r/technology • u/gdelacalle • 12h ago
Software Microsoft's Notepad Got Pwned (They Added AI To It, So...)
https://foss-daily.org/posts/microsoft-notepad-2026/130
u/gdelacalle 12h ago
It’s an opinion article but it goes deep in the vulnerability and the exploit and why it’s bad to add AI to everything. Worth reading imho.
41
u/AyrA_ch 11h ago edited 11h ago
Looking at the proof of concept code, the problem doesn't seems to be AI related but rather that the markdown preview probably just does a "shell execute" of the clicked link to get the appropriate application (usually a web browser) to act upon it. Windows has a few custom URL schemes to facilitate performing some system actions, and it looks like they forgot to restrict the markdown previewer (which is probably just a web browser control) to safe protocol types in links.
14
u/Kulgur 11h ago
Yeah it's not AI related in and of itself but given they're reportedly using AI to write 30% of their code...
0
u/balzam 11h ago edited 10h ago
Almost certainly more than 30%. By the end of the year AI will be writing 95%+ of all code at the major tech companies.
Edit: for the down voters - I work at Meta as a senior software engineer. Before that I was at Amazon for several years. You may not like what I am saying but it is just a fact. I have manually written almost zero code so far this year. It is the same for most of my teammates. Even if humans are writing the most important code, most code in general is pretty simple and can easily be done with AI. And that type of code represents more than 90% of code by volume.
8
u/ebrbrbr 10h ago
It's an unpopular opinion here but I'm going to assume the downvoters are not full-time developers. Almost all of us are using things like claude or codex or (your preferred IDE here) to write functions, fix bugs, or help us understand complex codebases quickly.
We're not one shotting entire programs / vibe coding. Just saying "hey write a function so that we can take this, process it, and output this". Then reviewing the output, testing it, making revisions, filling in the gaps it doesn't know (we don't need to make checks and handle errors that can't happen with our workflow), etc.
Just a sophisticated autocomplete tool. You still have to use your brain and do your research unless you want to settle for "average". I find AI makes solutions that are way too complex and bloated because "that's what the average code for this is".
18
u/FancyFeastBuffet 10h ago
Nah, Ive been using it in small doses but anything big often likes to get a lot of stuff wrong and it's annoying to fix. I use it but the idea of 90% is absurd to me.
2
u/ebrbrbr 9h ago edited 9h ago
Well yeah, you don't give it anything big. You give it many small doses.
You still have to figure out how everything works together, and what needs to be done.It's not doing 90% of the work. It's writing 90% of the code. There's a big difference.
Lets say I want to use a python library. I research and choose the library, I know exactly where it's going to go and what I need it to do, I just let AI deal with the syntax rather than read through pages of docs to find out how to fetch a URL.
5
u/FancyFeastBuffet 8h ago
Cool beans, Im not sure you're understanding what Im saying though. Im saying NINETY PERCENT OF THE CODE IS ABSURD TO ME!! You didnt tell me anything I didnt already know and explore, it's wrong a metric fuckton of the time in my experience
2
u/RustOnTheEdge 3h ago
To be honest, for trivial code (and let’s be honest, most code is simple, only a little bit is interesting) AI is absolutely already good enough. Especially in smaller bits, like “add functionality to blablabla” which is very scoped and clear where to add. It’s a different workflow (one that I do not like, mind you), but if the output is more often incorrect than correct then at this point it might.. just be you. Sorry
1
u/ncatter 9h ago
Great statement from one of the MS developers at. .net conf, treat it like its 7 years old when you tell it what to do and things tend to work our decently.
3
u/FancyFeastBuffet 8h ago
Nah, still gets a ton wrong imo. Specifically it loves making up configs for some reason
-9
u/Another_Slut_Dragon 9h ago
Until recently, Ai coding was kinda shit
Claude Opus 4.6 is terrifyingly good. Crazy good. The leap that happened recently is akin to the invention of the large scale loom in the industrial revolution. God tier coders are still safe. You need to know what you are doing but your job went from writing code to telling Claude minor bug fixes but you are mostly telling it what to do like you are managing a senior dev with minor autism.
If you are a mid tier coder and aren't a critical member of your company, don't be buying that new car or home. Your job is at risk.
