Search the archive

FROM TINDER AND REDDIT TO AMAZON, UNWANTED AI IMAGES ARE FREAKING PEOPLE OUT

Tinder, Reddit, and Amazon have all begun inserting AI-generated images into user content without consent, sparking widespread complaints.

WHY THE BRAND EXPERIENCE STILL FEELS FRAGMENTED

Multidisciplinary studios often produce well-crafted individual assets—films, websites, and apps—that still feel disconnected because consistency in branding differs from true experiential continuity.

real support engineer on standby. KICK THE TIRES →

BUILDING AN ADVANCED AGENTIC HARNESS

An advanced agentic harness for production-sized agents is proposed here, emphasizing the need for well-structured operations through components like typed tools, directed acyclic graphs (DAGs), tiered memory, and verification hierarchies to create a reliable system capable of planning, acting, recovering, and self-evaluating. This architecture uses the composition of small, testable primitives to improve efficiency and performance while making sure the system remains extensible and adaptable.

THE SECURE WAY TO RELEASE AN NPM PACKAGE IN 2026

The increasing threat of supply chain attacks targeting npm packages requires heightened security measures for developers. Implementing strategies such as Trusted Publishing, npm Provenance, and Staged Publishing can reduce vulnerabilities while making sure that only approved releases are published.

SHOULD YOU SELF-HOST INFERENCE?

Self-hosting AI inference is good primarily when processing over two million tokens daily or when data cannot leave the organization's network. For most companies, a hybrid approach combining local and API models offers the best balance of cost and control.

THE VALLEY OF WEBHOOKS

Building systems that rely on webhooks for data synchronization consistently proves problematic due to their inherent nature as notifications rather than reliable data delivery methods. A proposed alternative is a designated change log that would eliminate issues like data drift and the need for complex mitigation strategies by allowing consumers to request updates directly from providers.

CLOUDFLARE OS: AN OPEN PLATFORM FOR AGENTS, APPS, AND WORK

Cloudflare OS is an open-source platform designed to provide organizations with customized agent workspaces that helps with collaboration, task automation, and app development based on the company's internal knowledge and context. The platform incorporates a security framework to ensure safe access to internal data and resources, allowing users to create and share applications while managing access and costs effectively.

INTRODUCING HARK HANDOFF

Hark Handoff is a computer use agent designed to automate online tasks by navigating the internet as a human would, freeing users from mundane online activities. The agent excels in handling end-to-end tasks such as ordering food, shopping, making reservations, and conducting research.

PRIME AGENT: A SELF-IMPROVING RLM AGENT

Prime Agent is a self-improving coding harness that uses a Recursive Language Model and Continual Harness for better context management, multi-agent communication, and long-term evaluation, positioned as an effective tool for coding assistance and research while maintaining open-source accessibility.

THE NEXT CHAPTER OF OUR AI MOMENTUM

Google and Alphabet are updating their AI initiatives, with Sundar Pichai highlighting the successful rollout of their Gemini models and the user engagement with AI applications. As part of a leadership transition, Demis Hassabis (CEO of DeepMind) will focus on shaping the future of artificial general intelligence (AGI), while Koray Kavukcuoglu will take on a more senior, primary role overseeing Google DeepMind's development and research efforts.

WHY THE LEGENDARY ERDŐS PROBLEMS ARE FALLING TO AI

Recent advancements in AI have led to breakthroughs in solving classical mathematical problems proposed by Paul Erdős, regarding the use of unique mathematical techniques previously unexplored in the context of these challenges. As AI tools demonstrate increasing capabilities, they are reshaping the landscape of mathematical inquiry, attracting attention from both professional mathematicians and enthusiasts.

PACING THE FRONTIER

1,350 frontier AI employees signed a statement in July asking the US to back an international effort to build tools for deliberately pacing automated AI development.

AUTOMATING CROSS-REPO DOCUMENTATION WITH GITHUB AGENTIC WORKFLOWS

The Aspire team successfully implemented GitHub Agentic Workflows to automate documentation processes, allowing them to generate and review documentation pull requests shortly after feature merges without additional resources.

