A Public Citizen report tallies investor losses across Trump-linked crypto ventures at a minimum of $4.7 billion in 2025, against at least $1.4 billion Trump earned from the same projects. The TRUMP memecoin drives $3.2 billion of those losses. Roughly 1 million of 1.6 million retail buyers on decentralized exchanges remain underwater after the token fell from a $73.43 peak to approximately $2.73, with wallets from the first two trading days capturing nearly 90% of all retail-side gains. World Liberty Financial contributed $1 billion in additional losses, led by AI Financial Corp's $1.46 billion WLFI token purchase in August 2025, which left the Nasdaq-listed firm's stock down 91% to $0.642, while Trump Media's 9,477 BTC position accounts for another $450 million in losses. Trump's tokens were allocated rather than purchased, and his income flowed through licensing fees, meaning he deployed no capital while retail holders absorbed the drawdown.
2026.09.01·links.tldrnewsletter.com·3 min read·TLDR Crypto Daily volume on Aerodrome grew roughly 5x in a week, now above $25M/day.
Claims that agentic payment lending can be both virtually risk-free and yield 20-40% annually are tenuous.
Aave has activated incentives for USDC borrowers in its V4 Core Hub on Ethereum.
Robinhood Chain's "Fomo" app has finally cracked SocialFi by letting younger users trade stocks, tokens, and NFTs socially in one place.
Instagram now requires profiles featuring AI-generated personas to use a new "AI-generated profile" label, replacing the previous optional "AI creator" tag. Accounts that don't apply the label to AI-generated people will face reduced reach, though appeals are possible through the Account Status dashboard. The change targets only AI persona accounts specifically, not broader AI-generated content, amid rising concern over misleading AI "influencers" impersonating real humans.
Apple's Apple Watch Series 12 and Ultra 4 are expected to be modest upgrades focused on new ceramic case options and improved health tracking, including continuous heart-rate monitoring and more insightful wellness software, while a major redesign remains in development and could arrive in 2027 or be delayed until 2028.
Alibaba officially rolled out Wan3.0, an upgraded AI video-generation model, a day after announcing a $10 billion share placement to fund rising AI spending. The model generates 30-second videos from documents, spreadsheets, slides, and web pages, and has been used since its August 6 public beta. The share sale is the largest-ever primary follow-on offering by a Hong Kong-listed company, coming after Alibaba reported a 75% plunge in quarterly earnings due to soaring AI capital expenditure.
2026.09.01·links.tldrnewsletter.com·1 min read·TLDR Design open-design-system-bench is an open benchmark measuring whether AI coding agents use a design system correctly when generating UI. Four systems scored between 52.2 and 63.4 on its AI-readiness composite, and none reached the AI-native tier. Across 898 graded generations, some models ignored the design system entirely while others hallucinated component names.
2026.09.01·christophhellmuth.com·15 min read·TLDR Design Figma's MCP server and Code Connect give coding agents access to a team's components, tokens, and layouts, so generated code matches design specs. In the example workflow, a developer diagrams the flow in FigJam, reuses existing components, and catches token drift before review.
AI is pushing UX into a “custodial era” where teams can generate and ship features faster than they can properly evaluate them, creating UX debt. As a result, UX practitioners increasingly act as custodians who clean up, simplify, validate, and triage AI-generated experiences, helping organizations distinguish what can be built from what should be built, while adapting research and evaluation processes to keep pace with rapid production and embedding UX principles directly into AI generation workflows to prevent future problems.
Browse curated App Store screenshots, paywalls, onboarding flows, and icons from the best-designed iOS apps.
x1 helps builders turn app ideas into working iPhone apps through guided planning, visual design, milestone-based building, QA, publishing prep, and iteration.
BrowserAct builds and verifies a reusable scraper on a live website, then runs it whenever you need fresh results.
