标签：#apps

Split the instruction, split the blame Here's the part that should bother you: nobody had to find a clever new exploit primitive to pull this off. They just chopped a sentence in half. That's the whole technique. And it worked up to 100% of the time on some models. If your safety story depends on the model recognizing a bad instruction in one shot, you don't have a safety story. Context: we've seen this movie before Prompt injection via untrusted tool output isn't new. Anyone who's spent time red-teaming agentic systems has known for a while that if you let a model ingest text from an external source and then act on it with privileged tools, you've built an injection vector, full stop. What GhostSplice adds isn't a new vulnerability class, it's a demonstration that current defenses are pattern-matching on the wrong granularity. Single-prompt refusal training assumes the malicious ask arrives intact. Split it across two or three innocuous-looking tool descriptions and results, and the model reassembles the intent internally without ever seeing a chunk that trips its own guardrails. MCP (Model Context Protocol) makes this worse structurally, not because MCP itself is flawed in some novel way, but because it formalizes exactly the trust relationship that makes injection dangerous: an agent pulling in tool descriptions and results from a server it doesn't fully control, then acting on that content with local file access, SSH keys, and shell execution. We built a nice clean protocol for connecting agents to tools. We didn't build a nice clean way to know if the tool is lying to you. Hype check The framing "malicious MCP servers exfiltrate secrets" is accurate but it undersells the boring, structural nature of the problem. This isn't a zero-day. It's a logic gap that was always going to be there once you combine untrusted content ingestion with tool-calling agents that have real filesystem and network access. Calling it a "technique" with a name gives it more novelty than

Checks are being mailed from Grubhub's $23.8 million fine from the FTC after it settled allegations over its business practices.

Mesh, an AI-powered contacts app and relationship manager from Automattic, is now an Android app.

The new app launches with Facebook's AI creator assistant built into it, providing creators with personalized recommendations based on their content style, performance, audience engagement, and goals.

Gemini is keeping pace with OpenAI’s ChatGPT, which hit 1 billion monthly active users back in June.

Over a year following its post-election surge, Bluesky’s mobile app is seeing a continued decline in active users, though its remaining community is still relatively engaged.

Block Blast!, the most downloaded mobile game of 2025, is coming to Apple Arcade in September where it will be ad-free.

FlightAware says that Kalshi used its name and data to offer bets on flight cancellations without the flight tracker's permission.

Zoom has patched a major security vulnerability that could allow an attacker to hijack anyone's device during a meeting. In a blog post on Tuesday, researchers at A Security say they uncovered the flaw using "fewer than 20 prompts on publicly available AI models," as reported earlier by Wired. The exploit involved Zoom's annotation feature, […]

Bumble is ditching the rule that it has enforced since launching in 2024. Men can finally message first.

The company previously teased it would change messaging in May.

Bumble was famously built around exclusively giving women the power to initiate messages in heterosexual matches when it first launched in 2014 - but now the times they are a-changin' for the dating app. Today, Bumble has announced a "global evolution to its signature conversation experience": anyone can now send the first message, and the […]

I keep seeing the same mismatch in the screen-time category: a lot of apps are technically blockers, but they feel like parental control software. That is fine if a parent is the customer. It is a bad fit if the user is an adult trying to manage their own habits. The difference is not cosmetic. When a blocker feels like surveillance, adults bounce. They do not want an account, a dashboard, or the feeling that their phone behavior is being watched somewhere else. That is the gap I built SproutGuard for: built for adults blocking themselves , not kids runs on-device through Apple's Screen Time APIs no account no server no usage data leaving the phone App Store: https://apps.apple.com/us/app/sproutguard-screen-time-detox/id6768664921?ct=devto-adults I also put the positioning plainly on the product page: self-control, not parental control The hard lesson from launching it is that being right about the problem is not the same thing as being shareable . Privacy architecture matters, but users rarely tell friends about architecture. What they do share is something emotional or visible: a streak, a mascot, a challenge, a before/after feeling. So the current working question for me is not "how do I explain on-device privacy better?" It is: How do you make a self-control product feel human enough that people talk about it? Website: https://shantj.github.io/sproutguard/ If you've worked on consumer productivity or habit products, I'm interested in what actually made users talk about them.

Aptoide has brought its games store back to Google Play after more than a decade, as court-ordered changes open Android to competing app stores.

Platforms like Meta, TikTok, Snapchat, and Google are facing a long road of litigation.

Creators who want to start earning on the platform will need at least 8,000 qualified watch hours over the past year or 20 million qualified Shorts views in the last 90 days.

Aptoide has become the first app store distributed inside Google Play under a judge's order.

You can now use your Venmo balance or linked accounts for Google Play purchases.

The ability to add Venmo to Google Play comes as people are spending more money on apps and games.

Following the latest twist in Google's legal battles with Epic, US Android users are now able to open Google's Play Store and download a third-party digital store with its own selection of apps. Aptoide, a store specializing in mobile games, is the first to become available. Third-party app stores have always been available on Android, […]