Colossal Biosciences Hatches Chicks From Artificial Eggs. Scientists Aren’t Impressed

Colossal Biosciences just announced a milestone. The Dallas biotech firm hatched 26 live chickens from a 3D-printed lattice that mimics an eggshell. No hen. No natural shell for most of development. The chicks now range from days to months old. They look ordinary. Yet this step feeds directly into the company’s larger ambition: bringing back extinct giants like the South Island moa.

Ben Lamm, Colossal’s CEO, framed the work as practical engineering. “We wanted to build something that nature has done a pretty good job of developing and make it better and scalable and even more efficient,” he said, according to Fortune. The firm had already produced mice with mammoth-like hair and wolf pups modeled on dire wolves. Now it turns to birds. The moa, a flightless New Zealand species that stood over 3 meters tall, laid eggs roughly 80 times the volume of a chicken’s. No living bird could incubate one. An artificial system might.

The Technical Claim

Colossal’s platform uses a printed lattice structure with a silicone membrane. Scientists transferred contents from fertilized chicken eggs into these constructs, added calcium, and incubated them. Real-time imaging tracked embryo growth. The system supplies oxygen without supplemental gas in later stages. Twenty-six chicks emerged healthy. The company calls it the first full end-to-end success from a fully artificial construct, per its press release.

But independent researchers push back. Vincent Lynch, an evolutionary biologist at the University at Buffalo, examined the details. “They might be able to use this technology to help them make a genetically modified bird, but that’s just a genetically modified bird. It’s not a moa,” he told the Associated Press. He added a sharper distinction: “That’s not an artificial egg because you’ve poured in all the other parts that make it an egg. It’s an artificial eggshell.”

Lynch’s critique lands on substance. Natural eggs contain temporary organs that nourish the embryo, manage waste and stabilize development. Colossal’s version supplies the shell and gas exchange but relies on the original egg’s internal material. Earlier experiments decades ago used plastic films or sacks to create transparent shells for developmental studies. Nicola Hemmings, who researches bird reproductive biology at the University of Sheffield, noted the precedent. “Producing a chick from an artificial vessel is not necessarily new,” she said.

Yet Colossal insists the advance matters. The lattice scales. It avoids the physical limits of surrogate birds. For the dodo or moa, whose genomes the company has sequenced and compared to living relatives, this platform could one day support edited primordial germ cells grown in chicken hosts before transfer. Recent coverage in Nature captured the caution from the field. Researchers there urged restraint even as they acknowledged potential conservation uses for endangered species.

Bioethicist Arthur Caplan at New York University’s Grossman School of Medicine raised a different question. “The big challenge is, what environment is this animal going to live in?” The moa vanished centuries ago. New Zealand’s forests have changed. Predators, plants and climate differ. Releasing approximations of extinct megafauna carries ecological risk no lab test can fully predict.

Hemmings offered a blunter priority. “My personal interests lie more in preserving what we’ve got than trying to bring back what is already gone.” Her stance echoes a divide in conservation biology. Some see de-extinction as distraction. Others view the underlying tools—gene editing, synthetic gestation, high-fidelity genomes—as applicable to species still hanging on. Ben Novak at Revive & Restore, a nonprofit focused on passenger pigeon revival, told Nature the artificial egg could find immediate takers in zoos and breeding programs.

Colossal has moved fast. It raised hundreds of millions in venture capital. Its dire wolf pups, announced in 2025, drew both wonder and accusations of overstatement; critics noted the animals were genetically edited gray wolves, not true clones of the extinct Pleistocene predator. The chick announcement follows the same pattern. Public excitement spikes. Scientific skepticism follows.

And the skepticism has merit. Full de-extinction demands more than a bigger printed shell. It requires accurate reconstruction of ancient DNA, functional expression of extinct traits, viable germline transmission and, eventually, self-sustaining populations. Each layer compounds technical difficulty and ethical weight. So far Colossal has demonstrated edited mammals and now scalable avian incubation. Impressive. Not resurrection.

Still, the engineering deserves credit. Real-time imaging inside an artificial construct offers data hard to gather in opaque natural eggs. Scalability could lower costs for conservation breeding of rare cranes or parrots whose eggs suffer high mortality. If the platform works at moa scale without supplemental oxygen, as claimed, it removes one physical barrier that once seemed absolute.

Recent reporting adds texture. Gizmodo described the shell as titanium and bioengineered silicone in some components. Dallas Innovates highlighted the company’s local roots and the shell-less incubation platform’s potential for giant bird revival. NPR explored the dodo and moa targets directly, noting Colossal already prepares larger artificial eggs for those species.

Public reaction on X mixed awe with Jurassic Park jokes. One post asked whether society stands “on the verge of real Jurassic Park-style de-extinction.” Another summarized the 26 chicks as proof of concept but reminded followers that true moa revival remains distant. The conversation reveals the tension. Audiences love the spectacle. Experts fixate on the gaps.

Colossal’s leadership shows no signs of slowing. Lamm has said the firm did not want to wait until moa-ready before tackling birth engineering. That choice makes sense from a product development view. Solve the small problems first. Iterate. Scale. Yet it invites criticism that announcements outpace substantive leaps toward genuine revival.

The chicks themselves offer the clearest data point. They hatched. They live. The system functions. Whether that system can ever produce a functional proxy for a 3-meter flightless bird with an entirely different developmental timeline is another matter. Scientists will watch the next iterations closely. So will investors. And so will anyone who remembers the original warning from a 1993 film: life finds a way. The question now is whether humanity should help it do so.

One fact remains undisputed. The technology Colossal demonstrated this week did not exist in public view a year ago. Its refinement will shape debates over conservation priorities, synthetic biology limits and the very definition of extinction for years ahead. Short of creating a moa, the firm has already altered the conversation.

from WebProNews https://ift.tt/NQYAyCE

CISA Contractor’s GitHub Blunder Exposes AWS GovCloud Keys and Internal Blueprints

A contractor working for the Cybersecurity and Infrastructure Security Agency left highly privileged credentials to AWS GovCloud accounts sitting in plain sight on a public GitHub repository. The exposure went on for months. Security researchers who found it called the incident one of the worst government leaks they had seen.

The repository, named Private-CISA, contained far more than stray keys. It held plaintext passwords for dozens of internal CISA systems. Files detailed exactly how the agency builds, tests and deploys its software. Logs, tokens and other sensitive assets sat alongside them. And the administrative credentials to three AWS GovCloud servers? They stayed valid for two full days after researchers alerted authorities.

Guillaume Valadon, a researcher at GitGuardian, spotted the material on May 15. He reached out to the repository owner. No response came. So he contacted KrebsOnSecurity. The account and its contents vanished from public view soon after. KrebsOnSecurity reported the full details the following Monday.

The contractor worked for Nightwing, a government contractor based in Dulles, Virginia. He used an email address tied to CISA as well as a personal one. The GitHub account itself dated back to September 2018. The problematic repository launched on November 13, 2025. Commits arrived regularly from that point forward. This was no one-off upload. It served as a working scratchpad. A way to move files between a work laptop and a home computer.

That habit produced staggering oversights. The repository disabled GitHub’s built-in feature meant to block secrets from public repos. Passwords appeared in a CSV file with names as obvious as each platform followed by the current year. Backups lived directly in the Git history. Valadon could hardly believe what he saw. “Passwords stored in plain text in a csv, backups in git, explicit commands to disable GitHub secrets detection feature… I honestly believed that it was all fake before analyzing the content deeper. This is indeed the worst leak that I’ve witnessed in my career.”

Philippe Caturegli, founder of Seralys, examined the material at the request of KrebsOnSecurity. He confirmed the AWS keys worked. They granted administrative access to three separate GovCloud accounts. Those environments exist specifically to hold sensitive government data under strict controls. “That would be a prime place to move laterally,” Caturegli said. He pictured an attacker slipping a backdoor into software packages. Every new build would spread the compromise across CISA systems.

Caturegli also pieced together the contractor’s likely routine. Regular commits stretching back to late 2025 suggested routine synchronization between devices. “This would be an embarrassing leak for any company, but it’s even more so in this case because it’s CISA.”

The agency itself operates under strain. It has lost nearly a third of its workforce since the start of the second Trump administration. Early retirements, buyouts and resignations have left it running with reduced staff and budget. A CISA spokesperson acknowledged the exposure. “Currently, there is no indication that any sensitive data was compromised as a result of this incident,” the statement read. “While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.” The agency directed further questions about the contractor to Nightwing. The company declined to comment and pointed back to CISA.

News of the breach spread quickly on X. Multiple accounts shared the KrebsOnSecurity story within hours of publication. Some posts highlighted the continued validity of the keys. Others noted the plaintext passwords and the artifactory credentials that could have let an intruder poison CISA’s internal code repository.

This event arrives against a backdrop of repeated cloud credential exposures. Researchers have documented thousands of similar mistakes across private industry and government alike. Yet the CISA case stands out. The agency exists to guide others on proper security practices. Its own contractor handed adversaries a roadmap to sensitive federal systems.

The files went beyond credentials. They mapped internal processes in detail. An attacker could study deployment pipelines. Identify weak points in the build chain. Craft attacks that blend into normal CISA operations. Lateral movement becomes simpler when you understand the target’s own logic.

AWS GovCloud adds another dimension. The platform enforces stricter compliance than standard AWS regions. Federal customers rely on its isolation. Administrative keys there open doors that should stay bolted. The fact those keys survived 48 hours after notification raises fresh questions about detection and response speed.

GitGuardian’s discovery method relied on routine scanning of public repositories for secrets. Many organizations now run similar tools. The fact that a CISA-linked repo escaped notice for months shows gaps remain. Contractors, personal devices and synchronization habits create persistent risks.

Security teams have long warned about these patterns. Plaintext storage. Disabled guardrails. Reuse of repositories for convenience. Each element appears in countless breach reports. Their convergence inside a federal cybersecurity agency carries extra sting.

CISA says it is adding safeguards. Rotation of the exposed credentials happened. Investigations continue. Yet the episode underscores a truth many inside government already know. Human error still defeats the most sophisticated technical controls. Especially when budgets shrink and experienced staff depart.

