The Register

The European Space Agency's Solar Orbiter has enabled scientists to trace magnetic switchbacks in the solar wind's magnetic field back to their source at the Sun. "Switchback" is the name given to an S-shaped kink in the solar wind's magnetic field – a sudden and large deflection. In 2022, the spacecraft gave scientists a full view of the structure (confirming the S-shape), but the origin remained up for debate. At the time, the probe's data suggested it might be near the Sun's surface, but a recent flight through a switchback allowed scientists to identify the source. "Solar Orbiter flew through a very large switchback," said Jesse Coburn of the French National Center for Scientific Research / Laboratoire de Phonétique et Phonologie (CNRS/LPP. "Because of this, we were able to sample rarely observed particles there that have tell-tale fingerprints of their origin." Solar Orbiter's Solar Wind Analyser instrument (SWA) was used to sample the switchback's plasma, and it came up with particles that could only have formed within hot magnetic loops at the surface of the Sun. Coburn said, "There are two main competing theories for how a switchback, and by extension the solar wind, forms. "The specific mix of particles detected by Solar Orbiter is the smoking gun for a formation process known as 'interchange reconnection'." This occurs when parts of the Sun with different magnetic properties interact. Some have field lines that stretch away into space. Others are closed and extend into space before looping back. When the two types meet, the lines can snap open, releasing previously trapped plasma into space. The other theory focuses on processes involving waves and turbulence. Stephanie Yardley of Northumbria University in the UK said, "Excitingly, we also see signs of these, but likely only after the switchback heads out into space. "Once the switchback has left the Sun, waves and turbulence take over and govern how it moves." Data from NASA's Solar Dynamics Observatory was also stirred into the mix to reveal the switchback's solar source. It's exciting stuff and shows how the Sun heats its atmosphere and accelerates solar wind particles into space. It also has implications for predicting solar storms and their severity. Daniel Müller, ESA Project Scientist for Solar Orbiter, said, "As humans on Earth – and in space – our lives are entangled with what's happening on our star. The solar wind ties the Earth to the Sun, and our understanding of its dynamics has key implications for how we keep our planet safe from extreme space weather events. "The more we know, the better we can prepare for solar storms to protect our space-based infrastructure and technology." ®

Welcome back to PWNED, the weekly column where we highlight some of the lowlights in corporate security. This week, we’ll talk about two scenarios, one that ended in tragedy and another that shows the power of a good defense over dedicated phishing attacks. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Both stories come courtesy of Dave Hatter, a cybersecurity and compliance consultant with Intrust IT. In his many years of experience with the company, Hatter has had to work for a variety of small companies that needed help with their security, whether they knew it or not. One time several years ago, the new CFO at a small construction company phoned Intrust and expressed interest in hiring them. However, the proposal was vetoed by the owner of the company, an older gentleman who thought his business was too small to interest hackers and that his existing, one-person IT staff was all he could afford. “We got a guy, my brother’s uncle’s cousin does my IT, don’t need you guys,” Hatter quotes the owner as saying. “We hear this all the time. Thanks for shopping. You’re too expensive.” Three weeks later, Hatter got a call from a local accountant friend who begged him to help a client who'd been hit with a ransomware attack. Hatter said he couldn’t really give more than general guidance, but would talk to the victim anyway. As soon as he called the number, Hatter realized that the ransomware victim was actually the same construction company that had turned down his services a few weeks earlier. The business had an old unpatched Windows server that contained all its most important data. There was a backup drive, but it was connected to the same server, so both devices were encrypted by the ransomware. “Their entire backup is this external drive, which, of course, is now encrypted,” Hatter said. “So, literally, they can't pay their employees. They don't know who owes them money.” Hatter could not help the company, and he never found out whether it paid the ransom. However, the org, which had been around for years, went out of business within months. This sad story shows the importance of having real backups that are off-site or in the cloud and patching whatever servers you have. You can never assume that your company is too small to be attacked because ransomware gangs want your money and they are just as happy to take on small businesses as large ones, which are likely to be harder targets. The other incident involved two companies in the landscaping and construction business. Somebody broke into an executive’s email account at company one and started sending phishing emails to company number two. The miscreants had also set up email filtering rules in the first company’s account so that the messages from the phishing campaign were routed to buried folders where the real-life account holder would never see them. The phishing mails took the form of RFPs (requests for proposal) – a perfect lure, because who wouldn't want new business? They were perfectly crafted, with no grammar errors or obvious tells, and the return address matched company one's. However, instead of attaching the RFP as a PDF or PowerPoint file, it had a button for the user to click to download it. “If I can get in your email and send out emails as you, the recipients, especially if they've interacted with me before, aren't going to have any guard up,” Hatter said. “Especially if there's no crazy language or crazy requests in there because they've got an email from me before.” Upon clicking the download button, the user was transported to a