AI
Palantir’s Karp bashes OpenAI, Anthropic token model: ‘Something has gone completely wrong’
Karp told CNBC that Palantir and Nvidia’s open model is the solution for enterprises and governments seeking to own their data.
AI Decline? Confidence in Autonomous Penetration Testing Falls
The number of organizations willing to rely on AI-powered penetration testing for their security needs fell to 9% in 2026, down from 29% a year earlier. The vast majority of companies preferred a hybrid, human-in-the-loop approach or relegating only non-critical tasks to automation.
Attackers Seize Exposed AI Endpoints to Power Offensive Ops
Ollama ships with no built-in authentication on its default port (the aforementioned 11434) and LiteLLM authentication is opt-in, dependent on whether a user sets a master key. There is also a common placeholder key (sk-1234) attackers have been known to target.
County With 37 Data Centers Asks Schools to ‘Conserve Electricity’
When data centers move into communities they spike the cost of power for everyone who lives nearby. Often the people building new projects promise they’ll build out power infrastructure to make up the cost and prevent normal people from footing the bill. But power infrastructure is hard to build and takes time so developers often rely on short term solutions like gas and coal powered turbines. In Mississippi, an xAI data center runs on 27 gas turbines that belch pollutants into the air. In Henrico County, officials have said that some of the new data centers may be temporarily powered by more than 300 diesel generators.
Politics
Alibaba Bans Employees From Using Claude
Tthe ban is due to security concerns about Anthropic, after a recent controversy over Claude Code’s hidden code that was capable of tracking whether the user is in China. Even though Anthropic doesn’t offer Claude in China due to national security reasons, many tech firms and developers in China have found ways to get around the geographical restrictions and access Anthropic’s models and coding tool.
Microsoft is Making History by Offering Voluntary Retirement (from April)
In its history of 51 years, Microsoft, for the first time, is offering voluntary retirement buyouts to U.S. employees. For a company that has long relied on hard layoffs rather than a soft exit ramp, up to 8,750 people (about 7% of its workforce) could walk out the door with a retirement package.
The program is open to U.S. workers at the senior director level and below whose years of employment and age add up to 70 or higher. So a 45-year-old with 25 years of service qualifies, as does a 52-year-old with 18 years of employment.
Scientists Asked AI to Impersonate 112 Public Figures. What Happened Next Is a ‘Dire’ Warning
Researchers discovered that people found AI impersonators to be more authentic, coherent, and relevant than the real politicians, raising alarm bells around the potential for public deception.
Detection seems easy to me: if a politician answers a question and makes sense, they're a fake.
Karen Read lawsuit alleges history of disturbing texts between Michael Proctor, Sean Goode
They were police officers in Massachusetts. Here are some of the texts:
"Actually, take your time, I saw a [n----r] was involved, so I wouldn't rush if you're working. Let them die."
"It should be 'punch a [n----r] day' in canton today out of retribution. Any shine u see blast it in the face."
Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments
The threat actor has been using SEO poisoning to target AI agents searching for the Python library requests-secure-v2. Within the website, the attackers hid indirect prompts instructing the visiting agents to make a payment as part of the routine process of acquiring an API key.
Infosec
Confidential computing's core trust mechanism is broken. The fix may not exist
Confidential computing rests on a mechanism called remote attestation, in which a server cryptographically proves to a client that it is running inside a genuine, unmodified Trusted Execution Environment (TEE) before any sensitive data changes hands. But researchers found diversion attacks against two state-of-the-art attested TLS protocols. A connection intended for one server can be silently redirected to a different, compromised machine running identical software, anywhere in the world, without the client ever knowing. TLS is also vulnerable to relay attacks, in which a client verifies the evidence of a genuine, trustworthy AI agent or server but ends up encrypting its traffic to an entirely different, malicious one.
The best fix available today proves a client is talking to the right machine at the start of a handshake. It cannot prove that the data sent minutes later is still going to that same machine.
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices
Security firm runZero has disclosed seven vulnerabilities in FatFs, a small filesystem library that lets a device read and write the FAT and exFAT formats used on USB drives and SD cards.
The flaws matter because FatFs is nearly everywhere. It ships inside the firmware that runs security cameras, drones, industrial controllers, hardware crypto wallets, and other devices built on real-time operating systems.
On the worst-affected systems, an attacker who gets a booby-trapped USB drive, SD card, or update file onto a device can corrupt its memory and run their own code.
FatFs is maintained by one developer in a small corner of the internet, and runZero says it tried repeatedly to reach the maintainer and looped in Japan's JPCERT/CC coordination center, with no response.
Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses
Hide My Email is part of Apple’s paid iCloud+ product. It lets users generate an anonymous email address which they can then use to sign up to services or email people with instead of their personal email.
Apple was informed of this a year ago, and claimed to have fixed it, but did not, and no longer replies to inquiries about it.
This new Android security setting spots bad networks and fake cell towers - enable it ASAP
This feature is called "Network notifications." According to the settings option, you'll get notified when your device connects to an unencrypted network or when a network requests your unique device or SIM ID.
When Too Much Security Data Became the Risk
One CISO used artificial intelligence to filter what data truly belongs in the SIEM. The flood of low-value telemetry made it harder for analysts to see what actually mattered. The result was an 83% reduction in firewall log ingestion, without eliminating threat, intrusion, or authentication events.
Windows 11 Identifier Code Used to Arrest 19-Year-Old Over Alleged Ransomware Spree
Microsoft provided GDID [Global Device Identifier] data to the FBI to help them apprehend the alleged criminal--a unique identifier assigned to every Windows install that tracks device-specific telemetry.
SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing
Self-extracting packing moves the whole payload into a directory the scanner skips, like .git/, behind a harmless-looking decoder that rebuilds the skill only when the agent runs it. Scanners skip such directories to save time and cut false alarms, which is exactly the blind spot the trick exploits.
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions
The technique tweaks on-screen pixels in ways the eye cannot see, so that the video cable carrying them radiates a faint radio signal a nearby receiver can decode.
|