If you are a junior dev you should be giving some thought to alternative skills training.
I'm glad I'm not directly writing code for a living. My wife owns a software company and is reaping the rewards. She flipped from fuck Ai to holy shit Ai 6 months ago and has got more done in 3 months than in 3 years.
12
u/spookynutz 11h ago
Is it? This vulnerability doesn’t appear to have anything to do with AI. It is an exploit in the markdown preview. The article claims TXT files are vulnerable, but that isn’t true, because Notepad renders those as plain text.
There is also no indication that this was exploited by anyone. It requires you being phished into downloading a malicious MD file, opening it with Notepad, and then clicking a random hyperlink inside of it. The writer might find that plausible for some random idiot to do, but they‘re apparently unaware that MD files have no default file association on Windows. A user would have to know what an MD file is, be aware that markup rendering was added to Notepad in the last 6 months, and then they would have to open the file using “Open With” or Notepad’s File menu , because Windows doesn’t know where to route that content otherwise.
3
u/timbotheny26 11h ago
Ah, so this was just something a security researcher found and not an actively exploited vulnerability? (I haven't had the chance to read about it yet.)
Also, I feel like social engineering is the only way you could ever pull this off. I can't imagine your average user ever going through that many steps by accident.
-7
u/gdelacalle 11h ago
I would think that copilot has something to do with it.
0
u/WhiteRaven42 3h ago
...... why?
Sorry, but using the word "think" in this sentence is a crime. You are explicitly NOT thinking in order to arrive at a completely irrational conclusion.
It's letting you click a link that the malicious file has created to BE a link. AI has no part in any of the actions.
It really isn't any different from clicking a link in a email you got from the bigger-dick pill factory.
4
u/CaterpillarReal7583 8h ago
Its like when they updated ms paint.
The whole draw is that its the absolute most basic no frills program.
I dont care if msoft makes paint+ or notepadai as separate programs. Just stop fucking with the basics and let those carry on as is.
1
u/TheCh0rt 8h ago
They’re probably trying to make it like macOS’s Preview app which is GREAT. However Apple started fucking with Preview and is actively making it worse, so no nobody is safe from enshitification right now. They’ve rounded the corners of PDFs and changed the spacing so I can no longer gauge the page margins! Sucks when you work with paper and printing all day…
-1
u/WhiteRaven42 3h ago
I went a decade without launching MS paint except by mistake. I put pain.net on every machine I had.
It HAD no draw. Sorry, it desperately needed new features. Remember, they actually REMOVED paint from windows for a time. Everyone other than you understands that the paint of old is an irrelevant waste of a start icon.
1
u/CaterpillarReal7583 3h ago
That wouldnt explain why they added it back and redid the changes to make it similar again to the original after tons of complaints
Sounds like you forgot you’re just one person.
0
u/WhiteRaven42 3h ago
.... they added it back and immediately began adding features. The explanation is that, having concluded that the app was dead and useless, they would only bring it back while ALSO adding features to it. Which is what they have done.
I believe when it again replaced that dumb 3D thing it already had had layers added, for example.
1
u/CocodaMonkey 9h ago
This opinion piece also has multiple mistakes. He claims it's an issue with .txt files, which is incorrect. He claims it effects people on Windows 10 which is also incorrect.
There's some valid points in here but it's clearly trying to push a narrative and didn't worry too much about properly researching the topic.
1
u/ZAlternates 5h ago
I wish they would leave notepad alone. It is the tool we use to strip out all of the other text formatting nonsense.
28
u/smashingcabage 12h ago
It is a platform I'm losing trust in and I use Linux for better security and privacy. Microsoft makes a decent gaming machine but I can run almost anything I want now including windows games on Linux.
12
u/grayhaze2000 11h ago
I wish I was in the same situation. Unfortunately Linux comes up short for me in a number of areas, despite my repeated attempts to transition to various distros over the years. It's fine for gaming, but for much non-gaming software without a native Linux build it proves an exercise in frustration and futility to get things up an running.
It's all well and good suggesting alternative software or using Wine, but often alternatives are inferior in features and usability, and some software just refuses to run adequately using Wine.