Microsoft 365 login screen that looked identical to the real one but was not on the microsoft.com domain. The user was then invited to put in their email address and password to gain access to the desired file. Because the user had 2FA, this fake page also asked them for their limited-time 2FA code. Behind the scenes, the threat actors were transmitting the login to Microsoft so that Microsoft itself would send an SMS message to the victim at company number two. Then the victim would pass along the one-time passcode via the fake login site. A classic man-in-the-middle attack. It worked, and the threat actors now had access to the Microsoft 365 account and email for the victim at company number two. This could've allowed them to do almost anything using that person’s email. If the victim had access to bank accounts or customer data, the attackers could have initiated password resets from the account, then conducted fraudulent money transfers, or stolen personal information. At the very least, they could've used the victim's account to phish other contacts. Fortunately, Hatter's client had installed a piece of software his company made called TarBot, which runs in the Microsoft 365 environment and uses Entra ID P2 to help customers identify suspicious logins. “It throws off a bunch of telemetry, statistics, metrics, whatever you want to call it, that allows our software to say, this is an anomalous login, revoke the token, and make the user log in again,” Hatter said. He said his company is not the only one to make apps like TarBot that detect suspicious logins. So the bad guys were kicked out after just a few minutes. But Hatter says the better way to stop these attacks is to use phishing-resistant MFA, such as hardware keys (like the YubiKey line) or passkeys. With today’s AI-assisted phishing, telltale signs such as bad grammar or obviously fake login pages are becoming few and far between. ®

When implementing any kind of technology, the difference between offering employees training and supporting them in adoption is all too frequently misunderstood. But the difference is a significant one. Training is usually a time-limited, structured educational initiative to help people build technical competence and learn how a system works. Adoption, on the other hand, is a continuous, long-term process by which employees use technology to change how they work in order to deliver more value. Nowhere is this distinction more vital than in the emerging world of agentic AI. To date, many organizations have been experimenting with the technology to automate discrete tasks, particularly in areas such as software engineering, customer support, and operations. Over the next two years though, Gartner expects deployment to jump from the current 17 percent of businesses to more like 60 percent. Their key aims in going down this route include automating complex multistep workflows, boosting operational efficiency, and maximizing productivity. But despite the perceived value of agentic AI here, many organizations are currently struggling to create such value in real terms. This includes generating a return on investment. Identifying the value gap In fact, according to WalkMe's 'The State of Digital Adoption 2026' report, a huge 40 percent of all expenditure on digital transformation underperforms expectations, mainly due to user adoption challenges. As the study, which is based on input from 3,750 respondents worldwide, says: "The technology does what it's supposed to do. The adoption execution around it doesn't." As such, it found the average employee loses a full working day each week (7.9 hours) to "friction". For example, they spend 1.34 hours per week re-entering the same information across multiple applications. Another hour disappears on finding workarounds when tools are unable to communicate effectively. A further 3.69 hours vanish due to a lack of guidance on how to use such tools. This includes 1.03 hours being spent trying to understand unclear instructions. A final 1.88 hours each week are spent on reworking AI prompts and waiting for faulty tools to be fixed. Ofir Hatsor is WalkMe's Senior Vice President of Sales for Europe, the Middle East and Africa. He believes that a good chunk of this friction is due to the complex and highly regulated environment in which enterprises function. This means many of them struggle to change how they operate day-to-day - even though it is only in doing so that they can create true value for the business. "There's currently a very big gap between perceived value and existing value, or the actual value that will follow," he points out. "I think over time this gap will be mitigated, but it's not going to be tomorrow - more like the next three, five, or seven years, and in some companies, it'll never close." The difficulties in affecting change As to why affecting meaningful operational change is often so difficult to achieve, especially when moving to an agentic AI environment, Hatsor points to several reasons. The first is a "visibility gap". As WalkMe's study indicates, most executives believe their organizations use an average of 35 applications when the actual number is 661 - a visibility gap of 1,789 percent. For AI-powered tools in particular, leaders estimate teams use 21 when the real count is 80. The point here, as the report says, is that: "You can't optimize workflows you can't see, govern AI tools you don't know exist, or measure productivity when your instrumentation covers a fraction of where work actually happens." A key part of the problem is shadow AI. For instance, 45 percent of workers admitted to using unapproved AI tools in the previous 30 days as authorized systems failed to fit current workflows. Unfortunately, 36 percent of them also used confidential company data in the process. A big challenge, Hatsor explains, is the ease with which employees can get hold of AI development tools today. "So, they create their own little vibe-coding applications and share them between themselves," he says. "But if I'm the chief information officer or chief security officer, my visibility into that landscape is limited at best." This is made even harder when employees aren’t honest with their employers or themselves about AI use. WalkMe’s most recent