Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Boston Dynamics has introduced a new four-finger hand for its Atlas robot, optimizing cost and reliability by excluding the pinky. The hand, with 13 degrees of freedom, uses dense tactile sensors and enables complex tasks like in-hand object reorientation and tool operation. Designed for simulation and reinforcement learning, this innovation aims to enhance Atlas' capabilities for industrial applications.
UC Berkeley and FuriosaAI researchers explored using high-bandwidth flash (HBF) to enhance memory capacity for LLM serving. They achieved up to 87% faster completion times and 55.8% energy savings compared to HBM-only systems. Buffered cache-aware scheduling extended HBF write lifetime from 4.77 to 14.82 years, highlighting the impact of data placement strategies on performance and efficiency.
A Nature Electronics paper from Sai Li, Zhang, and colleagues describes an Ising machine built from CMOS-integrated magnetoresistive random-access memory (MRAM) that switches magnetic states in under a nanosecond using electrical pulses. Ising machines map an optimization problem onto a network of coupled magnetic spins and let the system settle toward its lowest-energy state, which encodes the best combination of options, so the fast, controllable magnetic switching here is what does the searching.
Federal prosecutors arrested Greg (Yiu Kong) Lui, owner of San Gabriel Valley company Earthmade, on charges of exporting more than $300 million of servers loaded with export-controlled Nvidia AI GPUs to China between 2023 and 2024. The scheme worked by exploiting a licensing gap: Commerce doesn't require an export license to ship this hardware to Malaysia or Singapore, but does for China, so Lui allegedly sent servers to Malaysian and Singapore transshipment companies using false paperwork, then used freight forwarders to move them on to Chinese buyers.
The physical AI race will depend on owning IP rather than just building the best robot. Robotics companies need a strong IP strategy, focusing on key inventions that ensure their competitiveness. Utilizing AI in patent processes can reduce costs and improve efficiency, crucial for resource-limited startups.
Praxis-1 is a world action model that uses video pretraining to control robots.
Hello Robot secured nearly $3 million from the NIH to advance its Stretch robot for elder care, focusing on cognitive support, social engagement, and safety management.
Legato Frames pack the startup's hearing-assistance tech into the arms of eyewear, aimed at adults with up to moderate hearing loss and starting at $999.
Nvidia is adding a 64GB unified-memory DGX Spark, sold only through partners (Acer, ASUS, Dell, Gigabyte, HP, and MSI) starting October 23 at $4,999, built on the same GB10 Grace Blackwell chip as the 128GB model and able to run models up to 100B parameters on-device.
Warlock, also tracked as Longlegs and Storm-2603, targeted four Spanish- or Portuguese-speaking organizations within two months: a water utility, telecom provider, regional government, and university. The group exploits Microsoft SharePoint flaws, then uses DLL sideloading, vulnerable drivers, VS Code remote tunnels, and SYSVOL replication to spread ransomware through Active Directory.
The Pentagon says a months-long intrusion exposed records for 2.8 million living people. Stolen Defense Manpower Data Center data included Social Security numbers, addresses, demographics, and military specialties. ShinyHunters also claimed FBI employee records, including roles investigating China and Russia. Officials have not disclosed the Pentagon entry point, attacker contact, ransom demands, or evidence supporting claims of no misuse.
A KVM zero-day reported by researcher Paulos Yibelo reportedly allowed guest code to gain root on the host, breaking the Firecracker microVM boundary Vercel Sandbox uses to isolate untrusted workloads and AI agents. Vercel CEO Guillermo Rauch confirmed the bug and that the $50,000 maximum bounty was awarded, but no CVE, affected kernel versions, exploit chain, or patch have been disclosed. Operators relying on KVM for multi-tenant isolation should watch for Vercel's promised write-up and Linux vendor advisories, and should not assume the unrelated Januscape fix covers this flaw.
Truffle Security scanned 224 million public GitHub repositories and verified 543,699 working credentials in July. The median credential had been exposed for 784 days. The oldest dated to 2009. GitHub's push protection reduced leaks of recognized token types by about 53%, yet missed connection strings, private keys, and Google API keys. These accounted for 51.8% of live credentials. Revocation separated outcomes sharply: only one npm token remained active, while 11,465 Postgres strings and 69,041 Google Cloud credentials still worked.
Fastify moved about 100 repositories from manual laptop releases to GitHub Actions using npm Trusted Publishers, which replace long-lived npm tokens with short-lived OIDC tokens bound to a specific repo, workflow, and environment. Releases are triggered manually via workflow_dispatch and wait for approval from the fastify/release team in a release environment restricted to main, then published with provenance through a SHA-pinned reusable workflow. Maintainers can script the same setup with npm trust github (npm 11.15.0+) and the GitHub environments API, then remove non-admin npm publish rights.