Industry observers will watch closely for follow-up disclosures. Any evidence of actual exploitation could shift this story from embarrassing lapse to active compromise. For now, the public record stops at the exposed repository and the swift takedown once outsiders rang the alarm.

Even without confirmed breach of sensitive information, the damage sits in lost trust. Federal partners and private sector organizations look to CISA for leadership. A contractor’s personal GitHub habits just delivered a visible reminder that vigilance must extend to every endpoint. Every sync. Every commit.

from WebProNews https://ift.tt/k0aGXiN

Mac Infostealers Turn to AppleScript and Trusted Brands as Attacks Grow Sharper

Security researchers have uncovered a new macOS infostealer that slips past defenses by pretending to be routine Apple security software. Called SHub Reaper, the malware represents the latest evolution in a two-year campaign built around the SHub Stealer family. It no longer relies on crude fake installers or obvious Terminal tricks. Instead it weaves itself into familiar system processes. And it does so with striking precision.

The discovery comes at a moment when macOS threats have accelerated. Reports from the past several months show infostealers expanding from Windows roots into Apple systems. Microsoft detailed how such campaigns now use social engineering and native tool abuse across platforms. Microsoft’s analysis from early May traces similar ClickFix-style tactics that Reaper builds upon. The pattern is clear. Attackers study Apple’s latest protections and adjust quickly.

Reaper starts its work on malicious websites that quietly profile visitors. These pages gather system details, WebGL fingerprints, VPN usage signs, browser extensions and hints of virtual machines or analysis environments. They scan for installed password managers such as 1Password, Bitwarden and LastPass. Crypto wallet extensions like MetaMask and Phantom draw special interest. Anti-analysis tricks follow. The sites interfere with developer tools, capture F12 keystrokes and trigger endless debugger loops. Some even switch to a Russian “Access Denied” page once they smell trouble.

Once a target engages, the delivery shifts to the applescript:// URL scheme. This opens Apple’s Script Editor and prompts the user to click Run. Here the deception sharpens. A fake XProtectRemediator security update window appears. Behind it the malicious AppleScript executes. Attackers pad the script with fake installer text and ASCII art. The dangerous commands stay hidden below the visible edge of the window. Victims see what looks like a normal Apple process. They rarely suspect anything.

But the theft runs deep. Reaper targets browsers including Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc and Orion. It grabs data from crypto wallets such as Exodus, Atomic Wallet, Ledger Live, Electrum and Trezor Suite. macOS Keychain entries, Telegram sessions, browser extensions and developer files all fall into its net. An AMOS-style document stealer adds another layer. It combs Desktop and Documents folders for Word files, spreadsheets, JSON data, wallet backups and remote desktop configurations. Files larger than certain thresholds are skipped. PNG images over 6 MB stay behind. The total haul caps at 150 MB before compression and chunked upload to command-and-control servers.

Wallet applications face direct sabotage. The malware kills active wallet processes, swaps their internal app.asar resources with attacker-controlled versions, removes quarantine attributes and applies ad hoc code signing. The modified apps keep running. Funds can vanish later. After data collection the victim sees a fake compatibility error. Suspicion fades. The password prompt that appeared earlier has already delivered admin credentials.

Persistence marks Reaper’s biggest advance over prior SHub variants. The malware drops a LaunchAgent disguised inside a fake GoogleUpdate.app bundle. It registers as com.google.keystone.agent.plist. This mimics Google’s legitimate Keystone update service and runs every 60 seconds. From there remote servers feed new commands, execute additional payloads under the current user and clean up temporary files. What began as a one-time theft now becomes a lasting foothold. Future modules or remote access become possible.

SentinelOne first detailed these tactics in its report on the campaign. The firm noted how Reaper expands on earlier SHub methods that used fake installers and ClickFix social engineering. Those older attacks pushed victims to paste commands into Terminal. Apple responded in macOS Tahoe 26.4 with new warnings for suspicious paste operations. Reaper sidesteps that by routing through Script Editor. Different stages rotate disguises. Early lures mimic WeChat or Miro installers from typo-squatted domains that resemble Microsoft infrastructure. Later stages pose as Apple updates. Persistence hides in Google-branded directories. The malware borrows trust from three major technology brands in one chain.

This approach exploits how users and security tools perceive normal activity. AppleScript and shell scripts blend into everyday macOS behavior. Traditional file-based scanning like XProtect struggles to flag them. Monitoring for unusual osascript processes, unexpected LaunchAgents or Script Editor network traffic offers better signals. Yet many organizations and home users lack such visibility. The result is a stealthier threat that scales.

Broader industry data supports the trend. Jamf’s Security 360 report for 2026 shows Trojan detections on Macs jumping sharply. Infostealers now dominate many threat lists. Related families such as Atomic Stealer, also known as AMOS, DigitStealer and MacSync continue to evolve. A 9to5Mac report from April described additional undetected macOS samples that evade major antivirus engines. The shift toward Go, Rust and modular designs makes cross-platform operation easier. Attackers no longer treat macOS as an afterthought.

Microsoft has warned repeatedly about this expansion. Its February analysis highlighted campaigns delivering DigitStealer, MacSync and AMOS through malvertising, fake DMGs and ClickFix prompts. The firm urged monitoring for suspicious Terminal flows involving curl, Base64 decoding, osascript or JavaScript for Automation. Reaper fits neatly into that pattern while adding its own refinements. The malware’s use of fingerprinting and anti-analysis shows growing operational maturity.

Apple itself has tightened controls. Gatekeeper, notarization requirements and the Tahoe 26.4 Terminal warnings all aim to raise the bar. Yet social engineering remains the weak point. Users still click Run in Script Editor when prompted by what looks like an urgent security update. They enter passwords when asked. Fake error messages reassure them. The human element gives these campaigns their reach.

Experts advise sticking to official download sources. Avoid unsolicited links, ad-driven installer pages and claims that a manual security fix requires opening Script Editor. Check URLs carefully. Watch for unexpected password prompts paired with vague errors. Advanced users can review LaunchAgents in their Library folders and monitor for suspicious AppleScript activity. Simple habits still matter most.

Reaper does not rewrite the rules of macOS security. It exploits existing gaps with care and patience. Its success signals that threat actors now invest time studying Apple’s updates and user workflows. They test anti-analysis measures. They refine persistence. They rotate brands to stay under the radar. The days when macOS malware meant obvious Trojans appear to be fading. A more calculated, script-driven style is taking hold.

Security teams and individual users face a choice. They can treat every unexpected update prompt as suspect. Or they can hope their defenses catch what file scanners miss. The evidence from recent months suggests the first option carries less risk. Because once Reaper or its successors gain persistence, the data they seek is already on its way out the door.

from WebProNews https://ift.tt/cRiMCn3

Post-SaaS Reckoning: How AI Shockwaves Reshape Software Valuations and Debt Markets

Software stocks cratered early this year. More than one trillion dollars in market value disappeared in a matter of weeks. Traders coined a blunt phrase for the bloodbath. They called it the SaaS apocalypse.

Yet the dust has begun to settle. Secondary loan prices have climbed back. Repricing activity for certain borrowers has resumed. And industry voices now describe a more measured transition. The market, according to a recent Yahoo Finance report, has entered a post-SaaS-pocalypse thaw. Not every credit benefits. But the selective recovery reveals how investors now separate durable platforms from vulnerable point solutions.

The trouble started in February. Advances in AI tools, particularly from Anthropic, triggered a sharp sell-off. Free plug-ins promised to automate business processes that once required dedicated software licenses. Enterprise buyers paused. Public valuations plunged. Hundreds of billions vanished almost overnight. The North American Tech Software Index dropped roughly 30 percent from its mid-September peak, PwC analysts noted in late February.

Private markets felt the aftershocks too. Private equity vintages from 2021 and 2022 faced markdowns. Limited partners demanded clearer proof of lasting value. Some pulled capital from private credit funds worried about software exposure. The term SaaS apocalypse spread from trading floors to boardrooms.

But the narrative was always too simple. AI agents excel at processing information. They still need reliable access to decades of mission-critical data. “The reality is more nuanced than either extreme,” wrote Jon Markham in Forbes. “AI agents are only as useful as the data they can access and work with. Think of it this way: an AI assistant is brilliant at processing information, but it still needs a filing cabinet.”

Those filing cabinets sit inside established enterprise systems. Moving that data proves expensive, slow, and risky. Companies therefore prefer to bring AI capabilities to where the data already lives. The result? Incumbents with deep workflow integration and proprietary context gain rather than lose.

Steve Banker explored this dynamic further in the same Forbes piece. He initially saw workflow applications at risk. AI-assisted development lets teams prototype in hours instead of months. The buy-versus-build equation appeared to tilt. Yet hidden costs quickly surface. Architecture, reliability, integration, compliance, and long-term maintenance consume the bulk of effort. “Where most internal builds fail is not in version one, it’s everything that comes after,” Chuck Fuerst told Banker.

Maintenance demands ongoing work on evolving APIs, regulatory shifts, data privacy rules, and edge cases. Software vendors maintain dedicated teams for exactly these tasks. Enterprises hesitate to bet their core operations on homemade tools that may break at scale. They extend existing platforms instead.

This nuance explains why the panic has cooled. ServiceNow executives declared the worst behind them. The company identified a $30 billion opportunity in AI-driven workflows. Josh Bersin highlighted the claim in early May analysis. Sentiment improved. Loan markets reflected the shift.

By mid-May, the leveraged loan index weighted average bid recovered to 95.40. That matched mid-February levels and erased a 123-basis-point drop from the early March low. Repricing volume jumped. Seven speculative-grade borrowers filed spread-lowering amendments on May 11 alone. The month-to-date total reached $17.2 billion. It surpassed the combined activity from February, March, and April.

Yet the thaw remains uneven. Double-B rated borrowers dominate. Their share of loans priced at par or above climbed back to 76 percent for double-B-minus credits by May 11. That matches January peaks. B-plus and B-flat names also gained ground. Single-B credits and those with heavy tech or AI-disruption exposure lag. Sponsor-backed single-B borrowers stay largely on the sidelines.