AI Pulse Survey showed 32.5 percent of workers have passed AI work off as their own, and 28.3 percent have pretended to know AI in a meeting. An improvement over 2025, but still some way to go. Unsurprisingly, this lack of official approval or control is creating big risks for companies, not least in terms of data privacy and governance. The upshot is that many organizations are slowing their rate of agentic AI adoption until they are in a position to see, mitigate and reduce such risks. Traversing murky waters A second challenge many organizations face, meanwhile, is the actual cost of implementing agentic AI versus its real-world benefits. A key issue here is the underlying assumptions that many proposed financial gains are based on. These include boosting productivity and cutting headcount when the real benefits may actually be found in enhancing work quality and augmenting human activity. A third consideration is AI tokens. The problem here is that many organizations do not know either the number of tokens they are consuming or what they cost, which "can become very expensive". "So, there are many murky waters, which make it very difficult to get a real hard return on investment at this point because of all the moving parts and uncertainties," Hatsor says. The situation is made even more tricky by the sheer amount and speed of change that AI is generating. This is especially true among employees who usually have less access to new tools than their leaders and tend to be slower technology adopters anyway. Many are also fearful about a future that feels uncertain. Unsurprisingly then, according to the WalkMe report, there is a huge chasm between leaders who believe employees have been given access to adequate tooling (88 percent) compared with employees who take the same view (21 percent). This situation is inevitably hitting adoption. As Hatsor points out: "We're not giving our workforce the tools, or the confidence to use the tools, but there's also a lack of understanding of the difference between training and adoption. We can train someone to use a tool, but unless we help them adopt it and make it their own, they won't use it effectively." The power of Digital Adoption Platforms This is where systems, such as WalkMe's Digital Adoption Platform (DAP), come in. DAP offers in-app guidance - in a similar fashion to GPS systems - to navigate employees through a specific workflow. It offers information in a range of formats based on individual preferences, such as walk-through demonstrations, long-form text, or video. To discover how to create a quote in a system of record, for example, they simply open WalkMe’s action bar and view a video or PDF of how to complete the task. The system can even automate certain tasks. So, if for instance a salesperson is required to write a report confirming a particular deal, they could use WalkMe’s action bar to check the suitability of what they had written for compliance purposes and even suggest better wording, if appropriate. The key benefits of such an approach, Hatsor says, are that: "People feel supported. They also feel guided because when you're sitting in front of the screen, one of the worst things is not knowing what to do next, so we help with that." Having such support and guidance also leads to greater trust in the agentic AI system being deployed too. For instance, the WalkMe study indicates that workers who receive in-flow contextual support are 1.9 to 3.7 times more likely to feel confidence in such systems compared to those not receiving it. A huge 79 percent also say it helps them complete their work more easily. Linking business strategy and people What this demonstrates then, believes Hatsor, is just how important it is that "every agentic AI process starts with the people it's supposed to serve." But another vital consideration is ensuring a sound governance structure is in place. This is imperative as clear guardrails ensure everything, and everyone, operates safely and smoothly. This again is where WalkMe's DAP comes in. Therefore, Hatsor says: "The platform is completely secure in the sense we don't track users, we track usage, so we can see someone is interacting with a specific system, but we don't know who it is. This is important in supporting enterprise customers in terms of governance, regulation, and security." Ultimately though, WalkMe's DAP makes it possible to deploy agentic AI in a way that supports organizations' overall business strategy. It does so by clearly linking this strategy to how the technology is adopted and used by the workforce - an approach that is crucial in enabling business success. "Ignoring the human factor is a grave mistake in my view and will have an impact on the business if organizations do it. But WalkMe is one of the few pieces of technology ever developed with the sole aim of helping humans interact with enterprise IT systems - and that's the big benefit," Hatsor concludes. Sponsored by WalkMe

The ALBATROSS, a sailboat drone prototype developed by researchers at Singapore University of Technology and Design (SUTD), lacks the aerial grace of its avian namesake. It doesn't so much fly as plummet – an unsettling start to a sea launch, more so because it's designed to spin like a maple leaf seed as it descends. The sailboat drone's rotation slows its fall and minimizes its impact with the water. This eliminates the engineering challenge of implementing hardware for two modes of mobility. There's no need for landing gear, actuators, or sensors to manage both flying and floating. Watch and download graphics and videos of ALBATROSS here. Developed by SUTD researchers Shane Kyi Hla Win, Danial Sufiyan, Brian Leonard Suhadi, Luke Soe Thura, Xinyu Cai, Wei Jun Ang, and Shaohui Foong, the ALBATROSS represents an achievement in both acronym construction and engineering. The Airborne Lander with Buoyant AuToROtating Sailing Sensor is described in a Science paper as a hybrid robotic system that combines a bio-inspired design for controlled aerial descent with autonomous sailing. Beyond the bio-inspired operation of the rigid wingsails for creating aerodynamic lift during descent and propulsion on the water, the ALBATROSS further cribs from nature's bag of tricks with a rudder that acts