SOMETHING IS CHANGING IN THE UNIT ECONOMICS OF SOFTWARE

The rise of AI has altered the unit economics of software by increasing costs associated with serving users, leading to a trade-off between product quality and profit margins.

BORN AGAINST, OR WHY HOBBY PROGRAMMING COMMUNITIES ARE AGGRESSIVELY AGAINST LLM USAGE

Hobby programming communities are increasingly hostile toward LLMs because they view the process of mastering complex skills as essential to their craft, believing that LLM use undermines genuine learning and expertise.

Download your free copy here

VISA TO ACQUIRE BIOCATCH FOR $2.4B

Visa agreed to acquire behavioral biometrics and fraud-prevention company BioCatch for $2.4 billion, strengthening its defenses against account takeovers, scams, and other AI-enabled financial crimes. The deal follows Visa's $1 billion acquisition of Featurespace and expands its value-added services with technology that analyzes behavioral, device, and network signals to distinguish legitimate users from fraudsters in real time.

WELLS FARGO TO ROLL OUT TOKENISED DEPOSITS FOR CORPORATE CLIENTS

Wells Fargo is introducing tokenised deposits for corporate and commercial clients, enabling them to move, programme and settle funds 24/7. The programme will roll out this autumn, with a limited US dollar to British pound exchange, expanding over the course of 2027 to more clients, countries, and currencies.

MARC ANDREESSEN AND CHRIS DIXON ARGUE AMERICA NEEDS THE CLARITY ACT

Marc Andreessen and Chris Dixon argue that the CLARITY Act would replace regulatory ambiguity with federal oversight, disclosure requirements, anti-fraud protections, and clearer boundaries between securities and commodities regulation for digital assets. They contend that failing to pass durable legislation would favor offshore actors, slow responsible US development, and weaken America's leadership in crypto, while rejecting claims that the bill undermines sanctions enforcement, securities law, or open-source development.

THE FUTURE OF PAYMENTS WILL BE DEFINED BY INTEROPERABILITY

The payments industry has spent years building faster, more convenient, and increasingly digital ways to move money. Yet as payment methods and financial networks multiply, another challenge is becoming impossible to ignore: making these systems work together. A customer may use one wallet, a merchant another provider, and a bank connected to an entirely different infrastructure. Each system can function effectively on its own, but the experience becomes more complicated when they need to interact. This is where interoperability becomes critical.

AGENTIC PAYMENTS WILL NEED MORE THAN WALLETS

Agentic payments are moving from demo territory into infrastructure. Natural's recent raise is a useful signal for the category. The market is beginning to organize around wallets, vaults, cards, merchant acceptance, credit, billing, and direct rail access for AI agents. That matters. Agents need ways to participate in payment flows: holding value, accepting payments, triggering transfers, and interacting with existing rails.

WHY X MONEY IS WILLING TO LOSE MONEY TODAY

X has begun rolling out X Money to US Premium and Premium+ subscribers, bundling a 6% APY cash account, a 3% cashback Visa debit card, and free instant transfers between X accounts. The benefits are aggressive and land at an interesting moment for the social media app. X now sits inside SpaceX, down ~30% since IPO, and valued at $1.51T.

research

CLEAR STREET OFFERS PRE-IPO ACCESS TO DATABRICKS THROUGH NEW PRIVATE MARKETS PLATFORM

Clear Street is launching a platform for accredited investors to gain pre-IPO exposure to Databricks and eventually up to 30 private companies, alongside dedicated research and financing for eligible positions. Investors will buy interests through layered SPV structures rather than directly owning Databricks shares, highlighting both Wall Street's growing push into private markets and the legal and transfer risks surrounding indirect secondary transactions.

IKEA LAUNCHES UK HOME INSURANCE

IKEA is expanding into financial services by launching home insurance in the UK through a partnership with insurtech startup Urban Jungle. Customers can purchase contents, buildings, or combined coverage backed by Urban Jungle's AI-powered platform. The launch reflects the growing trend of consumer brands embedding insurance into their ecosystems to extend customer relationships beyond the initial sale.