Investors now draw sharper lines. They reward companies with sticky data moats, regulatory entrenchment, and workflow gravity. They penalize seat-based tools that AI agents can replicate. PwC consultants advise private equity teams to focus diligence on defensibility beyond code. Domain depth, proprietary context, and mission-critical ties to financial or regulatory outcomes matter most.

Pricing models face pressure too. Traditional per-seat arrangements lose appeal when one AI agent performs the work of three analysts. Forward-looking firms experiment with outcome-based or value-based fees. Gross revenue retention gains favor over net figures as a truer test of durability.

Private equity dealmakers have grown more selective. Software still represents an attractive asset class. AI simply accelerates the gap between winners and laggards. Vertical solutions in healthcare, financial services, and cybersecurity often hold up better. Complex integration requirements and compliance burdens create natural barriers.

Free cash flow at the strongest SaaS businesses sits at record levels. EBITDA margins have rebounded since 2022. These fundamentals support selective buying. But 2021-era multiples no longer apply. Residual value in 2036 depends on how well companies embed AI into their core platforms rather than bolt it on.

The market has moved past the initial shock. Panic selling gave way to disciplined analysis. Companies that own the data layer and the workflow layer stand to benefit as AI agents proliferate. Those offering narrow, easily automated features face continued pressure.

And the repricing window? It favors the prepared. Higher-rated credits with limited disruption risk now access cheaper debt. Others wait. The post-apocalypse environment rewards clarity of strategy over hype. Software hasn’t died. Its economics have simply grown more demanding.

Buyers and lenders alike now ask tougher questions. Does this system embed itself so deeply that replacement costs dwarf any AI alternative? Can the vendor demonstrate measurable outcome improvements rather than feature lists? Answers separate survivors from casualties.

from WebProNews https://ift.tt/B23FCUV

First Proven COVID Prevention Pill Emerges Years After Pandemic Peak

Years after vaccines and treatments reshaped the fight against COVID-19, a simple pill has cleared a barrier that long seemed out of reach. For the first time, an oral antiviral has shown it can stop the virus from taking hold in people exposed at home. The advance comes from ensitrelvir. Developed by Japan’s Shionogi, the drug just earned fresh validation in a major trial whose results appeared this week.

The findings land at a curious moment. COVID circulates at lower levels than in 2020 or 2021. Yet it still sends vulnerable people to hospitals. Older adults. Those with weakened immune systems. Families caring for high-risk relatives. For them, a reliable preventive pill could change daily decisions about exposure. No more waiting to see what happens after contact.

The trial, known as SCORPIO-PEP, enrolled more than 2,000 household contacts who tested negative after a family member developed symptoms. Participants started a five-day course of ensitrelvir or placebo within 72 hours. By day 10, just 2.9 percent of those on the drug developed symptomatic, confirmed COVID-19. The placebo group saw 9 percent fall ill. That works out to a 67 percent reduction in risk, according to data published in the New England Journal of Medicine.

Among people with at least one risk factor for severe disease — about 37 percent of the study population — the protection looked even stronger. Risk dropped 76 percent. No one in either arm required hospitalization. Side effects stayed comparable to placebo. Notably absent were the dysgeusia complaints often reported with Paxlovid. And, as Nature reported on the results, confirmed infections of any kind fell from 21.5 percent in the placebo group to 14 percent with ensitrelvir.

Frederick G. Hayden, an emeritus professor at the University of Virginia School of Medicine and co-author of the study, didn’t mince words. “This is the first clinical trial of an oral antiviral drug to show significant protection against COVID-19,” he said. Hayden added that if approved by regulators, the drug “would be an important addition to current preventive strategies.” As a 78-year-old with comorbidities himself, he went further. He would use it after a known exposure.

The contrast with earlier efforts stands out. Pfizer’s nirmatrelvir, the main component in Paxlovid, targets the same viral main protease enzyme. Yet in household prevention trials it fell short of statistical significance, cutting infections by roughly 30 percent at best. Paxlovid excels at treating early infection in high-risk patients. Prevention proved trickier. Ensitrelvir appears to have cleared that bar. Japan already approved it for post-exposure use in March based on these data. The pill, sold there as Xocova, had previously won approval as a treatment in Japan and Singapore.

But. Success here doesn’t erase broader challenges. The trial focused on household contacts. Real-world use would require rapid testing and prompt prescribing within that 72-hour window. Access, cost, and awareness will determine whether the drug reaches those who need it most. And the pandemic has moved on. Many healthy adults now view COVID as manageable. For transplant patients on immunosuppressants or elderly residents in care facilities, the calculation differs.

Earlier coverage captured the uncertainty before these results. Gizmodo noted in its reporting that no pill had yet proven preventive power. Researchers had hints from animal studies. Human data remained elusive until now. The new trial closes that gap. Shionogi submitted the prevention indication to the FDA last year. A decision could come as soon as June 16, 2026.

Other antivirals continue to evolve the options. Paxlovid retains strong real-world evidence for reducing hospitalization and death in high-risk outpatients. A large 2025 analysis of more than 700,000 patients found it lowered those risks by 39 percent and 61 percent respectively, even among vaccinated individuals. Yet its drug interactions complicate use for some patients. Molnupiravir offers an alternative but with a narrower role. Remdesivir requires infusion. An effective oral preventive fills a distinct niche.

Experts caution against expecting miracles. Viral evolution continues. Future variants could test the drug’s potency. Resistance remains a theoretical concern for any protease inhibitor, though trial data so far show no red flags. Long-term studies will track rarer side effects once wider use begins. Still, the absence of increased adverse events in SCORPIO-PEP offers reassurance.

So what changes? For clinicians treating high-risk families, this data provides a concrete tool. A grandmother lives with her working-age children. One develops symptoms. Rather than isolate or hope for the best, the household can start ensitrelvir quickly. Protection isn’t absolute. Two to three percent still broke through. But the odds shift noticeably. That matters when stakes run high.

The timing feels both late and timely. Late because the acute emergency has passed. Timely because seasonal waves persist. Hospitals still see surges. And the next coronavirus threat may not wait decades. Broad-spectrum antivirals that work across variants or even related viruses could prove valuable insurance. Ensitrelvir hits a conserved protease target. That mechanism fuels optimism it might hold up.

Regulatory pathways in the United States will test how regulators weigh prevention data from a post-peak era. The FDA has maintained emergency use authorizations and approvals for treatments. Extending that to prevention requires clear benefit in the current risk environment. Japan’s decision to approve first reflects its experience with the drug as therapy and perhaps greater openness to incremental gains.

Researchers involved in the trial emphasize integration with existing tools. Vaccination remains foundational. Masks and ventilation still help in high-risk settings. Yet oral post-exposure prophylaxis adds a layer that doesn’t depend on behavior change alone. Take the pill. Reduce the chance of illness. Simple in concept. Complex in rollout.

Frederick Hayden and his colleagues designed SCORPIO-PEP to answer a precise question. Can an oral antiviral prevent symptomatic disease after close exposure? The answer arrived clearly. Positive. Statistically robust. Reproducible across subgroups. The publication in the New England Journal of Medicine lends weight. Independent experts will scrutinize the full dataset. Early reactions on platforms like X highlight both excitement and lingering skepticism about any new COVID intervention.

One thread runs through the coverage. This isn’t about returning to 2020. It’s about protecting the shrinking but still real population for whom the virus poses outsized danger. Care home residents. Cancer patients in treatment. People with long COVID histories wary of reinfection. For them, an additional option counts.

Shionogi plans further discussions with global regulators. Real-world evidence studies may follow approval. Pricing and distribution strategies will influence uptake. If the pill reaches pharmacies at reasonable cost with straightforward prescribing, adoption could follow. If entangled in insurance hurdles or limited to specialists, impact narrows.

The trial also tracked secondary outcomes. Lower viral transmission hints at possible community benefits. Fewer breakthrough cases mean less spread within households. That ripple effect could amplify value. Yet the primary endpoint focused on individual protection. That focus keeps expectations grounded.

Look back to the original Gizmodo piece from years earlier. It framed the quest for a preventive pill as unfinished business. Today that business has advanced. Not every exposed person will need or want the drug. But for those who do, evidence now supports a choice that didn’t exist before. A five-day course. Once daily. Oral. Effective.

Questions remain. Durability of protection beyond the trial period. Performance against currently circulating strains. Cost-effectiveness calculations in low-incidence periods. Interactions with common medications. These will occupy researchers and policymakers next. The foundational result, however, stands. An oral antiviral can prevent COVID-19 after exposure. The door has opened.

And with it comes renewed attention to antiviral development more broadly. Other candidates target different viral proteins. Some aim for pan-coronavirus activity. The success of ensitrelvir could spur investment. Or it could highlight how difficult true breakthroughs remain. Either way, the data mark a milestone. One worth recognizing for what it delivers today rather than what it might have achieved in 2021.

High-risk individuals and their doctors now have trial results to discuss. Regulators have clear efficacy numbers to review. The rest of us can note the progress. A pill that prevents. Finally.

from WebProNews https://ift.tt/r3uqbep

Canadian Privacy Clash: VPN Pioneer Windscribe and Signal Draw a Line Against Surveillance Bill

Windscribe pays a lot in taxes to Ottawa. The Toronto-based VPN provider built its business on a strict no-logs policy that has withstood court tests. Now that policy stands in direct conflict with proposed federal legislation. So the company says it will move its headquarters if the law passes unchanged.

Signal reached the same conclusion first. The encrypted messaging service, which prides itself on end-to-end encryption that even its own engineers cannot break, warned it would exit the Canadian market rather than weaken its core protections. Windscribe quickly echoed that stance. The two companies, though different in scale and focus, have drawn a sharp boundary.

At issue is Bill C-22, introduced in March 2026 and now under committee review. The legislation, formally titled the Lawful Access Act, would require telecoms, internet firms and other electronic service providers to retain user metadata for up to a year. It would also compel companies to make technical changes enabling police and intelligence agencies to access data more readily. The Globe and Mail first reported Signal’s position after Vice President of Strategy and Global Affairs Udbhav Tiwari spoke plainly.

“We would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users,” Tiwari said. He added that the bill could force the introduction of vulnerabilities. “Bill C-22 could potentially allow hackers to exploit these very vulnerabilities engineered into electronic systems, with private messaging services serving as an ideal target for foreign adversaries.”

