Feed aggregator

Todd Blanche remained composed throughout the hours-long hearing, but faced several testy moments during questioning as he seeks to win the support of all Republican senators on the committee.

(Image credit: Eric Lee)

OpenAI is building an AI-powered smart speaker nobody wants. That is, if you believe the Bloomberg report from Mark Gurman and you've read his description of said rumored device.

According to the report:

"OpenAI believes the product’s defining feature will be its personality and ability to connect on a humanlike level with users. The speaker incorporates mechanical elements that can move on their own, creating a sense that it is alive and not just an object responding to commands. The machine also will draw on personal information such as emails to better understand its owner."

The news sources, it appears, come from an insider who decided to spill all the juicy details mere hours after Apple dropped a blockbuster trade-secrets lawsuit on OpenAI's head. OpenAI claims it's done nothing of the sort, and recent reports say that Apple's claim that the AI giant has not even responded to Apple's earliest concerns was based on it potentially incorrectly identifying the former Apple employees who left to join OpenAI (allegedly with Apple trade secrets in tow).

Apple's concerns here are twofold: First, these former employees had access to many of Apple's secretive product development details and may even have asked recruits to share fresh details when they approached them to interview for jobs at OpenAI. The other concern is that Apple is already far behind in the AI race, and if Apple's plans for Siri, AI, and a potential robotic desktop home assistant were also leaked, it could harm its ability to catch up in multiple market sectors.

This latest news, which may or may not be accurate, should put Apple's fears to rest.

OpenAI is apparently not building something that could ably compete with any of Apple's key hardware or future hardware initiatives.

First of all, there's the smart-speaker-ness of the whole rumored OpenAI concept. There are already too many smart speakers on the market, many of them with their own smart assistants. Amazon, for instance, is smack in the middle of trying to convince millions of customers that not only do they need Echo devices throughout the home, but they need the AI-powered Alexa+ to guide them through their smart home experiences and, to some extent, their lives.

Apple has its own HomePod, Siri-infused speakers, which may get considerably more powerful with the Gemini foundation model-backed version arriving this Fall.

Put another way, smart speakers are a known quantity in the home consumer electronics space, and I think what most tech companies are realizing is that people like and use them, but mostly in limited ways: they want music, occasional answers to simple questions, and voice control of their smart home devices. That's it.

Why does my speaker think it's alive?

(Image credit: Future)

OpenAI appears to be prepared to offer something different: a personality-filled speaker that can watch you, move to engage, seem alive, and generally make you feel uncomfortable.

Obviously, that would not be the objective, but it could be the result. Who needs a speaker that quietly watches you as you walk from your kitchen to the den, waiting and hoping for you to say, "hey ChatGPT, what's up with the Strait of Hormuz today?"

In my home, we have a Psync smart security webcam with one oddball feature: it has a motorized body that can turn almost 360 degrees on its base and lift its thin, rectangular face and camera to keep track of people and alert me to intruders. However, most of the time, it's just watching us move around the house, and I can tell you that my family hates it. Sometimes I come home and find its face forced down so it can't pop up and track anything.

Now, imagine a larger and far smarter OpenAI AI smart speaker in your home, watching, waiting, chiming in when you don't want it to, and generally making people feel uncomfortable.

This will not be the breakout hardware hit OpenAI is hoping for.

Look, I was under the impression that OpenAI (really Jony Ive and Sam Altman) were working on an AI wearable. I didn't love that idea either, but it was a lot less creepy than this.

So, Apple, chill out. OpenAI's plans are no threat to you, even if they do allegedly have a bunch of insidery Apple information.

The change is driven by improved perceptions of China and declining views of the United States.

(Image credit: Mark Schiefelbein)

• AI hallucination can be weaponized, new report warns
• HalluSquatting is short for “adversarial hallucination squatting”
• GitHub Copilot, Gemini CLI, and OpenClaw are all affected

Your favorite AI service could be subverted to deploy code that turns your phone or PC into a botnet, according to researchers at Intuit, Technion, and Tel Aviv University.

The technique has been given the name HalluSquatting, a portmanteau of adversarial hallucination squatting, and is similar to typosquatting in that it relies on a mistake in order to distribute malicious code. While typosquatting might occur with the incorrect input of a website URL, HalluSquatting pivots on an LLM being unable to identify a resource or repository with 100% accuracy.

Relying on an LLM’s tendency to hallucinate repository resource identifiers, this weakness could be scaled up to conduct massive ransomware campaigns, botnets, and more.

