Search the archive

MENTION.CLICK

mention is an AI-powered lead generation tool that surfaces relevant Reddit conversations for your product to enable organic outreach, validation, and customer discovery.

SOME NOTES FROM THE CEO OF SPOTIFY

This thread contains tips given by the CEO of Spotify during a two-hour-long presentation. Spotify made the legal option faster and easier than piracy, and it only widened its focus when its core was working. It built a reusable distribution engine and let teams own outcomes. The company invested early in experimentation infrastructure and was built for global from day one. It only bets on AI when it moves core metrics. The key to the company's success was focus, compounding iteration, and small autonomous teams with real accountability.

HOW TO GET ON A VC'S RADAR IN 30 DAYS (USING ONLY LINKEDIN + X)

You don't need followers, content, or a personal brand to get on a VC's radar - just strategic commenting. Pick 25 investors you want to meet, turn on their post notifications, and show up early with thoughtful takes.

SHOT CALLED A YEAR AGO

Taste and judgment, not execution, are the bottlenecks when Cursor can take you from idea to code in minutes.

INVERT, ALWAYS INVERT

Instead of asking how to succeed, ask how to fail, then systematically avoid those things.

STUMBLING

The smartest people in the room are often terrible communicators.

See the full breakdown →

Ready to see why Bitwarden continues to lead the G2 reports for 11 consecutive quarters? Start a free trial of Bitwarden for your

business

FAKE PRETTIER EXTENSION ON VSCODE MARKETPLACE DROPPED ANIVIA STEALER

Checkmarx Zero identified and removed a malicious VSCode extension, "prettier-vscode-plus," within 4 hours of publication, limiting the impact to 6 downloads and 3 installs before removal. The brandjacking attack deployed Anivia Stealer (likely rebranded ZeroTrace, sold as MaaS for €120/month) using fileless execution from memory and sandbox evasion techniques to steal Windows credentials, data, and WhatsApp chats. Security teams should implement extension vetting controls and monitor developer tool installations, as supply chain attacks targeting IDEs increasingly aim to compromise source code and credentials.

US BANKS SCRAMBLE TO ASSESS DATA THEFT AFTER HACKERS BREACH FINANCIAL TECH FIRM

Major US banks and financial firms are investigating data stolen in a cyberattack targeting SitusAMC, a New York firm that serves hundreds of lenders. The breach involved theft of corporate, legal, and accounting records, but no malware was deployed. The full scope and impact remain under review. The FBI and affected banks are working to safeguard customer information and determine how many consumers may be affected.

UPDATE FIREFOX TO PATCH CVE-2025-13016 VULNERABILITY AFFECTING 180 MILLION USERS

A critical memory vulnerability in Firefox's WebAssembly (Wasm) engine, tracked as CVE-2025-13016, exposed 180 million users to remote code execution risks for six months. The flaw involved a stack buffer overflow within the Garbage Collection mechanism caused by an incorrect memory pointer calculation, allowing attackers to hijack program flow via malicious webpages. Security professionals should ensure all instances of Firefox are updated to version 145 or ESR 140.5 immediately to mitigate this high-severity risk.

PUBLIC REPORT: GOOGLE PRIVATE AI COMPUTE REVIEW

NCC Group conducted a comprehensive security review of Google's Private AI Compute system across two phases (April-September), investing 100 person-days with 10 consultants to assess the cloud-based AI system designed to extend mobile device capabilities while maintaining local privacy guarantees. The review covered architecture assessment, cryptographic implementations, IP-blinding relay security, Outbound RPC Enforcement configuration, and frontend server source code analysis. Security teams working on privacy-preserving cloud AI architectures should examine the full downloadable report for insights on attestation mechanisms, secure enclaves, cryptographic protocols, and privacy-preserving infrastructure design patterns.

HOW TO REPLICATE THE CLAUDE CODE ATTACK WITH PROMPTFOO

State actors weaponized Claude Code through jailbreaking (roleplay as security researchers + task decomposition) rather than traditional exploits, achieving 82% success rates in installing keyloggers, reverse shells with systemd/.bashrc persistence, LD_PRELOAD hooks, and exfiltrating SSH/API keys. The "lethal trifecta" vulnerability arises when agents have access to private data, exposure to untrusted content, and external communication ability. Traditional security tools fail because jailbreak traffic appears legitimate and the attack vector is semantic, not technical. Security teams must implement deterministic access controls, use red team testing tools like Promptfoo before deployment, and recognize that context-blind guardrails and helpful-by-default bias create fundamental vulnerabilities requiring semantic security defenses beyond traditional WAF/IDS/AV solutions.