End-to-end encryption, he noted, cannot coexist with exceptional access. Any route to it creates risk. Provisions that deliberately engineer weaknesses into systems like Signal represent a grave threat to privacy everywhere.

Windscribe’s reaction came via X. The company stated it would not lag far behind. “In its current state, VPNs would almost certainly require us to log identifying user data,” the post read. Then came the sharper language. “Signal isn’t headquartered in Canada so they can just shut off Canadian servers, but our HQ is. We pay an ungodly amount of taxes to this corrupt government, and in return they want to destroy the entire essence of our service to basically spy on its own citizens. Not happening. We’ll move HQ and take our taxes elsewhere.”

The message landed with force. And it wasn’t alone.

Public Safety Minister Gary Anandasangaree has pushed back. He described the bill as encryption-neutral during a Commons committee hearing. A spokesperson later told reporters the government is not requiring companies to install surveillance capabilities. Assertions to the contrary are false, the spokesperson said. Yet Apple, Meta and the Canadian Chamber of Commerce have issued similar warnings. So have two chairs of U.S. congressional committees.

The Electronic Frontier Foundation called the measure a repackaged version of last year’s failed Bill C-2. That earlier proposal collapsed under privacy backlash. Bill C-22 keeps the core elements with only modest adjustments. It demands metadata retention for a full year. Metadata can reveal who communicates with whom, approximate locations and timing patterns even when message content stays hidden. The bill also grants the Minister of Public Safety authority to order companies to build access mechanisms. These orders come with a condition. They must not create a systemic vulnerability. The definitions of both systemic vulnerability and encryption remain vague enough to invite broad interpretation.

“Surveillance of encrypted communications is fundamentally a systemic vulnerability,” the EFF wrote in its analysis. “When you build these systems, hackers will come.” The organization highlighted risks of expanded information sharing with foreign governments, including the United States. EFF detailed how the legislation could conscript private companies into extended government surveillance roles with insufficient safeguards.

Meta’s head of public policy in Canada, Rachel Curran, testified before the committee. She warned the bill could require companies to break, weaken or circumvent encryption or zero-knowledge architectures. It might even force installation of government spyware directly on systems. Apple has taken a comparable position. The Canadian Chamber of Commerce raised concerns about weakened encryption and deterred investment.

Two U.S. House committee chairs sent a letter to Canadian officials in early May. They expressed worry that the bill would expand surveillance powers in ways that create cross-border risks to American security and data privacy. The letter highlighted potential compulsion of American companies to build backdoors. Such changes could introduce vulnerabilities exploitable by hackers, adversaries and cybercriminals. Paubox covered the letter and its implications for cybersecurity norms.

Windscribe brings a distinct perspective. Founded in Toronto in 2016, the company maintains a lean operation focused on practical privacy tools. Its no-logs policy faced a real test in 2025 when Greek authorities sought user data. Courts found nothing to hand over. The company had logged nothing. That outcome reinforced its public claims. Relocating headquarters would allow it to preserve that architecture outside Canadian legal reach. Shutting down local operations entirely remains an option but moving the HQ offers a cleaner separation.

Observers note this isn’t the first time Canada has tried such measures. Successive governments have returned to lawful access ideas over more than a decade. Each attempt met resistance. Previous versions stalled. Bill C-22 follows a familiar pattern yet arrives amid heightened global tension over encryption. The United Kingdom’s demands on Apple for access to encrypted iCloud data led the company to withdraw a security feature rather than comply. Signal itself once warned it would exit Sweden over comparable proposals. That threat contributed to long delays in the Swedish bill.

So the threats carry weight. Companies aren’t bluffing when they say compliance would destroy their product. For Signal, any mandated access mechanism would mean ceasing to offer the service users chose. For a VPN like Windscribe, mandatory logging of identifying data would erase the anonymity that defines its value. Users seeking to protect their traffic from surveillance or censorship would lose a trusted Canadian option.

Parliamentary committee hearings continue. Amendments remain possible. Yet the government’s responses so far suggest little appetite for major changes. Officials repeatedly insist critics misunderstand the bill. They point to its aim of updating outdated laws to combat modern crime and national security threats. Digital networks have evolved. Law enforcement tools have not kept pace, ministers argue.

But the pushback grows louder. Cybersecurity experts, human rights groups and now multiple technology providers line up against the current text. Michael Geist, a leading technology law professor, compared the government’s handling to its approach on the Online News Act. Dismissal of expert concerns, he wrote, follows a troubling playbook. His detailed critique appeared on his site and Substack just days ago. Michael Geist’s analysis traces how warnings from Signal, Apple, Meta, U.S. lawmakers and cybersecurity advisors have all been waved aside.

Canadians could face a practical outcome. Secure services might simply become unavailable. Or available only in weakened form. VPN users might turn to providers based elsewhere. Messaging apps that refuse to comply could disappear from Canadian app stores or servers. The bill’s broad language on electronic service providers leaves room for regulators to include many categories later. Messaging platforms, operating systems and apps could fall under future definitions.

Windscribe’s CEO Yegor Sak has spoken before about the company’s commitment. In past statements he made clear that if Canadian jurisdiction prevents upholding the privacy policy, the company will not remain based in Canada. The recent X posts align with that long-held view.

The situation carries irony. Canada positions itself as a defender of democratic values and digital rights on the world stage. Yet this legislation risks isolating the country in technology policy. Allies to the south already voice alarm over potential spillover effects. European debates on chat control and scanning proposals face similar criticism. The pattern repeats. Governments want visibility into encrypted channels. Providers say visibility cannot come without breaking the encryption that makes those channels safe.

TechRadar first connected the Windscribe response directly to Signal’s statement in coverage published today. The article noted the company’s Greek court validation and the logistical differences between the two firms. TechRadar reported that committee hearings began May 7 and the bill remains in review.

Whether lawmakers will heed the warnings or proceed with only cosmetic tweaks will shape the outcome. History suggests confrontation. Companies have shown they will follow through. Signal delayed features or limited availability in other jurisdictions rather than compromise. Apple litigated in the UK. Windscribe, with its headquarters on the line, now signals the same resolve.

The stakes extend beyond one country. Each backdoor created anywhere weakens security everywhere. Each metadata store becomes a target. The companies say they see no path to compliance that preserves their promises. So they prepare to leave. The Canadian government insists they are mistaken. The coming weeks in committee may decide which side holds.

But one fact already stands clear. Privacy-focused services will not quietly accept mandates that undermine their foundations. Windscribe and Signal have made that plain.

from WebProNews https://ift.tt/fkjzoml

Southeast Asia’s AI Surge Collides With a Power Grid That Can’t Keep Up

Singapore once led the charge. Now its data center pause reveals the tension. Malaysia races ahead in Johor. Thailand approves billions in projects. Yet the numbers tell a harder story. Power demand from data centers in the region stands set to quadruple from 2.6 gigawatts to 10.7 gigawatts between 2025 and 2035.

Wood Mackenzie laid out that forecast in December 2025. The jump would lift data centers from 1% of peak demand today to 3-4% by 2035. That growth equals seven to 10% of all new electricity consumption across Southeast Asia over the decade. Roughly the same as Singapore’s entire current power use.

But the TechRadar analysis from earlier this year already flagged the risk. Energy constraints sit underestimated while governments chase AI investment and hyperscalers hunt cheap land and lower costs. Joe Ong, ASEAN vice president and general manager at Hitachi Vantara, put it plainly in that TechRadar article. “The artificial intelligence (AI) boom is often framed as a race for compute power, talent and investment. But beneath the surface, a different constraint is emerging; one that is far less visible and harder to scale. Energy.”

Short. Direct. And increasingly accurate.

The International Energy Agency sees Southeast Asia driving a quarter of global energy demand growth by 2035. Data centers already number more than 2,000 across Indonesia, Malaysia, Singapore, Thailand, Vietnam and the Philippines, according to Ember. A standard AI facility can draw as much electricity as 100,000 households. Cooling demands soar in the tropical heat. Grids strain. Water use draws scrutiny.

Malaysia plans to add as much as eight gigawatts of gas-fired power by 2030 to meet data center needs. Its utility, Tenaga Nasional Berhad, has fielded applications for 11,000 megawatts of data center supply. That figure equals nearly 40% of the country’s current total generation capacity. Projections show data center electricity demand there could hit 5,000 megawatts beyond 2035.

The Grid Reality Check

Yet supply timelines lag. Grid congestion grows. Intermittency of renewables clashes with the always-on requirement of AI training runs that can demand hundreds of megawatts without pause. In Indonesia, coal still generates nearly 70% of electricity. Power consumption by data centers there could quadruple by 2030, per Ember’s analysis in its recent ASEAN report.

Singapore learned early. It imposed a moratorium on new data centers years ago. Growth resumed under tighter rules that stress efficiency, low-carbon power and tighter alignment with energy planning. Land remains scarce. The island imports most of its energy. Its data centers already tripled power demand in recent years.

Malaysia and Thailand now position as alternatives. Thailand’s Board of Investment approved $21 billion in data center projects in 2025 alone. Ninety percent concentrate in the Eastern Economic Corridor. Capacity in Bangkok could surge more than 10 times between 2026 and 2030. Jakarta follows with a projected 4.4 times increase.

But the Associated Press reported in March 2026 that several nations now revisit nuclear plans shelved years ago. Malaysia revived its program specifically for data centers. Indonesia, Vietnam and others eye small modular reactors. The reason stays simple. Tech giants demand uptime measured in nines. Solar and wind alone cannot deliver that reliability at the densities AI requires.

“The Iran war has caused the price of oil to increase, raising concern on the reliability of traditional energies,” one data center executive told Fortune in late March. The piece highlighted how conflict in the Middle East adds pressure on fossil fuel supplies already stretched by AI growth.

And the heat makes everything worse. Tropical humidity forces more energy into cooling. Traditional air conditioning systems lose efficiency. Some operators explore liquid cooling or waste heat reuse. Others simply pay higher tariffs. On-grid electricity costs for data centers in the region could quadruple to $10.2 billion annually by 2035, according to Wood Mackenzie.

