Slashdot

An anonymous reader quotes a report from Ars Technica: Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase that threatens millions of people using Chrome, Microsoft Edge, and virtually all other Chromium-based browsers. The proof-of-concept code exploits the Browser Fetch programming interface, a standard that allows long videos and other large files to be downloaded in the background. An attacker can use the exploit to create a connection for monitoring some aspects of a user's browser usage and as a proxy for viewing sites and launching denial-of-service attacks. Depending on the browser, the connections either reopen or remain open even after it or the device running it has rebooted. The unfixed vulnerability can be exploited by any website a user visits. In effect, a compromise amounts to a limited backdoor that makes a device part of a limited botnet. The capabilities are limited to the same things a browser can do, such as visit malicious sites, provide anonymous proxy browsing by others, enable proxied DDoS attacks, and monitor user activity. Nonetheless, the exploit could allow an attacker to wrangle thousands, possibly millions, of devices into a network. Once a separate vulnerability becomes available, the attacker could use it to then compromise all those devices. "The dangerous part here is that you can just have a lot of different browsers together that you can in the future run something on that you figure out," said Lyra Rebane, the independent researcher who discovered the vulnerability and privately reported it to Google in late 2022 in an interview. He said using the exploit code Google prematurely published would be "pretty easy," although scaling it to wrangle large numbers of devices into a single network would require more work. In the thread of Rebane's disclosure to Google, two developers said in separate responses that it was a "serious vulnerability." Its severity was rated S1, the second-highest classification. Since its reporting 29 months ago, the vulnerability remained unknown except to Chromium developers. Then on Wednesday morning, it was published to the Chromium bug tracker. Rebane initially assumed the vulnerability was finally fixed. Shortly thereafter, he learned that, in fact, it remained unpatched. While Google removed the post, it remains available on archival sites, along with the exploit code. Google representatives didn't immediately respond to an email asking how and why it published the vulnerability and if or when a fix would become available. The exploit works by abusing Chromium's Browser Fetch API to open a service worker that remains persistently active. A malicious website can trigger it through JavaScript, creating a connection that can be used "for monitoring some aspects of a user's browser usage and as a proxy for viewing sites and launching denial-of-service attacks," reports Ars. Depending on the browser, those connections "either reopen or remain open even after it or the device running it has rebooted," effectively turning the device into part of a "limited botnet." Read more of this story at Slashdot.

Longtime Slashdot reader Himmy32 writes: GitHub has announced on X that their internal repositories have been breached through a compromised VS Code Extension on an employee's workstation. Bleeping Computer reported that the attack is linked to TeamPCP who have been in the news for a recent campaign affecting Checkmarx, Trivy, SAP, TanStack, and Bitwarden. The group appears to be attempting to sell the stolen code on cybercrime forums. "Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately," the company said. "Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker's current claims of ~3,800 repositories are directionally consistent with our investigation so far." Although the investigation remains ongoing, GitHub says it has "no evidence of impact to customer information stored outside of GitHub's internal repositories." The company has also not said whether it's in contact with the hackers or if it's received a ransom demand. Read more of this story at Slashdot.

Seagate CEO Dave Mosley said Monday that building new memory chip factories or adding capacity would "take too long" to keep up with AI-driven storage demand. "If we took the teams off and started building new factories or bringing up new machines, that would just take too long. You would end up with more capacity, but then you'd slow the rate of growth on that technology," Mosely said. CNBC reports: Memory chip stocks have soared in recent months as a flood of AI investing has sent demand soaring, with the chips a key part of the AI buildout in data centers. Chip production cycles stretch over many quarters for a single unit, and investors are increasingly wary of how long the leading memory makers can capture demand. CME Group is launching a new futures market for semiconductors, enabling more traders to lock in prices and hedge against the rising prices of computing power. At Monday's conference, Mosely also addressed the "very long lead times" and maintaining predictability with its clients. "We know what's coming out a year from now," he said. "And we've basically gone to the customers and said, 'Look, if you want to plan this really well, which it should be for your data centers, we know what's coming out. You can buy this stuff up to a certain period.' And so we want to keep that four or five quarters of visibility very, very solid for what's being built. But the demand is significantly higher than that." Read more of this story at Slashdot.

