopilot with conflict healing, engineering RSI (in-run gates + cross-run SOP rewrites). Aligns with DeepSeek Super-agent’s human-attention ceiling. ~130 GitHub stars; loopforge.cn; bash scripts/install.sh.

  • Point 1: One conversation binds one workspace and one Main Bot to avoid multi-bot pollution
  • Point 2: Credentials inject via gateway and wipe after tasks; models never see raw secrets

Why it matters: Team agents easily become noise. I will copy the “when to speak / when to auto-approve” structure, not necessarily the whole stack.

10. tsrs: Cloudflare x VoidZero Rust port of the TypeScript checker, agent-driven#

4 min · toolchain · InfoQ CN

Why you should care: Large TypeScript monorepos pay daily taxes in typecheck time and RAM.

Summary: Cloudflare with VoidZero and Max Schwenk ship tsrs (Oxc, https://github.com/oxc-project/tsrs, ~2,961 stars). Claims up to 8x faster typecheck and ~70% less memory at equal workers; WASM via @tsrs/wasm. Schwenk says Claude Opus 5.5 agents drove the port against 15,197 TS conformance tests. Owner’s 37k-file monorepo: TS 7.0 ~19 GiB / 80s vs tsrs ~7s. Independent bench ~5.3x / -72% RAM, but exit code 2 on errors (tsc uses 1) can break CI; gains shrink vs TS 7.1 beta. Daniel Rosenwasser: speed is not only Rust; some tsrs ideas already feed TS 7.1. Experimental: no watch, no LSP.

  • Point 1: npm i -D tsrs && npx tsrs -p . --noEmit
  • Point 2: Tracks TS 7; TS 5/6 teams should move to Microsoft’s Go port first

Why it matters: I will run tsrs as a side CI job until exit codes and diagnostics match.

11. Hundreds of Artex AI hacking tools found publicly exposed#

5 min · security · TechCrunch

Why you should care: Attack tools left open without auth also publish implants and loot directories.

Summary: Zack Whittaker cites Censys: 800+ unauthenticated Artex instances on the public web. Artex is an open-source autonomous pentest framework; Microsoft previously described agentic recon-to-exfil with little human input. Silas Cutler notes not every instance is malicious, but the software does not need internet exposure. CrowdStrike tied a September Korea finance campaign partly to an exposed Artex; Censys said that instance sat open for months with data beyond banks. October ConnectWise attack also saw Artex. Artex plans closed-source; code copies remain.

  • Point 1: Many linked attacks still ride weak passwords and missing MFA
  • Point 2: Exposure hurts operators’ own loot directories too

Why it matters: Anything that works locally should not bind 0.0.0.0 by default. I will recheck listen addresses on my scanners.

12. Nilay Patel: products aren’t good enough to sell the data-center costs#

short quote · commentary · Simon Willison

Why you should care: After the US midterms, political cost of AI infrastructure is said out loud; product narratives have to answer.

Summary: Simon Willison quotes The Vergecast. Nilay Patel: products are not good enough to justify backyard data-center noise; AI overviews and deepfake slop do not buy social license; agents are not yet what people want; companies spend more than they make. He ties that to political spectacle and concludes the industry exits only by shipping products whose benefit is obvious without an ad campaign.

  • Point 1: Source: The Vergecast - Big Tech lost big in the 2026 election
  • Point 2: Same week as X threads on data-center votes and harness engineering

Why it matters: When I pitch AI features, I will lead with steps saved in a week, not vision decks.

More to Read#

Builder Radar#

1. CHAI pulled from multiple App Stores; tracker cited ~$3M MRR#

App Store Tracker says CHAI vanished the same day in US/UK/Canada/Australia; post cites ~$3M MRR and a Reddit note about “improving the app,” plus Apple AI-app rule changes ~6 days earlier (~7.3k impressions, 32 likes).

What it means for your app: AI chat/character review risk can wipe revenue overnight. Keep a communications plan, migration path, and a non-store backup.

2. Apple Retention Messages: ASC is open, but UI != API#

Hendrik Haandrikman ran an emergency webinar: Retention Messages appear for every ASC account, yet on-screen config does not match Retention Messaging API capabilities (~2.1k impressions, 27 likes).

What it means for your app: The cancel screen is now an ops surface. With RevenueCat or custom code, verify ASC UI vs API fields with a recorded cancel path.