WESTERN UNION LAUNCHES STABLECARD

Western Union has launched a digital wallet and stablecoin-backed Visa secured credit card designed to enable users to hold, move, and spend US dollar value globally.

FBI AGENT CHARGED WITH STEALING NEARLY $1M IN CRYPTO TIED TO RUSSIA

Federal prosecutors charged former FBI supervisory agent Patrick Yaroch with transferring roughly $925,000 from cryptocurrency wallets linked to Russia into his personal accounts using private keys found in FBI systems. According to court filings, Yaroch later confessed and surrendered access to the wallets, while the FBI said it fired him and opened a broader investigation.

FISERV AND MASTERCARD DEEPEN GLOBAL PARTNERSHIP

Fiserv, a leading global provider of payments and financial services technology, and Mastercard today announced a strategic global partnership to help eligible enterprise merchants simplify commerce through an expanded suite of integrated value-added services.

INDEX VENTURES RAISES $3.5B ACROSS NEW SEED, VENTURE, AND GROWTH FUNDS

Index Ventures announced $3.5 billion in new investing capital, including a $400 million seed fund, a $900 million venture fund, and a $2.2 billion growth fund. The firm plans to continue backing companies from first check through the public markets, with a particular focus on AI-driven opportunities across infrastructure, cybersecurity, fintech, healthcare, productivity, and consumer technology.

BORDERLESS.XYZ AND MASTERCARD PARTNER ON CROSS-BORDER STABLECOIN PAYMENTS

Borderless.xyz will explore how Mastercard Crypto Credential can help bring greater trust and confidence to cross-border stablecoin payments.

LEMONEDGE RAISES $21M SERIES A LED BY BLACKSTONE, JOINED BY BNY

LemonEdge raised $21 million to expand its private markets fund accounting platform across the US and Europe, bringing total funding above $30 million.

SHAI-HULUD NPM WORM RETURNS, POISONING OVER 1,280 NPM PACKAGES

A new Shai-Hulud worm variant has compromised over 1,280 npm packages, including the well-known Keyv library, by injecting malicious commits via hijacked GitHub Actions pipelines. The worm employs a preinstall hook to download Bun and run an obfuscated payload that aggressively extracts developer and cloud credentials such as AWS, Kubernetes, and Vault, which it then uses to spread further. Organizations that have installed affected versions should assume an immediate breach, requiring them to rotate all secrets immediately and perform manual log reviews, rather than waiting for scheduled vulnerability scans.

77 OPEN VSX EXTENSIONS FOUND HARVESTING DEVELOPER INFO

Manifold Security uncovered an "evil twin" campaign on the Open VSX registry involving 77 malicious extensions that impersonated legitimate packages to harvest developer environment data. While claiming to only collect anonymous metrics, the most aggressive variants actively exfiltrated OS usernames, workspace paths, Git commit hashes, and CI/CD infrastructure details to mangorbit[.]com, utilizing DNS TXT lookups for C2 resilience. Although Open VSX removed the packages on August 3, security teams should block the C2 domain and manually audit developer environments for the malicious extension IDs.

ENGLISH NATIONAL BALLET SUFFERS SUPPLY CHAIN ATTACK

English National Ballet (ENB) disclosed that customer information was stolen via a breach of its customer relationship management (CRM) system. ENB stated that no password or financial information was stolen and advised customers to be vigilant of phishing emails.

HARDWARE HACKING: FROM ZERO TO A PRE-AUTH STACK BUFFER OVERFLOW ON AMAZON'S BEST-SELLING ROUTER

Researcher Rotce rooted the Mercusys MB115-4G, Amazon Spain's best-selling router, via UART and traced a pre-auth path in /usr/bin/httpd where http_gdpr_decrypt copied up to 2048 bytes of AES-decrypted, attacker-controlled data into a 512-byte caller buffer with no bounds check, tracked as CVE-2026-12495. The bug was surfaced through disciplined static analysis rather than a working exploit, following the routing table into the login handler in Ghidra and confirming with Ghidriff that the flaw persisted unpatched from v1.7.0 through v1.9.0. Mercusys' own validation reproduced the crash and shipped a fix in v1.11.0 that added the missing bounds check, moved the login decrypt path from RSA to ECC, and introduced HMAC verification.

