
Professor @uni_bamberg_of | privacy, information security, and ethics | digital teaching @dikule_uba | enthusiastic speaker | typography nerd | EN/DE
Bamberg, DE
Joined March 2008
- Tweets9.4K
- Following278
- Followers771
- Likes1.9K
Your regular Chrome already auto-updated to 156, so you think you're safe
You're not
The real danger here is Playwright, Puppeteer, and MCP browser tools running inside Cursor, Claude Code, or Terminal
1. Your IDE / Terminal has macOS Accessibility permissions
2. It spawns a cached Playwright Chromium (usually stuck on v131โ151 or whatever)
3. That browser inherits your IDE's Accessibility permission
4. Any site your agent visits can use the GPU process to press Cmd + Space, open Terminal, and run commands on your Mac ๐
Check ~/Library/Caches/ms-playwright and ~/.cache/puppeteer right now and update to Playwright 1.64.1+ (Chromium 156)
๐จ BEWARE: Chrome Sandbox Escape
Full remote command execution + full chain capabilities
October has been wild
pwn.ai/blog/chrome-escape
Dominik Herrmann retweeted
Initially, I had Claude make this animation in 2D. It wrote the piano score and drew every frame in JavaScript.
I gave this 2D version as reference to another Claude. Because the whole film was code, Claude was able to use its exact choreography and make the 3D one in Blender.
Dominik Herrmann retweeted
Over the last few weeks I've been running a few workshops on Practical AI for academics. I thought I would share the slides and reflect a bit on what I have learned. You can find the slides and some material here: claesbackman.com/ai_workshopโฆ
This AGENTS.md fixes the ๐๐ต๐ฟ๐ฒ๐ฒ ๐บ๐ผ๐๐ ๐ฎ๐ป๐ป๐ผ๐๐ถ๐ป๐ด ๐ต๐ฎ๐ฏ๐ถ๐๐ of Codex and Claude Code: writing backward-compatible code for a project nobody uses yet, never deleting old code and docs it no longer needs, and adding a pile of tests just to change a button color.
After using them every day for months, the lines I'd want in there from day one are the ones at the top: if the project has no real users yet, skip compatibility and migrations, and go straight to ๐๐ต๐ฒ ๐๐ถ๐บ๐ฝ๐น๐ฒ๐๐ ๐ฐ๐ผ๐ฑ๐ฒ ๐๐ต๐ฎ๐ ๐๐ผ๐ฟ๐ธ๐.
Then a four-step loop: docs first โ tests โ smallest implementation โ clean up.
Copy and paste it into your AGENTS.md ๐
A week of Claude Code sessions is too much to remember. Every weekend, have Opus 5.5 vibe-code a quick ๐๐ฒ๐ฒ๐ธ๐น๐ ๐ฐ๐ฎ๐น๐ฒ๐ป๐ฑ๐ฎ๐ฟ like this from your local session logs.
Then give it ๐ฎ ๐๐๐ฏ๐ฎ๐ด๐ฒ๐ป๐ ๐๐ต๐ฎ๐ ๐ผ๐ป๐น๐ ๐ฏ๐๐ถ๐น๐ฑ๐ ๐๐ฒ๐ฒ๐ธ๐น๐ ๐ฐ๐ฎ๐น๐ฒ๐ป๐ฑ๐ฎ๐ฟ๐:
โ Name it week-calendar, set its effort to medium, and preload a design skill
โ The first time, it asks which colors you like and whether to color by project or by task, and saves that to memory. After that, every calendar follows it
โ Call it when you want to look back on the week or write a weekly report. It regenerates the calendar and writes up a 3-line weekly report for you
โ The calendar shows four things: when you worked each day, what each session did, ๐๐ต๐ถ๐ฐ๐ต ๐๐ฒ๐๐๐ถ๐ผ๐ป๐ ๐๐๐ผ๐ฝ๐ฝ๐ฒ๐ฑ ๐๐ถ๐๐ต๐ผ๐๐ ๐ฎ ๐๐ถ๐ป๐ด๐น๐ฒ ๐ฐ๐ผ๐บ๐บ๐ถ๐, and how many hours each project took this week
Send this prompt to Claude Code ๐
"Set up a subagent that only builds weekly calendars:
1. Create week-calendar in ~/.claude/agents: model: opus, effort: medium, memory: user. Preload the design skills I have installed (for example impeccable). Give it Bash so it can run git log and the script that builds the calendar. It only writes files to ~/.calendar/ and its own memory.
2. The first time, it asks me what style I like: dark or light, one accent color, color by project or by task type, and whether the week starts on Monday or Sunday. It saves my answers to memory and follows them every time.
