plugin

Phoenix Technology reported that on September 29, the DeepSeek Harness v0.2 preview version was officially released, providing installation packages for macOS and Windows desktop, and is now available on the DeepSeek official website. The new version comes pre-equipped with commonly used features for daily office work and development, and introduces a plugin installation and management page.This update optimizes file display, content preview, and code change display, improves the settings and management of automated tasks, and offers various ways to showcase work processes. Users can provide documents, spreadsheets, or PDFs for organizing materials, analyzing data, generating charts, or creating presentations, and can also modify projects and run code.The built-in automation task plugin can be activated as needed, supporting the scheduling of repetitive tasks and allowing users to view running records, adjust execution frequency, and task instructions. The plugin management page supports installing by entering the plugin package name, as well as disabling, uninstalling plugins, and viewing introductions and sources; in the experimental creative mode, users can describe their needs through dialogue, allowing it to write and modify plugins. The official statement indicates that the product is still in its early stages and will continue to improve the sandbox and security, agent teams, long-term memory, browser and other GUI software automation, remote and mobile usage, and explore session sharing and multi-user collaboration. According to the official model API user statistics, about 60% of users have used third-party plugins.

According to Slow Fog Security Alert, the AI memory toolchain under MemTensor has been compromised. The open-source long-term memory library MemoryOS (PyPI) aimed at LLM and AI Agent, as well as the official plugin memtensor/memos-cloud-openclaw-plugin (npm) that connects to the OpenClaw runtime, have been implanted with a cross-platform Go binary, which triggers execution when the package is loaded or imported.Affected versions include: MemoryOS==2.34 on PyPI, and npm plugins 0.1.21, 0.1.23, 0.1.25. Among them, the affected npm plugins may also cause user prompt content leakage. Slow Fog recommends taking the following measures: uninstall or downgrade to known safe versions (npm 0.1.20, PyPI 2.33); terminate the sckit process; block related infrastructure; check network activity; and rotate credentials in the affected environment.

The DAO governance platform Aragon announced the launch of Confidential Voting, a governance plugin based on the Zama Protocol for Aragon OSx. This plugin keeps individual votes encrypted during the counting process while retaining the familiar Aragon voting experience. Zama's programmable confidentiality allows projects to define decryptable information, decryptors, and conditions.Voters select for, against, or abstain through the Aragon interface, choosing to encrypt and submit using the Zama Relayer SDK on the client side. The plugin utilizes fully homomorphic encryption for verification, weighting, and accumulating encrypted votes, only performing threshold decryption on the final counts of for, against, and abstain after the voting ends. The plugin does not grant decryption rights to individual ballots.To maintain confidentiality during voting, the system does not provide real-time counting, does not support early execution, and allows voters to change their encrypted votes before the deadline. The plugin adopts a modular architecture, allowing it to be used in parallel with other governance primitives, and actions related to proposals are executed by the DAO after approval.

Google (GOOG.O) announced the launch of the Google Cloud Developer Plugin, which is used for the artificial intelligence coding assistant.

According to the DeepSeek Harness team, the new version DeepSeek Harness v0.1.5 has been deeply debugged with the DeepSeek V4.1 Flash model, covering standard mode, Programmatic Tool Calling (PTC) mode, and minimalist mode, and supports updating system prompts while retaining the existing KV Cache.The web version adds support for uploading various file types such as images and PDFs, as well as a sidebar file tree preview, allowing direct viewing of Markdown, HTML, PDF, code, and images. The interface provides standardized extension entry points for plugins on both the left and right sides, supporting global entry, multiple tabs on the right, and column display.Long session loading and storage performance have been optimized, and bidirectional communication between the parent Agent and child Agents is more flexible, with the experimental plugin "Agent Teams" enabling multi-Agent team collaboration and task splitting.