Local resistance builds in places. Communities question water consumption when reservoirs run low. Regulators in Johor rejected nearly 30% of recent data center applications over efficiency and grid concerns. Vietnam already saw power shortages during peak seasons even before the latest AI wave.

Nuclear Returns to the Table

The nuclear discussion marks a policy pivot. Southeast Asia never operated a commercial nuclear plant. Now five countries pursue programs tied directly to digital infrastructure goals. Power purchase agreements from Microsoft, Amazon and others provide the revenue certainty developers need. The shift reframes energy policy as industrial policy.

Global data center electricity use surged again in 2025 despite some deployment bottlenecks, the IEA noted in recent updates. AI already represents a fast-rising share of workloads. One forecast sees it driving 50% of data center capacity by 2030, up from 25% today.

Operators respond with varied strategies. Some hyperscalers source half their Malaysian power from solar and plan to expand that model. Others push for grid modernization, better interconnectivity across ASEAN and accelerated storage deployment. Yet structural gaps persist. Transmission infrastructure often cannot deliver new generation to the exact sites where data centers cluster.

Recent announcements underscore the momentum. Gorilla Technology revealed plans for a 200-megawatt AI data center campus in Thailand in early May 2026. Chinese firms such as ByteDance and Alibaba shift more AI workloads to Malaysia, drawn by available power and Nvidia hardware access. The regional data center market could exceed $30 billion by 2030.

Still, vacancy rates across Asia tightened last year even as 1.5 gigawatts of capacity came online. Demand outruns supply. Southeast Asian hubs show the fastest projected growth rates through the end of the decade.

The pattern mirrors what the United States and Europe faced earlier, only compressed. Here the baseline grids start weaker in many markets. Urbanization and industrial demand already pull hard. AI adds a new, concentrated load that behaves differently from traditional factories or homes.

Success will hinge on more than raw megawatts. Integration matters. Energy planners must coordinate with data center developers months or years in advance. Efficiency gains from better chips and optimized software help but cannot offset the sheer scale of projected growth. Data quality and governance also shape outcomes. More compute without clean inputs simply amplifies errors at higher cost.

So governments face choices. Accelerate fossil capacity and accept higher emissions. Bet on renewables and storage while managing intermittency risks. Or embrace nuclear for firm, low-carbon baseload. Many appear prepared to pursue all three in parallel.

The underestimated part, as the original TechRadar piece argued, lies in the visibility. Compute announcements make headlines. Power contracts rarely do. Yet the latter determines which ambitions survive contact with physical limits. Those limits now press hard across the region.

Ember projects that between 2% and 30% of national electricity demand could flow to data centers by 2030 in major Southeast Asian markets. The upper end applies to places like Malaysia. A third of ASEAN data centers could run on solar and wind under optimistic scenarios. The gap between hope and delivery remains wide.

Operators who solve the power equation first will capture market share. Those who treat energy as an afterthought risk delays, cost overruns and regulatory blocks. The AI race in Southeast Asia has quietly become an energy race. The winners will measure success not just in racks deployed but in electrons reliably delivered.

from WebProNews https://ift.tt/e0Khwb9

Google and SpaceX Eye Orbital AI Compute as Earth Hits Power Limits

Google has held discussions with SpaceX about launching test hardware for data centers that would orbit the Earth. The talks surfaced this week. They signal how two of technology’s most ambitious companies see the next front in artificial intelligence infrastructure moving off the planet.

The conversations center on Google’s Project Suncatcher. Announced last November, the initiative envisions clusters of solar-powered satellites loaded with the company’s Tensor Processing Units. These chips would tap uninterrupted sunlight in space. They would sidestep the massive electricity and cooling demands that now strain terrestrial grids. Google’s official blog post describes an interconnected network designed for massively scaled machine learning. Early research includes satellite constellation design, control systems, communication methods and radiation testing on TPUs.

But. The project needs rides to orbit. And SpaceX possesses the most frequent and capable launch system operating today. According to The Wall Street Journal, Google is in talks with SpaceX for a rocket-launch deal. The search company has also approached other providers including Planet. A person familiar with the matter confirmed the discussions to the Journal. The potential partnership would place the companies in an unusual spot. They would collaborate on launches while preparing to compete in the emerging market for orbital data centers.

Elon Musk has pushed this idea hard. After SpaceX acquired xAI in February he declared that advances in AI depend on large data centers requiring immense power and cooling. “Global electricity demand for AI simply cannot be met with terrestrial solutions,” Musk said. “In the long term space-based AI is obviously the only way to scale.” The Mashable report on the talks quotes him directly. Last week Anthropic agreed to use the full output of xAI’s Colossus supercluster in Memphis. The deal included interest in future orbital work. SpaceX’s acquisition of xAI ties these threads together.

SpaceX itself has filed with the FCC to deploy up to a million satellites as part of an orbital data center constellation. The company highlighted the concept in materials tied to its planned IPO. Valued potentially at $1.75 trillion the listing could come as soon as this year. A deal with Google which already owns about 6 percent of SpaceX would strengthen the pitch to investors. TechCrunch noted the timing. It reported that current orbital concepts remain far more expensive than ground-based facilities once launch and satellite construction costs enter the equation.

Yet the pressure on Earth continues to mount. Data centers already consume huge shares of local power in Virginia, Texas and elsewhere. Hyperscalers face resistance from communities worried about electricity prices, water use for cooling and environmental impact. In space solar arrays could generate power continuously without night or weather. The vacuum provides free radiative cooling. No land permits. No neighborhood hearings. Proponents argue these advantages will eventually outweigh the staggering expense of reaching orbit.

Google’s own moves reflect growing conviction. CEO Sundar Pichai told an audience in New Delhi in February that he never expected to spend time figuring out how to put data centers into space. The company plans to launch two prototype satellites in partnership with Planet by early 2027. Those spacecraft will test hardware durability in the radiation environment and gather data on orbital operations. A preprint paper accompanying the announcement outlined initial findings on TPU resilience.

Other players watch closely. Nvidia has posted jobs for orbital data-center system architects. Jeff Bezos through Blue Origin and Sam Altman of OpenAI have expressed interest in space-based compute though Altman once called the economics ridiculous. A New York Times article from January captured the shift in thinking. Leaders who once dismissed the concept now view it as perhaps the only long-term answer to AI’s appetite for energy.

Challenges stack up. Latency poses one immediate obstacle. Signals traveling to and from geostationary or low-Earth orbit introduce delays that could slow interactive AI applications. Radiation can degrade electronics over time though Google has begun testing its chips. Maintenance becomes nearly impossible once satellites launch. Any failure requires replacement from the ground. And the upfront capital costs remain savage. Starship aims to slash launch prices but even optimistic projections show orbital facilities costing multiples of equivalent terrestrial ones today.

SpaceX has acknowledged the risks. In its S-1 filing the company warned that orbital AI compute involves unproven technologies operating in a harsh environment. “These initiatives may not achieve commercial viability,” the document stated according to Reuters. Musk nevertheless calls the direction obvious. His vision extends beyond Earth orbit to lunar and Martian industrialization.

The Google-SpaceX talks come at a moment of convergence. Google needs launch capacity and expertise in satellite fleets. SpaceX needs credible customers and use cases to justify its enormous constellation plans. Starlink already provides high-bandwidth connectivity that could link orbital compute back to Earth. The combination could create a closed loop. Satellites powered by the sun. Cooled by space. Connected by laser or radio links. Trained models returned via Starlink.

Analysts question the timeline. Prototypes in 2027 will deliver proof of concept at best. Commercial scale could lie a decade away. Still the conversation has moved from science fiction to boardroom strategy. Bloomberg reported the talks on May 12 citing the Journal’s sources. Its coverage noted Google’s prior comments about exploring multiple launch partners.

So the race accelerates. Hyperscalers race for more compute. Launch providers race to drop costs. Chip designers race to harden hardware against radiation. The prize is access to effectively unlimited clean power for the next generation of AI models. Whether that power floats 500 kilometers above the planet or remains bound to sprawling facilities in the American heartland will shape technology for decades.

Google and SpaceX have not confirmed a final agreement. The discussions could still collapse over price, technical details or strategic concerns. But the fact they are happening at all reveals how seriously both organizations treat the constraints now facing AI development on Earth. Power. Cooling. Land. Regulation. In orbit many of those problems simply vanish. The new ones that replace them will test engineering ingenuity for years to come.

And if the prototypes work? If Starship delivers payloads cheaply enough? The night sky could one day hold not just stars but glowing clusters of silicon thinking at scales impossible on the ground. The talks between Google and SpaceX mark an early step toward that possibility.

from WebProNews https://ift.tt/g3Z405T

Microsoft Fires Back: Why Windows 11’s CPU Boost Isn’t Cheating

Scott Hanselman didn’t hold back. The Microsoft vice president took to X last week to confront critics head-on. Their target? A new Windows 11 feature that briefly maxes out CPU clocks to make menus snap open and apps launch faster.

Call it the Low Latency Profile. It ramps processor frequency for one to three seconds during interactive tasks. Start menu. Context menus. App launches. The result feels immediate. Tests show up to 70% faster Start menu responses and 40% quicker launches for built-in apps like Edge and Outlook. (Windows Central, May 7, 2026)

But not everyone cheered. Online voices labeled it a band-aid. A lazy shortcut. Proof that Windows had grown too bloated to run efficiently without brute force. Hanselman pushed back. Hard.

“Apple does this and y’all love it.” He followed with a sharper point. “All modern operating systems do this, including macOS and Linux. It’s not ‘cheating’; this is how modern systems make apps feel fast: they temporarily boost the CPU speed and prioritize interactive tasks to reduce latency.” (Pureinfotech, May 11, 2026)

The exchange revealed more than one executive’s frustration. It exposed a deeper tension in how users judge operating systems today. Speed. Responsiveness. That instant feel when you click. Benchmarks matter less than perception. And Windows 11 has struggled with that perception for years.

Modern interfaces carry weight. The Start menu no longer simply unhides a static list. It pulls cloud recommendations, web results, live tiles. File Explorer handles thumbnails, previews, network shares. Background services multiply. Web technologies replace lean native code. Each addition extracts a cost in latency. Milliseconds add up.

