Hackaday Links Column Banner

Hackaday Links: July 26, 2026

At a time when so-called “artificial intelligence” seems inescapable, we were encouraged to see news that Amazon will be cracking down on third-party sellers that use AI-generated images for their product listings. They won’t be prevented from using the images, but they will need to clearly indicate that they don’t represent reality and were produced via artificial means. This comes in response to a recently enacted New York law that requires the disclosure of AI in advertisements.

Will this be the end of the cat sleeping bag?

But it’s not quite a clear cut as it might seem on the surface, as the New York law is actually about AI-generated people rather than products. Specifically, it’s designed to make it clear when a “synthetic performer” has been used in place of a human actor. As such, it would appear that the easiest way for Amazon sellers to dodge the new rule is to simply not include any humans in their AI slop images and videos. In other words, they can continue to post fake pictures of products without having to inform the consumer so long as they don’t show a fake person holding it.

Under normal circumstances we’d leave something like this next one for our weekly security column, but the utter lack of security in the Pope’s official “Click To Pray” mobile application revealed by researcher BobDaHacker on Friday is just too good a story to pass up. For one thing, who knew that there was an “official” prayer app? We don’t dabble in theology around these parts, but we’re fairly sure the good book didn’t mention anything about requiring a smartphone to give praise.

Continue reading “Hackaday Links: July 26, 2026”

Add Sensors To Everything!

“You can’t control what you can’t measure” goes the old chestnut. But that’s a little bit negative, in my opinion. Instead, think of the benefits of sprinkling sensors around everywhere: you gain insight where you simply didn’t have it beforehand.

We were thinking about this in the context of the recent video on pressure advance in 3D printers. Essentially, the unmelted filament acts as a springy piston, and that springiness means that the pressure built up in the melted plastic lags the feedrate of new filament. We usually calibrate this out with a guesstimate constant, but it can be different for every different filament. Measuring that pressure directly with a strain gauge in the hot end makes more sense.

But then there are knock-on benefits of having a sensor in the hot end. You can use the strain gauge as Prusa does to run the nozzle gently into the bed and set the z-axis height. Or you can use over-pressure as a sign that the nozzle is clogged. It’s quite possible that you can use it to signal other things that can go wrong as well, but you can’t tell until you put the sensor on in the first place.

Of course, you don’t want to put a pressure sensor where you want to know the temperature, or vice-versa. But as a general rule, the more you can measure, the more you can discover about the way your system is running. How many strain gauges are too many?

Hackaday Podcast Episode 379: Driving E-ink DIY, NES On ESP, And The Other IRC

On this episode, Hackaday editors Elliot Williams and Tom Nardi discuss their love of electronic paper, clunky cartridges, and keeping old games alive by any means possible. You’ll also hear about getting the most out of the sensors in our 3D printers, playing with X-rays at home, a ring that runs Java, and a roulette wheel that outgrew its 555 timer. Stick around to the end to learn about a different sort of IRC that’s even more niche than the one you’re probably familiar with, as well as the logistical challenges and potential benefits of catching rockets with a giant net.

Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download in DRM-free MP3.

Continue reading “Hackaday Podcast Episode 379: Driving E-ink DIY, NES On ESP, And The Other IRC”

This Week In Security: AI Is A Mess, Hacking Car Chargers, An OpenSSL DoS, And Factories Under Attack

[Ayush Paul] posts about extracting data from Claude agents while it accesses web data to fulfill user requests.

But it wasn’t that easy. [Ayush] discovered that Anthropic anticipated many of the attacks, and set up guardrails in an attempt to keep the agent from accessing arbitrary web sites. For Claude to access a website, the user has to specify it, it must be the results of a web search, or it must be referenced by a website previously specified by the user or returned in a search.

To convince the Claude agent to navigate a malicious site designed to extract data, Ayush formed a false warning that Cloudflare was blocking the agent for authentication purposes, and asked it to spell out the name of the agents owner by clicking a list of alphabetical links. Of course Claude trusts Cloudflare and wants to be helpful, so it cheerfully completed the task.

Once the agent is trapped in the false authentication loop, it can be interrogated for all sorts of information it knows about the owner: Ayush was able to convince it to disclose employer, and even data about the user that could be linked to security questions, like their home town.

Since Claude can be detected by the user agent (the field attached to web requests that tells the web server what sort of browser is requesting the page) custom information can be fed to the bot while users see a normal website; clicking a link looks completely normal, but asking an agent to summarize the site triggers fooling the bot into spilling the beans.

After reporting the issue, Ayush was told that Anthropic had already identified the issue internally, and eventually prevented the attack for now by preventing the agent from following links on external pages.

Grok sends entire codebases

Cereblab discovered that the Grok coding agent uploaded the entire content of the codebase it’s working with – and all Git history – to xAI servers, almost immediately. Even when told to never upload a file, the agent would reply “OK”, and then begin uploading the code bundle anyway.

If uploading your code to a remote server isn’t bad enough, and this could be extremely bad in some situations involving sensitive company code, including the entire Git history means that previously deleted files, like accidentally committed secrets or authentication credentials and tokens, were also leaked. Attempting to opt out by disabling options to improve the model by uploading code had no effect.

After gaining attention, Grok has added a privacy option to opt out of data retention. xAI has committed to deleting the retained uploaded code, but it is unclear if users will be told when their data has been removed. To actually prevent the agent from uploading local files to the xAI servers, even temporarily, a global flag “disable_codebase_upload” is required. Watch out, the privacy retention flags are only per-session!

Continue reading “This Week In Security: AI Is A Mess, Hacking Car Chargers, An OpenSSL DoS, And Factories Under Attack”

Hackaday Europe 2026: Half Quad, Half Blimp: Test. Fly. Survive.

A great many drones out there, whether homebuilt or store-bought, follow the same basic format. Four motors, some kind of controller, and a lithium-polymer battery supplying the juice to keep everything in the air. It’s a format that produces a remarkably capable air vehicle, suitable for everything from high-speed camera work to urban search and rescue.

With that said, the format does have its limitations. [Suryansh Sharma] has been working on alternative designs for fancy and interesting drones that are half quadcopter and half blimp, and he came to Hackaday Europe 2026 to tell us all about it.

Continue reading “Hackaday Europe 2026: Half Quad, Half Blimp: Test. Fly. Survive.”

Compile Here, Run Everywhere: Crosstool-Ng

In a recent post, I mentioned that I wanted to build some tools for a stripped-down Linux running on a 3D printer with a MIPS CPU. I had two options: build a toolchain to cross-compile, or use Zig, which, in theory, has built-in toolchains for MIPS. I had to jump through hoops to get Zig to work, and I did mention Crosstool-Ng, so you might wonder why I didn’t start there. Turns out, it had its own set of hoops to work through.

Continue reading “Compile Here, Run Everywhere: Crosstool-Ng”