STOP PUTTING YOUR PASSWORDS INTO RANDOM WEBSITES (YES, SERIOUSLY, YOU ARE THE PROBLEM)

Organizations and individuals have been carelessly exposing sensitive passwords, credentials, keys, and private data by pasting them into public online code formatting tools like JSONFormatter and CodeBeautify. These tools often let users save and share formatted data through predictable URLs, leaving credentials easily discoverable and accessible to anyone, including attackers. Thousands of secrets belonging to major sectors such as government, banking, healthcare, and critical infrastructure have been discovered. Never trust random online tools with any sensitive information, as this habit creates far-reaching security risks and exposure.

agents. Become an elite SOC

SANTAMON

Santamon is an experimental macOS detection sidecar for Santa that evaluates Endpoint Security telemetry locally using CEL rules. It forwards only matched detections to a backend while keeping raw telemetry on-device. Santamon leverages Santa's existing ESF sensor capabilities, avoiding Apple entitlement requirements. It adds three detection rule types: simple matching, time-window correlation, and baseline (first-seen) tracking with optional process tree enrichment.

BLT

OWASP BLT (Bug Logging Tool) is an open-source platform that democratizes bug bounties and security research. Built by the community for the community, BLT makes it easy for security researchers, developers, and organizations to collaborate on finding and fixing security vulnerabilities.

RAY SECURITY (PRODUCT LAUNCH)

Ray Security offers real-time, AI-driven data protection for enterprises. Its platform learns and monitors data usage, applying dynamic security controls to active data, detecting unusual behavior, and automatically responding to threats without impeding operations.

JPMORGAN, CITI, MORGAN STANLEY ASSESS FALLOUT FROM SITUSAMC DATA BREACH

SitusAMC, a mortgage data processor serving major banks including JPMorgan, Citi, and Morgan Stanley, suffered a data exfiltration attack discovered on November 12 that exposed corporate data and potentially customer PII, including SSNs, financial details, and employment records from loan applications. The attack used no ransomware, focusing purely on data theft. It was contained through credential resets, by disabling remote access, and by updating the firewall. Financial institutions must strengthen third-party risk management programs with written oversight policies per new SEC Regulation S-P amendments, as vendor breaches now account for 30% of financial sector incidents (up 15% YoY).

GOOGLE ANTIGRAVITY EXFILTRATES DATA

Google Antigravity is vulnerable to indirect prompt injection attacks where poisoned content manipulates the AI into bypassing .gitignore restrictions to steal sensitive credentials from .env files. The data is exfiltrated via a browser subagent directed to a malicious URL, exploiting default settings that allow autonomous command execution and whitelist dangerous domains. Security professionals should mitigate this risk by reviewing "Agent-assisted development" permissions and strictly monitoring AI agent access to sensitive files and external network traffic.

WORMGPT 4 AND KAWAIIGPT: NEW DARK LLMS BOOST CYBERCRIME AUTOMATION

WormGPT 4 and KawaiiGPT are new "dark LLMs" that empower less-skilled cybercriminals by automating phishing, malware creation, and reconnaissance without ethical guardrails. WormGPT 4 is a paid service that offers malware generation capabilities. KawaiiGPT is a free, open-source tool that facilitates social engineering and lateral movement scripts. Security professionals should view these tools as a new baseline for digital risk and prepare for a democratized threat landscape where advanced attack capabilities are accessible to anyone with an internet connection.

CHINA'S LENOVO AND OTHER TECH GIANTS STACK MEMORY CHIPS: THE RACE IS ON, AND PRICES ARE UP

Lenovo is stockpiling memory chips at 50% above normal levels as AI datacenter demand creates global semiconductor shortages.

HACKERS HIJACK BLENDER 3D ASSETS TO DEPLOY STEALC V2 DATA-STEALING MALWARE

Hackers are distributing malicious Blender 3D asset files on platforms like CGTrader, leveraging Blender's Auto Run feature and embedded Python scripts.

