On the Road to Macstock, Allison Sheridan previews her session that features a hands-on spreadsheet workshop comparing Excel, Numbers, and Google Sheets. She explains practical skills like fill-down, fill-right, and possibly pivot tables, while stressing that the goal is not exhaustive training but confidence-building. Our conversation also touches on Copilot i relation to Excel, vibe coding, and why Macstock feels like coming home.
The MacVoices Live! panel examines Spotify adopting Apple-backed video podcast technology, Instagram’s disappearing posts and why anyone would want them, and Microsoft expanding Copilot everywhere, whether it is a good idea or not. Chuck Joiner, David Ginsburg, Jeff Gamet, Guy Serle, Web Bixby, Eric Bolden, Marty Jencius, and Jim Rea also look at the risks of putting AI mini data centers in homes, and Plex’s major lifetime Pass price hike.
It’s not every day that attackers can force a frontier AI model to cough up user passwords and other sensitive data without user confirmation. That’s exactly what researchers recently did to Microsoft 365 Copilot for enterprise. Even more unusual is the source they tapped to discover the critical vulnerability that made their exploit possible. Rather than employing reverse engineering or other traditional vulnerability-hunting methods, they asked Copilot. The LLM assistant readily complied.
Researchers at security firm Varonis knew they wanted to create an exploit that would exfiltrate user data when a user did nothing more than click on a link. Like most AI assistants today, Copilot steadfastly refused and made clear that sensitive prompts like that require explicit user consent in the form of a gesture, such as pressing a return key or other key. In response, the researchers peppered Copilot with questions about the guardrails that required user confirmation before the assistant could execute powerful commands.
Loose lips sink ships
The dialog was like a game of 20 questions. Each answer provided a new clue that divulged information about the complex safety mechanism. Why was auto-execution impossible, they asked. What URL structures and deep links were involved? What happens when a page is loaded with input already in the prompt field? Each answer provided a deeper view into the guardrail and its limits. Eventually, Copilot provided a stunning Microsoft trade secret—an undocumented prompt parameter that completely bypassed the requirement for user consent.
It's the year of Linux, haven't you heard? You may as well pack up your PC, study your favorite distro, and get ready to evangelize the open-source platform that will run on all systems in the future.
Joking aside, Linux has grown a bit in popularity and Microsoft continues to embrace it. While the tech giant has several apps and projects on Linux, Microsoft has not released an official Copilot app for Linux.
Sure, you could use Copilot on the web. Heck, you could even open up Microsoft Edge for Linux and install Copilot as a PWA (Progressive Web App). But where is the fun in that?
Instead, you could install the unofficial Copilot app for Linux built by Hayden Barnes. The app opens the Copilot web app in a dedicated GTK window and keeps your login session safely on disk. It also integrates with the desktop for autostart, system downloads, app launcher execution, and accessing hardware permissions like the microphone.
Barnes shared the project on X alongside a link to the app's GitHub page.
Many of the unofficial Copilot app's features overlap with using the web version of Copilot since Microsoft's AI tool is the center of the experience. But building the unofficial app as a native GTK application means its developer can deeply integrate system shortcuts, allow it to run quietly in the system tray, and trigger native OS notifications as opposed to relying on browser notifications.
Other benefits include native support for desktop accent colors and system dark themes. Overall, the app looks and feels far more natural on a Linux desktop than a standard browser window, and keeping Copilot isolated prevents it from slowing down if your main browser gets bogged down with dozens of open tabs.
The unofficial Copilot app for Linux is new, so we'll have to use it for a while to determine its long-term stability and performance. The first publicly available release of the app shipped this week.
We have a few systems running Linux spread across our team, so we'll let you know how the unofficial Copilot app performs over time.
Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.
A Adobeanunciou hoje o lançamento de um plugin unificado para o ChatGPT, reunindo mais de 70 ferramentas criativas da seu suíte diretamente na interface do chatbot por inteligência artificial (IA) da OpenAI.
O plugin conta com ferramentas de aplicativos da Adobe que já possuíam integração com o ChatGPT, além de novos recursos do Adobe Express, Photoshop, Firefly, Premiere, Acrobat, Lightroom, Illustrator, InDesign e Adobe Stock, permitindo que os usuários possam criar peças publicitárias ou adaptar um vídeo para diferentes redes sociais sem precisar alternar entre aplicativos.
