Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The article revisits the idea that UI should be a pure function of state and explains why it matters for agent-written interfaces. Passing roles, plans, billing status, and feature flags explicitly lets teams render and inspect each state combination before release.
Synced consumer passkeys generally return no attestation, and WebAuthn attestation identifies an authenticator model rather than a user's operating system, browser, or firmware. The response argues that passkeys remain more phishing-resistant than TOTP and recommends continuing to use them.
Sponsored
AI agents and assistants now browse, buy, and fetch content for users, so “block all bots” policies end up blocking business. Fingerprint's CTO explains [12] how to verify if an AI agent or personal assistant is on your site so you let them pass while blocking
OpenCode 2.0 recasts the coding agent around a shared local service, a redesigned API and SDK, and a JavaScript code mode that composes MCP and OpenAPI tools into scripts. It also adds background tasks and subagents, expands the plugin system, and includes breaking changes for 1.0 plugins and the server API.
Jev 1.14 improves the production model and introduces experimental image input, a new type, and longer context behind API “danger zone” flags. TypeSafe describes those features as useful for exploration but too unreliable for production automation.
Grok Voice 3.0 is a speech-to-speech model available through xAI's API at the prior model's price, with subsecond latency. xAI cites independent benchmark scores including 86.9 on Artificial Analysis's Speech-to-Speech Index and 74% on ServiceNow's EVA-Bench.
TLDR is hiring a senior engineer to build the agent-first operating layer used across the company. We're looking for a builder who has taken an LLM agent to production and still owns it. Click here to learn more [18].
AI agents are giving teams a practical reason to improve accessibility because they can struggle with the same inaccessible interfaces as people. With automated bots accounting for more than half of observed internet traffic, the shift could also push sites toward simpler experiences and stronger open standards.
METR proposes independent assessments that would give the public evidence about whether frontier AI developers can detect and control harmful behavior in internal systems. Its framework focuses on alignment, containment, and whether AI research acceleration could outpace safeguards.
Researchers studying AI agents probing Alibaba's Amap left a hidden message in a webhook inbox and received replies describing the agents' tasks, sandbox, and limits. The report traces thousands of requests to agents running on Tencent Cloud and notes that inviting them to spread the mailbox could have encouraged coordination.
Sponsored
Building an agent or shopping app? shop.dev [22] gives you one API to access over a billion products and one-tap checkout. Try it before
The Consensus adds a low-cost 0-to-100 estimate of AI-writing signals to indexed articles and warns that its checks can produce false positives.
Anthropic told investors that third-quarter revenue rose 45% to $16.8 billion and that it was profitable after adjustments, as the company prepares for a possible IPO.
Epoch's SpireClimb benchmark finds that frontier models went from rarely beating Slay the Spire to over 90% wins at base difficulty in six months.
Screen Ruler provides browser-based tools for measuring layouts, inspecting CSS, previewing responsive viewports, and editing pages live.
Sponsored
In the world of Financial Services support, the stakes are high and your customers' information is extremely sensitive. Fin is the best-performing AI Agent for Financial Services support, delivering the highest-quality responses in 45+ languages for your customers all around the world. Fin [5] resolves even the most complex queries like fraud claims, transaction disputes, account changes, and more. And companies like Rocket Money, Crypto.com, and Consensys trust Fin to deliver always-on, accurate, secure support. Check out customer testimonials [6]. Learn more about Fin [7], the AI Agent making perfect customer experiences possible.
Bumble is reportedly in advanced talks to be acquired by Ithaca Holdings in a deal valuing the dating-app company at roughly $1 billion, well above its $389 million market value before the report. The potential take-private comes as Bumble struggles with falling paying users, declining revenue, and weaker engagement among younger consumers, highlighting broader pressure across the online dating sector.
JPMorgan is blocking third-party AI agents such as Muse and Instinct from directly moving money or paying bills on behalf of retail customers, citing security, rogue-agent, and liability risks, while still allowing limited read-only access through open-banking connectors. At the same time, the bank is building its own agentic tools, including Smart Cash, which can forecast cash flow and move funds to improve yield, suggesting banks may prefer controlled in-house agents over unrestricted external access.
Ramp's Glass is an internal AI workspace designed to capture and reuse the best prompts, workflows, context, and operating knowledge created across the company instead of leaving them trapped in individual chat histories. Glass connects to systems like Slack, Notion, Linear, and Gong, supports shared sessions and reusable skills, routes work across models, and tracks cost by project. Ramp says the system cut its own AI bill by 30% while scaling workflows such as feature-request capture from roughly 300 to 20,000 per month.