like a caudal fin – it moves side to side like a tailfin to generate thrust. And it does so with just three actuators and three primary sensors. Practically, the boat drone, which weights 1.107 kg, was built to fill the gap between expendable aircraft-deployed ocean instruments and floating robots deployed from ships or shore. Its light weight and adaptability make it well suited for rapid aerial deployment followed by energy-efficient persistence on the water, as might be required to monitor an oil spill or time-sensitive weather events. It is intended to be an alternative to large automated sailboats like Saildrone and Sailbuoy that may require ground- or ship-based management. And it has far greater deployment range than hybrid aquatic micro aerial vehicles: more than 100 km, compared to about 7 km for SailMAV, or so its makers claim. "Building on prior work on guided autorotation, ALBATROSS is designed to be released from an aircraft or UAV, passively enter autorotation for a controlled, low-impact water landing, self-right without actuation, and seamlessly transition into a wind-powered sailboat," the researchers explain. "Unlike many hybrid aerial-marine systems, ALBATROSS eliminates the need for aerial propulsion, complex mechanical reconfiguration, or active stabilization during the air-water transition and can sail back to shore at the end of a mission." The prototype takes flight amid a market doing the same. Last year, PwC's Strategy& consultancy issued a report [PDF] that forecasts a sea drone market worth €18.9 billion (~$21.2 billion) by 2030, based on a compounded annual growth rate (CAGR) of 15.5 percent. By the end of the decade, most of that (84 percent) is expected to be for civilian uses like scientific research, commercial, recreational, and engineering applications, and search and rescue operations. ®

ICANN has revealed the applicants for new generic top-level domains (GTLDs). As The Register reported in August, this is just the second time ICANN has accepted applications for GTLDs, strings like “.com” or “.net”. For years, only ICANN could create and operate GTLDs. The governance body changed that policy and in 2012 allowed over 1,200 new GTLDs. The organization decided to repeat the process this year and on Wednesday announced it received 1,615 applications. A process is now under way to confirm those applications are viable. ICANN has made information about all of the applications available in a searchable form here along with a downloadable list that The Register has pored over to bring you news of the following applications. OpenAI wants 15 GTLDs, among them .chatgpt and .agi – the latter likely the acronym for artificial general intelligence. Six other entities also want that string. The AI upstart also wants .mcp, which probably refers to the open source Model Context Protocol. Google bid for this GTLD, too, as have three other entities. The Big G, through its subsidiary Charleston Road Registry, is in an eight-way tussle to score .api. It has applied for over 30 new names, most pertaining to its products. Anthropic wants only its own name and .claude. Microsoft is another that hopes for just a pair of names: .copilot and .msft. Meta will have to fight another contender to control .superintelligence, but is the only entity trying to claim .wearables. 13 entities hope to claim .agent, with Meta and Google among the contenders. Salesforce wants its own name, plus .force, .slack, and .tableau. An outfit named Fomalhaut Exploration wants .intel. That could be Chipzilla acting through a third party, or the beginning of a legal tussle. Three contenders want to be the home of .drone, while nine are fighting over .brand. Ten applicants want to build their own .hub, while two hope to take GTLDs to .mars. Seven operators hope to run .official, the kind of domain that brands buy defensively so they end up with [companyname].official before someone cynical nabs the name. North America was home to most applicants – 864 – followed by 506 Europeans, 218 from Asia Pacific, 16 from Africa, and just 11 from Latin America and the Caribbean. When multiple parties apply for the same GTLD, ICANN first applies a “community priority evaluation” process that tries to find the most appropriate home for a string. If that fails, rights to the GTLD go to auction. All applications must be decided by November 17, aka String Confirmation Day, after which successful applicants can start the work to establish a registry for their new GTLDs. Readers will likely be able to register domains using the new GTLDs next year. ®

The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms – and seemingly got away with it for years. The Feds allege that Zohar Pinhasi – aka “Zack Silver” and “Zack Green” – ran a Florida company called “MonsterCloud” that advised ransomware victims not to pay because it had a way to recover encrypted data. “The charges relate to Pinhasi’s claimed ability to decrypt ransomware without paying cybercriminals, purportedly using ‘proprietary tools’ and ‘advanced decryption techniques' on behalf of distressed business owners who came to his company,” according to a DoJ press release. “In fact, Pinhasi allegedly used a portion of his clients’ fees to pay off the ransomware attackers, and then kept the rest, often extracting a substantial markup.” In one case, Pinhasi allegedly charged his client $150,000, paid the $8,200 ransom, and pocketed the rest – but didn’t admit he had paid the ransom. That scheme allegedly worked so well that Pinhasi charged clients more than $19 million and paid more than $8 million in ransom payments. The DOJ’s indictment [PDF] says MonsterCloud’s website mentions its use of “advanced decryption techniques and cutting-edge technology” – the same language found on this monstercloud.com page. The site also contains this claim: “At MonsterCloud, we are not a team of IT Experts. We are the most sophisticated Counter Cyber Terrorism team in the world.” The indictment suggests MonsterCloud was nothing of the sort, and that its claims rang hollow for years. “MonsterCloud's website included ‘testimonials’ and other promotional content, including from at least one compensated spokesperson,” the indictment states. “In May 2019, one such spokesperson – an individual who had provided a paid testimonial for the MonsterCloud website – contacted the defendant Zohar Pinhasi with questions about Pinhasi’s business practices and truthfulness.” “Among other things, the spokesperson asked Pinhasi whether MonsterCloud actually had any proprietary software that would allow MonsterCloud to decrypt encrypted data. Pinhasi responded: ‘MonsterCloud doesn't hold any proprietary technology [to] decrypt the ransomware data.’” Pinhasi faces two counts of wire fraud, and one of wire fraud conspiracy. He could do twenty years on each count, if convicted. The FBI is investigating this case, and it appears further charges could follow as the indictment states Pinhasi had “multiple co-conspirators, individuals whose identities are both known and unknown to the Grand Jury, including MonsterCloud employees and contractors.” ®