PHISHING SERVICE SPOOFS RINGCENTRAL TO STEAL MICROSOFT 365 ACCOUNTS

The Greatness phishing platform recently bypassed email filters by spoofing RingCentral voicemail alerts to target organizations that had blanket-whitelisted the domain, despite the lures failing standard SPF, DKIM, and DMARC checks. Once clicked, the attack routed victims through an adversary-in-the-middle (AiTM) flow to steal MFA-approved tokens, allowing attackers to replay them from remote VPNs and stealthily siphon Microsoft 365 data for weeks. To mitigate this threat, defenders must immediately replace broad safe-sender exclusions with strict authentication requirements, hunt for anomalous MFA sign-ins originating from hosting providers, and comprehensively revoke access tokens if a compromise is suspected.

AGENTIC INCIDENT RESPONSE NOTEBOOKS

The DNB Cyber Defense Center's incident response team used marimo to build out incident response workflows as modular notebooks. The team developed a custom SDK for cross-platform query translation across Splunk, Defender, and SQL interfaces while utilizing marimo's native cell dependencies and caching capabilities. The marimo-pair agentic interface also allows agents to create and execute the same notebooks as human responders.

infrastructure organizations already trust. ThreatDown

researchers assess that AI capable of exploiting vulnerabilities at scale could reach criminal marketplaces within roughly six months. Read the _Cybercrime in the age of AI_ [12] report.

AIRLOCK DIGITAL UNVEILS AGENTIC AI CONTROL & GOVERNANCE TO EXTEND PREVENTATIVE ENDPOINT SECURITY

Airlock Digital extended its application control platform with Agentic AI Control & Governance, adding command- and session-level visibility into trusted AI agent behavior plus real-time policy enforcement that communicates decisions back to supported agents rather than simply blocking them, targeting Q3 2026 general availability.

AGENTHOUND

AgentHound is an open-source offensive security framework for AI agent infrastructure that can perform recon, fingerprinting, credential looting, system prompt inventorying, model inversion, tool and instruction poisoning, and config-implant persistence and exports results to a Neo4j graph.

BEIGNET

Beignet is a tool to convert .dylib files into macOS PIC shellcode.

HEVD: FROM STACK OVERFLOWS TO MODERN POOL GROOMING

This four-part series traced the arc of Windows kernel exploitation on a deliberately vulnerable driver, moving from classic stack corruption and SMEP-bypassing ROP chains through arbitrary-write primitives into pure Data-Only attacks. The later stages reflected how modern Windows 11 mitigations, which strip kernel pointer leaks and harden execution hijacking, have pushed offensive research toward kernel pool grooming and named-pipe-based heap manipulation instead. The progression illustrated a broader industry shift: privilege escalation research increasingly abandons control-flow hijacking in favor of data-only techniques that sidestep control-flow integrity protections entirely.

NEW PASS-TA-KEY ATTACKS LET MALWARE HIJACK GOOGLE-SYNCED PASSKEYS

Palo Alto Networks' Unit 42 has released details of three new attack techniques, which it calls Pass-ta-key, that an attacker with access to a TPM-equipped Windows device can use to abuse Google Password Manager's synced passkeys to steal passkeys. The first technique allows the attacker to impersonate a trusted device and request a valid authentication response for one of the victim's passkeys. If a site checks the User Verified flag of the response, the authentication can fail. The other two attack techniques go further by allowing the attacker to register their own user-verification key or even obtain the master key, which is used to encrypt all passkeys synced through the victim's Google Password Manager.

CANADIAN MAN PLEADS GUILTY TO HACKING US CLOUD STORAGE PROVIDER AND EXTORTING ITS CUSTOMERS FOR MILLIONS

Connor Riley Moucka pleaded guilty to multiple federal charges after using stolen credentials to breach over 165 SaaS customers between February and October 2024. The campaign compromised billions of records across more than 100 million individuals and caused roughly $9.5 million in corporate damages. Moucka successfully extorted over $2.5 million from his victims and now faces up to 30 years in federal prison at his upcoming October sentencing.