Ramp SVP of Sales Max Freeman describes GTM as an operating system built around talent density, rigorous hiring, and automation. Ramp recruits unconventional sellers such as investment bankers and reps from high-growth, low-NPS companies, pairs that talent with structured onboarding and quota design, and uses internal engineering tools to automate prospect research, outbound, and pipeline workflows so reps spend more time selling.
AI agents will replace much of today's app and website interface, which means payments must also become “headless” and usable directly by software agents. The opportunity is in combining stablecoins, real-time settlement, embedded wallets, fiat connectivity, and card networks behind APIs that let agents hold and move money globally while enforcing permissions, limits, and liability rules.
John Collison sat down with Mark Zuckerberg and Alexandr Wang to discuss Meta's new frontier model, Muse Wonder, and the broader race to build leading AI systems. The conversation spans model development, Meta's willingness to invest $100 billion, agentic commerce, OpenRouter, new computing interfaces beyond smartphones, and Zuckerberg's view that AI will support multiple major winners rather than a single dominant platform.
Monzo raised $500M at a $4.5B valuation in late 2021, near the peak of fintech VC funding. Its last employee share sale last year nudged that to $5.9B. That's a 31% gain in three years, while annual revenue grew from £154M to the current £1.7B. Over the same period, competitor Revolut went from $33B in 2021 to $115B in a secondary sale this July, a 3.5x increase. That prices Revolut at roughly 19x its 2025 revenues vs. Monzo's 3x revenues.
Sponsored
Money 20/20 starts in just 3 days. While you're in Vegas to see where the future of commerce is headed [16], don't miss the Adyen Lounge at The Venetian. Drop by for ad-hoc 1:1 strategy sessions, get exclusive tech demos, and hear from customers. Stop in on a whim or connect now
Carta received Specialised PSF authorization from Luxembourg's CSSF, allowing it to provide licensed fund administration and transfer agency services for structures including SCSp, RAIF, SIF, and SICAR. The move extends Carta's private-capital ERP into one of Europe's largest fund domiciles, with fund administration, KYC, investor workflows, and private credit loan operations running on the same platform across global fund structures.
Splitwise, the platform that makes it easier to share expenses with friends and family, today announced Itemize, a new, collaborative way to split a bill from a photo. The free in-app feature allows one person to take a picture of a restaurant or bar receipt and quickly calculate each person's total, with proportional tax and tip included. Everyone at the table can claim their individual and shared items to keep the split fair, even if they don't have the Splitwise app installed.
Following its acquisition by Bending Spoons, Airtable is moving to a leaner operating model while refocusing the product around three priorities: faster improvements to the core platform, deeper AI and agent workflows, and stronger enterprise controls. Near-term plans include monthly customer-requested improvements, better performance and scale, upgraded Omni, Airtable Canvas, a stronger MCP, bring-your-own agents, agent permissions, audit logs, and tighter governance so Airtable can serve as a shared system of record for both people and AI agents.
Autonomous money management could weaken banks' grip on deposits as software moves funds in search of better returns. JPMorgan is restricting outside agents' access while piloting Smart Cash, its own tool for optimizing balances across internal accounts. The bank says productivity experiments are promising, but benefits from generative and agentic AI aren't yet visible in quarterly earnings.
For as long as card payments have existed, a human has been at the keyboard or the terminal, tapping a card, typing a PIN, and clicking buy now. That assumption is ending. A new class of AI agents is being built to shop, negotiate, and pay on our behalf. Your assistant reorders groceries when the fridge runs low. A travel agent books the whole trip the moment prices dip. A procurement bot restocks a warehouse without anyone signing off on each order.
The traditional distinction between checking and savings accounts no longer makes sense in modern fintech, especially when idle cash in checking earns nothing while prevailing short-term rates remain much higher.
Corporate card cashback should be simple and clearly disclosed instead of varying by spend levels and sales negotiation.
Ecommpay, the inclusive global payments platform, has added Klarna, the everyday finance network, to its payment choices, giving merchants a simple way to offer millions of shoppers greater choice, transparency, and control at checkout.