Design's struggle for legitimacy stems from "legibility," where organizations only value predictable, determinate work they can measure and plan around. Unlike engineering or marketing, UX/Design remained a synthetic, indeterminate practice, making its core work—research, iteration, and conceptual modeling—invisible to organizations. Design leadership's real challenge, then, is not translating design to the business, but expanding what businesses recognize as legitimate, valuable work.
Adobe added a conversational AI Assistant to Photoshop, Illustrator, InDesign, Premiere, and Frame.io in June 2026, automating multi-step production tasks like batch resizing and background removal. Illustrator's Text to Vector tool generates genuinely editable SVG paths rather than raster images, a capability no major competing AI tool offers.
CD Projekt Red has refreshed its firebird logo with sharper, more aggressive features and a stronger use of red to better reflect the mythological Slavic raróg it represents, but despite the redesign being a relatively modest evolution, some social media users have bizarrely interpreted the shift to a black-and-red color scheme as a political statement, even though the company says the update is simply intended to create a more modern, confident, energetic, and culturally authentic brand identity.
The Working Assembly's new identity for voice-journaling app Untold centers on a bespoke AI illustration system trained to feel emotionally resonant rather than algorithmically generated.
Apple's new Mac mini stop-motion ad celebrates human craftsmanship with handmade clay animation, positioning the computer as a tool that enhances rather than replaces creativity.
Illustrator and animator Moriz Oberberger creates playful yet subtly unsettling artwork featuring awkward characters, unusual proportions, and expressive mark-making, using experimental drawing and painting techniques to explore vulnerability, tension, and the strange beauty hidden within everyday situations.
Sponsored
OPENROUTER [4]gives you a unified, OpenAI-compatible API for inference, so you can access hundreds of models across dozens of providers without rebuilding your stack.
> SWITCH MODELS EASILY: Keep your existing OpenAI SDK calls and swap models with a single parameter.
> ROUTE INTELLIGENTLY: Use AutoRouter to choose models based on price, speed, and quality.
> BUILD FOR RELIABILITY: Multi-provider failover, transparent pricing, usage analytics, and fine-grained data policies are built in.
2026.09.01·openrouter.ai·Sponsor·TLDR Dev Vercel uses coding agents to create on-brand pages that adhere to specific design guidelines, using a public file called DESIGN.md to provide consistent design parameters for various tools and contexts. This framework incorporates a three-part system of guidance, a public stylesheet, and an evaluation loop to guarantee high-quality, cohesive outputs while continuously adapting through user feedback and real-world application.
2026.09.01·vercel.com·12 min read·TLDR Dev Neon uses Lakebase Postgres to enable real-time autoscaling of database resources, where compute sizes can change dynamically based on CPU load, memory use, and cache working set size without interrupting operations. This separation of storage and compute functions optimizes performance, reduces waste, and also allows for fast resource adjustments.
2026.09.01·neon.com·16 min read·TLDR Dev A recent exploration shows that Claude Code Opus 5 in Auto Mode is vulnerable to prompt injection attacks, achieving a 60-80% success rate despite previous claims of a 0.00% success rate in these scenarios. The findings suggest that Auto Mode, which is intended as a safety measure, does not provide a definitive security guarantee.
2026.09.01·embracethered.com·13 min read·TLDR Dev When selecting a Mac for local LLMs in 2026, prioritize unified memory and memory bandwidth over chip type, as these factors impact model size and processing speed. The best choices vary by need: the Mac mini M4 Pro offers great value for 30B-class models, while the new M5 Max and Ultra models are great for heavy workloads requiring larger capacities.
2026.09.01·vettedconsumer.com·10 min read·TLDR Dev AI in software development is driving down the cost of writing code, but this might lead to a lack of understanding and ownership of the software created. As coding becomes increasingly automated, it raises important questions about the responsibilities of developers, particularly in areas like quality, security, and maintainability.
2026.09.01·martiansoftware.com·3 min read·TLDR Dev Context engineering has evolved from adding information to minimizing it, as overly detailed context can reduce AI agents' performance. To optimize AI agent functionality, it's recommended to regularly revise and test context documents, solicit feedback from the agents themselves, and maintain a detailed record of past errors to refine the context over time.