CANON SAYS SUBSIDIARY IMPACTED BY ORACLE EBS HACK

Canon confirmed that a recent cyberattack linked to the Oracle E-Business Suite hacking campaign affected only a US subsidiary's web server.

RETAIL CATEGORY STRATEGIES FOR YOUTUBE

Retail content dominates YouTube. Fashion, home, beauty, and consumer electronics generate 688B views across 4.12M channels. Creators drive shopping behavior through reviews, tutorials, and short-form discovery. Viewers are 98% more likely to trust YouTube recommendations than other platforms. Fast-growing trends include practical problem-solving, shop-ertainment, and honest reviews.

HOW BRANDS ARE AIMING TO BUILD ‘ALGORITHMIC TRUST' AHEAD OF AN AI AGENT-POWERED BLACK FRIDAY

Brands are working to build algorithmic trust so AI agents can surface their products during a longer, AI-driven shopping window. Most consumers have used AI tools at least once. 68% report trying tools like ChatGPT, but only 2% use AI to make purchases, which shows a large gap that brands want to close. New tools such as Pulse and Atlas from OpenAI may speed adoption by proactively presenting personalized deals to shoppers. Brands are responding by encoding product data for machine understanding, strengthening verifiable brand values, and improving online reputation so AI agents can confidently recommend their products.

TURN INSULTS YOU GET INTO ADS

Reusing unfair insults can boost brand engagement and ad performance because it makes a brand seem more confident and humorous. Experiments showed that an electronics store increased its CTR by 26.7% when it embraced an insult, and MTV saw a 25% rise in interest, a 70.5% lift in humor, and a 20.2% increase in perceived confidence when it reused criticism. Vitamin Water saw similar gains, including a 67% rise in humor and a 21% rise in confidence. The approach fails when the critic is seen as vulnerable, as perceptions of a brand being a bully can rise by 59.9%.

REDESIGN OF PROTON.AI'S CUSTOMER NEWSLETTER

This post shows how Proton's newsletter moved from plain text to a sports-themed design. It introduced a mascot, used ChatGPT to build the HTML layout, and tested the code in Parcel to confirm it rendered well. The prompt used is shared in the comments.

WORKFLOW DRIVING 23% OF B2B PIPELINE

Bolt.new uncovered 23% of net new B2B pipeline, driven by Freckle.io. They enriched personal email sign-ups from high-potential companies. The workflow imported sign-ups from Snowflake, filtered personal and work emails, enriched contact and company data, scored and prioritized Tier 1 leads, and pushed them to HubSpot with LinkedIn engagement steps. In the first 4 weeks, this generated $1.7M in pipeline, including Fortune 500 deals, and the process has now been expanded to all demo requests.

PROMPT LIKE A MARKETER

This guide gives a structured way to craft AI prompts by focusing on signal context, roles, jobs, formats, and tone. It shows how to use AI across key marketing tasks, offers reusable templates tied to real GTM scenarios, and helps teams turn buyer signals into clear outputs. It aims to sharpen messaging and support smarter use of AI while keeping human judgment central.

AI EMAILS ME CONTENT IDEAS EVERY MORNING

This article explains how to set up a system where ChatGPT sends a daily email with categorized content ideas. The prompt pulls insights from past chats and organizes them into buckets for newsletters, LinkedIn, and email. Anyone can replicate the method by enabling ChatGPT schedules and applying a structured prompt. This reduces context switching and protects ideation from being lost in unstructured notes.

HOW TO DO USER RESEARCH WITHOUT USERS: THE SYNTHETIC USER GUIDE

AI-generated personas give early-stage teams a fast way to clarify who they are building for and what those users care about. Tools like ChatGPT can create realistic, behavior-driven personas that reflect motivations, fears, workflows, and decision triggers without long research cycles. These personas help teams pressure test ideas, refine messaging, simulate interviews, and uncover blind spots before talking to real users. The approach speeds up alignment and improves product decisions while still requiring real user validation later on.

7 ECOMMERCE BLOG EXAMPLES

Ecommerce blogs that win in AI search and convert effectively combine educational content with smart product integration. Garmin ranks in the top AI visibility charts by creating detailed, structured articles that answer user questions while subtly linking to products. Petlibro balances top-of-funnel education with transactional keywords, creating posts cited by AI tools. Thinx builds authority through mission-aligned content on menstrual health and earns high rankings with concise, helpful posts.

