Search the archive

ENVIRONMENTS HUB: A COMMUNITY HUB TO SCALE RL TO OPEN AGI

A new open-source platform is providing dozens of reinforcement learning environments to support “open AGI” and inviting contributors to add more.

OH GOODY, THE 'FIRST KNOWN AI-POWERED RANSOMWARE' HAS BEEN DISCOVERED, AND IT 'MAY EXFILTRATE DATA, ENCRYPT IT, OR POTENTIALLY DESTROY IT'

PromptLock is a newly discovered proof-of-concept ransomware that uses OpenAI's gpt-oss-20b model to generate code to exfiltrate data, encrypt it, and potentially destroy it. It uses the Ollama API to generate malicious Lua scripts on the fly, which it then executes. The ransomware runs locally, which allows it to avoid detection more easily as it doesn't use any online resources.

OPENAI AND ANTHROPIC SHARE SAFETY ACCESS

OpenAI and Anthropic allowed each other internal API access for joint AI safety testing, aiming to uncover blind spots in their model evaluations.

Explore OpenSearch

GOOGLE IRONWOOD TPU SWINGS FOR REASONING MODEL LEADERSHIP AT HOT CHIPS 2025

Ironwood is the first Google TPU explicitly designed for large-scale AI inference.

CRITIQUES OF WORLD MODELS

The primary goal of a world model is to simulate all actionable possibilities of the real world for purposeful reasoning and acting.

AN UNUSUAL CONSEQUENCE OF AI CODING

This developer found that they stopped listening to music when they replaced their old coding process with prompt-crafting.

WE ARE STILL UNABLE TO SECURE LLMS FROM MALICIOUS INPUTS

All AIs working in adversarial environments are vulnerable to prompt injections, and the people developing these technologies are pretending this isn't a problem.

DOES GENERATIVE AI FACILITATE INVESTOR TRADING?

Invest in Pacaso before this opportunity ends on 9/18

BITCOIN UNDERPERFORMS ETHER, BROADER MARKET

Bitcoin held above $111,000 but gained less than 1% over 24 hours, underperforming the broader cryptocurrency market as the CoinDesk 20 Index rose 3.2% and smaller tokens in the CoinDesk 80 gained 4%. With over $14.6 billion in Bitcoin and Ether options set to expire Friday at a "max pain" level of $116,000, options sellers have incentives to push BTC higher toward that strike price to minimize their costs. The standout performer was Cronos (CRO), which surged over 56% after Crypto.com and Trump Media announced plans to create a $6.4 billion CRO treasury company that will integrate the token into Truth Social's rewards system. Despite Bitcoin's recent sideways action, its 200-day moving average crossing above $100,000 signals the continuation of a strong long-term uptrend that has been in place since late April.

CIRCLE PUSHES DEEPER INTO PAYMENTS WITH MASTERCARD, FINASTRA DEALS

Circle announced partnerships with Mastercard and Finastra to embed USDC settlement into traditional financial infrastructure, with Mastercard enabling stablecoin settlements for merchants across Eastern Europe, the Middle East, and Africa. Finastra will integrate USDC into its Global PAYplus platform, which processes over $5 trillion in daily cross-border transactions, allowing banks in 50 countries to settle international payments in USDC while maintaining fiat-denominated payment instructions. These deals showcase Circle's accelerated push for global USDC adoption against tough competition in the stablecoin space abroad. The partnerships complement Circle's recent expansion efforts in Asia, including collaborations with major South Korean banks and a joint venture in Japan with SBI Group, Ripple, and Startale.

AAVE LAUNCHES HORIZON, AN RWA-BACKED LENDING MARKET

Aave Labs' Horizon is a new Ethereum-based lending market where institutions can borrow stablecoins against tokenized real-world assets (RWAs). Backed by partners including Circle, Superstate, Centrifuge, Ripple, VanEck, and WisdomTree, Horizon allows qualified investors to post RWA collateral and borrow GHO, USDC, or RLUSD, while retail users can supply stablecoins to earn yield. Horizon bridges compliant institutional finance with DeFi by integrating NAVLink from Chainlink for accurate valuations and Llama Risk for oversight, turning RWAs into productive onchain assets.

GOOGLE CLOUD REVEALS UNIVERSAL LEDGER L1

Google's blockchain, the Google Cloud Universal Ledger (GCUL), is now in private testnet. Designed as neutral infrastructure for finance, GCUL features Python-based smart contracts, native commercial bank money onchain, 24/7 capital markets infrastructure, and “agentic” payment capabilities. Backed by Google-scale distribution and institutional partners, CME Group is already piloting tokenized assets on the network. More technical details are expected in the coming months.

