Visit Mixture of Experts podcast page to get more AI content → https://ibm.biz/~AHBoMt9Qu

It's been a week that proves AI is moving faster than anyone can fully keep up with, unless you’ve got a good backhand. On episode 124 of Mixture of Experts, host Tim Hwang and co-host David Zax are joined by Bri Kopecki, Aaron Baughman, and Olivia Buzek to talk about new advances from OpenAI, new cybersecurity threats, and new tools for US Open fans from IBM.

First, OpenAI introduced GPT-6 Astra as the company's most intelligent and aligned model yet, reaching state-of-the-art results across computer use, software engineering, cybersecurity and science. Not missing a beat, the company dropped a second bit of news: an internal model produced a proof related to the 3-D Navier-Stokes equation, resolving one of mathematics' most famous unsolved problems. We dig into both the breakthrough and the conversation around the use of AI to solve these seemingly impossible problems.

Then, IBM and the USTA unveiled new AI-powered fan features for the 2026 US Open, including a Serve Quality metric and personalized stats, designed to bring fans closer to the action than ever.

Finally, we talk WeWorm, an AI-assisted exploit by California security firm built as a proof-of-concept self-spreading worm, capable of hijacking WeChat accounts before a victim even had a chance to answer a phone call. It's a sobering demonstration of what AI-assisted offensive security now looks like.

All that and more on Mixture of Experts.

00:00 – Intro
0:54 - OpenAI talks Navier-Stokes and GPT-6 Astra
14:30 - IBM's AI analysis at the US Open
22:55 - What WeWorm means for exploits

"The opinions expressed in this podcast are solely those of the participants and do not necessarily reflect the views of IBM or any other organization or entity. AI tools may be used to transcribe this episode and support selected stages of the production process. All AI-assisted content is reviewed by the production team before publication."

AI news moves fast. Sign up for a monthly newsletter for AI updates from IBM → https://ibm.biz/~Uc9A8pkUe
#aimodel #openai #navier-stokes

AI was used in the creation of the transcript and metadata for this video.

Rocket.Chat is used in more than 150 countries, where many organizations rely on its end-to-end encryption (E2EE) for security-critical communication. This talk presents the first comprehensive analysis of Rocket.Chat's E2EE as deployed in real systems. By combining automated symbolic analysis with in-depth manual inspection of the implementation, we identify practical attacks that break both confidentiality and integrity.

Our most severe finding is a practical key-recovery attack.
An attacker with access to encrypted user backups can recover private keys and all derived group keys in twelve days under realistic assumptions. We validate this attack with practical proof-of-concept exploits. This results from weak offline-attack resistance combined with a biased, low-entropy password generator used to encrypt key backups. At the time of reporting, any server operating under a malicious-server threat model could execute the attack.

We also uncover structural failures in the platform's key-rotation workflow. Although E2EE passwords and a master key were rotated, the group keys protecting message content were never replaced. Clients continued to accept and redistribute compromised group keys, which were then reused to encrypt new messages and decrypt past ones. A single key recovery therefore enabled expanding and persistent compromise across group communication.

Manual analysis further revealed integrity failures, including ciphertext forgery made possible by unauthenticated AES-CBC encryption.

Beyond the technical flaws, we also reconstruct how this fragile design emerged by examining public development discussions and historical commits. This OSINT analysis explains why several fundamental E2EE principles were never integrated and how long-term structural risks accumulated.

The most severe vulnerabilities, including key recovery and broken key rotation, were fixed within six months of disclosure, and remaining integrity issues were patched after extended coordination. Attendees will learn how to analyze real-world E2EE systems, detect specification-implementation gaps, and replace password-based architectures with modern best practices.

Hayato Kimura | Researcher, National Institute of Information and Communications Technology & The University of Osaka
Ryoma Ito | Senior Researcher, National Institute of Information and Communications Technology
Kazuhiko Minematsu | Research Fellow, NEC Corporation
Takanori Isobe | Professor, The University of Osaka

https://blackhat.com/asia-26/briefings/schedule/?#payload-compromised-full-key-recovery-in-rocketchat-e2ee-50105

Imaan Rana and Mayank Prasad present approaches for bringing native approximate nearest-neighbor (ANN) vector indexing to MySQL InnoDB. They compare Google’s production tree-based implementation with Oracle’s proof of concept, covering design tradeoffs, SQL syntax, storage, search behavior, and opportunities for community feedback.