Push-me-pull-you

Previous LLM-based malware operations have relied on pull-based attacks. In this scenario, a prompt designed to jailbreak or otherwise subvert the AI is (for example) placed on a website and the LLM encouraged to gather the information, thereby reducing its internal security.

What the researchers have shared in their paper, is that pull techniques are being combined with push attacks, which are traditionally executed as code injection.

The paper’s introduction summary states: “By preemptively registering hallucinated resources—a technique we call adversarial hallucination squatting (HalluSquatting)—we demonstrate remote tool execution and remote code execution at scale across a range of popular agentic LLM applications, which could be exploited to the establishment of a botnet.”

Once an attacker has identified the resource likely to be misnamed by an LLM, and squatted on it (to embed adversarial prompts), the work is done. All that remains is for a user to trigger the resource, the AI chatbot or agent to initiate the response, and the squatted resource will be accessed.

Promptware attack

Following this, the adversarial content held within the squatted resource is activated, triggering the tool invocation stage. This is the promptware attack, where attacker-controlled instructions are executed, with results potentially including turning the device you’re using into a botnet zombie.

LLMs such as the Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline coding assistants have been used in the testing of this avenue of attack along with Gemini CLI, and the OpenClaw, ZeroClaw, and NanoClaw AI assistants. The researchers successfully achieved remote tool execution (essentially remotely accessing and controlling the LLMs) and remote code execution (RCE, where malicious code is executed remotely).

Some mitigation is available, including LLM developers blocking fetch operations in favor of a search tool, and resource owners enforcing strict naming, perhaps in favor of globally unique resource names. However, these are will require collaboration by disparate parties, and may take a while to implement.

The risk of LLM-based malware is increasing, and some has already been spotted in the wild. Of these, the JADEPUFFER attack is perhaps the most notable, as it isn’t simply AI-based malware – it is a full ransomware attack run entirely by an LLM.

Here are hints and answers for the NYT Strands puzzle for July 16, No. 865.

Here are some hints and the answers for the NYT Connections puzzle for July 16, No. 1,131.

Leaked Pixel Watch 5 renders reveal every color, both case sizes, and Google's familiar design ahead of the Made by Google event on August 12.

The post Google Pixel Watch 5 Renders Leak Ahead of Launch appeared first on TechRepublic.

Here are hints and the answer for today's Wordle for July 16, No. 1,853.

Microsoft is redesigning Windows Search with improved local results, fewer promotional elements, better file previews, and more control over web-based search.

The post Windows Search Gets a Major Revamp Focused on Usability appeared first on TechRepublic.

Looking to buy 3D printer filament? Skip the confusion with our top options for all experience levels, picked by CNET's experts.

The hack allegedly confirms the suspicions of record labels and artists that their music is used in the creation of AI music.

• The three man team is known as “Slopfix”
• It claims to be able to reduce AI generated codebases by up to 65% in size
• They aim to "refactor vibecoded codebases back to maintainability"

Vibecoding has a lot to answer for, not least some excessively large codebases. A new team of software engineers are collaborating to reduce the size of these cumbersome projects… with a $10,000 per week bill.

Slopfix is the name of the team (comprising a trio: Maciej, Kuba, and Krzysztof), but its aim is efficiency and functionality, rather than code golf, where code is reduced to the shortest possible length.

However, while this might seem like a noble task and a service worth paying for, Slopfix isn’t taking a stand against the use of AI. In fact, it is employing AI tools to detect the AI flab in your codebases.

Use an AI to catch an AI

Challenges around vibecoded projects have increased in recent months, as the limitations of the technology become apparent.

While using an AI to program based on your prompts and requirements is straightforward, agents habitually begin to lose context and logic once the project reaches a certain size or age. Once that happens, you’re looking at duplication, features breaking, and of course, the dreaded hallucination.

Slopfix is targeting companies that have adopted vibecoding, built huge codebases, and found that they’re running into issues. To find the problematic AI code, however, Slopfix is employing AI.

They state that a full “screen by screen, endpoint by endpoint” evaluation of the vibecoded app is made, which aims to find the duplicated functions, broken logic, and other issues. There’s also the promise of a two-week warranty for anything they break.

All of this is aided by Claude Code “on a very short leash” which Slopfix uses find problems. They clearly state that “the agent doesn’t get a vote.” Instead, they’re relying on their experience as developers to improve your code.

$10,000 seem a bit steep?

While the price might seem high, $10,000 for one successful week’s work for three seasoned developers shouldn’t really be a budget breaker.

