MD Rifat

Philosophy, science, politics and religion are my jam. Software development is my bread and butter. Sarcasm is my salt and pepper. Follow me for a tasty treat.

[MD Rifat @mdrifatcom]

Amazon saw Meta's AI agent coming and slammed the door. Shopify rolled out the red carpet, agentic checkout with Shop Pay on every store.

SEO got you ranked. GEO gets you bought. The new shelf is whatever the agent recommends.

#AI #GEO #SEO #AgenticCommerce

[MD Rifat @mdrifatcom]

SHA pinning was supposed to stop plugin rug-pulls.

Plugin4Shell: four coding agents checked out the pinned commit but never verified the working tree matched it. Auto-update makes it zero-click.

Update Claude Code to 2.1.179+ and Codex to 0.146.0+. Copilot has no client fix.

[Raju Borda @rajuborda]

Four of the biggest AI coding agents just shared the same zero-click hack.

Claude Code. OpenAI Codex. GitHub Copilot. Gemini CLI.

Researchers found a flaw called "Plugin4Shell" that lets an attacker swap a trusted plugin for malicious code — with no click, no approval, nothing.

You do everything right — install from a trusted marketplace, use a plugin that's SHA-pinned to a reviewed commit — and you're still exposed. The pin gets silently bypassed.

Once it's in, the malicious code runs with the same access as the dev running the agent: source code, cloud keys, SSH, prod systems, secrets.

Anthropic and OpenAI patched it fast. Microsoft hasn't fixed Copilot. Google just killed off Gemini CLI instead of fixing it — so every existing install stays vulnerable, forever.

Nearly 90% of Fortune 500 companies run Copilot.

If you use any of these: update now, and don't trust "reviewed and pinned" as a safety guarantee anymore.

[MD Rifat @mdrifatcom]

@kristindahl client side, yeah. what makes the inventory messy is copilot still has no client fix, and gemini cli's path is deprecated so it's migrate not patch. only claude code 2.1.179+ and codex 0.146.0+ are clean upgrades right now.

[MD Rifat @mdrifatcom]

@fakharkhan the fix is basically one line in the install path: after checkout, assert git rev-parse HEAD equals the pin and bail if it drifts. auto-update is what makes it nasty, zero clicks needed. claude code 2.1.179+ and codex 0.146.0+ are patched, copilot still isn't.

[MD Rifat @mdrifatcom]

Your site can rank #1 and still never show up in an AI answer.

Google's generative AI Search guide: AI Overviews run on ranking + RAG. Skip the llms.txt theater. Unique, crawlable pages still win.

Measure Generative AI performance in Search Console, not just blue links.

[Abdessalam Alaoui @musthaveai]

Same questions. Different source markets.

A new 960-answer dataset tested 80 AI-search questions across ChatGPT, Perplexity, Gemini and Claude. The result was not one shared citation market.

Key findings:
• All 99 answers that skipped web search also showed no visible citations.
• Perplexity exposed 19.48 cited URLs per answer; ChatGPT exposed 3.05.
• 966 of 1,329 cited sites appeared in only one engine.
• Yet 23 of the 25 most-cited sites appeared in three or four engines.
• Two separate datasets found near-zero Perplexity video citations while Gemini remained much higher.

The practical lesson: an aggregate AI visibility score can hide the search gate, source-list capacity and engine-specific selection behavior. Preserve those denominators before comparing citation share.

Full analysis and downloadable dataset:
https://t.co/1qCbD4kAwy

#AISearch #AEO #SEO

[MD Rifat @mdrifatcom]

@musthaveai This is the nuance most GEO dashboards miss: visibility is engine-specific, and citation share depends on whether the engine searched at all.

[MD Rifat @mdrifatcom]

@seorce_ Strong point. In AI search, original evidence and a clear point of view are much harder to commoditize than polished filler.

[MD Rifat @mdrifatcom]

@ProcessVenue Exactly. The gap between ranking and being cited is where intent coverage and answer completeness really matter.

[MD Rifat @mdrifatcom]

Eval hygiene > model brand.

[MD Rifat @mdrifatcom]

@theaisignals The accidental internet access is the key lesson here. An eval is only as trustworthy as its containment assumptions, especially when the targets are real organizations.

[The AI Signal @theaisignals]

Full writeup on how Gemini broke out of its sandbox and hit three companies: https://t.co/YPKkN3PZDR Curious how you read it

[MD Rifat @mdrifatcom]

@AgenticCoreAI The coding-agent zero-day point is the one that sticks. A small prompt boundary can become a production blast radius, so permissions and sandbox design matter as much as the model.

[MD Rifat @mdrifatcom]

Google visibility and AI training used to be one blunt choice.

Cloudflare's Sept 15 setting adds a no-training preference in robots.txt while Accountable crawlers keep search-crawling. Hit Block and you can lose Googlebot.

Check Search / Training / Agent before changing crawl.

[広報PR・マシンリレーションズ支援のPRナビ📢 @PR_NAVi]

Cloudflareからウィークリーニュースです。

今週のテーマは「AIクローラーの検索とAI学習の切り分け」です。

これまでGoogleやMicrosoftなどのクローラーは、検索用にサイトを巡回するのと同時にAI学習用データも集めていました。サイト側は「検索に載りたいならAI学習も許可するしかない」という状態でした。

・Cloudflareが新しい設定「Disallow AI Training」を追加。検索には載ったまま、AI学習だけを拒否できるようになった
・Apple・Google・Microsoftの3社がこの仕組みに対応済み、または対応を約束
・Cloudflare上のサイトのうち、検索ボットを拒否しているのは1%未満。一方AI学習を何らかの形で拒否しているサイトは17%
・9月15日から適用開始。既存の設定は自動移行、広告収益のあるサイトは今後「AI学習は拒否、検索は許可」が推奨設定になる

3行まとめ
・検索に載る、AI学習に使われる、の二択を強制する仕組みが変わった
・自社サイトが検索されつつ、AI学習には使われないよう選べる
・広報担当は自社サイトのCloudflare設定を一度確認すべき

参照：https://t.co/lRW0c5SJxX

[MD Rifat @mdrifatcom]

@Vishalaii @sengineland @Cloudflare Exactly. The safe default is a deliberate split: keep search discovery on, then set a separate policy for training. That distinction is easy to miss in a broad bot block.

[MD Rifat @mdrifatcom]

@bbbybuilder The mixed-use crawler detail is the part teams need to catch. Separating Search from Training avoids turning a model-policy decision into an SEO outage.

[MD Rifat @mdrifatcom]

Hot take: SEO/GEO agents waste money calling big LLMs for yes/no calls.

Jev (TypeSafe AI) isn’t a writer—it’s a decision model. Choice/Score/Noul in, answers + confidence out. Code routes. LLM writes.

That’s the split more teams need.
#AIAgents #SEO

[MD Rifat @mdrifatcom]

Google didn’t ship a September core update. It did something worse for lazy SEO: AI Overviews can now auto-expand full-height on some desktop queries. Same rank. Less screen. Less click. Track CTR + citations, not just position.
#SEO #AIOverviews