SlowMist founder Yu Xian (Cos) warned that Telegram's new message-embedded "apps" feature lacks sandbox protection, creating a potential vector for malicious code execution. The security researcher noted that the platform's use of QuickJS could serve as an attack path, exposing users to unnecessary risks. Yu emphasized that current AI capabilities for vulnerability discovery and exploitation far surpass those available in the past, amplifying the danger of such design flaws. He advised users to hold off on updating Telegram until the issue is addressed.