The Daily Index — Tuesday, September 15, 2026 · TLDR Index

Across today’s newsletters

Today’s Index

An AI agent selects one of several software tools while a counterfeit plugin covertly opens access to files and system controls. — AI-generated editorial illustration

TLDR InfoSec

SKILL POISONING TURNS AI AGENTS INTO MALWARE DROPPERS

China's National Computer Virus Emergency Response Center is warning of "skill poisoning" attacks, where counterfeit plugins compromise AI agents to secretly download malware. Analysts have already identified eight malicious skill packs in popular agent repositories that impersonate legitimate tools, granting attackers unauthorized file access and remote-control capabilities. These poisoned plugins exploit an AI agent's natural task-execution design, bypassing the need for a user to actually click a suspicious link.

ministryofcyberaffairs.com · 3 min

TLDR InfoSec

MORE JFROG ARTIFACTORY BUGS UNDER ATTACK, AND ALL 3 HAVE PATCHES

Attackers are exploiting CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in JFrog Artifactory. Activity includes admin-account creation, Rust backdoors, Groovy plugins, web shells, token minting, and key theft. Wiz found 59 percent exposed to CVE-2026-42016 and 62 percent to CVE-2026-42018, so please patch exposed instances, restrict network access, and audit privileged logins.

theregister.com · 3 min

TLDR InfoSec

MALICIOUS TWITCH BROWSER EXTENSION EXPOSES 30,000 USERS' OAUTH TOKENS TO RUSSIAN BOT SERVICE

Socket found that a cross-store browser extension, 'Twitch Enhanced Viewer | JeetBot', captures account OAuth tokens from Twitch pages. Current Chrome and Firefox builds add tokens to proxy redirect URLs for most viewed channels, but earlier builds sent tokens directly to set-token endpoints. The extension has about 31,000 installs across both stores, and anyone holding a token can access chat, whispers, account settings, and channel points. Remove the extension, disconnect Twitch sessions, and re-authenticate.

socket.dev · 6 min

TLDR AI

APPLE'S SIRI AI CAN BE SWAPPED OUT FOR CLAUDE, CHATGPT, CODE SHOWS

Private iOS 27 and macOS frameworks show Apple built Siri so Claude or GPT-5.6 can sit in as the brain: Model Delegation lets Claude handle a natural-language ask, then hand Reminders or Messages back to Siri, and an inference-provider path can swap Apple's server-side Siri model entirely while keeping Siri's UI and voice. A demo already has ChatGPT finding emails, summarizing action items, and texting a contact through Siri's tools. The hooks are not user-facing yet, but they land as iOS 27 ships and after EU DMA pressure to open Siri to rivals.

macrumors.com · 4 min

TLDR Dev

AGENTIC CODING IS STRAINING CI. HERE'S HOW WE SCALED TEST IMPACT ANALYSIS AT ANTHROPIC

Agentic coding drove a 25x increase in CI jobs over six months, overwhelming a singleton test selection service despite bigger machines, package sharding, and daily restarts. Anthropic replaced it with stateless listener workers, a journal in an in-memory store, and a separate rollup consumer, creating a horizontally scalable system that has remained stable.

claude.com · 5 min

TLDR Crypto

MEXICAN AUTHORITIES RAID HIDDEN CRYPTO MINE

Mexican federal prosecutors, the navy, and state security raided a covert mining operation in Tlaola, Puebla, seizing roughly 300 GPUs, a transformer, 80 medium-voltage terminals, and eight satellite antennas. This is the fourth such site found in the area since early 2025, near a hydroelectric dam authorities suspect was tapped illegally. Investigators are examining whether the operation laundered cartel proceeds, echoing prior Chainalysis findings on mining as a way to generate "clean" crypto. Chainalysis estimated illicit addresses received at least $154 billion in 2025, though illicit activity stayed below 1% of tracked transaction volume.

links.tldrnewsletter.com · 4 min

TLDR Crypto

STABLECOINS WERE SUPPOSED TO CUT OUT THE MIDDLEMEN

Visa, Mastercard, Coinbase, and Stripe are absorbing stablecoin rails rather than being disintermediated, since settlement is only one part of a payment alongside identity, fraud, disputes, and the customer relationship. Visa's stablecoin settlement volume surpassed a $20 billion annualized run rate in September 2026, over 15x year-over-year, while issuers still depend on Visa for network acceptance. Mastercard's new Wallet Pay lets wallets like Alipay+, CRED, and Mercado Pago extend cross-border through its network, and Coinbase's Moov deal lets 1,000+ community banks add stablecoin capability without leaving their bank relationship. Stripe, having acquired Bridge and Privy and co-incubated the Tempo L1 with Paradigm, is positioning to control which rail a transaction routes through as cards, banks, and stablecoins converge.

links.tldrnewsletter.com · 6 min

TLDR IT

GOOGLE SIMPLIFIES MICROSOFT 365 MIGRATIONS, BUT ENTERPRISE LIMITS REMAIN

Google Workspace now has a built-in setup workflow that can discover Microsoft users and migrate email, OneDrive files, calendars, contacts, and tasks. The catch: automated migrations currently support only 10 Microsoft users, so it is useful for small environments but does not replace enterprise migration tooling yet.

petri.com · 3 min

TLDR Design

SLACK CAN NOW VIBE-CODE INTERACTIVE CHARTS AND REPORTS INSIDE CHATS

Slackforce Surfaces lets Slackbot build interactive reports, polls, dashboards, presentations, and microsites directly inside a chat from a plain description. Slackbot pulls information from relevant conversations and connected apps such as Google Drive or Salesforce, and the result can be pinned to channels for colleagues to use. The feature is available to all customers with Slackbot enabled, including free users, with live data support arriving in October.

slack.com · 4 min