Daily brief · Sunday, 1 November 2026
OpenAI scales back raise, ChatGPT takeover bug
Startups & Funding
The Wall Street Journal reports OpenAI has secured about $11B in commitments, less than half of its initial $30B target, and expects to raise more in coming weeks. The round values the company at $1.25 trillion, below the $1.4 trillion it had targeted. The Financial Times reports OpenAI now seeks about $20B at that valuation, as some investors cut commitments amid an AI selloff.
Security & Privacy
Researchers found that a public ChatGPT share could be turned into attacker-controlled JavaScript running as chatgpt.com in the session of whoever opened it. The chain started with two features that looked harmless alone, a graph and an HTML Preview. The code could list the victim's conversations, read a private conversation and send it to an external server, and call ChatGPT's authenticated APIs as the victim. OpenAI fixed it on October 26 and rated the report P1; The Hacker News reports a $5K payout.
CVE-2026-98432 is a use-after-free in the IPv4 TCP handshake that a remote, unauthenticated peer can reach, scored CVSS 3.1 9.8 by the kernel's CNA. The bug goes back to Linux 4.4. Stable fixes shipped October 11 and 15, in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. As of 5:15 PM CDT on October 31, Ubuntu's tracker still listed its kernels as vulnerable, and Red Hat, which raised its rating to Critical on October 30, listed RHEL 8, 9 and 10 as affected with no fix. The Go Security Team says Go programs open multipath TCP listeners by default.
Anthropic says a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which Anthropic did not build or publish. Anthropic is working with Cursor on the incident and says it was not a compromise of Anthropic's systems or employee laptops.
The Windows malware VOLTA-AUTODOXER, found through the CAIRN research effort, is a self-deleting infostealer. After stealing browser passwords, wallet seed phrases, session tokens and cloud keys, it builds an evidence bundle on the victim, including home address, employer and card last-4 digits. It sends the bundle to OpenRouter under a prompt to act as a forensic intelligence analyst, and the required output includes a section titled "WHAT THEY'RE WORTH".
Binance says it has covered 90% of the roughly $6.3B stolen from customers in its recent hack, having set aside more than $6.34B of company funds. The remaining 10% is in less liquid tokens. CEO comments reported by The Verge say the company plans to cover that portion too.
Big Tech
The Wall Street Journal reports CoreWeave, Nebius and Nscale have effectively been shut out of the bond market in recent weeks, as lenders and investors demand tougher terms. Separately, TechCrunch reports Nvidia is weighing cosigning financing for Nscale's AI data center in West Virginia.
AI
Tom's Hardware reports Claude has quietly started refusing work such as modding, decompiling or reverse-engineering video game code, with no official announcement. This follows a wave of AI-assisted game decompilation, browser ports and a PlayStation 5 jailbreak. A separate HN thread says Anthropic blocks users for anything touching training larger models.
Running in Codex at a low thinking level, GPT-5.6 Sol finished a peaceful-mode Factorio run in 13.5 hours of game time. It played through a Python library that enforces human-style limits such as reach and fog of war. The author says Sol exceeded expectations in some areas and showed clear weaknesses in others, and kept the run going past blue science.
Policy & Society
Rightsholders suing Meta over Llama training say former researcher Stephen Roller admitted in a deposition that he torrented the Books3 dataset, roughly 200,000 books, and knowingly distributed it. Roller worked at Meta from 2017 to 2023. Meta told Entrepreneur Media in August it did not believe it had obtained Books3 through BitTorrent. The court ruled last year that training Llama on books was fair use, leaving the BitTorrent downloads as the main open issue.
Show HN and Launch HN
A game for guessing Star Trek: The Next Generation episodes, made as a tribute to Patrick Stewart. It drew 234 points on HN.
A char-level neural network trained on machine-generated dmesg output that generates endless Linux boot logs. The inference engine fits in the MBR, with weights and vocab in the following sectors.
Contra's 6502 logic was translated routine by routine to C, checked frame by frame against the original in Mesen, then compiled to WebAssembly. It adds online two-player co-op.
A hardware project that gives a computer a phone line through a USB-C LTE modem.
Also today
A YouTube-style interface over 6,454 videos sourced from 39,834 HN comments since 2007. It reached 610 points on HN.
An ImGui-based coding harness built for local LLMs, which its author says uses about two orders of magnitude fewer resources than web-stack harnesses. It ships with no model providers built in.
S&P cited high capex and negative free cash flow. Meta stock fell 15% in October, its worst month in four years.
The Information reports Meta built the prototype with Chinese robotics firm Fourier in three months and is building a second. Meta says it has no plans to sell the units.
A judge allowed the lawsuit to move forward. It accuses the SpaceX-owned AI company of violating the Clean Air Act.
In a Wired interview, Apple's new leader John Ternus said the company does not want to ship AI for AI's sake. He said Tim Cook is available to help on policy, and that he has yet to meet Trump.
Washington Post tests found Copilot cited the error-prone Ballot Brief in 75% of tests and ChatGPT in 22%. The sites are obscure and AI-built.
Its latest release was July 31 (v8.19.2-4), so it lacks fixes already in Signal 8.27, including one for an exploit disclosed in October. Users cite UnifiedPush and F-Droid updates as reasons to keep it.
Read from 70 items posted in the last day on Hacker News, Techmeme, TechCrunch, The Verge, Ars Technica, Lobsters and the YC blog.
Get it every morning
The daily brief at 00:45 UTC, the weekly on Monday. Free, and one click to stop.