
Copilot for Word AI Worm: Document-Borne XPIA That Self-Propagates
Håkon Måløy’s MSRC disclosure: hidden instructions in Word docs can make Copilot alter drafts and copy the payload forward — still exploitable after 144 days.

Expert profile
Founder & AI Product Leader
Yash Thakker is a Generative AI expert with over 12 years of experience in product leadership and technical strategy. As the founder of explainx.ai, he has taught over 300,000 learners and built AI platforms serving millions of users globally. He specializes in Agentic AI, Multimodal RAG, and the intersection of LLMs with consumer hardware.

Håkon Måløy’s MSRC disclosure: hidden instructions in Word docs can make Copilot alter drafts and copy the payload forward — still exploitable after 144 days.

Cursor Start is ₹649/mo for developers in India — Grok 4.5, Composer, cloud agents, UPI. What’s included vs Pro, and who should upgrade from Free.
gavamedia/deltafin streams Kimi K3 MXFP4 experts on Apple Silicon — ~16 s/token on M1 Max 64 GB, 1.7 TB full install or 215 GB stream, OpenAI-compatible API.

Fish Audio’s $52M seed and S2.1 Pro launch: 5-second voice clones, word-level emotion tags, ~1/6 ElevenLabs cost claims, open weights, and free API trial.

Jul 29: Tibo resets ChatGPT Work and Codex limits, expects ~18% longer Sol usage, and restores the five-hour cap tomorrow. Why Sol burned quota faster.

Hugging Face’s Jul 27 anatomy of the OpenAI ExploitGym agent: ~17.6k actions, HDF5 file read + Jinja2 RCE, Tailscale mesh, GLM-5.2 forensics — what changed.

Sebastian Raschka’s Kimi K3 architecture notes: LatentMoE, NoPE everywhere, Kimi Delta Attention, attention residuals — plus why causal models don’t need RoPE.

MCP 2026-07-28 drops sessions for a request/response core — serverless-ready, with MCP Apps, Tasks, OAuth/OIDC auth, and Claude rollout details.

Microsoft MAI-Image-2.5-Pro and MAI-Voice-2-Flash: Foundry pricing, production metrics, SSML setup, voice cloning safeguards, and honest caveats.

Jul 27, 2026: NVIDIA invests in Safe Superintelligence and partners long-term so SSI can ~10× compute on Vera Rubin. What the deal says — and what it hides.

OpenAI released @openai/codex-security under Apache 2.0 — scan repos, track findings, export SARIF, and wire CI. Install with npx and what to watch for.

OpenAI’s new gpt-live-transcribe and gpt-transcribe models: live vs file workflows, context/keywords, Common Voice scores, and when to keep Whisper.