Issue 4 · November 6, 2026 · Panic Meter 6/10, down 1 from last week

Binance's $6.3B heist began with a fake job interview. How to make sure that doesn't happen to you.

How to make sure a fake recruiter doesn't sucker you, plus a second try at a denied claim, forgotten subscriptions, a trip draft and dinner from your fridge.

New here? This is one weekly edition. If AI is new to you, start here first: one small task, ten minutes.

Watch · 1 minute Binance's $6.3B fake job interview, in one minute

The biggest crypto theft on record began the way plenty of job offers do: a friendly recruiter, two convincing interviews and a take-home test. Binance says one of its engineers downloaded a coding "assignment" from a company that didn't exist, and it quietly installed malware. Weeks later, about $6.3 billion walked out the door. The FBI blames North Korean state hackers.

Crypto and AI share a lot of headlines, so plenty of people assumed a robot did it. The Atlantic Council says there's no public evidence AI was used to break in; the attackers did turn one of Binance's own internal AI tools against it once they were inside. The door opened the old-fashioned way, which is the good news: old tricks have known defenses.

So, this weekend: check any file a recruiter sends before you open it, ask AI for round two on a denied claim, find the subscriptions you forgot, let a chatbot draft your next trip (then check the hours), and photograph your fridge for dinner ideas.

This Week's Five

The most useful things to try this weekend.

This week's worry

Should I let an AI assistant shop, book and send messages for me?

The companies say these "agents" are getting good. On November 2, CNN reported on an internal OpenAI test of everyday jobs, like choosing a kindergarten after a move or planning meals for a parent newly diagnosed with diabetes, built with help from about 4,000 ChatGPT users. OpenAI says its newest model scored 80% overall, up from 49% for a model released last December. Those are OpenAI's own numbers with no outside check, and CNN noted that the scoring can be subjective.

Real-world tests are more mixed. NPR reported in September on a reviewer who let Meta's Muse agent sell a phone and a keyboard on Facebook Marketplace. Without checking with him first, it accepted an offer below his minimum, set a pickup time and sent the buyer his home address. He had allowed address sharing but expected to be asked; Meta said its review found no breach of its privacy controls. A columnist in the same piece found Muse good at sorting email and still advised treating it as an experiment for now. And CBS News reported that Amazon blocks Muse from shopping on its site.

What to actually do: Use AI to research and draft, and keep the button-pushing for yourself for now. If you try an agent, start with something low-stakes, give it the least access it needs, and switch on any setting that makes it ask before it buys, sends or shares anything. Then test that setting on something unimportant before you rely on it.

Slop Watch · Spotting AI fakes

Field note: The Disaster Footage

A wall of water smashes through a town, sweeping away cars. In September the clip spread widely on X and Facebook as footage of a deadly flash flood in Nepal and Tibet. The UK fact-checkers at Full Fact found an invisible Google watermark showing it was made with Google's AI, and spotted the giveaways: objects that appear and vanish, and people walking toward the wave.

The opposite mistake is now just as common. After a deadly jet crash in Palm Beach County, Florida, on November 1, posts on X insisted the dashcam video was "100%" AI, with screenshots of an AI detector as proof. PolitiFact traced the clip to the local man whose dashcam recorded it; the detector didn't flag his original file, and major news outlets ran the same footage. Calling real footage fake is its own kind of slop.

  • Find the original uploader. A real eyewitness clip usually traces back to a real person who was there.
  • Check whether several news outlets or an official agency confirm the event happened where and when the post says.
  • Watch the details: objects popping in and out, people merging or growing extra limbs, crowds in identical clothes, people moving the wrong way.
  • Google's AI tools leave an invisible SynthID watermark. Gemini can check an image or video for it.
  • AI detectors are one clue, not a verdict. One flagged a screen recording of the real crash video but not the original.
Prompt of the week

The recruiter red-flag check

Copy this into ChatGPT, Claude or Gemini. Remove names, phone numbers, email addresses and links from the messages first, and don't upload the file itself.

A prompt is the instructions you give the AI. Anything in [square brackets] is a blank for you to fill in. First time? Start here 

I'm job hunting and a recruiter has asked me to [download a file / install an app / open a link / complete a test]. Here are their messages, with names and contact details removed: [paste messages]. Here is what I know about the company: [what you found]. List the red flags you see, explain each in plain English, and give me a short checklist of what to verify before I open anything. Be honest that you can't confirm whether the company or file is safe.
  1. Press Copy prompt.
  2. Open ChatGPT, Claude or Gemini.
  3. Paste it into the message box and fill in the [blanks].

Keep it private. Before you paste: leave out passwords, codes, and account, card, ID and policy numbers. Swap real names for "my mother" or "the company."

The free weekly email: 5 useful things, every Friday morning Free, always. Unsubscribe any time. We will never sell your address.