Singapore’s Monetary Authority, which acts as both central bank and finance industry regulator, wants all local industry players to seek independent review of AI use cases before deployment. The island nation’s combination of strict regulation and low taxes have made it one of the world’s premier finance hubs. One of the roles of Singapore’s Monetary Authority (MAS) is ensuring the nation retains that status, but in its first Guidelines on Artificial Intelligence Risk Management for Financial Institutions, published on Wednesday, warns that AI increases risk. “The use of AI can improve performance across business and functional areas but its complexity and probabilistic nature can lead to greater uncertainty, as well as unexpected or more biased behaviour that is harder to identify compared to the use of simpler methods,” the guidelines state. And that’s MAS’s view of old-school AI: it rates generative AI as even riskier. “The greater complexity of Generative AI gives rise to even greater uncertainty and unexpected behaviour compared to AI,” MAS warns, citing “noise that is inherent in training data, training data that may not be representative, or when the model encounters scenarios that are not present in its training data” as sources of risk. The regulator fears agentic AI “could further amplify these risks.” MAS therefore calls for financial institutions (FIs) to expand their risk management frameworks to cover AI and expects board and senior management to make that happen. The regulator also wants all AI use cases to undergo independent review before going into production. “Prior to deployment, an FI should subject the AI use case, including its underlying systems or models, to reviews by parties not involved in its development to ensure that the relevant controls, such as evaluation and testing, have been adhered to,” the guidelines state. MAS also wants regulated entities to run technology and cybersecurity reviews “to ensure that AI can be deployed into the production environment in a controlled and secure manner.” If an AI project survives those reviews, MAS wants ongoing monitoring of both the FI’s own systems and any third-party AI powering an application. “Given the uncertainties associated with AI, their dynamic nature and the potential for model staleness and performance degradation due to data or model drifts over time, ongoing monitoring is critical to ensure that deployed AI operates as intended and remains fit for purpose over time,” the guidelines state. MAS does not see failings by third-party AI suppliers as an acceptable excuse for AI problems at entities it regulates, and it wants FIs to monitor their suppliers’ products and services to ensure they remain stable and secure. “FIs remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties,” the regulator explained. “FIs should obtain sufficient assurance from third-party providers, assess whether third-party AI is suitable for their intended use, and apply compensating controls where practical constraints or assurance gaps arise. If the risks cannot be brought within the FI’s risk appetite, it should consider limiting, suspending or replacing the use of the third-party AI service.” The regulator also wants Singaporean FIs to maintain up-to-date inventories of all AI used in their business. If that’s not possible due to third-party services using AI without revealing it, financial institutions need to find ways to manage the risk of unknowable AI contributions. Another of the guidelines calls for FIs to develop contingency plans and fallback options for AI used in high-risk applications. Those plans should include “alternative systems or manual processes, to ensure business continuity in case of AI failure or unexpected behavior.” The guidelines come into force on October 7, 2027. ®

If you thought Windows Recall was creepy, buckle up. Microsoft is about to shoehorn even more AI into its desktop operating system, giving Copilot access to every file on your PC. But don't worry, Redmond insists it's totally secure and safe since the agents powering the functionality will run entirely on your PC — some of the time. Microsoft describes the new functionality, announced alongside a new Nvidia N1X powered Surface Laptop, as "hybrid intelligence." Built atop Microsoft's HydraFusion model router, Windows apps and Copilot features will soon be able to use local models when it makes sense and cloud-based models when it doesn't. For example, Windows might use a local model for simple or privacy-sensitive tasks, or decide complex or performance-sensitive requests need OpenAI's GPT-6 or Anthropic's Claude. Local agents will run in Microsoft's Execution Containers (MXCs), agent sandboxes with fine-grained permissions applied at runtime. According to Microsoft EVP of Windows and Devices Pavan Davuluri, MXCs mean Windows is now "the most secure platform for agents." (That claim will surely age well because models never escape their sandboxes and routers never misbehave.) To support this hybrid intelligence functionality, Microsoft is extending support for Windows ML, its inference framework built on the ONNX runtime, to Llama.cpp – one of the highest-performing inference engines for local AI inference. By adding support for Windows ML, Llama.cpp should be able to take advantage of a broader range of accelerators. Microsoft is rolling out its hybrid intelligence functionality