ChatGPT scopes 17% of searches, Grok decrypts attacker payloads, Bun.WebView

Sources

ChatGPT search now uses the site:operator at scale simonwillison.net

ChatGPT search now uses the site:operator at scale Promptwatch is part of the emerging “GEO” space, for Generative Engine Optimization - the chatbot version of SEO, where companies offer tools and consulting to help your site increase its presence in replies to prompts inside tools like ChatGPT. The Promptwatch product uses automation to track responses to prompts across end-user chat products like ChatGPT, Claude, and Gemini. They publish aggregate reports on this as part of their own content…

Grok exfiltrates user data when malicious instructions are encrypted arstechnica.com

Cryptographic Context Injection is only the latest way to break an LLM safety guardrail.

A shot-scraper-style JSON API on Bun 1.4’s new Bun.WebView simonwillison.net

Research: A shot-scraper-style JSON API on Bun 1.4’s new Bun.WebView Today saw the long awaited release of Bun 1.4 , the first stable version since the infamous Rust rewrite a few months ago . Interestingly, the Rust rewrite was downplayed in the release notes, which introduced a bewildering array of new features and claimed 2,900 additional bug fixes: Bun 1.4 adds +1,517 tests from the Node.js test suite - our biggest jump in Node.js compatibility since Bun 1.0. Bun v1.4 also fixes over 2,900…

Up to 3.2x Faster Inference with LFM2.5-DSpark huggingface.co

Liquid AI’s new LFM2.5-DSpark variant delivers up to 3.2x faster inference than its predecessor, aimed at edge and on-device deployment. The speedup targets latency-sensitive workloads where the original LFM2 architecture already competed with larger transformer baselines on efficiency.

The /wayfinder Skill: Navigating the “Fog of War” of Planning latent.space

Matt Pocock’s /wayfinder skill helps coding agents chart a path through greenfield projects where the next step is unclear. The prompt structures exploration when specs are thin, cutting the planning fog that stalls agents on ambiguous or unscoped tasks.

References

Forbes (Gabriela Linzainescu) forbes.com

Reddit’s share of ChatGPT Search citations fell 86.4% between August 7 and August 14, 2026, dropping from a consistent 3.83% to just 0.52%, while OpenAI declined to comment on the change.

Search Engine Journal searchenginejournal.com

A Reddit spokesperson dismissed the significance of the data, noting the platform does not rely on LLMs for traffic since most users arrive via direct visits or traditional search, and pointed to alternative trackers that still rank Reddit among the most-cited domains.

Explainx.ai explainx.ai

Reports indicate Reddit may have blocked its entire domain via robots.txt in mid-August, potentially to protect its data-licensing value or push users toward its native AI features — meaning the citation drop may be Reddit-initiated, not an OpenAI ranking change.

TIKR analyst note tikr.com

The 2024 OpenAI–Reddit contracts, worth an aggregate ~$203 million, are entering renewal windows; Reddit’s data-licensing revenue grew 24% YoY to $43M by mid-2026 but remains only ~5% of total revenue, leaving visible ‘unresolved tension’ over pricing.

OpenAI Responses API docs developers.openai.com

The web_search tool exposes allowed_domains and blocked_domains parameters accepting up to 100 entries each, confirming that domain-scoped retrieval is a first-class API primitive — not just a system-prompt hack.

Promptwatch blog promptwatch.com

91% of ChatGPT’s fanout queries are unique and almost never repeat the same lexical string, meaning external prompt-tracking snapshots capture only a fraction of retrieval behavior and understate the true site: operator prevalence (Qwairy measured 23–24% vs Promptwatch’s 17%).

Adversa AI (original disclosure) adversa.ai

Adversa reported a 40% success rate across 20 attempts against Grok 4.5 Fast; failures were attributed to the model struggling with the decryption logic rather than detection by security filters. xAI was notified in June 2026 via HackerOne but had not issued a patch as of late August.

CybersecurityBoard summary of Willison/Rehberger commentary cybersecurityboard.com

Willison and Rehberger argue the attack exemplifies the ‘lethal trifecta’ of AI agent risks — untrusted input, private data access, and external actions — and note xAI classified the reports as ‘informational’ rather than critical security flaws.

Giskard Phare LLM Benchmark V2 (encoding tasks) phare.giskard.ai

Claude 5 Sonnet scored ~71% on resisting encoding-based jailbreaks, while GPT-4o scored 44.41% and Gemini 3.0 Pro Preview scored 42.08% — a wide gap in how frontier models handle malicious instructions hidden in Base64 or unusual encodings.

Veritensor red-teaming guide (CipherBench findings) guide.veritensor.com

More capable models are actually more vulnerable to cipher-based attacks because their advanced reasoning allows them to decode complex instructions that weaker models simply cannot process — Base64 remains effective on GPT-4 and Claude precisely because those models are competent enough to autonomously decode and execute the hidden directive.

Johann Rehberger, embracethered.com (ZombAI / OpenHands RCE) embracethered.com

ZombAI describes an AI agent hijacked via indirect prompt injection to join an attacker’s botnet; Rehberger demonstrated the pattern across OpenHands, Google Jules, and Anthropic’s Claude Computer-Use — the class of exploit CCI generalizes into the cryptographic domain.

r/linuxadmin discussion reddit.com

Some developers expressed skepticism regarding the ‘novelty’ of the attack, arguing it is an evolution of indirect prompt injection rather than an entirely new class of vulnerability.

grigio.org — Bun 1.4 controversial AI-driven rewrite grigio.org

The rewrite transformed ~570,000 lines of Zig into ~682,000 lines of Rust in under two weeks… introduced over 13,000 unsafe blocks and nearly 1,000 instances of global mutable state, leading Zig creator Andrew Kelley to label the codebase ‘unreviewed slop’.

daily.dev — Bun 1.4 Rust rewrite drama daily.dev

Independent testing by Zahin Afsar showed a 6% reduction in memory usage… though the older Zig-based version remained roughly 2% faster in raw execution speed.

GitHub issue oven-sh/bun#38350 github.com

view.cdp() permits only a single in-flight call; attempting a second concurrent command results in a ‘cdp() is already pending’ error… On macOS the runtime defaults to WKWebView, where view.cdp() is entirely unsupported and throws ERR_METHOD_NOT_IMPLEMENTED.

bunjs.run — Bun.WebView headless browser bunjs.run

Methods such as view.click(), view.type(), and view.scroll() trigger native pointer and keyboard events that the browser’s renderer process identifies as legitimate, resulting in an isTrusted: true status.

Medium (onix_react) — What’s new in Bun v1.3.12 medium.com

Community projects like Bunwright attempt to bridge this gap by providing a lighter, scriptable wrapper around the native WebView API for repeatable workflows… users have noted stability risks, such as the accumulation of temporary session directories if the await using disposal pattern is not strictly followed.

o16g.com — HN reactions roundup o16g.com

A community-driven fork of Bun called ‘Buz’ attempts to maintain the original Zig codebase and avoid ‘LLM-authored contributions’… commenters noted Willison’s approach was engineering-superior because it was significantly smaller (roughly 20,000 lines of code) and prioritized readability over sheer token volume.