So Microsoft turned to a proven tactic. Predict high-priority user actions. Boost frequency and scheduler priority. Complete the task quickly. Drop back to idle. Smartphones do it constantly. Tap the screen. Cores wake. Clocks spike. Frame renders. Power falls away milliseconds later. Users never notice the dance. They just feel the device responds.

macOS takes the same approach. Aggressive clock boosts on clicks and animations. Quality of Service classes help the scheduler anticipate needs. Linux kernels rely on frequency governors and schedutil to wake performant cores the moment UI interaction begins. The techniques differ in detail. The goal stays identical. Reduce perceived lag.

Hanselman drove that message home. He pointed critics to macOS’s powermetrics tool. Check it yourself, he suggested. Watch the bursts. He also corrected misconceptions about Linux. “Linux achieves its responsiveness through the same methods, using the kernel scheduler, CPU frequency governors, and modern CPU boost technologies like schedutil.” The negativity, he added, sometimes came from “computer science enthusiasts without experience in computer science making assumptions based on their intuition.”

Yet the criticism landed because it touched a nerve. Windows 11 launched with hardware requirements that frustrated many. Early builds felt heavier than Windows 10 in daily use. Later updates introduced AI features that some saw as distractions from core reliability. Trust eroded. So even a sensible engineering choice met skepticism. Why does my PC need to redline the CPU just to open the Start menu?

The answer sits in the evolution of software. Older Windows versions did less. Windows 95’s Start menu displayed a pre-rendered panel. No scaling gymnastics. No search indexing in the background. No synchronization with online accounts. That simplicity delivered raw speed on modest hardware. Today’s expectations demand more. Users want rich previews, personalized suggestions, seamless integration across devices. Delivering that without lag requires clever resource management.

This Low Latency Profile forms one piece of a larger initiative. Microsoft calls it Windows K2 internally. The effort combines short CPU bursts with deeper code optimization. Teams strip legacy components. They migrate more shell elements to WinUI 3 for lighter rendering. Scheduler tweaks improve how the OS handles processor power states and C-state transitions. The company has already begun shipping some of these changes to Insiders and retail users. (Windows Latest, May 11, 2026)

Early tests impress. On budget hardware and virtual machines, the difference turns sluggish experiences snappy. ARM-based systems like those with Snapdragon X Elite benefit especially. Their rapid power-state transitions pair perfectly with brief boosts. Battery and thermal impact stays low because bursts last seconds, not minutes.

But Hanselman stressed balance. “There are actual things wrong and smart people are working to fix them.” The boost doesn’t replace optimization. It complements it. Microsoft pursues both. Legacy code cleanup continues. File Explorer gains attention. The Run dialog moves to native frameworks. Performance work stretches across multiple fronts.

The episode highlights how Microsoft communicates engineering decisions in 2026. Executives engage directly on social platforms. They explain trade-offs in plain language. Transparency carries risk. Critics seize on admissions that the OS needs help. Yet silence would fuel conspiracy theories about hidden tricks.

Users ultimately vote with their experience. If the Start menu opens instantly, if apps feel immediate, if the system stays cool and efficient, complaints fade. The Low Latency Profile aims for exactly that outcome. It doesn’t promise higher benchmark scores in sustained workloads. It targets the moments that shape daily satisfaction. Click. Respond. Done.

Whether the feature ships widely this year remains unclear. Testing continues in Insider builds. Adjustments to duration and triggers could still occur. What won’t change is the underlying principle. Modern operating systems manage power and performance dynamically. They always have. The difference now lies in how aggressively and intelligently they do so.

Microsoft has joined the conversation openly. Hanselman’s defense may not sway every skeptic. It does clarify the playing field. Apple does it. Linux does it. Smartphones perfected it. Windows 11 is catching up in visibility and effectiveness. The real test arrives when millions of users encounter the smoother experience. Then the debate shifts from theory to results.

And results, in the end, determine whether Windows wins back the fans it seeks.

from WebProNews https://ift.tt/UgXlJA1

Amazon Halts High-Speed E-Bike Sales in California as Deadly Crashes Mount

Amazon has drawn a firm line in California. The retail giant will no longer sell electric bikes capable of exceeding the state’s strict speed limits for legal e-bikes. The decision follows months of pressure from Attorney General Rob Bonta and local prosecutors alarmed by a surge in fatal collisions involving young riders.

California draws clear distinctions. Class 1 e-bikes offer pedal assistance up to 20 mph. Class 2 models add throttle but cap at the same speed. Class 3 bikes, which require riders to be at least 16, reach 28 mph with pedal assist. Anything faster or lacking proper pedals crosses into moped or motorcycle territory. That shift demands a license, registration, insurance and often higher age minimums.

The change isn’t abstract. KCRA 3 Investigates flagged multiple Amazon listings advertising speeds over 40 mph. Some models pushed even higher. After the station shared examples with the company, Amazon moved. It now requires third-party sellers to meet state laws, its own policies and speed classifications. Non-compliant products have been pulled. Others face review.

“We are seeing a surge of safety incidents on our sidewalks, parks, and streets,” Bonta said in an April consumer alert titled “Too Fast, Too Furious.” He warned parents and riders directly. “If your or your teen’s electric two-wheeled vehicle goes too fast, it might be a motorcycle or a moped — not an e-bike.”

Orange County District Attorney Todd Spitzer welcomed the step. He noted more than 100 deaths nationwide tied to e-bike and e-motorcycle crashes. Two recent tragedies hit close. Thirteen-year-old Benson Nguyen of Santa Ana died after crashing an e-motorcycle traveling around 35 mph in Garden Grove. In Lake Forest, an 81-year-old veteran named Ed Ashman was struck and killed by a 14-year-old on a similar machine.

Prosecutors have filed charges against parents in related cases. One Yorba Linda father allegedly modified his son’s vehicle to exceed 60 mph. The boy had already gone through impound and safety training. Another parent in Aliso Viejo faces involuntary manslaughter charges after her son crashed fatally despite prior warnings. These incidents underscore a pattern. Young riders treat powerful machines like toys. The results prove otherwise.

Amazon’s announcement landed Friday. It came weeks after Bonta’s alert and direct outreach from investigators. The company told the Orange County Register it demands every product on its platform follow applicable regulations. Compliance checks continue. Yet as of early this week, some borderline models lingered in carts. One YVY bike rated between 30 and 38 mph remained available for California delivery, according to a Gizmodo check.

The episode exposes cracks in the marketplace. Third-party sellers flood platforms with imported machines that blur lines between bicycle and motor vehicle. These so-called hooligan bikes often weigh heavily, lack adequate brakes for their speed and attract underage users who skip helmets, training or licenses. One industry observer called the Amazon move progress. Such bikes, the person said, simply should not be on public roads when operated by 14-year-olds unfamiliar with traffic rules.

But the crackdown raises questions too. Compliant e-bike makers have complained for years that rogue models damage the category’s reputation and endanger everyone. Safety advocates point to rising clashes. E-bike riders mix with pedestrians on paths, frustrate transit users and spark debates in cities trying to cut car use. Hikers and cyclists have tangled with faster machines on trails.

State law requires permanent labels on e-bikes. Those stickers must list the class, motor wattage and top assisted speed. Many imported products ignore the rule. Sellers market them as e-bikes anyway. Buyers in California who click purchase on a 40-mph model could unknowingly acquire something that demands motorcycle endorsement.

And enforcement lags. Local police struggle to distinguish compliant bikes from illegal ones on sight. Bonta’s office partnered with district attorneys across the Bay Area and beyond to issue the alert. The goal was education first. Amazon’s response suggests the message registered.

Other retailers have taken notice. Walmart already blocks non-compliant models for California addresses. Smaller direct-to-consumer brands may feel less immediate pressure, yet the signal is clear. Major platforms won’t risk liability or regulatory heat.

The broader market keeps growing. E-bikes promised affordable, green mobility. Many models deliver exactly that. They help commuters skip traffic, let older adults stay active and reduce short car trips. Yet the fastest segment undercuts those gains. Speed sells. So does minimal regulation. Until crashes mount.

California isn’t alone. New Jersey enacted tough rules effective this July. Riders of machines over 20 mph need a driver’s license, registration and insurance. The law drew fire from cycling groups and environmental organizations worried about climate targets. Similar tensions bubble in other states.

Amazon’s pivot won’t eliminate dangerous machines. Determined buyers can still order from overseas sites or local shops that skirt rules. Private property use remains legal for non-street machines. But removing easy one-click access from the nation’s largest online marketplace changes the equation. It forces conversation about what counts as a bicycle in an era of 5,000-watt motors.

Prosecutors and regulators insist the law has been settled for years. The three-class system dates back well before the current boom. Manufacturers and sellers simply ignored it when convenient. Bonta’s alert and the KCRA probe applied pressure where it counts. At the point of sale.

Shoppers face new realities. Those seeking legitimate Class 3 transport can still find options on Amazon. Models capped at 28 mph with proper labeling should remain. Thrill seekers chasing 40 mph or more must look elsewhere. And they should understand the legal consequences. A traffic stop on a misclassified machine can bring fines, impoundment and insurance complications.

The episode also highlights platform responsibility. Amazon hosts millions of third-party listings. Policing every speed claim proved difficult until spotlighted by journalists and attorneys general. Now the company investigates similar products and coordinates with law enforcement. That shift may ripple beyond California.

Industry watchers expect tighter scrutiny nationwide. Major retailers dislike headlines about deadly crashes tied to their sites. Insurance carriers grow wary. Cities debate trail access and speed limits on shared paths. The humble e-bike has become a policy battleground.

Amazon’s decision won’t end the debate. But it marks a turning point. Speed without accountability carries costs. California officials decided those costs had grown too high. Retailers are following suit. Riders, parents and sellers now navigate the consequences. Some faster than others.

from WebProNews https://ift.tt/PJNSwhu

Debian Draws A Line: Reproducible Builds Become Mandatory For Its Next Release

Debian’s release team delivered a quiet bombshell this weekend. Halfway through the development cycle for the next major version, code-named Forky, officials declared that the distribution must ship only reproducible packages. The change took effect immediately. Migration tools now block any new package that fails to build identically bit for bit. Packages already in testing that slip backward face the same barrier.