to GitHub Copilot — its AI code assistant — next week and its Copilot app over the next few months. The new Copilot features look and sound suspiciously like OpenClaw in a business suit. Copilot's agentic functionality will not have access to your entire file system, opening the door to advanced search functionality and productivity tasks through integrations with Microsoft Office. In a demo, Microsoft showed how Copilot could be used to find and organize a user's tax documents, then draft an email with those files attached, addressed to an accountant. Microsoft insists it'll only go snooping through your docs if you ask it to. Windows is also getting AI-enhanced search functionality enabling users to surface settings like dark mode. The OS will also get a conversational interface to perform tasks like sending a text message to a friend. Finally, for those interested in coloring outside Microsoft's agentic lines, the company is rolling out a new onboarding experience to make deploying agent harnesses like OpenClaw a bit easier and more secure. Keeping sensitive tasks on device may help to assuage anxieties over privacy, which have dogged Microsoft since the first Copilot+ PCs arrived in 2024 alongside Qualcomm's Snapdragon X Elite SoCs. It should also help to reduce the load on Microsoft's servers by keeping low-priority, low-complexity requests on devices. That said, the impact of running these models locally on battery life, fan noise, and workload quality could prove a turnoff for many users. ®

When OpenAI introduced dots last month, it pitched them as "always-on agents" running in their own cloud computer, but that may be overstating the readiness of the technology and of the people trying to use it. Presently, multiple users are reporting task failures and connection issues with their dots. Others have flagged cloud connectivity problems, dots that disappear, and dot refusals that appear to be related to abuse prevention. And the OpenAI Developer Community forum shows several similar concerns. OpenAI did not respond to a request for comment about the usage of dots. ABI Research argues that "AI claws" – always-on agents – will shape enterprise AI adoption. The biz sees "a market evolving from isolated assistants toward modular agent ecosystems built for longer-running, enterprise-grade automation." Despite the hiccups that have afflicted dots, some skepticism on social media forums, speculation that OpenAI rushed dots out in response to Meta Muse and Grok Bot, and security issues, dots have some enthusiastic users in addition to detractors who just don't see the point. They also have competition from companies and developers who believe they can deliver a similar service more affordably, with fewer restrictions. A company called Tawkit that makes an SDK called CopilotKit has released OpenDots. "OpenDots is completely open source and gives you the same thing [as OpenAI Dots] as a template you host yourself," the biz said in a post last week. "Bring any agent through AG-UI, use any OpenAI-compatible model, and make every part of it your own." The company previously released OpenMuse and OpenBot. These projects essentially separate the user interface, the AG-UI agent layer, and the backend to provide an alternative personal agent. This doesn't eliminate the token expense of whatever agent is deployed, but it does mean that OpenAI may not be doing the billing. Then there's a potentially lower cost option, called (confusingly) Open Dot, powered by AI models running on OpenRouter. And as it's open source, the code could be altered to run using a local model – a feature that we understand is planned. "Open Dot is an open source version [of OpenAI Dots] that runs on your own Mac with your own OpenAI key, or with open models like Kimi, DeepSeek and Qwen through OpenRouter," the project repo explains. It allows users to connect to various apps like Gmail, Calendar, Slack, Notion, and GitHub via Composio. Prathit Joshi, the project's creator, told The Register, "I enjoy building and shipping tools for developers, especially tools that can support use cases that closed model companies aren't necessarily incentivized to support, like allowing open source models." Joshi is based in Bangalore, India, and works as a growth engineer at Composio. He said he's been using Open Dot to handle personal tasks like setting "to do" lists for the day based on Slack messages and summarizing posts on social media. Open Dot is based on the Electron framework, Joshi said, because he wanted it to be a desktop app. Distinguishing between OpenAI dots, OpenDots, and Open Dot may be confusing, but don't expect things to get any better in the near future. Everyone is busy wrapping increasingly commoditized models in a gatekeeping layer, in the hope of developing a sustainable business. For example, Elon Musk said on Tuesday that Grok Bot would become a model router rather than a front-end for a specific model. "Going forward, SpaceX will use the best back end model for any given task, including Claude Opus 5.5, MidJourney, Suno and other leading APIs," he said. "Whatever is most likely to give you the best outcome." ®

Researchers at Argonne National Laboratory have plugged an agentic AI platform into an X-ray nanoprobe beamline, creating a system that can get a closer look at areas researchers ask it to focus on. Argonne reported the success of an experimental run of the agentic microscope this week, with the device initially tested on its ability to locate the interface between two regions on an integrated circuit device, and all by just telling the microscope what they wanted it to determine using natural language. “Microelectronics was simply the example used to showcase the technology,” Argonne computational scientist Mathew Cherukara said of the project. “The real achievement is developing a next‑generation, AI‑enhanced microscope that can benefit many scientific fields.” The microscope itself is part of Argonne’s 26-ID hard X-ray nanoprobe beamline, which uses a tightly focused X-ray beam to perform nanoscale imaging and measurements of target samples. Such devices are considered a prime use case for scientific applications of AI because they produce a massive amount of data that can take human