Datasette patches subtle bugs found by a frontier-model security audit
A frontier-model audit of Datasette exposed subtle private-table leaks; Willison will now audit all his code this way. Plus: Grok 4.7 slips again.
Copy markdown
The leak lived where public meets private
Datasette 1.0a39 and 0.65.4 close subtle flaws that mainly bite public instances mixing public and private tables, after issues first flagged by Sevban Donmez. If you run Datasette on the open web, upgrade now.
Three frontier models, one week, human-written tests
Simon Willison and Alex Garcia ran the audit with Claude Fable 5.1, GPT-5.6 and GPT-6 Astra - one writes the failing test, the other ships the fix. They'll now bake frontier-model security audits into all their work; you can point the same setup at your own repo's trust boundaries this weekend.
Elsewhere: Grok 4.7 slips again
Musk said on Sept 11 that Grok 4.7 needs "a few more days" of RL tuning - it wraps up prematurely and its answer-checking runs too loose - and docs.x.ai still lists only grok-4.6. No firm date, so don't rebuild your stack around it yet.