IF YOU LIKE PREDICTION MARKETS YOU SHOULD LEARN ABOUT FUTARCHY

Futarchy is a governance model that combines democratic voting on desired outcomes with prediction markets to determine which policies are most likely to achieve those goals, following the principle "vote on values, bet on beliefs." Traditional democracy aggregates preferences but not knowledge since being wrong carries no cost and policies are chosen by popularity rather than accuracy, while prediction markets require participants to risk capital and reward correct predictions. Citizens would vote on outcomes they care about, like GDP growth or employment levels, then prediction markets would compete to identify which specific policies are most likely to deliver those results, creating real-time probabilities based on collective intelligence rather than ideology. Crypto infrastructure now enables futarchy to be tested at scale through open participation, transparent settlement, and programmable incentives, with DAOs already experimenting with prediction market governance for resource allocation and policy evaluation.

THE THREE-LAYER BANK SCAM

Saving in banks is a “three-layer scam.” First, banks pocket risk-free treasury yields instead of passing them to savers, while lobbying to block stablecoin yields. Second, “real” yield disappears once inflation and taxes are factored in, leaving depositors worse off. Third, the dollar itself is an inflationary asset, eroding long-term value relative to scarce assets like BTC, ETH, and gold. Keep dollars for short-term needs, treasuries for medium-term, and scarce assets for long-term wealth preservation.

SOLANA'S PROPRIETARY AMM REVOLUTION

Solana has witnessed the emergence of proprietary AMMs, a new market-making primitive that embeds trading strategies directly onchain rather than relying on off-chain execution, with daily volumes consistently exceeding $1 billion and capturing over 60% of SOL/USDC trading volume. These venues, operated by professional market makers like SolFi, Tessera, and HumidiFi, provide "active liquidity" through continuously adjusted pricing strategies anchored to oracle feeds, fundamentally differing from traditional "passive liquidity" models of constant-product DEXs. The model is uniquely enabled by Solana's structural advantages, including high retail participation, low-cost oracle updates, and Jupiter's aggregator dominance, which provides single-integration access to non-toxic retail order flow.

RETHINKING TOKEN SUPPLY

Outstanding Supply is a new token supply metric that mirrors Outstanding Shares on the stock market to fix inconsistencies in crypto valuations. It offers a clearer picture of true market cap versus FDV (overstated) or Circulating Supply (inconsistent). The framework also refines Circulating Supply into a smarter version that excludes locked or insider tokens, giving investors apples-to-apples comparability, transparency, and more accurate valuation multiples. Outstanding Supply equals Total Supply minus Protocol Holdings.

AERODROME SEES 30% VOLUME JUMP AFTER COINBASE DEX INTEGRATION

Aerodrome's integration with Coinbase DEX on August 8 boosted trading volume from $8.7B in the prior two weeks to $11.3B after a 30% increase.

RAIN BRINGS YIELD-BEARING STABLECOIN SPENDING TO LATAM

Rain has added support for Dinari's USD+, a U.S. Treasury–backed stablecoin yielding ~5% APY, enabling users to both earn yield and spend via Rain-issued Visa cards.

TOWNS PROTOCOL VALUE CREATION

Towns Protocol, which allows online communities to generate value, has passed $43 million in revenue to builders and captured $4 million in protocol fees.

THE SANDBOX FACES TROUBLE

Metaverse project The Sandbox has laid off over half its employees, swapped its executive board, and is starting to work on a memecoin launchpad amid a lack of adoption and a collapse of the metaverse concept.

GOOGLE REVEALS MYSTERY AI IMAGE MODEL THAT CAN SMARTLY EDIT PHOTOS

Google's AI image model, “Nano Banana,” is actually Gemini 2.5 Flash Image, a powerful tool that blends images, maintains character consistency, and performs precise edits via natural language prompts. Capable of tasks like changing clothing colors, altering poses, or removing objects, it outperforms similar apps and will be integrated into Adobe Firefly and Adobe Express for seamless creative workflows.