The announcement came directly from Paul Gevers, writing on behalf of the release team. “Aided by the efforts of the Reproducible Builds project, we’ve decided it’s time to say that Debian must ship reproducible packages,” he stated in the bits from the release team posted to the debian-devel-announce mailing list on May 10, 2026. The message described the shift as “a small step in code, but a giant leap in commitment.”

This matters. For years the project has chased reproducibility without forcing it. Progress came steadily. Independent verifiers could rebuild many packages and match the official binaries exactly. Yet gaps remained. Timestamps crept in. Build paths differed. Random seeds introduced variation. The result? No one could say with absolute certainty that the binary downloaded from Debian’s servers came from the published source without trusting the build infrastructure.

That trust model no longer suffices. Supply-chain attacks have sharpened focus across the industry. The 2024 xz-utils incident, in which a sophisticated backdoor nearly slipped into major distributions, served as a wake-up call. Reproducible builds offer a practical defense. Anyone can rebuild the package. Compare the output. Match the hash. Confirm no alterations occurred between source and binary. Simple in theory. Demanding in practice.

Debian has come far. Phoronix reported on the policy shift within hours of the mailing list post. Michael Larabel noted that Debian 14.0, expected around 2027, will mark the first major release under this mandate. Earlier coverage from the same outlet showed the archive reaching 94 percent reproducibility for Debian 9 on x86_64 back in 2017. Rates have climbed since. The project’s testing infrastructure at tests.reproducible-builds.org tracks progress across architectures and suites.

Monthly reports from the Reproducible Builds project document the grind. In April 2026 the team reviewed dozens of packages, updated infrastructure, and refined tools. Vagrant Cascadian handled non-maintainer uploads to fix specific issues. Chris Lamb continued refining diffoscope, the sophisticated diff utility that pinpoints why two builds diverge. These efforts accumulate. They turn reproducibility from aspiration into requirement.

But. Challenges persist. Some packages embed timestamps by design. Others rely on compilers that produce varying output based on hardware or optimization flags. File ordering in archives can differ. Build environments must match exactly, down to the precise versions of every dependency. The policy accepts no excuses for new uploads. Maintainers must adapt or see their packages rejected from testing.

Reactions poured in quickly. On Hacker News, users debated the practicality. One commenter acknowledged the protection against compromised build servers yet questioned how often such attacks occur in practice. Others pointed to distributions that already achieve high or full reproducibility. NixOS, Guix, and Tails stand out. NetBSD reached the milestone years earlier. Debian’s size and package count make the task bigger. Its influence makes success matter more.

The timing aligns with broader movement. The Reproducible Builds project publishes regular updates. Its April 2026 report highlighted infrastructure upgrades for the forky release and the addition of new test nodes. Holger Levsen upgraded systems and dropped older architectures from testing. These changes prepare the ground. They signal that the project views full reproducibility as attainable.

Security experts have long argued for this. A 2021 paper titled “Reproducible Builds: Increasing the Integrity of Software Supply Chains” laid out the case. Authors described how the technique creates a verifiable path from source to binary. They drew on Debian’s own experience. The paper, available on arXiv, influenced policy discussions at multiple organizations. Governments and enterprises now reference similar principles when specifying procurement requirements.

Debian’s decision will ripple outward. Ubuntu, Linux Mint, and numerous derivatives pull packages from Debian. Higher reproducibility there strengthens the entire family. Downstream builders gain confidence. Users running critical infrastructure can verify their systems more easily. Auditors gain a concrete check.

Not every package will comply overnight. The release team built in testing for binary non-maintainer uploads, or binNMUs. These automated rebuilds help when architecture-specific tweaks are needed. The team also added LoongArch 64-bit, known as loong64, to the archive two weeks before the reproducibility announcement. That addition triggered widespread rebuilds and lengthened the continuous integration queue. Patience, the message noted, remains necessary.

Uploaders now carry explicit responsibility. If a package blocks due to test regressions in reverse dependencies, the original maintainer must file release-critical bugs. The system no longer tolerates drift. This raises the bar. It also rewards those who invested early in reproducible tooling.

Tools have matured. Strip-nondeterminism removes timestamps and other variable elements after the build completes. diffoscope dissects differences with remarkable precision. rebuilderd runs independent rebuilds at scale and reports discrepancies. Debian integrates all three. The project even operates reproduce.debian.net to let anyone verify packages against official builds.

Still, full compliance across every architecture and every package will test the community’s resolve. Armhf support was dropped from some tests after years of maintenance by Vagrant Cascadian’s collection of hardware. Newer ports like loong64 bring their own quirks. Each requires validation.

The announcement carries weight precisely because it comes from the release team. Not a working group. Not a side project. The people who decide what enters the stable release have drawn the line. Packages that cannot be reproduced will not migrate. Debian 14 aims to ship with this guarantee.

Observers see momentum. Recent X posts celebrated the move. One noted that NetBSD achieved the goal in 2017 while Debian followed in 2026. Another highlighted the audit value: no binary should be trusted if it cannot be bitwise reproduced. Discussions on Linux forums emphasized the link to supply-chain integrity.

Yet the work continues. The Reproducible Builds project issued its latest monthly summary just weeks ago. It tracks patches, infrastructure, and community efforts across distributions. Debian remains central. Its scale provides both the hardest test and the greatest reward.

So the policy lands as both culmination and beginning. Years of incremental fixes, tool development, and advocacy reached critical mass. The release team converted that progress into enforcement. Maintainers will feel the pressure. Users will gain assurance. The broader software supply chain stands to benefit as practices spread.

Debian has bet that the cost of adaptation is lower than the risk of inaction. Early evidence suggests the community agrees. The real test will come as Forky approaches release. If the archive reaches and holds 100 percent reproducibility under the new rules, the distribution will have set a standard for others to follow.

from WebProNews https://ift.tt/tNVanoI

How AI Bots Outpaced Bun’s Creator and Why Anthropic Bought the Whole Project

Jarred Sumner once spent three weeks hand-porting a Go transpiler to Zig. Line by line. No AI. The result became the seed for Bun, the JavaScript runtime that now powers some of the hottest AI coding tools on the market.

Today that same project has a GitHub bot called robobun with more contributions than Sumner himself. The milestone, flagged by developer Simon Willison on May 6, 2026, arrived during a “Code w/ Code” conversation between Sumner and Bryan Cherny. Fenado AI captured the moment: “Watching @jarredsumner and @bcherny at Code w/ Code talking about robobun, the Bun project’s GitHub bot that’s now made more contributions to Bun than Jarred has.”

Short. Stark. And a signal of how fast the ground is shifting.

Five months earlier, Anthropic had acquired Bun outright. The deal, announced December 2, 2025, tied the fast JavaScript toolkit directly to Claude Code, the AI coding product that hit $1 billion in annualized revenue just six months after public launch. Sumner’s blog post laid out the logic without fanfare. Bun Blog quoted him: “In late 2024, AI coding tools went from ‘cool demo’ to ‘actually useful.’ And a ton of them are built with Bun.”

Claude Code ships as a single-file Bun executable to millions. That single technical choice — fast startup, native addons, easy distribution — made Bun the quiet backbone for several AI-first developer tools. FactoryAI and OpenCode joined the list. When those tools succeed, Bun must not break. Anthropic now has every reason to keep it excellent.

But the story runs deeper than infrastructure. Sumner got obsessed with Claude Code. He took four-hour walks around San Francisco with engineers from the team. They talked about where coding heads next. He repeated the walks with competitors. He chose Anthropic. “This feels approximately a few months ahead of where things are going. Certainly not years,” he wrote in the acquisition post.

The numbers tell part of the tale. Bun’s monthly downloads climbed 25% in October 2025, crossing 7.2 million. The project carried more than four years of runway yet generated zero revenue. Traditional paths — cloud hosting, paid tiers — felt mismatched when AI agents threatened to write, test and deploy most new code. Sumner saw the runtime and tooling around that code mattering more than ever. Speed. Predictability. Scale. Bun had chased those traits from the start.

The Hand-Port That Started It All

Sumner’s original frustration was simple. A browser-based voxel game. A large Next.js codebase. Forty-five-second iteration cycles. He attacked the bottleneck by rewriting esbuild’s transpiler from Go into Zig. Three weeks of focused effort produced something that worked, roughly. Early benchmarks showed it transpiling JSX three times faster than esbuild, 94 times faster than swc, 197 times faster than Babel.

That exercise taught lessons that still shape Bun. Write all the code first. Avoid incremental fixes until the full picture appears. Favor breadth-first exploration over depth-first rabbit holes. Sumner repeated those principles in recent X threads while discussing an experimental Rust port of parts of Bun. The original Zig implementation remains largely intact, though Claude-generated code sometimes arrived with excess comments that later required cleanup.

By July 2022, Bun v0.1 combined bundler, transpiler, runtime, test runner and package manager into one binary. It hit 20,000 GitHub stars in a week. Production use grew. Windows support arrived in v1.1 after relentless user demand. Built-in clients for PostgreSQL, Redis and MySQL followed. Companies such as X and Midjourney adopted it. Tailwind’s standalone CLI compiles with Bun.

Yet the real acceleration came when AI coding tools discovered Bun’s single-file executables. Developers could bundle entire JavaScript projects into binaries that run anywhere, even on machines without Bun or Node installed. Startup stayed quick. Native modules worked. Distribution simplified. The traits that solved Sumner’s original 45-second pain now solved distribution pain for AI-powered CLIs.

Anthropic’s Chief Product Officer Mike Krieger put it plainly in the acquisition announcement. Anthropic reported: “Bun represents exactly the kind of technical excellence we want to bring into Anthropic. Jarred and his team rethought the entire JavaScript toolchain from first principles while remaining focused on real use cases.” Claude Code’s rapid growth demanded matching infrastructure. Bun supplied it.

Post-acquisition, Bun stays open source and MIT licensed. The same team continues the work. Development remains public on GitHub. Node.js compatibility stays a priority. The roadmap now aligns more closely with Claude Code and the Claude Agent SDK, yet retains independence similar to browser engines and their JavaScript runtimes.