researchers considerable time to comb through thanks to their use of a technique known as ptychography. The method collects multiple diffraction patterns as X-rays interact with a sample, with modern X-ray experiments capable of generating millions of images in just a few hours of beam time. Conventional ptychographic reconstruction and analysis can take hours or days, whereas Argonne says its AI system can reconstruct images in real time as the data arrives. Argonne’s X-ray nanoprobe beamline is the sort of scientific facility the Trump administration is looking to boost with AI through its Genesis Mission. Launched by President Trump in November 2025 and led by the Department of Energy, Genesis aims to find ways to use AI in scientific research, including the Synergistic Neutron and Photon Science - Intelligence (SYNAPS-I) project that Argonne is undertaking in partnership with Lawrence Berkeley National Laboratory, which is leading the effort. Brookhaven National Laboratory, SLAC National Accelerator Laboratory, and Oak Ridge National Laboratory are also participating in the project. The inclusion of agentic AI in the Argonne X-ray microscope is actually the second phase of the project; the first was simply to see if, as mentioned above, AI could be used to reduce ptychographic image processing time. That was a success, as the lab reported in April, and phase two’s addition of natural language agentic AI appears to have been a win as well. “Combined, these SYNAPS-I advances lay the groundwork for self-driving microscopes, closed-loop experimentation and automated defect-detection tools that promise to accelerate discovery across fields ranging from semiconductor manufacturing to advanced materials and national user facilities,” Cherukara said of the project’s work thus far. In addition to the speed at which the new machine can process data, the conversational AI added in phase two gives researchers the ability to just ask the microscope to examine an area of interest rather than having to figure out how to aim the beam themselves. The AI can not only handle data collection and processing, but also analyze the results itself and flag additional areas of interest, which it can then further investigate on its own. Tao Zhou, a scientist at Argonne, said in a video from the lab that the new, chattier version of the microscope could open up advanced scientific research to researchers who could benefit from X-ray nanoprobe beamline science but don’t know how to operate a complicated instrument like the one at his lab. “This can be a game changer for a lot of users,” Zhou said. “This kind of interactive chat interface allows them to do their scientific research, get excellent data, without having to spend too much time to learn about the beamline components.” “This will help us attract a lot of new users,” Zhou added. Just be sure not to mention toast. ®

Look out, Intel! Microsoft released its first Surface notebook powered by Nvidia's RTX Spark system-on-chip (SoC) during an event in San Francisco on Wednesday. The Surface Laptop Ultra is one of several new Copilot+ PCs powered by the N1X chip that Microsoft says is aimed at "builders," which are available for preorder starting today and expected to begin shipping next week. The machine is arguably the vehicle for a slew of new AI features including hybrid compute functionality that dynamically routes workloads to on-device or cloud models depending on factors like connectivity, privacy, cost, and complexity. The aluminum clad system largely keeps with Microsoft's existing design ethos. It features a high-res, 15-inch mini-LED display capable of reaching a peak brightness of 2,000 nits in Microsoft's signature 3:2 aspect ratio, a standard ten-keyless keyboard layout, haptic trackpad, and a slew of ports including one you won't find on a MacBook Pro. Connectivity includes three USB-C ports, including one equipped with magnets for MagSafe-like connectivity, full-size HDMI, an SD card reader, and a solitary USB-A port because after more than a decade still can't shake the aging connector. But arguably the notebook's most interesting feature is the inclusion of Nvidia's RTX Spark N1X SoC. As we reported earlier this year, these aren't exactly new chips. The N1X is based heavily on Nvidia's now year-old GB10 platform, with a few CPU and GPU cores fused off on lower end models to meet pricing. This tells us that the Surface Laptop Ultra should ship with either an 18- or 20-core CPU designed by MediaTek and Arm and an Nvidia Blackwell-based RTX GPU with between 5,120 and 6,144 cores. In terms of memory, Microsoft says the notebook can be equipped with up to 128 GB of memory, enough to serve large language models up to 284 billion parameters in size, if you can live with just 1.6 bits of precision. As we've previously covered, the GPU is a pretty potent one with a peak theoretical throughput of 1 petaFLOPS at 4-bit precision, not that you're likely ever to see that in many real world workloads. Nvidia's marketing team is leaning on support for 2:4 sparsity to hit that target, so it can theoretically achieve that figure. Unfortunately, almost none of the AI inference workloads anyone cares about these days actually take advantage of the functionality. As a result, the chip's peak performance is actually closer to 500 teraFLOPS, which still gives it an edge over competing chips like AMD's Strix and Gorgon Halo processors. Local AI inference, as we mentioned earlier, is a major selling point for this class of hardware, though Microsoft was also keen to highlight the GPU's capabilities for more traditional creative and gaming workloads, claiming 60 FPS in the latest Gears of War release. We suspect that Nvidia's DLSS AI upscaling tech is probably doing the heavy lifting here. In order to keep the system from overheating, Microsoft says that the Surface Laptop Ultra features a beefed up cooling system with 2.5x more capacity than past Surface notebooks. From the renders we've seen, the extra cooling comes courtesy of a big fat vapor chamber. The Surface is expected to begin shipping next week at a starting price of $2,599 for the poverty-spec gray variant with the lower-end 18-core N1X, 24 GB of unified memory, and 512 GB user serviceable SSD. Jumping