Arca detailed wealth management agent tasks spanning up to 10 days, using its own memory system and runtime framework to coordinate decisions involving multiple people, while humans still execute trades. Parameter Labs disclosed a ChatGPT shared-link vulnerability: logged-in users could have private conversations stolen simply by opening a malicious link. OpenAI fixed it on October 26 and classified the report as P1. Wispr Flow's revenue grew 30-fold over the past year, and its 50 creators produce 500 to 600 paid UGC ads each month.
Arca assigns analysis to agents while leaving financial transactions to human advisers.
Arca's head of AI, Aman Singh, said its wealth management agent tasks can span up to 10 days. Rather than running continuously, they pause and resume around decisions and handoffs involving multiple people. An in-house memory system tracks customer progress, pending tasks and task owners, while an in-house runtime framework selects models based on internal evaluations. Agents analyze information and propose plans; human advisers execute trades and fund transfers, with safety constraints enforced through deterministic rules.
Read original →🔍 Analysis: Arca's “10 days” is not a direct measure of a model's ability to execute autonomously without interruption; it describes a business cycle that includes human decisions and handoffs. For enterprises, acceptance criteria should focus on whether customer status, pending tasks and ownership carry over after a pause, and whether deterministic rules still constrain execution when it resumes—not how long a single run can last.
A ChatGPT vulnerability turned opening shared content into an entry point for attacks on private conversations and API permissions.
Parameter Labs disclosed that attackers could craft malicious ChatGPT shared links that, when opened by logged-in users, could steal private conversations or make API calls on their behalf. The attack chain exploited a MathLive message-validation flaw to escape the HTML preview sandbox, then used a YouTube interface to bypass the content security policy. OpenAI fixed the issue on October 26, 2026, and classified the report as P1.
Read original →🔍 Analysis: This attack chain combined a MathLive message-validation flaw with a content security policy bypass via a YouTube interface, showing that preview sandboxes and content security policies cannot be treated as independent backstops. For AI products offering HTML previews, security reviews need to follow the entire path from incoming external content through sandbox escape to the use of logged-in user permissions.
Wispr Flow brings consumer brands' paid UGC playbook to SaaS growth.
AI speech-to-text tool Wispr Flow's revenue grew 30-fold over the past year, and it reached a $2 billion valuation in a funding round. Its content team coordinates 50 creators who produce 500 to 600 paid user-generated content (UGC) ads each month. The approach brings a marketing method long used by consumer brands to SaaS: creators receive a share of ad spend, with top performers earning more than $13,000 a month.
Read original →