A novidade faz parte da estratégia da Adobe de expandir a compatibilidade dos seus recursos com as ferramentas de IA generativa; em junho, a empresa já havia mencionado que levaria esses recursos inclusive para rivais do ChatGPT, como o Claude. No Copilot, no Gemini e no Slack eles chegarão “em breve”, segundo a empresa.
Grande novidade: um novo plugin da Adobe já está disponível no @ChatGPT da @OpenAI! Mais de 70 ferramentas — incluindo @Photoshop, @AdobeFirefly, @Lightroom e @Acrobat — reunidas em um único chat. Crie mockups com suas fotos. Adapte vídeos para qualquer plataforma. Transforme um modelo em um PDF com acabamento profissional. Saiba mais: adobe.ly/3TDrxff
Ainda conforme a desenvolvedora, a novidade foi pensada para “facilitar e agilizar a transformação de ideias em conteúdo de alta qualidade dentro do ChatGPT”, mas a empresa destaca que, para necessidades criativas “mais profundas”, os seus aplicativos nativos seguem sendo a primeira opção.
Questionada pela AI Magazine se o uso dos recursos incorporados ao ChatGPT poderia rivalizar com o uso dos aplicativos nativos, a líder de produtos de IA agêntica da Adobe, Deepti Pradeep, respondeu o seguinte:
Dentro do ChatGPT, a experiência é transformadora: em vez de escolher plugins da Adobe separadamente, os usuários podem experimentar uma única experiência da Adobe que traz o Photoshop, Acrobat, Express e mais juntos.
Nós acreditamos que a consolidação adiciona mais valor aos usuários do ChatGPT. Fora dele, nossos aplicativos nativos permanecem essenciais para um controle mais profundo, preciso e avançado dos fluxos de trabalho.
Para iniciar, é possível utilizar algumas funcionalidades do plugin como convidado, embora a Adobe recomende fazer login com a sua conta para “desbloquear recursos adicionais”.
O plugin da Adobe já está disponível tanto no app quanto na versão web do ChatGPT.
O Copilot Cowork, que passa a estar disponível a nível internacional, é um agente de IA que promete tratar do trabalho real e ajudar na produtividade. Tarefas que levavam dias a concluir passam agora a ser finalizadas numa manhã, afirma a Microsoft.
Last Tuesday, Microsoft patched a vulnerability it rated as max critical in its M365 Copilot AI platform. On Monday, the researchers who discovered the vulnerability and reported it to Microsoft revealed how their proof-of-concept exploit could retrieve 2FA codes and other sensitive data from emails accessible to Copilot.
Microsoft and other LLM providers have been unable to prevent their products from complying with malicious requests to reveal data. The root cause: AI bots are unable to distinguish between instructions provided by users and those snuck into third-party content the models are summarizing, drafting responses to, or using to perform other actions on behalf of the user. With no way to secure this crucial boundary, Microsoft and its peers are left to erect complicated and ad hoc guardrails designed to rein in the consequences of this incurable gullibility.
Jumping over guardrails
One guardrail built into Copilot and most other LLMs prevents them from submitting web forms, sending emails, and taking similar actions that can be used to exfiltrate data from the user. To work around this, LLM hackers turned to markup language, which, among other things, allows users to add formatting elements such as headings, lists, and links to text without the need for HTML tags. Another workaround is to wrap sensitive data inside HTML tags such as <img> and <form>. In either case, a web request showing the data hits the attacker’s web server, where the secret information is captured in logs.
Microsoft's Build developer conference kicked off today, and as with almost everything the company has done in the last few years, Microsoft's opening keynote focused overwhelmingly on AI and other closely related technologies. There's Microsoft Scout, an OpenClaw-based "Autopilot" agent that can hook into Microsoft 365 data to perform tasks for users; several new AI models; an expanded preview of "Codename MDASH," which is a "multi-model agentic scanning system" meant to detect and fix software vulnerabilities.
A few of those announcements stood out to us as particularly interesting, either for esoteric technical reasons or because they seem like they may have some utility for those who aren't spending their every waking moment using generative AI tools. (Microsoft's recent efforts to make its flagship operating system faster, more reliable, more useful, and less annoying didn't really come up, but there have been plenty of other announcements on that front lately.)
On the hardware front, we didn't get any updates for existing Surface devices (not counting yesterday's Surface Laptop Ultra announcement), but we did get something new: the Surface RTX Spark Dev Box is "a compact developer PC" built around Nvidia's new RTX Spark chip with up to 128GB of built-in memory.
Login