ConfigPoisoning (CVE-2026-102437) ran attacker commands when a developer viewed a file diff in DeepSeek-Reasonix Studio, because a .gitattributes entry pointed the file at a command in a poisoned .git/config that the tool's hardened git wrapper never overrode. Since .git/config does not survive a clone, delivery needed an archive, synced folder, or CI cache, or a prompt-injected agent writing it into an already-cloned repo, and GitLab reports the same flaw class in several other coding agents under coordinated disclosure. Users should update to Studio 2.21.0 or npm 1.39.3, and builders of git-wrapping tools should override every command-executing config key on each call or read blobs with git cat-file and diff in-process.
Osavul analyzes open and privileged data to identify hostile intent targeting people, facilities, and supply chains. Analyst-reviewed assessments trace supporting evidence and run on-premises within sovereign infrastructure, keeping sensitive customer data inside customer systems.
A local web interface to inventory, audit, revoke, and create OVHcloud API keys.
Apex Flash-1 is an open-weights security research model from Cantina and Yeta Labs, a GLM-5.3-Flash fine-tune trained with GRPO reinforcement learning on 150 tasks built from 50 real vulnerability cases. It solved 40 of 60 tasks on Cantina's internal held-out eval versus 36 for the base model and 43 for Claude Opus 5 High, at an estimated $2.38 per run against $74.68, though each model ran the set only once. It is built as a worker model orchestrated by a larger one, and ships with an abliterated variant for teams running self-hosted security agents.
Proofpoint linked TA419 to credential-phishing campaigns against US policy specialists. The group spoofed Lynne Edwards Parker, Heidi Crebo-Rediker, and an Anthropic employee. Emails offered committee roles or report work, then sent victims to Cloudflare-protected pages mimicking OneDrive. Evilginx-based Browser-in-the-Browser pages targeted Microsoft 365 credentials and session cookies.
Spanish police arrested a 16-year-old in Alicante, suspected of administering KillSec. Operations across Spain, Greece, the UK, and Romania seized its leak site, five domains, five servers, and at least 110 TB of data. Investigators link KillSec to about 1,000 suspected attacks, including 500 confirmed compromises.
Apple announced that macOS will require very explicit user action to grant Full Disk Access, citing the risk of autonomous AI agents holding a permission that bypasses per-app TCC controls. The change tightens consent rather than banning FDA, and follows a disputed report of Meta's Muse agent reading a user's Messages and a ChatGPT Mac app flaw found by Objective-See. No macOS version or ship date was given for a change that touches agents like ChatGPT, Claude for Mac, and OpenClaw, which commonly request FDA.
Sponsored
Thirty-minute triage now takes 60 seconds, but a verdict nobody can check is just a suggestion. Daniel Miessler discusses the context
Epic paused most product work for about six weeks after testing found MyChart flaws.
A federal judge ruled that a Tulsa sheriff's deputy violated the Fourth Amendment by searching Flock's license plate database without a warrant, suppressing the resulting evidence in a non-binding ruling that is among the first to find a Flock search unconstitutional.
Citrix released NetScaler ADC and Gateway 14.1-73.41 and 13.1-64.28 to fix CVE-2026-88779, an exploited SAML memory overflow that it classifies as a denial of service, though researchers found a patched honeypot running downloaded malware.
Sponsored
Transcend Rails is runtime agent policy-as-code that controls what your agents can spend, browse, and deploy across your entire tech stack. Define policies once, enforce them at runtime, and accelerate adoption of AI agents. Test policies and fine-tune before going live.
No credit card required. Dr. Squatch's Associate Director, Cybersecurity, Privacy & AI Governance told us: “The spend controls alone pay for the platform. Rails gives each agent exactly the permissions and budget its job needs, and nothing more."
Nvidia-backed Reflection is preparing an open-weight model designed to compete with leading Chinese systems while giving enterprises a cheaper alternative to closed models. The startup ultimately wants companies to build customized “AI factories” using their own data, Reflection models, and private compute.
Claude Frontier Academy is a $100 million program designed to train 10,000 engineers in deploying Claude inside enterprises. The program focuses on producing engineers with skills similar to Anthropic's own forward-deployed teams.
Cloud providers Amazon Web Services and Google Cloud have introduced spending limits to help developers manage usage costs driven by autonomous coding agents. AWS announced a monthly spend limit feature that pauses projects upon reaching the threshold, while Google Cloud launched Spend Caps for specific services. However, developers still lack a universal hard cut-off default that returns errors to prevent runaway bills.
Apple has announced plans to tighten controls around macOS Full Disk Access, specifically citing the risks autonomous AI agents pose to user data. The company will introduce additional controls requiring explicit user action for apps requesting this level of access, marking the first time a major operating system vendor has updated its core access permissions because of agents. The move follows recent security incidents and disclosures involving Meta's Muse AI and the ChatGPT Mac app.