2026.09.01·newsletter.posthog.com·8 min read·TLDR Dev Sponsored
How do you measure the efficiency gains of agentic AI against climbing bills and credible open-weight alternatives? GitLab will answer this at the upcoming GITLAB TRANSCEND livestream [11]. See the latest AI capabilities and learn how to ship at agent speed - while
2026.09.01·about.gitlab.com·Sponsor·TLDR Dev FnScribe is a private dictation tool for macOS that transcribes voice recordings locally and integrates seamlessly with any active application. It allows users to dictate using a shortcut, supports hands-free operation, and offers features like smart cleanup and a personal dictionary.
2026.09.01·github.com·GitHub repository·TLDR Dev OpenClaw 2.0 has been released as the largest update in its history, with an overhaul of the installation process, browser experience, and collaborative functionalities.
2026.09.01·openclaw.ai·4 min read·TLDR Dev DevSpace is a self-hosted server that integrates ChatGPT with local coding environments, allowing users to read, edit, and run code without exposing their files to third-party services. It enables ChatGPT to interact with users' projects directly, providing tools for repository inspection and command execution in a secure and controlled manner.
2026.09.01·github.com·GitHub repository·TLDR Dev Diffusion language models represent a new approach to generative AI, focusing on the simultaneous generation of entire text sequences rather than iteratively producing tokens one at a time. These models use techniques such as iterative refinement, variable-length generation, and error correction, allowing for faster and more controllable text generation.
2026.09.01·kuleshov-group.github.io·34 min read·TLDR Dev A forgetting curve was designed for a local-first vault agent to manage memory, but its complexity led to more problems than benefits. The system proposed intricate scoring and tiering for memory management, which ultimately went unused and overcomplicated the process of deciding what to retain. Simpler methods could effectively handle memory without the unnecessary layers of abstraction.
2026.09.01·eris-system.dev·18 min read·TLDR Dev AI memory lock-in improves user retention by accumulating context that makes switching expensive, but it can also hurt product adoption within a company's own offerings.
2026.09.01·usewire.io·10 min read·TLDR Dev Memoryfields represent a simplified and effective data format for agent memory, allowing AI agents to store and retrieve relevant information through directly written Markdown pages and semantic search, rather than relying on complex multi-stage memory systems.
2026.09.01·calpaterson.com·13 min read·TLDR Dev Despite advancements in AI-generated content, human writing remains safe from obsolescence as AI struggles to capture the depth, authenticity, and subjectivity inherent in effective prose.
2026.09.01·muratbuffalo.blogspot.com·14 min read·TLDR Dev Instinct uses SMS and voice communication to manage consumer tasks across various sectors without a traditional eCommerce interface, showing a shift toward agentic commerce in everyday services.
2026.09.01·blog.starpointllp.com·14 min read·TLDR Dev Anthropic warned affected Claude users that infostealers hijacked browser sessions and drained usage limits. The malware included Vidar, Lumma, StealC, RedLine, Acreed, and AMOS. Anthropic logged out compromised sessions, removed stored payment methods, and refunded identified unauthorized charges. Users should remove malware before re-adding payment details.
McKesson detected an intrusion on August 25 tied to third-party apps in its Oncology & Multispecialty and Medical-Surgical units. ShinyHunters vished McKesson employees, hijacked Okta SSO accounts, then pulled roughly a terabyte from Salesforce and Snowflake over four days. The group demanded $55,236,150 with a 72-hour deadline, which McKesson didn't pay. Breached data includes 284 million records containing SSNs, birth dates, Medicaid info, medical record numbers, medication/allergy data, and employee records.
Unauthenticated attackers can drive ADB commands on Android devices connected to Microsoft's open-source UFO Desktop AgentOS through CVE-2026-73296, which affects versions up to v3.0.7 and has no official patch. Attackers can exploit this vulnerability to capture screenshots, extract UI hierarchy data, and tap, swipe, and text-entry actions on TCP 8020 and 8021 whenever operators follow the documented remote-deployment guidance and bind to 0.0.0.0. Users should restrict those ports to trusted hosts and front the services with TLS and an authenticated reverse proxy until the proposed UFO_MCP_API_KEY bearer-token fix merges.