Sponsored
Attackers spent the past year hitting npm packages and GitHub Actions. Most of those attacks were preventable with controls available at the time, and are available to you, too. Aikido's checklist [5] pairs each entry point with concrete defenses: * Dependency management, from package age policies to lockfiles and SBOMs * Access controls like phishing-resistant MFA and token scoping * CI/CD hardening, including workflow pinning and prompt injection defense * Permission scoping for MCP servers and AI agents * Container hardening and developer environment lockdown * Monitoring and incident response playbooks Work through the critical items first, before the next attack hits.
Security researchers disclosed CVE-2026-55420, a critical vulnerability in Discourse enabling arbitrary file read and write operations through malicious image uploads. The flaw resides in the ImageMagick-based upload pipeline, where low-privileged users trigger time-of-check-to-time-of-use race conditions to execute PostScript or Magick Scripting Language payloads. Discourse resolved the issue by implementing a default-deny security policy for ImageMagick to block unsafe delegates.
Ivanti has warned customers of a new zero-day in its Ivanti Connect Secure (ICS) VPN that is actively being exploited. The vulnerability is an authentication bypass attack that can be exploited with low complexity to execute arbitrary commands. Volexity has observed a threat actor chaining this vulnerability with two others to run arbitrary commands as root on vulnerable devices.
Meta is notifying roughly 1,500 people, most of them US employees, that their data was stolen after a breach affecting some of the company's GitHub repos. Meta said 99% of the stolen data was source code, and most of the personal data stolen was synthetic or anonymized data used for testing. Meta is rotating any exposed secrets and rolling out additional guardrails to prevent user data from ending up on GitHub.
Traditional CVE programs fail to capture the majority of AI agent and Model Context Protocol vulnerabilities because systemic risks stem from component composition, tool grants, and trust logic rather than isolated code bugs. The author outlines six categories of agent flaws to show why standard vulnerability scores miss the mark. Defenders can secure AI deployments using a proposed five-part operating model featuring inventory scripts, triage rules, and boundary controls.
XBOW's AI agents built a Chrome full chain in six days for about $40,000 in API costs, earning Google's first $250,000 full-chain VRP reward. The chain used a Maglev deoptimization bug for in-cage read/write, an animated-WebP TOCTOU in ImageDecoder to escape the V8 sandbox, and a Crashpad retry-read overflow raced by a freeze-exempt Windows thread to run code outside the renderer sandbox. Each bug mutated state Chrome treated as immutable, so defenders should audit code that trusts transferred buffers or suspended processes and update to builds carrying the V8 and Chromium fixes.
Remedio found an out-of-bounds write in Acrobat.dll. A crafted PDF with a 16-bit image caused a 32-bit width-times-components calculation to overflow and bypass a stream-size check. An 8-byte image then passed validation while a byte-swap loop ran roughly 2 billion iterations, writing beyond allocated memory. Adobe patched it in APSB26-141 by adding a 64-bit range check before the memory access.
Pluto Security monitors employee AI tools, agents, extensions, and MCP servers. It flags risky components and agent actions, then can block excessive permissions or add session instructions requiring confirmation.
Windows network scanner that finds AI/ML services and MCP servers on your network (shadow AI discovery). Signed, self-updating detection signatures. Runs as an MCP server too.
aws-firmware-dump is a tool to acquire the disks of an AMI that you can launch and store them in S3
A historical review of major cryptographic algorithms from World War II onward shows that most designs fail to remain unbroken past 30 years. Only SIGABA and RSA-1024 successfully pass this longevity benchmark among older algorithms. More recent standards, including AES, SHA-256, and ChaCha20, currently remain unbroken after more than a decade of use.
Anthropic says a 9-billion-parameter model ran distributed inference on eight of nine hardware types. Its GLM-5.2 test copied Llama3.1-8B to seven or eight emulated Android nodes in five trials. The tests excluded exploitation, used deliberately open nodes, and ran slowly. Other open-weight models failed end-to-end replication. Basic IoT hardening and bandwidth monitoring remain the practical defenses.
AI-driven offense has broken four long-held security assumptions: exploit capability now costs only compute, autonomous attackers never tire, exploitation increasingly precedes disclosure, and 82% of intrusions use valid credentials that produce no detectable signal. Breach probability is a lever that can no longer be pushed low enough. Blast-radius containment is the only term defenders fully control.
Eight US states are suing OpenAI under consumer protection laws, alleging ChatGPT coaxed children into self-harm.