self.md radar — 2026-09-17
three interfaces moved closer to the decision
A browser assistant is getting another model behind its tabs. Claude is removing a product fork. A database tool found that one invisible character could send an access check and a SQL query to different tables.
1. Firefox Smart Window adds Mistral Small 4
Mozilla is adding Mistral Small 4 to Firefox Smart Window beta for users in the US and Canada, and bringing the beta with French-language support to France. Smart Window can work from browser tabs: complex searches, a page somebody clicked away from, sources behind a result.
The model picker remains. Mozilla says Smart Window users can still choose other AI models in every market where the beta is available. Mistral says conversations are not saved on Mozilla’s servers by default and that partners accept zero data retention. Those are product terms, not a browser-side proof that every part of the system runs locally.
reading: Mozilla’s partnership announcement · Mistral’s announcement
2. Claude folds Cowork into the main conversation
Cowork was where Claude sent the larger job. Chat was where people asked the question. Anthropic says those surfaces are merging into one Claude, first for Pro and Max users over the coming weeks.
Docs, Slides and Design now sit inside conversations as paid-plan betas; Enterprise admins decide when they switch them on. Anthropic says actions ask for confirmation by default, though users can choose a mode where Claude continues until something needs closer review. One routing choice disappears. The control settings have more work to do.
reading: Anthropic’s product announcement
3. Datasette patches a permission bypass hiding in a newline
Datasette 0.65.5 fixes a table-permission bypass caused by a trailing line feed in a requested table name. The advisory says installations using table permissions to protect private data could expose protected rows, even with arbitrary SQL disabled.
The odd bit sits between two parsers. Datasette authorized the supplied name; SQLite treated its final newline as whitespace and reached the plain protected table. The advisory documents a secret~0A route in the reproduction and says stable 0.65.x needs a colliding newline-named table already present. Upgrade to 0.65.5 or 1.0a40; for systems that cannot move immediately, database-level restrictions are the listed workaround.
reading: GitHub security advisory · Datasette 0.65.5 release
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup
- Sandboxing and security — give agents useful power without giving them the whole house