Prospero: a native C++ coding harness that sheds the web stack
Public-domain, bring-your-own-endpoint, headless over SSH — plus a ChatGPT share link that hijacked accounts and Gemini Computer Use reaching GA.
Copy markdown
A coding harness that isn't a web app
Chris Wellons (skeeto, of nullprogram) released Prospero, a single native C++/ImGui executable that runs coding agents against any OpenAI- or Anthropic-compatible endpoint you supply — he claims roughly two orders of magnitude less resource use than typical web-stack harnesses, though he shows no benchmarks. The core is public-domain on GitHub; a paid Professional edition adds prebuilt headless engines so an agent can run on a remote box while the GUI stays on your laptop, and every operation carries a deadline so runs don't hang.
One ChatGPT share link could hijack your account
Parameter researchers showed a single shared ChatGPT conversation could execute attacker HTML as chatgpt.com by abusing MathLive's postMessage listener, which checked neither origin nor event.source and rendered raw HTML via innerHTML — enough to read and exfiltrate a victim's private chats just by opening the link. OpenAI reproduced it, escalated it to P1, and fully patched both frontends by Oct 26 (a $5,000 bounty); the lesson for your own apps is to audit every postMessage listener for origin and source checks and never turn cross-window messages into innerHTML.
Gemini Computer Use goes GA
Google promoted its Computer Use tool to general availability across the Gemini API's Interactions and GenerateContent endpoints on Oct 30, about 388 days after the first preview. If you've been prototyping click-and-type browser or desktop agents against Gemini, they're now cleared to ship without the preview caveat.