Google appears to be testing Canvas inside NotebookLM, plus possible Connectors support and smarter source labeling tools.
The CVSS‑9.3 vulnerability allows unauthenticated remote code execution on exposed Marimo servers and was exploited in the wild shortly after disclosure, Sysdig says.