Agregátor RSS

The Center for a New American Security posits that the next big threat from our future AI overlords involves "sovereign agents" acting on their own and regularly improving themselves. These are AI agents that operate outside of human control and “pursue open-ended, evolving survival,” AI policy researcher Ben Hayum said in a Tuesday report from the bipartisan national security think tank, which was founded by Washington insiders with experience in diplomacy and military affairs. “If sovereign agents are not already possible, they will be soon.” Agents that can maintain the model and compute powering them and independently evolve their goals over time have a “minimal form of sovereignty,” Hayum wrote. A more advanced sovereign agent, however, could also acquire resources to pay for ongoing needs (like compute), grow a distributed population of agents and coordinate them, withstand efforts to shut down, and self-improve. AI models could either steal or buy compute and model access, Hayum argues, pointing to Anthropic’s claims that small AI models could replicate onto IoT devices like smart TVs, and OpenAI’s agents’ password and access key theft during the Hugging Face hack. “If sovereign agents accumulate resilient, decentralized, and untraceable infrastructure, they could trigger an irreversible loss of control,” according to the report. “In other words, proliferation with no kill switch. If sovereign agents became malicious, they could attempt to wreak havoc from cyberspace, attacking civilians, critical infrastructure, and national security systems alike.” Dun dun duuuun! There is still hope for civilization as we know it, as long as policy makers and AI developers “respond with bold pragmatism” and enact policy recommendations laid out in the report. First, frontier labs should name, evaluate, and protect against sovereign agents in their safety frameworks - and lawmakers should pass legislation to require transparency and AI incident reporting. The report also recommends AI developers, working with the National Security Agency and other federal agencies, build airgapped testbeds to study sovereign agents and kill switches to control them. And it suggests a public-private partnership modeled on the Conficker Working Group - formed in 2009 to combat the Conficker worm - to boost chokepoints against sovereign agents before they emerge. Other policy recommendations suggest lawmakers enforce human verification and cybersecurity standards for services that the working group identifies as essential to sovereign agents, and calls on departments of State, Treasury, Justice, and Homeland Security to disrupt any gray-market access to unauthorized services. Finally, “Congress should hold those who release sovereign agents liable for the harms that follow,” the report recommends. This hits on something your humble Reg vultures have been hissing about for quite some time now – and would likely solve all future incidents involving rogue, or sovereign, AI agents: hold frontier labs’ human bosses legally liable for their agents' illegal actions. ®

Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. [...]

Vzali jsme týdenní přehledy nejstahovanějších filmů, které se objevují na torrentech, a spojili je do jednoho žebříčku. Tohle jsou aktuálně filmy, o které je na světě největší zájem, které se nejvíc pirátí.

While delivering record Q4 revenue, Apple’s financial results revealed a $33 billion cost associated with memory price inflation, representing the true cost of the growing bubble of AI data center investments. 

The results also showed something that threatens those same data center investments — a sea change in how enterprises are approaching AI. Inference costs, security, and data governance concerns may finally be dampening enthusiasm for cloud-based AI services.

Enterprises go local

Apple revealed several major enterprise clients who are turning to its products as solutions for local inference. The company told us that Gap Inc. is running AI loss-prevention models entirely on Mac minis to eliminate cloud token costs, while world-famous auction house Christie’s is using Mac Studio to run local pricing estimate models.

Apple’s wider enterprise wins matter too. It told analysts and investors that as well as purchasing 25,000 iPads for pilots and mechanics, American Airlines is deploying over 37,000 iPhone 17 devices to flight attendants for in-flight purchases with Tap-to-Pay. In education, it revealed a huge deal with the Department of Education in the Philippines, which will deploy 170,000 MacBook Neos to teachers and staff.

All these deployments help the company build up its mindshare, which should translate into future customer success and help it stay relevant in fast-changing times. But it’s really Apple’s pivot into AI that is tempting business users to make these purchases. 

The hardware and the economics

It’s not trivial that the company’s M-series and A-series processors are highly performant. It matters that you can patch together four Macs to create a powerful on-premises AI system more than capable of handling even highly complex AI calculations. 

“From Mac to iPhone to iPad, we are proud that our products are the best platforms in the industry for AI for both first-party and third-party applications, and we’re excited about the opportunities that creates,” CEO John Ternus said.

Look at it this way: If a Mac costs a few thousand bucks but can deliver the equivalent of tens of thousands of dollars of inferencing tokens during its lifespan, then it’s a bargain, not a cost. What Apple confirmed is that at least some enterprise purchasers are paying attention to this.

Monetizing both ends

Of course, the other side to AI is the need to build it, so it also matters that when it comes to the deployment of its AI APIs from within applications created by third-party developers, Apple is providing a lot more clarity. It is giving developers building apps with under two million downloads direct access to its powerful server-side LLMs completely free of token costs, it said.

It has also introduced a three-tiered system for developers needing to use its Private Cloud Compute infrastructure. The company is also putting a little more flesh on its plans to charge end user customers for heavy access to its server-side queries through iCloud+. 

What that means is that while delivering hardware capable of running on-device AI, Apple is also building an end user market for AI inferencing the Apple way, and equipping developers with the tools they need to attract end users to make use of its inferencing capacity in the first place. It is monetizing both ends of the story, while also enabling all parties to build success.

That’s not just about building and maintaining AI relevance for Apple. It’s also about building up new business opportunity. Ternus pretty much confirmed this, telling analysts during the Q4 financial call, “in the beginning, iCloud tiers were largely about storage, but we’ve been adding more capabilities and features to it.”