3. Indie MRR diary: ~$384 portfolio, $239 from App Store#

Luka Shaw week 15: 75 subs, 9 trials, $384 MRR, $649 / 28 days; App Store alone 61 subs, $239 MRR, $504 / 28 days.

What it means for your app: Tiny utilities can stack, but high App Store share makes review/takedown/retention messaging cashflow-critical. Keep a non-store channel.

4. Cursor Build Live Apps: describe it, get a shareable URL#

X news story: Cursor Build Live Apps scaffolds via cloud agent, Neon Postgres, Cursor SSO, security checks, deploy to Vercel on paid plans.

What it means for your app: Internal tools/demos skip localhost screenshots. Production still needs your data retention, authz, and compliance story.

5. Airbnb AI travel agent targeted for H1 2027#

Airbnb put a travel agent on the H1 2027 roadmap.

What it means for your app: Vertical travel/subscription tools must prove a sharper single-scene edge before that collision.

6. Tolt connects RevenueCat for store purchase affiliate payouts#

Tolt announces RevenueCat sync for App Store/Play purchases into partner payouts (~6 likes, 374 impressions).

What it means for your app: Fewer custom webhooks for affiliate-driven growth - but model refunds, trials, grace, and Family Sharing before go-live.

Builder note: CHAI is a reminder about takedown risk, Retention Messages turns the cancel screen into an ops surface, the MRR diary shows how much cashflow sits on the store, and Cursor plus Airbnb put big-platform agent timelines on the table. My check order: review backup -> cancel copy -> payment rails -> affiliate reconciliation.

What the Community Is Arguing About#

1. Should Claude Code email leaks make you switch harnesses?#

HN’s 1,542-point thread splits between Anthropic’s apology/privacy mod and “privacy must not be a plugin” / move-to-pi calls. People scanned ~/.claude/projects/**/*.jsonl for dozens of UA leaks; whoami-guard claims 8/60 -> 0/60. The fight: can regex mods stop stochastic models, or must email never enter context? I take the latter.

Related: HN

2. European payment sovereignty vs Google Play Integrity#

ASN/Wero talk shifted from broken apps to whether critical rails should bind US attestation. EPI replies are being line-edited; developers publish dual Play Integrity + Keystore measurements; regulator outreach is on the table. bunq/Triodos/N26 counterexamples weaken “technically impossible.”

Related: HN

3. Is harness engineering a real job family?#

X news frames Anthropic/Google hiring harness specialists at high bands, while another thread argues subagent handoffs lose context and prefer forking the main session. My bias: long tasks need clear gates; short tasks should avoid agent sprawl.

4. Whose baseline is tsrs’s 8x?#

Weekend migrants report ~5x; others note smaller gains vs TS 7.1 beta and exit code 2 vs tsc’s 1. Daniel Rosenwasser says speed is not only Rust. Benchmark baseline and CI compatibility matter more than language wars.

Related: oxc-project/tsrs

Chinese Tech Scene#

1. LoopForge: coding agents enter engineering teams#

(InfoQ CN): InfoQ CN: Tencent Lightweight Cloud open-sources a team agent platform; 20+ internal businesses, 200+ tickets/month.

2. Cloudflare and VoidZero launch tsrs#

(InfoQ CN): InfoQ CN: Cloudflare/VoidZero tsrs claims up to 8x / ~70% less RAM; align on TS 7 first.

3. Harness evolution for agents#

(InfoQ CN): InfoQ CN: harness evolution from chains/graphs to code - same week as English harness-job talk.

4. DigitalOcean learning/data services for agents#

(InfoQ CN): InfoQ CN: cloud services framed for agent self-iteration.

5. GitHub redesigns PR overview#

(iThome): iThome: GitHub PR overview redesign clusters merge state and todos.

6. OpenSSH long-password bypass patches#

(iThome): iThome: OpenSSH long-password auth bypass patches - continues yesterday’s Alpine/musl line.

7. OpenAI ships GPT-6 Cyber#

(iThome): iThome: OpenAI GPT-6 Cyber security-oriented model coverage.

8. GCE API multi-version concurrency#

(iThome): iThome: GCE API multi-version concurrency eases forced upgrades.

9. M6 MacBook Pro first look#

(sspai): sspai: M6 MacBook Pro efficiency first look.