META'S NEW ULTRA-THIN FLAT-PANEL DISPLAY COULD CHANGE THE FUTURE OF SCREENS

Meta developed an ultra-thin laser display, just two millimeters thick, that produces bright, high-resolution images with a wider color range. The breakthrough utilizes a photonic integrated circuit combined with a liquid-crystal-on-silicon panel, resulting in a display that is one-eighth the thickness of conventional displays. This technology could enable lighter AR glasses and improve smartphone, tablet, and television screens, although challenges such as laser speckle and power efficiency remain.

ADOBE BRINGS GOOGLE GEMINI 2.5 FLASH IMAGE TO FIREFLY AND EXPRESS

Adobe integrated Google's Gemini 2.5 Flash Image model into Firefly and Express, providing creators with enhanced image generation capabilities and improved photo editing control. The company will offer unlimited generations for subscribers through September 1, while new free users receive up to 20 generations. Google's model includes SynthID watermarking and content filtering, although it may produce factually inaccurate details, such as imperfect faces or spelling errors.

SUCCESSIVE PROTOTYPES BRIDGE THE GAP BETWEEN IDEA AND REALITY

Ideas cannot be adequately evaluated through mental visualization or persuasive arguments alone. They require physical prototypes to bridge the gap between concept and reality. Verbal descriptions fail to capture an idea's true potential, leading to decisions based on persuasiveness rather than substance. Prototypes provide concrete, testable manifestations that allow fair evaluation of ideas through direct experience rather than abstract debate.

A WEEK IN THE LIFE OF AN AI-AUGMENTED DESIGNER

A UX designer conducted an AI-augmented design sprint, using ChatGPT and Figma Make to accelerate research synthesis, ideation, and prototyping while maintaining human oversight for critical decisions. The designer discovered AI's collaborative potential but found that verification remained essential due to occasional hallucinations and the omission of human nuances. The week-long experiment yielded a validated concept of Gen Z financial literacy and a framework for integrating responsible AI into design workflows.

APPLE'S 3-YEAR DESIGN PLAN JUST GOT ME EXCITED ABOUT THE IPHONE AGAIN

Apple, long criticized for incremental iPhone updates and a lack of innovation, is rumored to be preparing a dramatic redesign cycle over the next three years. Reports suggest the iPhone 17 Air—its thinnest model yet—will debut next month, followed by a foldable iPhone in 2026, and culminating in 2027 with the iPhone 20, which will feature a seamless curved-glass design to mark the device's 20th anniversary.

PROMPT, AND EDIT VISUALLY

VibeFlow generates full-stack web apps from prompts with n8n-style visual workflows for the backend.

CREATE FORMS THAT PEOPLE LOVE

Collect all the data you need to understand customers with forms designed to be refreshingly different.

TURN YOUR GITHUB README INTO BEAUTIFUL DOCUMENTATION

Doksy helps developers and teams transform their README files into stunning, multi-page documentation websites in just a few clicks.

THE DESIGNER'S GUIDE TO LARGE LANGUAGE MODELS

Designers must understand LLMs beyond prompt writing to create better user experiences through three integration levels: Feature-Level (helpful additions), Agent-Level (active participation), and Platform-Level (autonomous orchestration). Current AI interfaces suffer from a technology-first mindset and design homogeneity. However, successful solutions make AI invisible, focusing on user goals rather than the underlying technology. The best approach combines conversational capabilities with familiar interface patterns, designing flexible frameworks that embrace uncertainty rather than rigid user flows.

DESIGN AS A POLITICAL SUPPORT INFRASTRUCTURE

The US National Design Studio and "America by Design" initiative represent a shift from liberal capitalism to neo-mercantile governance, recasting citizens as guests in a national hospitality experience. The initiative employs aesthetic design to garner allegiance and legitimize administrative control, rather than empowering users, treating design as an infrastructure for state authority. Without built-in provenance and recourse mechanisms, this approach risks using beautiful interfaces to launder bureaucratic violence and restrict citizen agency through "friendly fascism."

THE TIMELESS DESIGN LESSONS I LEARNED CREATING ALBUM COVERS

Creating album covers for artists like Cream, Pet Shop Boys, and Lightning Seeds taught Rob Petrie that great design prioritizes emotional resonance over decoration.

MORE GREAT WALLPAPER IN THE RUN-UP TO TWO MORE APPLE STORES IN INDIA

Apple is set to double its retail presence in India by opening new stores in Bengaluru on September 2 and Pune on September 4.

“CMD+Z DOESN'T EXIST ON PAPER”: PAT THOMAS' DRAWINGS ARE UNAPOLOGETIC AND FILLED WITH FEELING

London artist Pat Thomas uses crayon illustrations of nostalgic objects and surreal scenes to transform personal memories into vibrant, intimate works that celebrate connection and shared moments.