The 2026 Commonwealth Short Story Prize is facing backlash after several winning entries were accused of being AI-generated, with one Caribbean winner's story flagged as fully AI-written by a detector that WIRED says it independently confirmed. From the report: Each year, the Commonwealth Foundation, a nongovernmental organization in London, awards its short story prize to one writer in each of five regions: Africa, Asia, Canada and Europe, the Caribbean, and the Pacific. One overall winner is then selected from that short list. Regional winners take home [about $3,350], while the top winner, to be announced next month, claims [about $6,700]. On May 12, the respected UK literary magazine Granta published the top five 2026 entries -- all previously unpublished, per the rules of the contest -- on its website. (It has hosted the winning submissions for the prize since 2012.) Within days, however, one entry aroused suspicion. "The Serpent in the Grove," a story by Jamir Nazir of Trinidad and Tobago, which had taken honors for the Caribbean region, struck a few people as bearing the stylistic tells of AI-generated text. "Well, this is a first: a ChatGPT-generated story won a prestigious literary prize," wrote researcher and entrepreneur Nabeel S. Qureshi, a former visiting scholar of AI at the Mercatus Center at George Mason University, in a post on X on Monday. "'Not X, not Y, but Z' sentences everywhere, the 'hums' trope, and plenty of other obvious markers of AI writing. A major milestone for AI, at any rate..." "They say the grove still hums at noon," Nazir's mysterious and atmospheric tale begins. In his screenshot of the opening paragraphs, Quereshi highlighted the second line as what he considered to be a signature example of AI syntax: "Not the bees' neat industry or the clean rasp of cutlass on vine, but a belly sound -- as if the earth swallows a shout and holds it there." As the literary community undertook a closer read of Nazir's story, many criticized its language and metaphors as nonsensical, wondering how the Commonwealth judges could have seen any merit to them. Others shared screenshots showing that the AI-detection tool Pangram flagged "The Serpent in the Grove" as 100 percent AI-generated, a result that WIRED independently confirmed. (While no AI-detection software is perfect, third-party analysis has consistently determined Pangram to be the most accurate, with a near-zero rate of false positives.) [...] Besides Nazir, two more winning authors have drawn allegations of using AI in their work. Pangram finds that "The Bastion's Shadow," by Maltese writer John Edward DeMicoli, winner for the Canada and Europe region, is fully AI-generated; it scans "Mehendi Nights," by Indian writer Sharon Aruparayil, winner for the Asia region, as partly AI-generated. Neither DeMicoli nor Aruparayil immediately returned requests for comment when reached through their respective social media accounts. The other two short-listed stories, by Holly Ann Miller of New Zealand and Lisa-Anne Julien of South Africa, deliver "fully human-written" results from Pangram. Wired also reports that one of the judges for the prize has been "accused of using AI to craft her descriptive blurb that accompanied the listing of 'The Serpent in the Grove' as a regional winner.'" Pangram labels the text as "AI-assisted." Read more of this story at Slashdot.

Google is again pressuring some longtime G Suite Legacy users to move onto paid Workspace plans, warning that accounts flagged as "commercial use" could lose access to Gmail, Drive, Calendar, and other services if appeals fail. "The trouble, according to users, is that the appeals system appears about as transparent as a brick," adds The Register. From the report: A reader alerted The Register to what appears to be a new crackdown on long-standing G Suite Legacy accounts, with similar complaints now piling up on Reddit from users accused of violating Google's non-commercial use policy, despite insisting they use the accounts only for family email and personal domains. Reports have been stacking up on Reddit's r/gsuitelegacymigration subreddit from users who say their long-running personal G Suite Legacy accounts are suddenly being classified as "commercial use" accounts and pushed toward paid Google Workspace plans by May 2026. A lot of users have been through this before. Google spent part of 2022 trying to wind down free G Suite Legacy accounts, then changed course after users running family domains made enough noise. Now some of those same users are being told they have fallen outside Google's rules after all. Emails seen by The Register warn users their accounts have been "identified as being used for commercial purposes" and say Google may start suspending Gmail, Calendar, Drive, Meet, and other Workspace services if they do not either win an appeal or begin paying for Workspace subscriptions. "Please upgrade to a paid Google Workspace subscription to continue using your services. Look out for a notification regarding the appeal process in Google Admin console or email," the email reads. "If you don't take action during your 45-day appeal period, Google will begin suspending your Google Workspace core services, including Gmail, Calendar, Drive, and Meet. As a result, you will lose access to these core services and data." One wrongly-flagged user said the company reversed its decision after they filed a GDPR data request seeking evidence. Others were less fortunate, with some reporting that family-only custom domains were permanently classified as commercial despite failed appeals. Read more of this story at Slashdot.