SafePal stated that its order tracking plugin has a security vulnerability, leading to unauthorized access to some customer information.This incident involves approximately 39,798 users, with affected customers being those who placed orders between March 2, 2025, and April 11, 2026.The leaked information includes names, email addresses, shipping addresses, phone numbers, and purchase details, but does not involve mnemonic phrases, private keys, wallet passwords, bank card information, or government-issued identification numbers.SafePal stated that the relevant vulnerability has been fixed, and affected users have been notified individually. At the same time, the official has launched a query page where users can confirm whether they are affected by entering their order number and shipping country.

According to blogger Max For AI, DeepSeek Harness (DSH) will officially start public testing on August 13. The final internal test version will be pushed tonight for developers to complete the final plugin compatibility work, and the plugin repository should include the #dsh topic tag. Plugins developed during the internal testing period can be migrated to the developer's personal account and made public. This means that DeepSeek is not only releasing the Harness product this time, but its accompanying plugin ecosystem will also be opened simultaneously. Currently, the official announcement has not been made, and specific details will be based on official information.

According to official news, the Binance wallet plugin now supports mnemonic-derived accounts. By backing up a set of mnemonics, you can derive up to 99 independent accounts.It can protect the security of mnemonics and efficiently manage accounts; multi-chain support allows a single account to be used across chains. The supported plugin version is 1.12.0 and above.

Thibault Sottiaux, the head of OpenAI Codex, announced that the usage limits for Codex across all plans have been reset to align with the newly launched plugin system and to encourage users to experience it.The first batch of integrated plugins includes commonly used developer tools such as Slack, Figma, Notion, and Gmail, allowing users to utilize Codex capabilities in more application scenarios.

According to Tencent's public account, WeChat has officially launched the WeChat "ClawBot" plugin, supporting the integration of OpenClaw. Users can scan a QR code or copy a command to connect OpenClaw to WeChat. Once connected, users can quickly interact with their "lobster" efficiently through WeChat chat. In addition, Tencent's "Shrimp Workshop" cloud shrimp Lighthouse, self-developed shrimp workbuddy, and local shrimp QClaw are all in place.

OpenClaw founder Peter SteinBerger posted on the X platform, stating that the team is considering how to make the OpenClaw plugin system more powerful while keeping the core system more streamlined, and plans to add support for the Claude Code and OpenAI Codex plugin packages.He revealed that the next OpenClaw version update is expected to be released this Sunday, and the new version will allow users to ask questions at any time while the AI Agent is performing tasks. Meanwhile, Peter SteinBerger disclosed that the automated task filtering system developed for X is performing well, running every five minutes to automatically identify and clean up spam, marketing replies, and other content, thereby enhancing the effective interaction experience.

According to Cointelegraph, hackers are using the "ClickFix" attack method to steal cryptocurrencies, with the latest two attacks involving impersonating venture capital firms and hijacking browser extensions.Cybersecurity company Moonlock Lab reports that scammers impersonate fake VCs such as SolidBit, MegaBit, and Lumax Capital, contacting users via LinkedIn to offer collaboration opportunities, then directing them to click on fake Zoom and Google Meet links. After clicking the link, users are led to a page with a forged Cloudflare "I'm not a robot" verification box; clicking this box copies malicious commands to the clipboard and prompts users to open a terminal to paste the so-called verification code, thus executing the attack.Moonlock Lab points out that this method turns victims into execution mechanisms, bypassing defenses in the security industry. Meanwhile, hackers are also spreading malware by hijacking the Chrome extension QuickLens. This extension allows users to run Google Lens searches directly in the browser, and after ownership was transferred, the new version contains malicious scripts that can initiate ClickFix attacks and steal information.The extension has about 7,000 users, and once hijacked, it searches for cryptocurrency wallet data and recovery phrases to steal funds, as well as scraping Gmail inbox content, YouTube channel data, and login credentials or payment information entered in web forms. The extension has been removed from the Chrome Web Store. The ClickFix technique has been popular among hackers since last year, forcing victims to manually execute malicious payloads, affecting thousands of businesses and multiple industries worldwide.