DATA I/O BECOMES LATEST RANSOMWARE ATTACK VICTIM

Data I/O, a tech manufacturer, suffered a ransomware attack on August 16 that led to major outages. The incident's impact remains unclear as the investigation is still underway, but restoration of operations has begun. Costs may be substantial.

FIRST AI-POWERED RANSOMWARE POC SPOTTED

PromptLock, the world's first known AI-powered ransomware, uses OpenAI's gpt-oss-20b model to generate malicious scripts. It is currently only a proof-of-concept and has not been seen in active attacks. PromptLock demonstrates how AI can simplify cybercriminal operations.

NX COMPROMISED TO STEAL WALLETS AND CREDENTIALS

The popular NX build system was compromised with malicious versions published to npm that steal cryptocurrency wallets, API keys, and credentials from at least 1,400 affected users. The malware creates repositories prefixed with "s1ngularity-repository" in victims' GitHub accounts. It uniquely leverages the Claude Code CLI or Gemini CLI to execute file system searches for sensitive data through AI prompts, making detection more challenging for traditional security tools. Users should immediately check for unauthorized repositories, update to version 21.4.1, and rotate all potentially compromised credentials, including GitHub tokens, npm keys, and SSH keys.

BEWARE THE FALSE FALSE-POSITIVE: HOW TO DISTINGUISH HTTP PIPELINING FROM REQUEST SMUGGLING

Sometimes, when people are hunting for HTTP request smuggling vulnerabilities, they actually run into false positives caused by connection reuse. Some scenarios where connection reuse may be necessary for finding vulnerabilities include situations where the frontend server only reuses the upstream connection if the client connection was reused, connection-state attacks, and client-side desync attacks. James Kettle created a Custom Action for Burp Suite called `Smuggling or pipelining?` to distinguish between a genuine HTTP smuggling attack and an HTTP pipelining false-positive.

BEHIND THE COINBASE BREACH: BRIBERY EMERGES AS ENTERPRISE THREAT

Threat actors like The Com and Scattered Spider bribed TaskUS workers in India with up to $2,500 to steal data from 70,000 Coinbase customers, resulting in a $20 million ransom demand that Coinbase refused, offering the same as a bounty. The breach revealed a shift from phishing to insider targeting through bribery, primarily targeting customer support staff with data access. Coinbase fired 226 workers, opened a US support hub, and enhanced controls. Experts advise red-team exercises to test employee responses to bribery attempts worldwide.

THE ONE WHERE WE JUST STEAL THE VULNERABILITIES (CRUSHFTP CVE-2025-54309)

A flaw (CVE-2025-54309) in CrushFTP servers allows attackers to gain administrative access if certain features are disabled. Researchers used a honeypot sensor network to catch hackers exploiting this race condition in real time and confirmed that two coordinated HTTP requests could add a rogue admin account. The vulnerability impacts thousands of vulnerable servers and is being exploited in the wild, highlighting the need for organisations to patch and monitor for unusual activity.

BRUTEFORCEAI

BruteForceAI is an advanced penetration testing tool that transforms traditional brute-force attacks by incorporating large language models for smart form analysis. The tool automatically detects login form selectors with AI and then performs complex multi-threaded attacks that mimic human behavior.

MERCATOR

Mercator is an open-source web application designed to manage the mapping of information systems, as described in ANSSI's "Mapping the Information System Guide".

REACH SECURITY (PRODUCT LAUNCH)

Reach Security employs virtual assistants in exposure management to automate drift detection, policy enforcement, and remediation. Its new ConfigIQ Drift module empowers customers to set custom deviation rules and baselines, all of which are managed centrally.

NEW SNI5GECT ATTACK CRASHES PHONES AND DOWNGRADES 5G TO 4G WITHOUT ROGUE BASE STATION

Sni5Gect is a framework that can downgrade 5G connections to vulnerable 4G, crash phone modems, and bypass authentication by passively sniffing unencrypted messages between base stations and phones during the initial connection phase before authentication. The attack achieves 80% sniffing accuracy and 70-90% message injection success rates from up to 20 meters away, exploiting the window before NAS security context establishment without requiring a rogue base station. Tests successfully targeted phones from OnePlus, Samsung, Google, and Huawei. The GSMA has acknowledged the vulnerability as