SlowMist Warns New Telegram Message-Embedded Apps Lack Sandboxing

The concern here is less about Telegram specifically than about how quickly messaging platforms are pushing embedded app functionality ahead of the security isolation that normally contains it. QuickJS as an execution surface without sandboxing turns a convenience feature into a potential delivery channel, and Yu Xian's point about AI-accelerated vulnerability discovery suggests the exploitation window may be shorter than teams assume. The immediate exposure falls on users who update early and on any project relying on Telegram for distribution or community access. Worth watching is whether Telegram responds with sandboxing or update guidance, and whether similar embeddings appear on other platforms before that question is settled.