Gold falls by Tk 1,691 a bhori as world prices keep sliding

Brent crude climbed above $111 a barrel on Thursday, near its highest level in about five months, after a new round of attacks on Saudi energy sites and on shipping in the Gulf renewed fears that supplies from the world's main oil-exporting region will be disrupted.

Brent was up 2.5 per cent at $111.58 a barrel by late morning in London, according to The Guardian's business coverage. The Daily Star, quoting Reuters, put Brent at $110.11 by 0747 GMT, a gain of $1.32 or 1.2 per cent, with US West Texas Intermediate at $99.00. The two readings reflect different times of the morning; both show the benchmark well above the $100 mark it crossed earlier this month.

The trigger was another round of attacks. Yemen's Iran-aligned Houthis said this week they had hit an Aramco site at Yanbu, the Shaybah oilfield and the airports in Riyadh and Abha. Shipping trackers counted at least 18 attacks on vessels in two weeks, and analysts at LSEG warned that Iran was targeting tankers beyond the Strait of Hormuz, reaching into the Gulf of Oman.

Iran's Revolutionary Guard Corps said on Thursday that its navy had struck four ships involved in oil transfers in the Gulf and that three more vessels caught fire after hitting mines near Hormuz. It warned that it could extend confrontation to US bases in the region. Iran's foreign minister, Abbas Araqchi, said Tehran had received no response from Saudi Arabia or the Houthis to its offer to help broker talks, and Iran told Pakistan's army chief that there would be no negotiations with Washington until its demands were met. A Qatari delegation has arrived in Tehran.

For Bangladesh, the numbers matter more than the headlines. The country needs more than 6.8 million tonnes of petroleum a year, with diesel making up more than two-thirds of demand, and buys most of it as refined products, so a sustained rise in crude and freight costs reaches the state oil company's books quickly. Petroleum import letters of credit opened in July-September were worth $3.7 billion, against $2.28 billion a year earlier, central bank data show. Brent averaged $97 a barrel in that quarter, up from $69 a year before. Spot LNG has traded near $30 per million British thermal units, almost three times pre-war levels, after QatarEnergy declared force majeure.

The government has tried to keep the shock away from households. The Bangladesh Energy Regulatory Commission left retail prices unchanged for October, with diesel at Tk 135 a litre, octane at Tk 165, petrol at Tk 160 and kerosene at Tk 155. That followed a Tk 20-a-litre increase on 20 September.

The September increase is still working through the economy. Traders in Dhaka's kitchen markets told the Dhaka Tribune that truck and pickup fares had risen by Tk 2,000 to Tk 5,000 a trip, pushing up vegetable prices by at least Tk 20 a kilogram in some markets. Beef rose to Tk 850 a kilogram from Tk 800, and a dozen eggs to Tk 160-170 from Tk 120 in the first week of September. Agricultural economist Abdul Bayes warned that costlier diesel would raise irrigation costs by Tk 10,000-20,000 a hectare and feed into rice, pulses and wheat prices. The Consumers Association of Bangladesh said monitoring needed to be tightened to stop traders passing on unjustified costs.

What happens next depends on two decisions the government does not fully control. The first is whether the Gulf escalation continues: Asian markets fell on Thursday, with Japan's Nikkei down 2.65 per cent and South Korea's Kospi down 3.7 per cent, as investors priced in higher inflation. The second is the November pump-price review. Officials have not said whether they will raise prices again, absorb the cost through the Bangladesh Petroleum Corporation, or hold and let the subsidy bill grow. The finance ministry has not published an updated loss estimate for the corporation this month.

For now, the immediate question for a Dhaka household is narrower: whether the next fuel-price notice repeats October's freeze or passes on a fifth month of war-driven costs. That notice is expected before the end of the month.

Meta has paused a feature that let users share conversations with its Muse artificial-intelligence assistant after security researchers showed that thousands of the resulting links could be found and opened by strangers.

The problem lay in how Meta built the addresses. According to the security firm Claroc, each shared chat was given a web address made from the conversation's title, a short phrase describing what it contained, followed by a random identifier. Those addresses sit under a Meta-owned domain, and the full hostname was written into the public domain name system, the internet's directory of web addresses. A search of historical DNS records therefore returned a list of shared pages, labelled by subject, without anyone having to guess a link.

Claroc said it found more than 6,800 such links. Its researchers opened only a few hundred, so the figure does not mean that 6,800 confidential conversations were exposed. Most of the pages they inspected were ordinary, but a minority held material that users plainly expected to stay private. The examples included a marketing company's internal revenue review addressed to its chief executive, a small business owner's loan application, a workplace's staff calendar for the year, partial details from a bank fraud alert and notes for a job candidate's call with an AI laboratory.

Meta confirmed the pause. "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Tracy Clayton, a spokesperson for Muse, told The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

The sequence matters. Meta acted once the researchers' findings were reported, and Bangla Tribune said a check of 40 links on 20 October found that none would open. The old DNS records, however, still preserve the hostnames, including the conversation titles, so the subject matter of some shares may remain visible in historical records.

This was a design weakness rather than a break-in. Nobody needed a stolen password or an account to reach the pages; the link itself was the only protection, and the way it was put together made it discoverable. A shared page could be opened by anyone who came across its address, which is why the DNS trail mattered so much.

Muse is part of Meta's artificial-intelligence lineup and was launched only last month. Sharing a conversation is meant to be a convenience, letting a user send a result to a colleague or friend. The episode shows how quickly that convenience can turn into a disclosure when a public link is treated as if it were private.

Similar accidents have happened elsewhere. Shared conversations from OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok have appeared in search results in the past, and security researchers have repeatedly warned that a link created for one recipient may be reachable by anyone who comes across it.

For users, the practical lesson is blunt: a shared AI conversation should be treated as public material. Work documents, loan papers, client names, account numbers, internal calendars and anything else that would cause harm if a stranger read it should not be pasted into a chat that will be shared by link. Where a team relies on such tools, it should check what is being shared and whether the service offers a way to revoke a link after it has been sent.

Several questions remain open. Meta has not said how many shared pages contained sensitive material, whether it has contacted the people affected, how long the links were discoverable, or whether it will restore sharing in a different form. It is also not known how many of the links belonged to users in Bangladesh or elsewhere in South Asia; the researchers did not identify individuals or businesses.

What happens next depends on Meta's review. The company could redesign the share addresses so that titles no longer appear in DNS, add expiry dates, or require a stronger secret before a page opens. Until it says which route it has chosen, the safest assumption for anyone using the assistant is that a Muse share link is not a private channel.