> Just like Doom-in-a-PDF, this is in equal measure incredibly impressive and utterly horrifying that it's possible.

Yes but at the same time we now have options... For example it's now totally possible to do the following:

    - intercept any PDF downloaded
    - send it to a sandboxed app before opening
    - open it from withing the sandbox
    - headlessly screenshot every page to images
    - pull the pictures (one per page) out of the sandbox
    - reconstruct a similar PDF from the pictures

It's not hard and it can literally be vibe coded in a few prompts (because it's really not hard).

Some people are going to say: "But PDFs aren't supposed to be PICTURES, it has to be searchable, so we want our Turing-complete, exploits-ridden, 2 GB big PDF readers running as admin/root and we insist, we repeat INSIST, to have our ability to open any unkown PDF from any proprietary PDF readers for that is the way!".

Thing is: we know have tool that can extract text from pictures too and they work perfectly fine.

So, yup, the surface attack PDFs have is utterly horrifying but we're already at a point where we can just honey-badge any potentially evil PDF into a well-behaving one.