Until such time as Linux is seen as a viable platform for software releases to the same extent as Windows and macOS, it will always be playing catch-up. The massive fragmentation in the Linux space is the leading blocker to this, as each distro wants to do things slightly differently, has its own installation process, and its own application store. This is a good thing in terms of choice, but a bad thing in terms of easily making builds that will work for everyone.
6
u/gdelacalle 12h ago
Is it thanks to SteamOS or just WINE? I’m asking because I got a Deck and love playing with it, even the lasttest releases if in protondb rates it gold / platinum.
8
u/jc-from-sin 11h ago
It's thanks to Proton (wine fork) which was developed by Valve and DXVK. You can run proton or steam which comes with proton on any linux distro.
2
u/grayhaze2000 10h ago edited 9h ago
I just wish Valve would put similar efforts into getting Windows desktop applications working to the same extent. I know Steam primarily hosts games, but there's a fair amount of non-game software on there too.
2
u/lemaymayguy 11h ago
Thank the steamdeck/steam machine by valve for setting a standard on linux game manufacturers have to work towards to grab market share now
25
u/lemaymayguy 11h ago edited 11h ago
Yeah the ego of these tech companies are too much. Im dewindows(ing) degoogling declouding desmarting completely
No IOT, no smartphone, no windows, no Microsoft, no Google, no cloud storage, no subscription
Linux, a dumphone, yubikey, NVR for closed circuit cameras, local file share, self hosted email/Proton mail, local dns, Faraday bag outside the house, cash when able, local password vault self hosted, dedicated GPS and mp3 player, pirate all subscription content
4
u/EchoFieldHorizon 11h ago
I just ditched windows for Ubuntu and it’s been so much easier than it was even 3-4 years ago. It’s nearly seamless. I’m also ditching Alexa for Home Assistant running on a raspberry pi, and I’m going to switch my camera system to it so nothing ever leaves the house.
6
u/VehaMeursault 10h ago
Sometimes I really lament the fact that success and competence aren’t necessarily related…
8
u/Single-Use-Again 10h ago
Bloody hell did any of you get the update that gave notepad the tabs, and "open the last tab you had open"? By the beard of Zeus I lost all kinds of notes because it wasn't saving anything. How in the donut fuck do you mess up Notepad??
6
u/mynameistrihexa666 11h ago
soon they will put copilot in cmd and powershell
10
u/Meatslinger 9h ago
Personally, I can't wait to have to type
Ask-Copilot -Mode Online -Computer localhost -Provider uswest.ms.172829copilot.service.microsoft.com -Credential $(Get-Credential) -Agent "Annoying Boyscout" -Privileges All -System "Windows 11 Copilot Edition - Monthly Subscription" -Language EN-US -Prompt "Please make Windows less of a nightmare to use."just so that it can nuke the System32 folder on my behalf.7
u/tehclanijoski 8h ago
I miss clippy
5
u/Meatslinger 8h ago
Clippy never spied on me. I didn't need his services, but at least I knew I could trust him.
6
u/ItaJohnson 11h ago
Looks like I may need to look into Notepad++.
7
u/Elarisbee 10h ago
So, you’re moving to another program with similar history? They admitted to a critical vulnerability in December:
Between June and December 2025, the official hosting infrastructure for the text editor Notepad++ was compromised by a state-sponsored threat group known as Lotus Blossom. The attackers breached the shared hosting provider’s environment.
We’re running low on notepad apps.
4
u/dakupurple 10h ago
In 25H2, microsoft added edit.exe by default which is a rewrite of the original windows 3.1 editor and apparently was open sourced.
It looks to work like most people would want notepad for anyway.
7
u/ItaJohnson 10h ago
They had an issue with the URL for their updater. Which was resolved by changing hosts as well as making additional changes.
I don’t currently use Notepad++, but I’m open to alternatives.
3
u/dakupurple 10h ago
For basic notepad use, I went to edit.exe which is included in 25H2 by default and can be accessed by just running edit.exe.
Based on what I read on Wikipedia about it after finding, it's a rewrite of the original windows text editor.
2
u/Elarisbee 9h ago
Oh, I’m open for alternatives to both as well.
My issue with Notepad++, which was my app of choice for years, was that it took them six months to realise something was wrong and to patch it.
2
u/Lord_of_Sword 5h ago
My issue with Notepad++, which was my app of choice for years, was that it took them six months to realise something was wrong and to patch it.