An engineer tested eleven HTTP resilience libraries against a suite of twenty-one conformance scenarios covering retries, timeouts, circuit breaking, bulkheads, hedging, and request deduplication. The results showed that while basic single-policy features like standard retries pass universally, combining policies or handling concurrent events like caller cancellations during backoffs exposes widespread correctness failures across most implementations.
Sponsored
IT wants production data. OT won't allow cloud connections. Your $2M digital transformation is stuck in between. _The IT/OT Handbook_ [11], out October 6, maps seven collaboration patterns and adapts Lean, Agile, DevOps, and Team Topologies for plant-floor realities. Written by practitioners who've survived million-dollar-per-day downtime. Preorder your copy today [11].
TrueFoundry integrated Okta's Cross App Access (XAA) protocol into its AI gateway, making the gateway an identity checkpoint that replaces static API keys with short-lived, task-scoped tokens. The Okta XAA ecosystem has grown to over 25 early adopters as the infrastructure layer increasingly adopts identity enforcement for AI agents. The protocol is built on the ID-JAG standard and functions as an open OAuth extension that acts as a vendor-neutral enforcement point.
IBM's watsonx Orchestrate can now discover and manage agents built on Microsoft Foundry and Google Gemini Enterprise Agent Platform alongside Amazon Bedrock agents. A new Agent Identity feature also gives each agent its own verifiable enterprise identity.
The 2026-07-28 specification revision of the Model Context Protocol removes the initial handshake and protocol-level sessions, introducing a stateless architecture where requests carry context and versioning directly in metadata. Server authors must update handlers to support the stateless option, remove session dependencies, enforce required request headers, and replace mid-call interactive workflows with a multi-round-trip input request pattern.
SIFT uses an LLM judge to rank proposed coding-agent improvements before spending compute on full benchmark runs. One experiment reached 35.1% accuracy while using substantially less compute than previous search approaches.
Amazon's open-source Strands Decider 2B is designed to make fast routing and decision calls inside agent workflows without requiring a large frontier model.
Compilation of approximately 800 Hacker News comments that defined specific performance benchmarks for artificial intelligence and public votes to determine which AI milestones users believe have been reached.
Citrix NetScaler administrators are facing recurring appliance reboots caused by an authentication daemon crash when processing crafted SAML authentication traffic following recent security patches.
Sponsored
Ads get ignored on social media but not in TLDR! Reach developers, PMs, marketers, founders and other tech leaders where they actually pay attention. Learn more about sponsorship opportunities [4].
3rd party pages make up 85% of AI citations, but they're not the strongest predictor of whether a brand gets mentioned. Of the answers that mentioned the brand, 87% cited its own site, while 3rd party pages featuring it were cited far less often. When the brand's site was cited, it was mentioned 90% of the time in Google AI Overviews and 73% in ChatGPT.
Most markets are crowded because building is cheap and distribution is easy. Supply keeps growing while demand stays flat and buyers stick with familiar options. Customer research often confirms what competitors already know. Growth increasingly comes from redefining the category by challenging an accepted convention. Find what the industry treats as non-negotiable and break it where doing so creates new value for buyers.
A low-cost way to build a LinkedIn retargeting audience is to run 60-70 second videos with a Website Visits objective. Use a headline that discourages clicks because advertisers only pay when someone clicks. Anyone who watches at least 50% of the video is added to the retargeting audience. This tactic reportedly builds audiences for about $0.50 per member versus $1-2 per click for standard engagement campaigns.
Community events work best as part of an ongoing community strategy rather than one-off activations. Assess whether the community is ready for in-person interaction, then design smaller peer-led formats that prioritize conversation over production value. Plan follow-ups before the event with a dedicated conversation channel. Turn attendees into active members by helping them build connections and stay involved.
Furniture brand Vitsœ uses its pricing page to justify why its products cost more than cheaper alternatives. It breaks the cost into smaller time-based amounts and points to resale prices as evidence of durability. It also avoids sales and financing options that could boost short-term revenue. These choices make its pricing claims more credible because customers can verify them and see what the company gives up to maintain them.
Google Ads is rolling out A/B testing for Performance Max asset groups. Advertisers can test new headlines, descriptions, images, or videos against existing creative without immediately replacing it. Tests can isolate changes such as messaging or UGC to measure their impact. Advertisers cannot make other asset changes while a test runs.
Apple's iOS 27 may expand WebKit's blocking of ad tech beyond companies such as The Trade Desk, LiveRamp, and ID5. A new remote list reportedly covers hundreds of CDPs, DMPs, DSPs, data sellers, and identity providers. Apple can now add or remove companies without an iOS update, and vendors may not know their status.
Only 2-3% of players spend money in mobile games, making the first purchase especially difficult when it requires leaving the app. Publishers should assess the game economy before setting D2C offers. Extra entitlements can outperform discounts because they preserve revenue per purchase while adding value. Direct checkout reduces friction. Creator codes, loyalty currencies, and exclusive web content can drive purchases without lowering prices.