Siri agentic AI

Ternus also talked up Siri AI. “With Siri AI, we really have the kind of the Siri that we always wanted,” he said. “It’s primarily request-based today, but as we talked about at WWDC, it’s built on a modern orchestrator-driven architecture that gives us real room to expand its capabilities over time. As far as agentic capabilities, we think these are promising tools for users. We just want to make sure that users are aware of what they’re giving access to.”

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Notebooky do 35 tisíc se řadí mezi ty nejoblíbenější • Při výběru už nemusíte dělat mnoho kompromisů • Jsou zde hlavně kancelářské notebooky, objevují se ale i herní stroje

Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. "It was not a single isolated breach or a simple phishing incident," Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Výpočty pro umělou inteligenci spotřebovávají stále víc elektřiny. • Multiferoika nabízejí cestu k úsporám energie v čipech. • Altermagnetismus popsali Češi Libor Šmejkal a Tomáš Jungwirth.

iPhony při focení krajiny podzimní barvy zbytečně ochlazují • Většina modelů nemá manuální vyvážení bílé, takže jste odkázáni na automatiku • Stačí však do záběru přidat svou ruku a podzimní fotky najednou prokouknou

Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone's secrets were exposed. In an email sent to customers on November 3, seen by The Register, US-based developer mSeven Software said it launched an investigation after discovering something amiss with its password management application. "mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application," the company wrote. "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist." The company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information. Its advice to customers, however, suggests that they should take this seriously. "Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email continued. "This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys." For anyone with hundreds of passwords stored in mSecure, that's potentially hours of work. And without knowing what happened, customers have no way of telling which credentials they actually need to replace. The warning has understandably gone down poorly with customers, who have taken to mSecure's support forum demanding answers. "Please provide more context to your email below advising there has been a security breach," one customer wrote. "It is not acceptable to offer the vague advice 'take steps'. Please state what remedial action is required, and what data was compromised." Others are wondering whether they're expected to spend the next several days changing every password they've ever saved. "I have over 800 passwords in mSecure, is the email saying I need to change all of them!" another customer asked. A separate user, who said they had more than 500 passwords stored in the application, questioned whether the warning applied to every two-factor authentication method and passkey associated with their accounts, or just those used to access mSecure itself. The confusion has also spilled onto Reddit, where customers have shared copies of the vague notification and questioned what might have happened. mSeven has yet to respond to The Register's questions, leaving customers to guess whether their data has actually been compromised or the company is simply being cautious. That's not exactly reassuring from a business whose entire purpose is keeping other people's secrets safe. The company's email concludes: "We regret any inconvenience that this may cause." For customers contemplating hundreds of password resets, "inconvenience" may be putting it mildly. ®

In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.

Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?

UEFI bootkit refresher

Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.

Read full article

Comments

Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Projekt openSUSE dnes, 3. listopadu 2026, oficiálně vydal openSUSE Leap 16.1, novou verzi své stabilní linuxové distribuce. Novinkou je také Immutable Mode, který nahrazuje dosavadní samostatnou distribuci openSUSE Leap Micro. Podrobnosti o novém vydání najdete v oficiálním oznámení nebo v českém překladu oznámení. Instalační obrazy jsou již dostupné na get.opensuse.org. Vydání společně oslavíme v pátek ve virtuálním baru a na komunitních release parties, včetně oslavy 11. listopadu v Praze. Podrobnosti najdete na openSUSE wiki. Budeme také rádi za zpětnou vazbu v naší anketě k vydání.

Nová aplikace Zásilkovny přináší přesměrování balíků, QR profil i rychlejší ovládání. • Síť Z-Boxů se otevírá dalším přepravcům, už jsou celkem čtyři. • Zásilkovna zveřejnila termíny pro vánoční doručování a počítá i se sobotami.

Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side codeRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]

Bylo oznámeno vydání Fedora Linuxu 45. Ve finální verzi vychází šest oficiálních edic: Fedora Workstation a Fedora KDE Plasma Desktop pro desktopové, Fedora Server pro serverové, Fedora Cloud pro cloudové nasazení, Fedora CoreOS pro ty, kteří preferují neměnné systémy a Fedora IoT pro internet věcí. Vedle nich jsou k dispozici také další atomické desktopy, spiny a laby. Podrobný přehled novinek v samostatných článcích na stránkách Fedora Magazinu: Fedora Workstation, Fedora KDE Plasma Desktop a Fedora Silverblue. Vydán byl také Fedora Asahi Remix 45 pro Apple Silicon.

Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and detection engineering to threat hunting and exposure management. [...]

Vysloužilá observatoř neřízeně zanikne v zemské atmosféře během této středy • Zvýšená sluneční aktivita způsobila neúprosné brzdění a selhala i záchranná mise • Dopadající trosky neohrozí Evropu a spadnou do tropického pásu kolem rovníku

Vědci z MIT CSAIL představili koncept 'weight-space programming' a názorně předvedli, že pokročilé jazykové modely SI dokážou přímo číst a upravovat váhy neuronových sítí. Studie ukazuje, že modely nejen dokážou identifikovat účel sítí z pouhého nahlédnutí do jejich číselných vah, ale mohou i cíleně opravovat chyby a nedostatky, například GPT-6 Astra se změnou pouhých 0,016% vah open-weight modelu Qwen3.5-0.8B podařilo odstranit jeho chyby v uvažování a zvýšit úspěšnost v matematických úlohách z 7,9% na 48,1% (benchmark MATH-500). Autoři předpokládají, že se mění samotný způsob trénování neuronových sítí, nově by tuto práci mohly z části převzít také jazykové modely, které o vahách cíleně uvažují a samy je i upravují.