Podcast 5-5 by Dongee · November 6, 2026

Transcript

Gabriel: Welcome to the Friday, November sixth episode. Let's go.

Gabriel: Hey Lina, picture an account that's locked for passwords. Keys only.

Lina: Locked?

Gabriel: You put an asterisk in the file and that's it: nobody gets in with a password.

Lina: Okay. And?

Gabriel: On Alpine servers and other Linux systems using the musl library, someone found that with a ridiculously long password… you get in anyway.

Lina: Long as in how long?

Gabriel: More than two hundred fifty-six characters. The system fails to hash it, returns another asterisk, and that asterisk matches the one on the locked account.

Lina: So the lock and the broken key say the same thing, and the door opens. What elegant design.

Gabriel: It's called sshole. And on the official Alpine images in the Amazon and Azure clouds, the default account can escalate to admin without a password.

Lina: One single try?

Gabriel: One. No brute force, and you're in.

Lina: What about my good old Ubuntu?

Gabriel: No. Debian, Ubuntu and Fedora use a different library.

Lina: Is there a patch?

Gabriel: OpenSSH ten point six. If you can't update today, turn off password login until you do. A researcher found it using AI agents, almost eighteen thousand tests. The Hacker News thread passed two thousand votes.

Lina: Some read it as a critical hole in the base of the world's containers and routers. Others say five conditions have to line up at once, and a lot of people already have that turned off.

Gabriel: And you, listening: if you run an Alpine server today, do you update it before bed?

Lina: Gabriel, yesterday Wall Street went pale.

Gabriel: That bad?

Lina: The Nasdaq fell five point five percent. Its worst day since April last year.

Gabriel: Five and a half?

Lina: The S&P 500 almost four and a half. The Dow, more than eighteen hundred points.

Gabriel: Ouch.

Lina: And the seven biggest tech companies lost more than a trillion dollars in value.

Gabriel: Nvidia too?

Lina: Nvidia alone shed more than four hundred forty billion. It's now negative for the year.

Gabriel: And what's the fear?

Lina: That after the US midterm elections, AI and data centers get reined in.

Gabriel: And Asia?

Lina: Today Asia followed the hit. Japan's index dropped six percent. Korea and Taiwan opened more than eight percent down. Korea even paused trading.

Gabriel: So… what the neighbors voted against data centers on Tuesday, the market cashed in yesterday.

Lina: Some say the illusion broke that AI grows with no ceiling and no angry neighbors.

Gabriel: And others answer it's a short-term political scare, chip demand is still there, and Asia already won back part of the losses the same day.

Lina: Okay, tell me the truth: with tech stocks, do you panic-sell or sit tight?

Gabriel: Look at this, Lina. Claude Code, Anthropic's coding tool, was sending the account email to websites.

Lina: Without asking you?

Gabriel: Without asking. They put it in the model's context so it wouldn't make up names in author tags.

Lina: How does it send it?

Gabriel: Then, when running a curl or another request, it sometimes put it in the User-Agent, that header that identifies the client.

Lina: And?

Gabriel: Some sites ask for a contact, and the model used the one it had at hand: yours.

Lina: Free work… with your identity thrown in as a bonus.

Gabriel: An engineer on the team admitted it on Hacker News, in a thread with over a thousand votes. She apologized.

Lina: And the fix?

Gabriel: There's a safeguard in version two point one point three seventeen that asks you first. And next week they're taking the email out of the context completely.

Lina: Meanwhile, the stable channel was still on an older version. A minor detail, of course.

Gabriel: Some see it as a serious leak: the agent handed your identity to third parties without permission.

Lina: And others say the real fix is not giving the model data it doesn't need to code.

Gabriel: And you, listening: would you keep using an agent that leaked your email yesterday?

Lina: Hey. Anthropic launched Personal Finance in Claude.

Gabriel: What's that?

Lina: You connect your bank through Plaid, and you ask in plain language: where did my money go this month? Can I afford that trip?

Gabriel: Does it move money?

Lina: No. Read-only.

Gabriel: What does it see?

Lina: Balances, up to two years of transactions, duplicate charges, bills that creep up month after month.

Gabriel: Does it invest?

Lina: No. It doesn't transfer. It doesn't sell you cards. And chats in that hub aren't used to train the AI.

Gabriel: Good.

Lina: ChatGPT already had something similar since May. Now Claude plays in that league, for now only in the US and on paid plans.

Gabriel: Still… two years of your financial life in the hands of an AI.

Lina: Some people don't want an AI reading that, even if it says it won't touch a cent.

Gabriel: And others say: if it doesn't move money, doesn't train on it, and I pick which accounts to connect, go ahead.

Lina: Would you give an AI read access to your bank? I wouldn't yet.

Gabriel: And we wrap up with this. OpenAI introduced GPT-6 Cyber.

Lina: Another model?

Gabriel: One built only for security research. It finds bugs, verifies them and proposes patches, and it stays inside the scope you set.

Lina: How inside?

Gabriel: In their tests, ninety-nine point nine three percent of the time without the deployment prompt. And a hundred with it.

Lina: A hundred?

Gabriel: They moved it up to Critical in cybersecurity. Before it was High.

Lina: Critical sounds like: careful who touches it.

Gabriel: That's why initial access is only for approved Daybreak Red customers.

Lina: And did it work?

Gabriel: With it they found eighty-one new serious bugs in Firefox. Mozilla is already shipping fixes for millions of users.

Lina: Great for whoever defends systems.

Gabriel: Unsettling if it falls into other hands. Some celebrate more ability to patch in time, with fewer deviations.

Lina: And others point out the offensive window opens too, no matter how many vetoes they add.

Gabriel: And you, listening: would you trust a Critical model if only approved teams use it?

Gabriel: That's it for today's episode.

Lina: If a question kept spinning in your head, share it with someone and talk it over.

Gabriel: Tomorrow, five more stories. And if you run Alpine, update OpenSSH before your coffee.

Lina: I'm checking which version of Claude Code I have. Talk to you tomorrow.