Apple's new macOS update overhauls Siri to work like browser AI assistants—it can see what's on your screen and answer questions about it. The OS also adds design refinements and improves Spotlight search to let you query your files, emails, and messages directly.

• Siri can now look at your current window or a selected portion of the screen to answer questions and perform tasks, similar to existing AI sidebars in Chrome and Edge
• You can use keyboard shortcuts (Command+Shift+Space for full window, Command+Shift+6 for selection) to give Siri context before asking questions
• Spotlight Search now lets you search within specific categories like Applications, Files, and Clipboard, and query your personal data like emails and calendar without opening apps
• Siri can edit text directly—select a passage and ask it to proofread, rewrite, or improve your writing

Trail of Bits crafted four malicious agent skills that bypass Cisco, Vercel, and ClawHub scanners by padding code or embedding payloads in docx and bytecode. The article shows how Siri-AI’s integration with private cloud compute and search can expose messages, emails, and calendars through prompt injection. It also covers a PyPI worm that auto-executes a hades-setup.pth hook to steal cloud and GitHub tokens, urging audits and immediate token rotation.

• Trail of Bits bypassed Cisco, Vercel, and ClawHub agent-skill scanners using tricks like 10,000 newlines of padding, or hiding payloads in .docx files and compiled Python bytecode—none of the scanners caught the buried triggers.
• Siri-AI's use of Gemini via Apple Private Cloud Compute pulls in messages, email, notes, and calendars, making it vulnerable to prompt injection that can leak private data or trigger unwanted actions like forwarding sensitive material.
• Socket found a PyPI supply-chain attack hijacking 19 packages (37 malicious wheels) that drop a hades-setup.pth hook to run an embedded Bun runtime, stealing AWS/GCP/Azure, GitHub, npm, and SSH credentials and exfiltrating them to GitHub repos while disguising traffic as Anthropic API calls.
• Affected package names include bramin, executor-engine, executor-http, funcdesc, coolbox, dynamo-release, and magique—any match warrants full credential rotation and a CI/CD log audit.