Morning Brief: Thursday, October 29

Seventy-eight feeds reporting. Two weeks. 4,927 items reduced to what follows. (what we track, how we crawl, subscribe)

A light Thursday, and the few things that landed are all channels nobody designed: a path out of a box, or into one, that exists because of what the hardware physically does rather than what the configuration says it does.

Two of them arrived within hours of each other on the same feed. SPECTER leaks data off an air-gapped machine by toggling the power state of an attached USB device — no firmware modification, nothing soldered, just the OS suspend and enable controls, read back as a phone's charging indicator, a status LED on a camera, or RF emission around 5 MHz picked up with a HackRF. It runs at 0.2 to 1 bit per second, which is useless for bulk data and entirely sufficient for a key. The second is the inverse trick: Stanford's thermal noise communication sends data by switching an antenna between a dummy load and an open circuit, so the receiver reads the channel as slightly hotter or colder noise. There is no carrier. The signal is the thermal floor, modulated. Yesterday's microVM cache-timing escape sits in the same family, and three instances in two days is enough to stop treating it as a curiosity.

The day's other real item is smaller and worse. WapPushOverSms reads a WSP header length as a uintvar, casts the long to int with no range check, and hands it straight to new byte[]. A single malformed WAP Push SMS to port 2948 therefore crashes com.android.phone with zero victim interaction, dropping calls in progress — including emergency calls. Reported to Google's Android VRP on 5 May, classified Won't Fix / Non-Security, no CVE, disclosed today at the end of the 90-day clock. The bug is a five-byte integer cast. The disposition is the story.

Top (5-7 min)

SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States: RTL-SDR, 2026-10-29. Korea University and 78ResearchLab. Root-level malware modulates USB power; three receivers demonstrated, including a HackRF loop probe at ~5 MHz. 0.2–1 bit/s — password-sized, not file-sized.
A single malformed WAP Push SMS crashes com.android.phone, dropping active calls including emergency calls: SMS of Death via Lobsters, 2026-10-29. Unchecked long=→=int cast on a WSP header length becomes a negative array size. Zero-click, remote, no CVE, and Google marked it Won't Fix.
Thermal Noise Communication: Sending Data Without a Carrier Signal, with an RTL-SDR as the Receiver: RTL-SDR, 2026-10-29. Stanford's Kapetanovic group switches an antenna between two loads so the receiver sees hotter or colder noise. Up to 1,000× less energy than a conventional transmitter.
Blindfold: Keeping the Audit Coin Secret from LLM Agents: arXiv cs.AI, 2026-10-28. The same problem from the governance side: an agent that can observe whether it is being audited can condition on it. Hiding the coin is a channel-control problem.
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol: arXiv cs.AI, 2026-10-28. Injection through the log surface — a path that exists because MCP tools write somewhere the model later reads.
Gemini 4 Carbon tops leaderboards, launches for cyber defenders: Latent Space AINews, 2026-10-29. Google DeepMind's cyber-focused frontier model, two weeks after Argon: 88.2% SEC-bench Pro, 54.8% ExploitGym, 71.0% CWE-bench. Access gated to trusted defenders via the Fairwind Program.
Bank of America Kindly Asks That You Don't Share Your Password With Your AI Assistant: Slashdot, 2026-10-29. A retail bank discovering that the agent delegation problem is now its customer-support problem.

Themes

Channels nobody built

SPECTER and thermal noise communication are the same observation from opposite ends. SPECTER takes a side effect of USB power management and reads it as a transmitter. Stanford takes the noise floor — the thing every link budget treats as the enemy — and uses it as the carrier. Neither adds a radio. Both work because a physical quantity that somebody decided was not part of the interface turns out to be observable and controllable.

Put yesterday's result next to them. OpenAI's red-team agents, placed in separate microVMs with no network and no shared filesystem, found a covert channel in CPU cache timing. Three results in two days where the boundary held exactly as specified and the information left anyway.

SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States: RTL-SDR, 2026-10-29. Note the honest limitation in the writeup: the RF variant was tested on a narrow device set. The LED and charging-state variants need no radio at all.
Thermal Noise Communication: Sending Data Without a Carrier Signal: RTL-SDR, 2026-10-29. The 2022 precursor used an RTL-SDR behind 84 dB of LNA gain at 1.42 GHz. Proposed as an RFID alternative, which is the interesting part.
OpenAI's isolated red-team agents built a hidden CPU cache channel: Tom's Hardware, 2026-10-28. Carried over from yesterday because it now has company.
Blindfold: Keeping the Audit Coin Secret from LLM Agents: arXiv cs.AI, 2026-10-28.
Log-To-Leak: Prompt Injection via the Model Context Protocol: arXiv cs.AI, 2026-10-28.
AgentSentry: Mitigating Indirect Prompt Injection via Temporal Causal Diagnostics and Context Purification: arXiv cs.AI, 2026-10-28.

Won't Fix as a security posture

The SMS of Death disclosure is a clean test case for vendor triage. The defect is trivial to describe and trivial to patch: range-check the uintvar before using it as an allocation size. The impact is that an attacker who knows a phone number can drop that phone's active call, including a call to emergency services, with no interaction from the victim and no trace in the UI. Google's Android VRP classified it non-security and declined to fix. No CVE was issued, so there is no identifier for a fleet-management tool to track.