The fee covers successful work only, and as the Slopfix website states, payment is in proportion to how much of the reduction target the team hits, with $10,000 being the price for hitting the target – it’s not the default fee.

However, there is a lot of preparation involved, and the analysis of your codebase is conducted free of charge. If they can't fix your project's issues, they'll let you know and refuse the contract.

As software consultancies go, Slopfix is an unusual case. But as the problems with vibecoded projects begin to become apparent, competing consultancies may begin offering similar services.

The UK plans a midnight-to-6 a.m. social media curfew for 16- and 17-year-olds, with autoplay and personalised feeds switched off by default from spring 2027.

The post UK to Introduce Midnight Social Media Curfew for Older Teens appeared first on TechRepublic.

The New York Times journalist Jonathan Swan says the president is fixated on becoming a "great man of history" during his second term. Swan's new book, written with Maggie Haberman, is Regime Change.

(Image credit: Jacquelyn Martin)

New Jalisco and OmegaLord phishing kits target Microsoft 365 accounts by abusing device code flows, OAuth tokens, and MFA prompts to maintain access.

The post Jalisco, OmegaLord Phishing Kits Target Microsoft 365 Accounts appeared first on TechRepublic.

A new system could create patient-specific lenses for those with irregular corneas who struggle with traditional contact lenses.

New York paused new hyperscale data center permits for up to one year while it studies grid, water, ratepayer, and community impacts.

The post New York Imposes One-Year Moratorium on New Hyperscale Data Centers appeared first on TechRepublic.

Netflix brings the '80s nostalgia with this 10th-anniversary special edition of season 1.

• Vyriy 15 FPV with The Fourth Law's TFL-1 AI guidance reportedly struck Russian logistics 68 miles (110 KM) away
• Ever-innovating Ukrainian drone industry continues to achieve economies of scale even as it becomes a growing threat to Russian advances
• With a payload capacity of 8kg and the ability to be equipped with a thermal imaging module as well as electronic warfare deterrence, it offers an interesting alternative to comparable fixed-wing drones that cost thousands of dollars

Basic FPV drones are hardly a new thing in a market flooded with hundreds, if not thousands of options that can cost as little as $100 to 200, but the Russia-Ukraine conflict might have upped the ante on affordability for a different kind of UAV that leverages the same tech: attack drones.

The Vyriy 15 is a self-styled "kamikaze drone" by the company that offers a stated strike range of 40-70km with up to a 8kg payload in tow which can be retrofitted with a thermal imaging module as well as an extended band VTX module to make jamming it harder.

With a control range of up to 30KM and a flight duration of 20 minutes (with a payload) and a cruising speed of 60-100 km/h, its not the most technologically advanced drone out there, but at its purported price tag of $500, it doesn't need to be.

An FPV strike record backed by AI

On the 10th of July, Yaroslav Azhnyuk, the CEO of Ukrainian autonomy developer The Fourth Law, announced on X what he called "a new FPV strike record": a Vyriy 15 quadcopter, flown by Ukraine's 5th Border Guard Detachment and fitted with his company's AI terminal-guidance module, had flown 110 km (68 miles) to strike a Russian logistics target.

This is both a significant achievement for Ukraine's domestic drone industry and a key indicator of how fast the Russia-Ukraine war has turned into one of attrition, with supply lines becoming increasingly targeted to prevent significant advances in either direction.

It also showcases how AI on the battlefield is shaping the conflict: the Vyriy 15 is, by default, a manually controlled drone that would otherwise need an operator or a relay to be closer to the theater of war.

The competition is American-made Hornets, fixed-wing drones that can cost upwards of $5,000, a 10-fold increase in cost for an already cash-strapped Ukrainian military that is increasingly looking towards localized solutions.

The optional AI module used to set the record is The Fourth Law's TFL-1, a machine-vision terminal-guidance module that operates on a fire-and-forget principle: once the operator visually designates a target, an onboard computer takes over the final approach, essentially countering Russian jammers that would otherwise disrupt a video link.

If Ukraine manages to mainstream such warfare in the future while cutting costs down to a tenth of what they do right now, reliably striking as deep as 100km into enemy territory while proving difficult to jam or costly to intercept, drones like the Vyriy 15 could signal an evolution in the modern battlefield even as aggression with low-cost drone swarms is already being rewarded in other conflicts such as the US-Iran war.

Even if you don't use AI, I found some useful features in the iOS 27 beta. But most of them are smaller, quality-of-life changes.