BitsLab co-founder Luis_0xyi posted on X platform: "A reminder to be cautious when using Chrome extension wallets on Windows computers with large funds. BitsLab recently discovered a vulnerability present in several top extension wallets that can be used to directly steal private keys. This issue affects extension wallets from major exchanges like Coinbase Wallet, Binance Wallet, and others, but the exploitation scenario has certain requirements. We will disclose more after the fix."

ChainCatcher news, the Web3 security organization BitsLab announced that it has completed the acquisition of the security browser plugin KEKKAI Plugin from the Japanese Web3 infrastructure company KEKKAI Labs, and has officially renamed it to BitsLab Safe.KEKKAI Labs is a Japanese tech team focused on Web3 security and infrastructure development, with its core product KEKKAI Plugin having a solid user base and high usage rate in the Asian market.BitsLab stated that this acquisition aims to expand its security capabilities from B-end services to C-end security. BitsLab will retain the original features of KEKKAI Plugin while introducing its own AI-driven security analysis and threat detection technology to expand and upgrade the product's functionality intelligently.It is reported that the renamed BitsLab Safe is a free browser security plugin aimed at ordinary users. Its core features include: automatically simulating the transaction process before executing transactions in the wallet, displaying results in advance, issuing warnings when dangerous contracts or malicious actions are detected, and providing phishing website protection and alerts. BitsLab plans to make this product an important part of its AI security ecosystem.Previously, BitsLab's main business focused on B-end services such as security audits, penetration testing, and vulnerability mining, having provided solutions for over 400 projects covering mainstream ecosystems like Sui, Aptos, TON, and Solana. This acquisition marks a strategic upgrade for BitsLab, aiming to build a complete security protection system "from underlying infrastructure to end users."

ChainCatcher message, the GoPlus browser security plugin now fully supports EIP-7702 detection features, providing stronger security protection for Web3 users.This update includes core features such as real-time risk alerts, advanced threat detection, and protection against malicious contracts, capable of instantly identifying and intercepting various attacks based on the EIP-7702 protocol during transactions. As one of the first platforms to focus on the security threats of this protocol, GoPlus recommends users update their extensions in a timely manner to arm themselves with the latest security tools and ensure asset safety.

ChainCatcher message, the X plugin product FlowX is now live on the Chrome Web Store. This product mainly helps users by providing background information on X accounts, funding amounts and investors, trending activities, and popular project rankings while browsing and analyzing X (formerly Twitter), enhancing their information acquisition efficiency.FlowX not only utilizes RootData's vast and reliable database but also provides links to RootData pages in multiple locations on the X account page, shortening the user action path and striving to become the best navigator for users on their encrypted journey on the X website. As an early user reward, users can earn 30 RootData points simply by logging into the FlowX product and can earn more points through daily check-ins.Download link

ChainCatcher news, according to official information, the Binance wallet has officially launched a wallet plugin (Beta version), allowing users to manage crypto assets, interact with decentralized applications (dApp), and explore Web3 directly through the Google Chrome browser on their computers.

ChainCatcher news, the on-chain aggregated trading platform Ave.ai announced a deep cooperation with the Web3 one-stop social leader DeBox. The two parties are integrating innovations around the concept of "social as liquidity," focusing on Meme trading and community building.It is reported that Ave.ai's latest official website (pro.ave.ai) has fully integrated the DeBox (debox.pro) holding chat plugin. Each token launched on the platform will automatically generate a dedicated token holding group, allowing users to join the corresponding community and communicate rapidly with other token holders without switching platforms.DeBox has over 11.15 million registered users and 640,000 daily active users, and has formed over 290,000 instant messaging groups based on on-chain asset and behavioral data. DeBox community groups have no upper limit on the number of members and come with powerful group management tools, such as red envelopes, lotteries, token airdrops, and live voice rooms. Ave.ai, as a leading on-chain trading analysis platform, has over 7 million users, aggregating more than 130 chains, as well as features like on-chain real-time trading, historical data, and signal squares.The growth leader of Ave.ai stated that this cooperation aims to break down the barriers between trading and community interaction, gather community liquidity, enhance user experience and efficiency, and promote the investment ecosystem of Web3 assets like Meme towards a more social and community-oriented direction.