FlashFeed

Full text

Modern vehicles increasingly rely on proprietary repair software.

Independent repair shops face rising costs that threaten competition.

Fewer repair choices could leave drivers paying more over the long term.

Today’s vehicles are safer, smarter, and packed with more technology than ever before, but those advances are coming with a consequence. Software is becoming just as important as nuts and bolts, and independent repair shops say the cost of keeping up with modern vehicles is spiraling out of control. The result? Fewer neighborhood mechanics can afford the specialized tools and subscriptions needed to service today’s cars, potentially leaving drivers with fewer repair options and higher bills.

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform !== "DESKTOP"){

adpushup.triggerAd("0f7e3106-c4d6-4db4-8135-c508879a76f8");

} else {

adpushup.triggerAd("82503191-e1d1-435a-874f-9c78a2a54a2f");

}

});

Read: A Porsche Oil Light That Couldn’t Be Turned Off Turns Into A Monopoly Lawsuit

A new report from The Detroit News explores how increasingly software-defined vehicles are changing the repair business. While independent shops can generally access factory repair information, many say the growing cost of software, diagnostic equipment, and technician training is making it harder to compete.

Wrenches Aren’t The Problem Anymore

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform === "DESKTOP"){

adpushup.triggerAd("ea4d4b5a-f8e5-4d5d-9d9a-53a3b956b6cd");

} else{

adpushup.triggerAd("44c0a4dc-e25b-4ba5-ac64-2c510461b92a");

}

});

Stephen Rivers / Carscoops

Years ago, most repairs required little more than mechanical know-how and a decent toolbox. Today, even routine jobs can require manufacturer-specific software to diagnose faults, program replacement modules, or install software updates.

Read: Sure, You Can Replace Ioniq N Brakes, But Only With Hyundai’s $6K Tool Or A $2K Locked Workaround

According to the report, annual subscriptions for factory diagnostic software can run into the thousands of dollars. Tesla charges $3,188 per year, Ford charges around $2,500, and General Motors charges approximately $1,200. Many automakers also offer shorter-term subscriptions, but costs can quickly add up for shops working on multiple brands.

The software itself is only part of the equation. Modern vehicles are loaded with cameras, radar sensors, and advanced driver assistance systems that often require specialized calibration equipment after even relatively minor repairs. Shops must also continually invest in new scan tools and technician training as vehicle technology evolves.

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform !== "DESKTOP"){

adpushup.triggerAd("bb7964e9-07de-4b06-a83e-ead35079d53c");

} else {

adpushup.triggerAd("9b1169d9-7a89-4971-a77f-1397f7588751");

}

});

Dealers Aren’t Complaining

Photo Ford

Importantly, for automakers and dealers, all of this probably seems like a non-issue . Manufacturers would love more control over who works on the cars they sell. Dealers obviously would too since service is where they make the bulk of their profit. Whether intentional or not, the new hurdle that software presents to independent shops plays directly into the hands of dealers and, by extension, manufacturers.

Also: Trump Says Ford And GM Want A Bill To Restrict Your ‘Right To Repair’ Your Own Car

Washington has taken notice, with lawmakers still arguing over right-to-repair legislation meant to keep repair information and tools available to anyone who needs them. Automakers counter with a 2014 industry agreement that promises independent shops the same repair data and diagnostic tools franchised dealers get. The Alliance for Automotive Innovation restated that commitment as the issue resurfaced, adding that manufacturers have intellectual property and confidential business information to protect.

var adpushup = window.adpushup = window.adpushup || {que:[]};

adpushup.que.push(function() {

if (adpushup.config.platform !== "DESKTOP"){

adpushup.triggerAd("b25ecba7-3bbb-4ea7-a3a8-dbea91695c07");

} else {

adpushup.triggerAd("e46c436a-adeb-4b5e-a2c7-56bc36561c10");

}

});

The Bill Lands On Owners

Repair bills are climbing for consumers regardless. According to U.S. Bureau of Labor Statistics data cited by The Detroit News, vehicle maintenance and repair costs increased 36 percent between May 2022 and May 2026, including a 6 percent increase this year alone. Inflation, supply chain disruptions, tariffs, higher labor costs, and increasingly sophisticated vehicles have all contributed to the trend.

Stephen Rivers / Carscoops

Full text

Anthropic’s Claude extension flaws allow fake clicks to launch sensitive AI workflows

Researchers found vulnerable handlers unchanged across eight extension updates

Synthetic clicks bypassed checks designed to confirm real user actions

Security researchers at Manifold Security have claimed Anthropic's Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, released July 7, 2026.

According to Manifold Security , it first reported both vulnerabilities to Anthropic through the company's bug bounty program on May 21, 2026, and received acknowledgment the following day.

The first flaw lets any browser extension trigger nine predefined Claude workflows by simulating a synthetic user click on claude.ai.

Nine workflows and one missing check

Researcher Ax Sharma found that the extension never verified whether a click event carried the Event.isTrusted property before acting on it.

Under default settings, the vulnerability received a CVSS score of 7.7 High, increasing to 9.6 Critical when users enabled automatic execution because Claude could perform actions without approval.

The nine hardcoded tasks include reading Gmail, opening Google Docs, checking Google Calendar, and modifying Salesforce leads without asking.

Because the browser marks synthetic clicks as untrusted, the extension should have rejected them but instead executed the workflow anyway.

Manifold Security confirmed on July 7 2026 that both vulnerabilities still work against version 1.0.80, months after first reporting them to Anthropic.

Anthropic released eight separate versions between 1.0.73 and 1.0.80 without altering the specific handlers’ researchers had already flagged as vulnerable.

The company closed the synthetic-click report, saying an existing internal report already tracked the broader trust-boundary issue researchers had described in detail.

However, Sharma believes the fix required only one additional line of code to verify the click event's isTrusted property before allowing the workflow to continue.

A second, structural weakness

A second flaw involves a side-panel URL parameter called skipPermissions, which can activate a privileged mode without any consent prompt.

When the parameter is set to true, the panel begins skipping permission checks entirely, allowing Claude to act without asking the user first.

Manifold notes that only Anthropic's own scheduled-task feature is supposed to construct this kind of privileged URL internally right now.

The panel, however, honours that parameter regardless of which script or page actually constructed the originating URL string in practice.

One example task lets Claude read a user's Gmail inbox, identify promotional messages, and automatically click the unsubscribe links inside them.

Manifold warns that "the bypass is still six lines of JavaScript," months after researchers first flagged the underlying issue to Anthropic.

Anthropic classified this second finding as informational, arguing that the parameter is only ever constructed by its own internal systems.

Manifold said the content-script and side-panel code linked to both vulnerabilities remained byte-identical across the eight subsequent extension releases examined after the original report.

The flaws were also reproduced across Claude's Opus, Sonnet, and Fable side-panel model selections, indicating that the issue affected the extension's security design rather than the underlying artificial intelligence models.

The report also connected the findings with OWASP concerns involving LLM01: Prompt Injection and LLM06: Excessive Agency risks in AI applications.

The researchers noted that abuse involving AI tools may remain difficult to detect because normal browser activity and network connections can appear unchanged while unauthorized AI actions occur.