An anonymous reader quotes a report from NPR: Minnesota Gov. Tim Walz has signed the nation's first law banning prediction market sites from operating in the state, and in response, the Trump administration has sued, teeing up a legal battle over the most far-reaching crackdown on popular services like Kalshi and Polymarket. It comes as states confront a growing standoff with the Trump administration over how to regulate the industry, which allows people to bet on virtually anything. The new state law makes it a crime to host or advertise a prediction market, which it defines as a system that lets consumers place a wager on a future outcome, like sports, elections, live entertainment, someone's word choice and world affairs. The prohibition extends to services supporting prediction markets, like virtual private networks, that could allow consumers to disguise their location and get around the ban. It would force prediction market sites like Kalshi and Polymarket to leave the state, or face possible felony charges. The law takes effect in August. The law has a carve-out for event contracts that serve as an insurance policy in the event of "harm, or loss sustained" and for the purchase of securities and other commodities. The Commodity Futures Trading Commission's lawsuit seeks to block the law before it starts, arguing the prediction market industry should be exclusively regulated by federal officials. "This Minnesota law turns lawful operators and participants in prediction markets into felons overnight," said CFTC Chairman Michael Selig. "Minnesota farmers have relied on critical hedging products on weather and crop-related events for decades to mitigate their risks. Governor Walz chose to put special interests first and American farmers and innovators last." An updated version of the prediction market bill allows trading on weather, an exception that followed pushback from the agricultural industry, which has historically used futures trading on weather as a hedge against storms and other inclement weather that can affect a harvest. Walz is expected to sign it soon. "We as a state should decide how best and what regulations we think should attach to gambling, to protect public safety, to protect our kids," said Minnesota Rep. Emma Greenman, the Democrat who introduced the measure. Kalshi spokeswoman Elisabeth Diana called the ban a "blatant violation" of the law. "Minnesota banning prediction markets is like trying to ban the New York Stock Exchange," said Diana, adding that "this actively harms users because it reduces competition and drives activity offshore." Read more of this story at Slashdot.

Google is giving its iconic search box its first major redesign since 2001. The new design incorporates, you guessed it, artificial intelligence, "getting bigger and more interactive so that people can ask even longer questions and upload photographs and videos into queries," reports the New York Times. "In addition, people can ask follow-up questions with a chatbot on Google's main search page." From the report: The company will also offer digital assistants, known as agents, to automate searches so that someone who may be apartment hunting can be notified of a new listing without opening a real estate site like Zillow. The search features will be powered by a new artificial intelligence model, Gemini 3.5 Flash. Google said the model had improved on creating software code and performing autonomous tasks, worked faster and was less expensive to run than comparable models. [...] Google is also bringing one of A.I.'s biggest breakthroughs -- software coding -- to search. When people research complex topics like astrophysics, Gemini can build interactive graphics and simulations behind the scenes to provide a deeper answer than its previous listing of websites. Google said it was introducing an alternative to the agents powered by Anthropic's Claude Code and OpenAI's Codex. Called Gemini Spark, the service is embedded in Gmail, Docs and other Google products, where it can turn meeting notes spread across emails and chats into a single document. It can also read and draft emails. "The open web is on its way out," says Richard Kramer, a financial analyst with Arete Research. "With A.I., Google is reducing everyone to raw data providers." Read more of this story at Slashdot.

OpenAI co-founder Andrej Karpathy has joined rival AI lab Anthropic. "The hire is a major coup for Anthropic in the high-stakes competition for elite AI talent -- and another sign the company is emerging as a magnet for some of the industry's most respected technical minds," reports Axios. From the report: Karpathy will start this week on Anthropic's pre-training team, which is responsible for the massive training runs that give Claude its core knowledge and capabilities, according to Anthropic. Karpathy will help launch a new team focused on using Claude itself to accelerate pretraining research -- an increasingly important frontier as AI companies race to automate parts of AI development. "I think the next few years at the frontier of LLMs will be especially formative. I am very excited to join the team here and get back to R&D," Karpathy said in a post on X. Karpathy is a rare AI figure with credibility across research, industry and education. He was a founding member of OpenAI before serving as Tesla's director of AI, where he led the computer vision team behind Autopilot. Karpathy coined the term "vibe coding" and recently described himself as being in a "state of AI psychosis" since December -- embracing "tokenmaxxing" and aggressively stress-testing frontier models. Read more of this story at Slashdot.