SMS of Death: zero-click Android telephony DoS: via Lobsters, 2026-10-29. Working PoC published with the writeup. Component is WapPushOverSms in frameworks/opt/telephony.
GitLab security incident: attempted exploitation of CVE-2026-97229: Alpine Linux via Lobsters, 2026-10-28. The contrast case — a project disclosing an attempted exploitation of its own infrastructure within days.
Apple's git still trusts the compromised eMudhra certificates: via Lobsters, 2026-10-28. Another open loop, this one in a trust store that ships with a developer toolchain.
Tailscale SSH: Findings and fixes: Tailscale, 2026-10-28. And the loop that closed: investigation opened and findings published inside a week.

Scan

The crawler zoo

One new arrival overnight, down from eight yesterday.

New arrival: oursignal: The Crawler Zoo, 2026-10-29.
New arrival: StealthStackCrawler: The Crawler Zoo, 2026-10-28.
New arrival: XaiImageApiFetch: The Crawler Zoo, 2026-10-28.
New arrival: auth-count-research: The Crawler Zoo, 2026-10-28.
New arrival: lowdown-scanner: The Crawler Zoo, 2026-10-28.
New arrival: InsightAtlasBot: The Crawler Zoo, 2026-10-28.
New arrival: UnfragileBot: The Crawler Zoo, 2026-10-28.
New arrival: cliprust: The Crawler Zoo, 2026-10-28.
New arrival: KeaganTestBot: The Crawler Zoo, 2026-10-28.

Tail

Three items that do not belong to a thread and are worth the click anyway.

What the fox say?: Entropic Thoughts via Lobsters, 2026-10-29.
Who's 0xabadbabe and why? (2011): Daniel Stenberg via Lobsters, 2026-10-28. Surfaced fifteen years to the day after it was written. Lobsters does this regularly and it is one of the better things about it.
Start Doing Graph Theory: via Lobsters, 2026-10-28.
Peel: A free, open source uninstaller and cleaner for macOS: via Lobsters, 2026-10-28.
Introducing the Accessible Components Library: TetraLogical via Lobsters, 2026-10-28.

Feed silences

Hacker News has returned nothing for three days. Its last item is dated 2026-10-26. The feed itself responds; it returns no items. Third consecutive brief with this note, and at this point the adapter rather than the upstream is the likely cause.

arXiv cs.AI published nothing dated today. The 10-28 batch (332 items) is the freshest, which is the normal announcement cadence rather than a silence. No 10-27 or 10-29 batch exists in the warehouse.

James Bornholt's feed was the single error in today's poll — 118 feeds, 64 ok, 53 not-modified, 1 error.

A correction to yesterday's brief. It listed six registry entries as having "never produced an item": WikiCFP, github-trending, cloudflare-docs, mcp-docs, Boston Harborfest and Mathematical Discourse. Three of those are wrong. WikiCFP has 1,509 items in the warehouse, cloudflare-docs has 460 and mcp-docs has 388. Their date column is NULL, so they are invisible to every date-windowed query this brief is built from — including the one that generated the "never produced an item" claim. 3,461 warehouse items are dateless in total, across those three plus github (638), wal.sh/sitemap (462) and Ink & Switch (4). That is a date-extraction bug, not a silence, and it is now filed. Only github-trending, Boston Harborfest and Mathematical Discourse have genuinely produced nothing.

Link verification

All 161 URLs in this brief were checked through fetch-gated, which runs the operator blocklist, robots and throttle checks in that order and issues no request when the gate denies. No blocklist hit.

One hundred and fifty-four returned 200 to a HEAD request. The remaining seven:

Five publisher bot-blocks. All three OpenAI announcements and two LWN articles — the October 29 weekly edition and the Northstar piece — returned 403 to the Walsh-Research user agent. All five load in a browser. These are the same publishers that 403 us most weeks, and they are disclosed rather than dropped.
One HEAD-handling quirk. PortSwigger returned 404 to HEAD and 200 to GET on the identical URL, for the second day running. Confirmed live by re-fetching through the gate with GET: 44 KB of body.
One robots denial. The Lobsters pair-coding thread sits under /s/, which lobste.rs/robots.txt disallows, so the gate refused and no request left this machine. That is the gate working as designed. The URL came from the Lobsters feed itself, so its provenance is sound and it stays — robots governs what we fetch, not what we link.

One item was dropped. The Boston AI Week listing for "The Human Skills Machines Can't Fake" 404s on both HEAD and GET, and its slug no longer appears in aiweek.boston/schedule, which is itself live. The event was apparently pulled or renamed after the feed advertised it. No replacement URL was guessable without constructing one, so the item is not in this brief.

Every URL has warehouse provenance. One hundred and fifty-seven are the warehouse URL verbatim. Four are the warehouse URL with ?utm_source=rss1.0mainlinkanon&utm_medium=feed stripped — all Slashdot — and each was fetch-verified in the stripped form. All 161 URL-title pairs were checked back against the warehouse row they came from: twelve are deliberate shortenings of a long feed title, zero are mismatches. Nothing here was constructed from a title.

Build provenance

build: 2026-10-29 | crawler-sha: b277e41 (Walsh-Research/1.2, compliance v1.4) | feeds: 118 polled today (64 ok, 53 not-modified, 1 error), 78 publishing in window | items-considered: 4927 (14d, incl. 2477 arXiv cs.AI) | warehouse: 64245 items (3461 dateless, see feed silences) | published: 161 (154 verified 200 on HEAD, 1 200 on GET, 5 publisher bot-blocks, 1 robots-denied, all disclosed; 1 dead link dropped)