10. ChatGPT search nearing 20% of Google#

(TechNews): TechNews: ChatGPT search volume nearing ~20% of Google.

11. Medical AI transparency poll#

(TechNews): TechNews: medical AI transparency poll - ~80% want transparency.

12. NgRx 22 release#

(InfoQ CN): InfoQ CN: NgRx 22 Resource Extensions and dynamic DeepSignal.

Open Source Picks#

1. ppmpreetham/BUI#

multi-language | 1,278 stars

Blender GPU UI library for Python/Rust/JS/C/C++; GPL-3.0-or-later; docs at bui.preetham.top; HN 660-point thread.

2. oxc-project/tsrs#

Rust | 2,961 stars

Rust port of the TypeScript 7 type checker; WASM-capable; watch exit-code differences vs tsc; claims up to ~8x.

3. zortos293/Lichii#

C++ | 3,837 stars

Experimental Nintendo Switch 2 emulator; README marks VERY experimental; high stars, verify playability yourself.

4. Tencent/LoopForge#

  • | 130 stars

Team coding-agent delivery: cloud workspaces, SOP gates, engineering RSI; ~200 tickets/month internally; bash scripts/install.sh.

5. deepseek-ai/dsh-superagent-prototype#

TypeScript | 20,220 stars

DeepSeek Super-agent research prototype (MIT); read beside LoopForge on “bother humans less” philosophy and auth models.

Watch & Listen#

1. Fireship: the thing holding theoretical CS together just broke… kinda#

Channel: Fireship

Fireship

Why you should care: Short-form take on “trusted foundations failing” - a B-roll companion to today’s identity theme.

  • Point 1: Title targets assumptions people treat as solid
  • Point 2: Useful pacing reference for spoken digests
  • Point 3: Local transcript fetch was empty; details from the video itself

2. 20VC: who is carrying the downside in the AI boom?#

Channel: 20VC with Harry Stebbings

20VC

Why you should care: Investor framing of risk holders - same week as Nilay Patel’s cost critique and builder takedown anxiety.

  • Point 1: Breaks down who carries downside
  • Point 2: Pair with Stratechery midterm data-center talk
  • Point 3: No local transcript; replay before quoting

3. Silicon Valley 101: data-center financing, power, and froth#

Channel: Silicon Valley 101

SV101

Why you should care: Chinese long-form complement to English post-election data-center pushback.

  • Point 1: Annual offline conference cut
  • Point 2: Financing meets power constraints
  • Point 3: Good extended listen after Today’s Take

Today’s Take#

I finished the Claude Code issue in a bad mood. You didn’t click anything. The model still wrote your login email into the User-Agent and sent it to the sites it visited. Anthropic apologized and said the email leaves the context next week. Until then I will update Claude Code to 2.1.317 or newer, switch to a throwaway login, and add a hook that blocks outbound requests carrying my address.

The ASN Bank story made me angrier. GrapheneOS locks the phone down more tightly, but users fail Google’s Play Integrity check, so iDEAL and Wero payments just stop working. The bank hands the verdict to Google’s black box. Hardware attestation could have answered the integrity question; they did not use it. If I add device integrity later, the docs will spell out what hardware attestation proves and what Play Integrity proves, plus who maintains the allowlist and how often it updates. I don’t want the only record to be a screenshot of a green pass.

I will keep tsrs on a side CI job until its diagnostics match tsc. Errors return exit code 2 there, while tsc returns 1, so flipping the main pipeline too early would break existing scripts. From LoopForge I will borrow the idea of one Main Bot plus gates. I will not drop the whole platform in. CHAI vanished from several App Stores, and Retention Messages shows one thing in App Store Connect while the API can do another. For a subscription product I will keep a site and an email list, so I can still talk to users if the store goes dark.

I am also holding onto what Nilay Patel said about data-center costs. The product has to make the trade feel worth it; a slide deck will not. Muse Spaces, Cursor Live Apps, and Airbnb’s travel agent all added features today, but I still judge them by whether a user does fewer annoying chores in a week. If the changelog can show that kind of change, I will put the agent work in the title. Paint’s remote code execution and the 800-plus exposed Artex instances go on my weekend list: check Paint builds on Windows images, and make sure my scanners are not listening on 0.0.0.0.

More from the same month