Stratechery: a hacked Mac and Apple's rules for agents; Lenny's: how OpenAI builds on ChatGPT Sites

Agents and permissions: Apple's controls, OpenAI's connectors

"Apple and a Hacker's Future" — Stratechery

1. A Mac Mini running nothing but Claude and Codex was broken into, and Claude is what noticed. Thompson's always-on machine was compromised through CVE-2026-65400, a macOS screen-sharing flaw rated 7.1 out of 10 that Dutch authorities warned was under active exploitation on machines with port 5900 reachable from the internet; the attacker held root, installed a crypto miner, and backdated both files. 2 His agent flagged the shell startup hook and the miner, stopped running commands, then helped him find the four-second window the attack used and wipe the machine. 1 The essay's argument turns on that result: he kept the machine running agents on purpose, and the agent is the reason the intrusion surfaced.
2. Apple's answer is more control, applied one level up. Its developer site's note, "Updates to Full Disk Access in macOS," says Apple will add controls so that granting an app Full Disk Access — the macOS permission that lets one app read everything on the machine — takes more explicit user action, and the note gives its reason plainly: as AI agents become increasingly capable and autonomous, the risks attached to that level of access grow substantially. 3 Thompson's objection lands on where the control sits. macOS permission prompts stay invisible to software, so a headless Mac that agents drive fails silently and waits for a click on a screen nobody is watching, and he argues the permission layer belongs on the agent rather than on each program the agent writes. 1
3. The essay closes on a buying decision. A Bloomberg report by Mark Gurman says Apple will push into the smart home on October 13 with a roughly six-inch hub code-named J490, a HomePod mini update, and a new TV set-top box, all serving as showcase for the rebuilt Siri under new CEO John Ternus. 4 Thompson reads the plan as more Apple constraints spread across more of his life, and writes that he can now picture a future in which he stops buying Apple by default; he has already bought a Linux server for his rack and says he will never put a Mac in one again. 1

"How OpenAI uses ChatGPT Sites (live at DevDay!) | Kath Korevec (Product Lead)" — Lenny's Newsletter (How I AI)

1. Plugin Insights is the piece of Sites most teams have not touched, and it re-cuts one site for every visitor. She built an incident command site on it, wired to Slack and Notion, that works out which team you belong to from your channel access and shows only the incidents and runbooks that apply to you. Connector authentication does that work, so nobody writes per-person logic. 5 Codex can also infer the connectors when a prompt mentions Notion, a calendar, or collaboration, which means the setup is often a sentence rather than a build. 5
2. Under the surface, Sites carries real infrastructure. D1 storage, an R2 bucket, MCP plugin hosting, and support for co-editors sit inside it; her team used it for production work, including the slides behind OpenAI's Dev Day keynote, while plenty of other people still treat it as a prototyping toy. 5 That low overhead changes what is worth building at all: she describes making a site for a single business trip, using it for a week, and throwing it away afterward. 5
3. The most transferable part of the episode is where she keeps control. Korevec uses Codex for research, thinking, and drafting, and keeps the send button for herself, on the rule that AI can prepare a communication and she decides whether it goes out. 5 The demos around that line show what faster models change day to day: a Monday music-discovery flow that reads Reddit through computer control and rebuilds a Spotify playlist, and a community dungeon crawler that other people extend by installing a skill she published rather than by touching her code. 5

Where to start