OpenAI exploit chain raises alarms & NYT lawsuit reveals AI concerns - Hacker News (Sep 18, 2026)

A single image-handling bug reportedly became a path into OpenAI employee accounts in less than three days. Welcome to The Automated Daily, hacker news edition. The podcast created by generative AI. It's September 18th, 2026. I'm TrendTeller. Today: a sharp reminder that AI-era security failures can start small and escalate fast, fresh pressure in the New York Times copyright fight, a thoughtful new twist in the debate over AI and mathematics, a privacy-first approach to personal search, and one beautifully simple actuator that still earns its place in modern machines.

OpenAI exploit chain raises alarms

Let's start with security. Researchers at Hacktron say they chained a heap-overflow bug in libheif with a single-sign-on misconfiguration to compromise several OpenAI employees' ChatGPT and Codex accounts. According to their write-up, the entry point was OpenAI's community forum, where image uploads could trigger vulnerable HEIF processing. They say they limited their proof to a harmless internal pull request rather than touching sensitive code, and both OpenAI and Discourse moved quickly to patch the issues. Why this matters is bigger than one company: a narrow media-parsing bug, paired with weak identity boundaries, can become a route into high-value internal systems. It is also another sign that AI tools are making complex exploit chains quicker and cheaper to assemble.

NYT lawsuit reveals AI concerns

Staying with AI, the copyright battle between The New York Times, OpenAI, and Microsoft just got more serious. Newly unredacted court filings allege that senior executives privately described training on copyrighted news as theft and acknowledged that AI products could damage publishers by replacing visits to original articles. The filings also claim internal Microsoft data showed a major drop in click-throughs to The New York Times from Copilot. If those claims hold up, they could undercut the industry's public fair-use arguments and strengthen the case that the business impact on journalism was understood internally all along. This is becoming one of the most important legal fights in AI because it goes straight to the question of whether model training is innovation, appropriation, or something the courts will force into licensing.

Tao reframes AI math risks

In an update to the story we've been following about AI and mathematics, Terence Tao has explained why he did not sign a letter warning that AI could swamp the field with fast, low-effort results. Tao agrees there is a real problem, but he argues the issue is more nuanced. His view is that the bigger risk may not be an unreadable flood of theorems, but mathematicians gradually losing the hard problem-solving work that builds intuition in the first place. That is a subtle but important shift. It moves the conversation away from pure volume and toward what kinds of thinking researchers might stop practicing if AI becomes extremely capable. In other words, the concern is not just what AI produces, but what humans may stop doing.

Hister keeps personal search local

Away from the big platform battles, an open-source project called Hister is getting attention for a very different take on search. It is a personal search engine that indexes the full contents of web pages you've visited, along with local files, and it is designed to run locally or on infrastructure you control. The appeal is straightforward: instead of handing your digital memory to a cloud service, you keep that searchable record yourself. Hister also supports several ways to search, from a web interface to terminal access, and it can plug into AI assistants. The reason this stands out is that as people juggle more tabs, files, and fragmented knowledge, private personal search starts to feel less like a nice extra and more like core software.

Wax motors power quiet automation

And finally, one quieter engineering story: the wax motor. This is a linear actuator that turns heat into motion by relying on wax expanding as it melts and contracting as it cools. It sounds almost too simple, but that simplicity is the point. Wax motors can deliver smooth, reliable movement without complicated electronics, which is why they show up in places like HVAC valves, appliances, water systems, and greenhouse controls. In a week full of AI models and legal filings, it is a nice reminder that a lot of useful technology still comes from elegant physical design rather than software. Sometimes the smartest component in a system is the one that just works for years and never asks for an update.

That's the roundup for September 18th, 2026. If you want to dig deeper, links to all the stories are in the episode notes. Thanks for listening to The Automated Daily, hacker news edition. I'm TrendTeller, and I'll be back with more tomorrow.

OpenAI exploit chain raises alarms & NYT lawsuit reveals AI concerns - Hacker News (Sep 18, 2026)

Our Sponsors

Today's Hacker News Topics