Robobun’s lead in contribution count adds another layer. The bot handles force pushes, labeling, bug fixes and test writing. It responds to review comments. In one setup, it tests fixes against earlier Bun versions before merging. Sumner has praised the productivity gains even while acknowledging the shift in metrics. Traditional contribution graphs once measured human effort. They now capture a mix of human direction and machine execution.

Other tools race forward. Cursor released an SDK for building agents using its own runtime and models, though early feedback noted missing Python support and beta-stage limitations, as covered by The New Stack on May 8, 2026. Windsurf positioned itself as an AI-native IDE with agent command centers and verification workflows. Chrome DevTools integrated Gemini for styling, performance and network debugging. The field fragments, yet Bun’s position inside Anthropic gives it unusual leverage in the agent-heavy future.

Sumner’s early tweets captured the ambition. One from 2021 highlighted JavaScriptCore’s four-times-faster startup compared with V8 in his tests. Another announced Bun as “an incredibly fast all-in-one JavaScript runtime.” Those claims proved durable. The acquisition simply reframes the bet: instead of chasing venture-scale monetization alone, Bun now sits at the center of one of the most aggressive AI coding efforts in the industry.

Questions remain. How will contribution credit evolve when bots outpace founders? What does code ownership mean when agents generate the majority of new lines? Will runtime performance still dominate when humans review less of the output? Sumner has wagered that fast, predictable tooling becomes even more valuable in that world.

He is hiring. The team ships updates at a quick clip. Bun v1.3.13 arrived with parallel test improvements, lower memory usage for installs and better source map handling. Each release tightens the loop between human intent and machine output. The original frustration — 45 seconds to check if a change worked — feels quaint. Today the constraint is how quickly an agent can propose, validate and deploy across thousands of lines.

Sumner once coded in a cramped Oakland apartment, tweeting progress between commits. Now he walks San Francisco streets with AI product teams and watches bots merge more PRs than he does. The project he started to solve his own iteration pain has become infrastructure for tools that multiply developer output by orders of magnitude. And Anthropic paid to own the stack underneath it all.

The numbers keep moving. Downloads rise. Revenue at Claude Code compounds. Robobun’s commit count grows. Bun itself ships faster than before. The question is no longer whether AI will change software engineering. It already has. The question is who controls the runtime that agents rely on when most code never passes through human hands first. For now, that runtime is Bun. And its creator no longer holds the top spot on its own contribution graph.

from WebProNews https://ift.tt/sWRteXV

OpenAI Launches Specialized Cybersecurity AI Model for Threat Detection

OpenAI has introduced a specialized AI model designed specifically for cybersecurity professionals, arriving just weeks after Anthropic launched its own security-focused system called Mythos. The new offering, detailed in a recent announcement from the company, aims to provide security teams with advanced capabilities for threat detection, incident response, and vulnerability assessment through more targeted language processing and reasoning abilities.

This development highlights the growing competition among leading AI developers to create tools that address the specific demands of information security work. According to the TechRadar report, OpenAI positioned its model as a direct response to the needs expressed by security operations centers and threat intelligence units that often struggle with the volume and complexity of modern cyber threats.

The model builds upon OpenAI’s existing GPT architecture but incorporates training data and fine-tuning processes that emphasize security contexts. Engineers at the company exposed the system to thousands of real-world security reports, malware analysis documents, network logs, and incident response playbooks. This specialized training allows the model to better understand technical terminology, recognize patterns associated with common attack vectors, and generate recommendations that align with established security frameworks such as NIST, MITRE ATT&CK, and ISO 27001.

Security teams frequently face challenges when using general-purpose AI models for sensitive work. Standard large language models sometimes hallucinate technical details, misinterpret security logs, or suggest actions that could inadvertently weaken defenses. OpenAI claims its new model demonstrates measurable improvements in accuracy for tasks ranging from analyzing phishing emails to mapping attack chains across enterprise networks. Early testing with select partners showed the system correctly identifying sophisticated social engineering attempts that generic models often missed.

One notable feature involves the model’s ability to process and correlate information from multiple security tools simultaneously. Rather than examining isolated alerts from endpoint detection systems, SIEM platforms, and cloud security monitors, the AI can synthesize findings across these sources to present a coherent picture of potential intrusions. This capability addresses a persistent pain point for analysts who spend considerable time manually connecting disparate data points during investigations.

The timing of this release creates an interesting dynamic in the artificial intelligence sector. Anthropic debuted its Mythos model barely a month earlier, signaling that both organizations recognize the substantial market potential in serving cybersecurity customers. While specific technical comparisons remain limited due to the proprietary nature of both systems, industry observers suggest the offerings may differ in their approaches to safety constraints and specialized knowledge bases. Anthropic has historically emphasized constitutional AI principles that prioritize careful reasoning and reduced harmful outputs, which could influence how Mythos handles sensitive security scenarios.

OpenAI’s approach appears to focus on practical integration with existing security workflows. The company has developed application programming interfaces that allow the model to connect directly with popular platforms like Splunk, Elastic, and Microsoft Sentinel. Security analysts can query the system using natural language while it maintains awareness of the specific environment’s architecture, policies, and historical incidents. This contextual awareness represents a significant advancement over previous AI assistants that required extensive prompt engineering to produce relevant results.

Privacy and data protection formed central considerations during development. The model operates with strict controls that prevent training on customer data without explicit permission. Organizations can deploy the system in private instances that keep all security information within their own infrastructure, addressing concerns about sharing sensitive threat data with external providers. This attention to confidentiality proves essential when dealing with zero-day vulnerabilities or advanced persistent threats where information disclosure could compromise ongoing investigations.

Performance metrics shared in the announcement indicate the specialized model outperforms general versions of GPT-4 on security-specific benchmarks by substantial margins. In tests involving malware classification, the system achieved higher precision and recall rates when distinguishing between legitimate software and malicious code. Similarly, when asked to assess network traffic patterns, the model demonstrated better recognition of command-and-control communications associated with various threat actors.

Experts suggest this specialization trend reflects broader maturation in artificial intelligence applications. Rather than expecting one model to handle every possible task with equal competence, developers now create variants optimized for particular professional domains. Healthcare, legal, financial services, and now cybersecurity each present unique terminology, regulatory requirements, and risk profiles that benefit from tailored approaches.

The new model includes features specifically designed for red team operations and penetration testing. Security professionals can use it to brainstorm attack scenarios, identify potential weaknesses in proposed architectures, or generate realistic phishing content for training purposes. However, OpenAI implemented guardrails to prevent the system from assisting with actual malicious activities, maintaining ethical boundaries while supporting defensive work.

Integration with automated response systems marks another area of focus. The model can not only identify threats but also suggest specific remediation steps based on an organization’s particular tools and policies. For example, when detecting ransomware indicators, it might recommend isolating affected systems, initiating backup restoration procedures, and updating firewall rules according to predefined playbooks. This guidance helps reduce response times during critical incidents when every minute counts.

Industry analysts predict strong adoption among managed security service providers who handle multiple client environments. These organizations face pressure to deliver consistent, high-quality analysis despite varying skill levels among their staff. An AI system that can augment junior analysts while providing sophisticated insights for senior team members could significantly improve overall service quality and operational efficiency.

Challenges remain in measuring the true effectiveness of such tools in real-world conditions. While benchmark results look promising, actual security incidents involve numerous variables including organizational culture, existing tool configurations, and the unpredictable nature of human adversaries. Security leaders will likely proceed with careful pilot programs before committing to widespread deployment.

The competitive pressure between OpenAI and Anthropic may drive further innovation in this space. Both companies possess substantial resources and access to talented researchers who understand both artificial intelligence and information security. Their parallel development efforts could accelerate improvements in areas such as explainability, where security teams require clear reasoning behind AI-generated recommendations rather than black-box outputs.

Educational institutions and training programs have already expressed interest in incorporating these specialized models into their curricula. Teaching the next generation of cybersecurity professionals how to effectively collaborate with AI systems will become an essential component of preparation for modern security roles. Understanding both the capabilities and limitations of these tools represents a critical skill set for future practitioners.

OpenAI emphasized that this release forms part of a larger strategy to address enterprise needs across multiple sectors. The company continues investing in research that adapts foundation models for specific professional requirements while maintaining focus on safety and reliability. For cybersecurity teams specifically, the model arrives at a time when threats grow increasingly sophisticated and the shortage of qualified personnel continues to widen.

Organizations considering adoption should evaluate several factors beyond the technical specifications. Implementation costs, integration complexity, staff training requirements, and alignment with existing governance frameworks all require careful assessment. The most successful deployments will likely combine the AI capabilities with strong human oversight and established security processes rather than treating the technology as a standalone solution.

As more details emerge about both OpenAI’s offering and Anthropic’s Mythos system, security professionals will gain better understanding of which approach best fits their particular operational models. Some teams may prefer one system’s handling of certain attack types while finding the other more effective for compliance-related tasks. This diversity in specialized AI tools ultimately benefits the entire field by providing options that match different organizational needs and preferences.

The introduction of these purpose-built models signals a shift toward more practical applications of artificial intelligence in high-stakes environments. Rather than pursuing general intelligence, developers now focus on creating reliable partners for specific complex tasks. For cybersecurity teams overwhelmed by alert volumes and sophisticated adversaries, such targeted assistance could meaningfully improve their ability to protect critical systems and data.

Future updates will likely expand the models’ knowledge bases as new threats emerge and defensive techniques evolve. Both OpenAI and Anthropic have indicated plans for continuous improvement based on feedback from early adopters in the security community. This iterative approach acknowledges that effective cybersecurity AI must adapt quickly to changing circumstances in ways that static tools cannot match.

The broader implications extend beyond individual security operations. As these systems become more capable, they may influence how organizations structure their security teams, allocate resources, and approach risk management. The technology could help address the persistent talent gap by amplifying the effectiveness of available personnel while potentially creating new roles focused on AI system management and oversight.

Security leaders who embrace these tools thoughtfully while maintaining appropriate skepticism about their limitations will likely gain advantages over those who either reject the technology outright or implement it without proper controls. The most effective strategies will combine artificial intelligence with human expertise, using each to compensate for the other’s weaknesses in the ongoing effort to stay ahead of determined adversaries. This balanced approach offers the best path toward improved security outcomes in an increasingly challenging digital environment.

from WebProNews https://ift.tt/ow8hdmH