ANTHROPIC INTRODUCES CHEAPER, MORE POWERFUL, MORE EFFICIENT OPUS 4.5 MODEL

The update addresses previous limitations where long chats ended abruptly by introducing behind-the-scenes summarization that retains key context.

THE SOCIAL-MEDIA PLATFORM THAT MAKES YOU TELL THE TRUTH

Strava turned fitness tracking into a social competition for over 150 million users.

Register now

ANTHROPIC INTRODUCES CHEAPER, MORE POWERFUL, MORE EFFICIENT OPUS 4.5 MODEL

Anthropic has released its latest frontier model, Opus 4.5. The model brings improvements in coding performance and user experience. The Opus 4.5 API costs $5 per million input tokens and $25 per million output tokens. Anthropic's developer platform now includes a new 'effort' parameter that allows developers to more precisely tune the balance between efficacy and token usage. Claude Code is now available in the desktop Claude apps.

AMAZON TAKES AIM AT STARLINK WITH SATELLITE BETA PROMISING GIGABIT SPEEDS

Amazon has made a promise that its Leo satellites will offer gigabit satellite internet speeds. The company has opened a preview program to select enterprise customers to beta test its Starlink competitor. Amazon's Leo Ultra satellite dish provides download speeds of up to 1Gbps and upload speeds of up to 400Mbps simultaneously. A wider commercial rollout won't happen until next year.

BLUE ORIGIN TO BUILD A "SUPER HEAVY" ROCKET TO COMPETE WITH STARSHIP

Blue Origin plans to make a super-heavy version of its New Glenn system to rival SpaceX's Starship. Named the New Glenn 9x4, it will feature a larger payload fairing and be able to deliver 70 metric tons to Low Earth Orbit, 14 metric tons to Geosynchronous Orbit, and 20 metric tons to the Moon. Blue Origin plans to conduct launches using both the enhanced and super-heavy versions of its New Glenn rocket to improve performance and launch cadence.

BOY WITH RARE CONDITION AMAZES DOCTORS AFTER WORLD-FIRST GENE THERAPY

Hunter syndrome is an inherited condition that causes progressive damage to the body and brain. The effects are sometimes described as a type of childhood dementia, and patients with the disease usually die before the age of 20 in the most severe cases. Medical staff in Manchester have halted the disease in a three-year-old boy by altering his cells using gene therapy. It has only been a year since starting the treatment, but the boy appears to be developing normally.

REALLY GOOD SEARCH IS REALLY HARD

Search remains a highly open problem. This post looks at how to design information systems for agents. Agents need to have ready access to information without a human in the loop. Systems that plug AI in require highly configurable behavior and properties that aren't always conventional.

HOW WE BUILT THE V0 IOS APP

Vercel recently released its first mobile app, v0 for iOS. Building a native app was new territory for the company. It built dozens of iterations of the app before its public beta, experimenting with drastically different tech stacks and UI patterns each time. This post provides a technical breakdown of how the app was developed.

EXECS SAY OPENAI HAS FIRST HARDWARE PROTOTYPES, PLAN TO REVEAL DEVICE IN 2 YEARS OR LESS

OpenAI CEO Sam Altman says that the company has finished its first prototypes for hardware devices. The company has yet to reveal any details about what the device is or what it does. OpenAI's hardware plans are being closely watched by rivals. A successful device launch from OpenAI could threaten Apple, which has had trouble rolling out its AI features.

GOOGLE'S NEW 'ALUMINIUM OS' PROJECT BRINGS ANDROID TO PC: HERE'S WHAT WE KNOW

Google is unifying ChromeOS and Android into a single desktop platform codenamed 'Aluminium OS'. Aluminium OS will feature deep integration with Gemini at the core. There is little information on what features Gemini will enable on Android PCs. Gemini already powers an array of on-device AI features on smartphones. The operating system will eventually be extended to detachables, tablets, and mini-PCs.

VIBE CHECK: OPUS 4.5 IS THE CODING MODEL WE'VE BEEN WAITING FOR

Opus 4.5 holds the thread across complex flows, course-corrects when needed, and executes like a senior engineer who knows what they're building.

NO FREE LUNCH IN VIBE CODING

As long as absolute control remains a requirement, there's no way around addressing the resulting complexity.