Microsoft’s September patch release fixed about 972 vulnerabilities, including 112 rated high critical severity. Microsoft did this after prior months that patched 570 and 620 vulnerabilities, and it follows an open letter warning that the patching window could narrow. As a result, companies are issuing large numbers of patches more quickly, reflecting an ongoing shift in how software vulnerabilities are managed under AI-enabled exploitation risk.
Claude subscribers reported their token usage rising while they were inactive, after hackers reportedly accessed accounts and minted unauthorized Claude Code OAuth tokens. The reported theft included an increase from 45% to 55% during a controlled interval, and Anthropic refunded £44.49 for the remaining time on a $200-per-month subscription. Anthropic suspended affected accounts, invalidated sessions and server-side tokens, and partial refunds were issued, after which some users canceled or switched tools due to the lack of itemized token visibility and fast support.
Chrome switched from a four-week to a two-week update release schedule across desktop, iOS, and Android, tied to its security strategy for the AI era. Chrome 153 launched on Tuesday under the new cadence. The shorter cycle is meant to reduce the “N-day” gap between when vulnerabilities are known and when patches reach users and to speed feature delivery for AI-related browser updates.
Tesla Cybercab launched in Austin, Texas, but riders reported finding a virtual joystick that enables manual control. The change was spotted within less than a week after the official launch. The vehicle’s “no manual control” design is now contradicted by an employee-intended toggle on the central display.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