Researchers found an exposed Amsterdam server staging tools and stolen Philippine data. Custom scripts abused ownCloud CVE-2023-49105, impersonating known users through unsigned WebDAV URLs. The recovered data included reactor records, radiation-safety files, employee PII, travel documents, BitLocker keys, KeePass data, and AxCrypt files. Logs referenced roughly 9 GB taken from the nuclear agency. A naval contractor's WordPress site was breached through LiteSpeed Cache CVE-2024-28000 and XML-RPC password guessing. The server also hosted Sliver, Metasploit, Mettle, and a loader that fetched a second-stage payload.
MDSec red-team engagements turned phished ServiceNow users, exposed MID config.xml files, and over-permissioned roles into tenant admin access. Roles including catalog_admin, import_admin, and sn_cmdb_editor enabled Glide-script execution or role chaining. Operators created hidden admin accounts, altered timestamps, removed login and role histories, and used scheduled jobs as SnowFall C2 callbacks. From the tenant, they enumerated incidents and attachments, extracted credentials, bypassed adaptive authentication, and executed commands on MID servers through JAR plugins or the ECC queue.
Security researcher Dekens has demonstrated how adversaries can manipulate AI-assisted OSINT investigations by planting hidden prompt injections within digital documents. Through a dedicated training lab, Dekens highlights techniques like pushing CSS div elements off-screen, embedding white-on-white text in PDFs, and hiding instructions in unformatted spreadsheet cells. While not yet observed in active campaigns, these invisible artifacts successfully steer language models toward false narratives without altering the visually rendered file. To defend against poisoned sources, investigators should hash original documents and independently extract text using tools like Apache Tika or Tesseract to compare against the visual output. Furthermore, analysts must strictly isolate AI models in read-only environments to prevent untrusted inputs from executing unauthorized actions.
EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers, and responsible product managers. It supports the complete security analysis process, starting with firmware extraction, doing static analysis and dynamic analysis via emulation, building the SBOM, and finally generating a web-based vulnerability report.
Cloudflare has launched Adaptive Intelligence, a bot detection engine designed to make evasion economically unviable for attackers by continuously retraining its models on live traffic. Rather than relying on deterministic rules, the engine utilizes non-deterministic signal weighting and delayed reactions to prevent threat actors from isolating and defeating specific defenses. This cross-temporal evaluation allows the system to detect slow credential-stuffing attacks distributed across residential proxies that would otherwise bypass standard rate limits. Enterprise customers can activate the continuous retraining component immediately by enabling "Auto Update Machine Learning" in their Bot Management dashboard, while advanced features such as disposable rule generation are still in development.
Cloudflare OS is an “operating system” for AI productivity that consists of an agent chat UI, a sandboxed application development environment for small personal apps, and security guardrails.
Calif researcher Lukas Maar has developed a universal exploitation strategy that elevates an unprivileged Android app to root across modern Samsung, Xiaomi, and Oppo devices. Rather than hunting for generic kernel or chipset vulnerabilities, Maar targeted the proprietary OEM software overlays, such as One UI and HyperOS, that span each vendor's entire device lineup. The exploit leverages a page use-after-free vulnerability mapped to a freed physical page. This reliable technique successfully bypasses KASLR, control-flow hijacking, and slab protections without modification across kernels 5.4 through 6.12. While this initial publication outlines the overarching methodology on locked bootloaders, Maar plans to release the specific exploit chains affecting July 2026 flagship devices like the Galaxy S26 Ultra in future installments.
Paul Schwarzenberger updated his open-source serverless CA with support for ML-DSA post-quantum cryptography. CA private keys are generated and used within AWS KMS FIPS 140-3 HSMS. ML-DSA is still not universally supported by applications, so users should check compatibility before adopting.