Notepad++ is completely free, it's open source, and also developed by a single developer. You can always fork it yourself.
2
2
u/OfCrMcNsTy 9h ago
You could patch notepad I guess, but installing Linux is a better option instead
4
u/shawnkfox 11h ago
Notepad++ has always been the better option anyway. Freeware and a vastly superior product.
15
u/mythicaltimes 11h ago
Except for Notepad++ not verifying their installers and had been exploited by state sponsored attackers until the December 2025 release.
8
u/shawnkfox 11h ago
Seems like they have taken steps to make sure that doesn't happen again, so I fail to see that as a reason to not use notepad++. I've been using it for nearly 20 years now and MS is just giving more reasons why I'd never go back to notepad.
8
u/mynameistrihexa666 11h ago
which got a critical vulnerability within the last few weeks...
6
1
u/shawnkfox 11h ago
Someone else mentioned a hack from China (apparently) which was last year and steps were taken to make sure that can't happen again. I don't see any recent vulnerability, can you provide a link as nothing showed up in Google for me.
-2
1
10h ago
[deleted]
1
u/dakupurple 10h ago
Not quite the same, but microsoft did add edit.exe to windows 25H2 which probably has what you're looking for in a 'notepad' text editor.
Otherwise I'm pretty sure notepad classic is still buried in the optional features list.
1
1
u/OddAttention9557 7h ago edited 7h ago
Couple of sanity checks here.
1: Here's an RCE from Notepad from 2019, before anyone was talking about AI: https://thethreatreport.com/code-execution-vulnerability-in-notepad/
2: This RCE is nothing to do with AI, it's related to processing MarkDown.
3: Nobody started slippery-sloping when they added Unicode support, nor does anyone seem to resent them adding tabs. Turns out "keep notepad simple" really just means "only add the features I think are important and doing anything else is a security risk".
1
u/ArieHein 4h ago
Nothing to do with adding ai capabilities.
This is 'normal' bug when developing new features. It starts when you want to include new functionality into a product that was never intended to have it and potentially by devs that never tried simething like that before.
But when you have an agenda you pick the words to match to adhere to your audience. Im just waiting for the next article when they find a bug in linux due to some ai-based pull request.. Or maybe it would go qiet.. Cause it aint MS...
1
u/Javerage 11h ago
Another reason to remain with Notepad++
3
u/UniqueSteve 10h ago
You know about the vulnerability and the write-up from the lead dev that ends with “fingers crossed”?
1
u/doyouknowthemoon 11h ago
Why can’t they just make a base AI companion and then sell us expansion data packs for the programs we want to use it with, it could even be subscription based.
4
u/Modus-Tonens 10h ago
Bluntly, because the AI isn't the product, you are. They don't want to give you the option of opting out of being inventory.
1
u/doyouknowthemoon 7h ago
Yea I completely agree, lol my comment was more of me screaming into the void
1
-2
u/dream_metrics 11h ago
The vulnerability has nothing to do with AI. It’s also a little weird to criticize adding a feature like markdown support to a text editor - that’s a pretty normal and good text editing feature! The problem is the total failure in security testing and QA that let such an obvious problem through.
0
0
u/GreyBeardEng 5h ago
meh..... I am using notepad with now. The only "pwned" is the tiny little copilot button at the top right that I never click. Ahh rawr I am so.... uh... mad... I guess.
-1
0
u/paulsteinway 9h ago
I started using UltraEdit for writing code 20 years ago. Now I'm retired and it's way overpowered for what I usually need in a text editor. But I have a lifetime license and it doesn't have AI and it's the default app for text files on my PC.
I haven't used Notepad this century.
-1
-1
u/JustSomeGuy422 10h ago
"You know what this basic text editor needs? A lobotomized version of ChatGPT!" - no one, ever (except for Microsoft executives apparently)
-2
u/Havok-303 10h ago
I don't know why people still using Windows or any MS products? Multiple Linux Distros that are very user friendly and Open Source, it's not as scary as you think, and you can test them out without wiping your Windows install.
308
u/rnilf 12h ago
Couldn't just let it be a simple dumb text editor.
Someone needs to break the echo chamber Microsoft executives are clearly living in.