3. The calendar is one HTML file. The script writes the data straight into it, so it opens with a double-click. Use this week's session logs: Claude Code's are in ~/.claude/projects/ (skip the subagents folders), and if I use Codex, add ~/.codex/sessions/. Before writing the script, open one file to check the fields. Convert times to my local time zone, and use the cwd in each record to tell projects apart. One block per session; start a new block after any gap longer than 30 minutes. Clicking a block shows the project, start and end time, the model used, the session title (if there isn't one, sum up my first typed message in 3 to 5 words), my first typed message, and my commits and changed files in that repo during that time (skip folders that aren't git repos). Sessions that stopped without a single commit get a red outline and also go in a separate list. At the top, total this week's hours per project, counting parallel sessions only once. Keep everything local.
4. Add a rule to ~/.claude/CLAUDE.md: when I say "what did I do this week" or "write my weekly report", have week-calendar regenerate the calendar first, then write a 3-line weekly report from it: what I mainly got done this week, which project took the most time, and which no-commit sessions to pick up first next week.
Show me the contents of the files you'll create or change, then explain the whole flow in words a 10-year-old could follow. Don't write anything until I confirm."
I asked Opus 5.5 to write, produce, and create me an educational 'cartoon' about The History of Light - using whatever resources it had available to it.
I didn't expect it to make a 36 minute video and spend $200+ dollars though ๐
The study of light is genuinely fascinating, and we have spent thousands of years trying to understand it. This is that story.
Opus 5.5 wrote and produced the entire film. I told it to use any keys in my keychain to generate the voices, create any images or video it might need, and to create whatever motion graphics it could to explain concepts in electromagnetism.
It used
> Gemini 3.8 Flash TTS for the narration, and I must say, it did an excellent job.
> Lyrica 3 for the background music, which is also essentially perfect.
> GPT Image 2.5, Nano Banana Pro and NB2 Flash for some of the scenes imagery
It's certainly not perfect but I was still really impressed with how well it did producing the film. It's very interesting if you're a physics nerd like me.
Opus is genuinely creative in a way that I've not really seen with other models. I just gave the model a few constraints and just let it make all the decisions end to end.
It even wrote itself credits at the end lol.
It's going to be so fun to create bespoke educational videos like this for my children to learn from
Dominik Herrmann retweeted
๐ Days 3 & 4 of #ARES2026 featured research across AI, critical infrastructure, cyber risk, forensics, PQC & more.
๐ Congrats to Best Paper winners Ralf Gundelach, Michael Mรผhlhauser & Dominik Herrmann!
โ๏ธ Day 3 ended at Flygvapenmuseum with the banquet and choir performance. โ at Sweden
Tippst du besser als die KI? ๐คโฝZur WM 2026 haben wir ein Tippspiel gebaut, bei dem du nicht nur selbst tippst โ du konfigurierst eine eigene KI, schaust ihr beim Tippen zu und trittst gegen sie an. Ist ChatGPT oder Claude besser? #KI #WM2026 tippspiel.wiai25.de/
Zum 25-Jรคhrigen der Fakultรคt WIAI haben wir einen Stiftplotter aus der Werkstatt geholt. Auf wiai25.de/dein-muster/ kรถnnt ihr ein eigenes Muster designen โ wir zeichnen es auf A3, schwarz auf weiร oder Silber/Gold auf Schwarz. Auf Wunsch auch kleiner.
Wir plotten in vier Runden bis zum Fest. Die erste schlieรt am 26. Mai, 23:59 Uhr. Abholung am 26. Juni beim Fest in der WE5 in Bamberg, kostenlos. 20 Muster sind schon in der Galerie.
4 Jahre lang haben wir im Bayer. Forschungsverbund ForDaySec.de untersucht, wie IT-Sicherheit im Alltag funktioniert. Informatik, Soziologie und Recht, 5 Unis, 8 Teilprojekte. Am Mittwoch (25.3.) stellen wir die Ergebnisse in Mรผnchen vor. 1/2
Keynote: Eva Wolfangel, Gruรwort: Caroline Krohn-Atug (BSI), Podiumsdiskussion. 16โ19 Uhr, Eintritt frei. Anmeldung noch bis morgen: fordaysec.de/veranstaltung/bโฆ
Dominik Herrmann retweeted
Let me blow your mind real quick:
When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.
Itโs called the RDP Bitmap Cache.
To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.
Even if the session is over and the remote server is destroyed... your laptop still holds the cache files.
Forensics teams use tools like BMCViewer to stitch those tiles back together.
They won't just see logs but the literal email, document, or picture you were looking at.
๐
Dominik Herrmann retweeted
In security, when you do your job perfectly, nothing happens. And people don't see when nothing happens.
Finally! An LLM grades 3000 free-text exam answers โ while I drink coffee!
Too good to be true? Exactly.
After field testing at Uni Bamberg: Weโre not grading faster with AI, weโre grading twice. ๐งต
Made me chuckle, but totally right. 37 iterations later at 3 AM: Procrastination in the AI age. But quality improved.
Part 2 of my series on exams and AI is live: Automated grading, prompt injection (the LinkedIn flan experiment!), and why we spend more time discussing AI policies than actually teaching.
Bike-shedding at its finest.
uni-mal-anders.de/en/shorts/โฆ
#HigherEd #AI #AcademicTwitter


