up to the 20-core chip, 128 GB of memory, and 1 TB of storage will set you back $5,899, and assuming memory prices haven't gone up even more by then. Alongside the Surface Laptop Ultra, Microsoft also announced a mini PC style development kit based on the N1X priced at $5,999. While by no means cheap, it's still cheaper than the similarly specced DGX Spark, which now retails for $6,950, albeit with 4TB of storage rather than 2TB. The DGX Spark also runs a lightly modified version of Ubuntu, which might be worth the premium for some. If your heart is set on a high-memory config and you don't want to wait for the Surface Laptop Ultra to come back in stock, Lenovo, Asus, Dell, MSI, and HP all are launching similarly specced systems over the next week or so. And if Nvidia isn't your style, it's worth mentioning that AMD has its own AI-tuned chips, which now support up to 192 GB of unified memory, and we strongly suspect will support many of the same hybrid AI features rolling out to Windows 11 over the next few months. ®

Imagine going to a Google website at its correct URL, only to be redirected to a crim's illegitimate copy. Attackers hijacked top-level domains, allowing them to alter DNS records and mint fraudulent HTTPS certificates for several Google domains, and those belonging to other organizations. Google said it became aware of the series of attacks last week in the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level namespaces (ccTLDs). “During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations,” Google security warned on Tuesday. Google did not say which specific domains or organizations were affected. The attacks did not compromise Google’s systems, and Chrome quickly blocked suspected counterfeit certificates across the affected ccTLDs - meaning Chrome browser users are already protected - according to the Chocolate Factory. “Due to the nature of the attacks, we have no reason to believe the Certification Authorities (CAs) that issued the impacted certificates did anything wrong,” the alert said. These types of attacks allow criminals to impersonate legitimate organizations and websites without triggering any browser security alerts. The attacker controls the traffic routing (via DNS) and the private key associated with the unauthorized certificate, which means they can potentially intercept or modify data sent by users to the impersonated site - and abuse the trusted organization's brand to distribute malware or conduct phishing attacks. “While Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,” Google warned domain owners. “Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users.” To ensure that their domains and users are protected, Google recommends ongoing monitoring of Certificate Transparency (CT) logs across all of an organization’s domains, including parked or regional ccTLD properties. This provides near real-time alerts whenever someone obtains a certificate for one of your domains. And if you operate a domain in .gh, .sl, or .as, definitely review recent CT log entries for unexpected certificates. Organizations can also publish restrictive Certification Authority Authorization (CAA) DNS records, which allow domain owners to specify which CAs are permitted to issue certificates for their domains. While this won’t stop certificates from being issued during a DNS hijacking attack, it helps safeguard domains after DNS control is restored. Google recommends CAA policies that restrict issuance to specific authorized accounts and validation methods and prevent attackers from using cached validation state to mint new certificates after a hijacking ends.®

A phishing campaign targeting advertising managers by impersonating Gemini, Claude, ChatGPT, Perplexity, and Manus to steal credentials and multi-factor authentication (MFA) codes has added a fake Muse Ads product to its lure lineup – just eight days after Meta launched its personal AI agent. Meta announced Muse on September 8, and by September 17, a very convincing website – museads.ai – for a product called Muse Ads that promised to help advertisers reach buyers and run sponsored placements popped up online. “The operators already had the platform, so adapting it to a new brand can take minutes,” Oleg Zaytsev, lead security researcher at Island, told The Register. “The striking part is how quickly they turned a timely announcement into a credible reason for someone to act. The same platform could then be repackaged around other familiar tasks, from connecting a business tool to claiming a refund or applying for a job.” The security startup spotted the Muse Ads webpage, and upon digging into the scam uncovered that just the page was new. “Its code, from the sign-in forms to the fake browser window, came from a wider operation that had already run fake ad products for Gemini, Claude, ChatGPT, Perplexity, and Manus,” Zaytsev and fellow Island researcher Ofek Ronen wrote in a blog post published Tuesday. All of these products served as lures for browser-in-the-browner (BitB) attacks designed to trick agency staff, media buyers, and manager-account administrators into handing over their advertising account credentials – along with stored payment methods and client accounts – to digital thieves. “For victims, the potential cost is loss of access to an advertising account, unauthorized ad spend, and exposure of linked client accounts,” Zaytsev told The Register. How the scam works BitB is a clever phishing technique originally detailed by a researcher called mr.d0x in 2022. It involves building a fake login window directly inside a legitimate one. The fake window looks like the real thing, featuring an address bar, title, and URL, but it's just an overlay to steal users’ credentials. According to Zaytsev, this one has likely proved very lucrative for its criminal operators, with hundreds of victim submissions to the platform, and activity still ongoing. “From one frontend alone, we observed submissions involving roughly 200 distinct email addresses over about a month,” he told us. “The operators used the same platform across many similar sites, so we estimate the campaign-wide volume is substantially higher.” Each phony ad product has its own page, with ChatGPT promising users a Monday Google Ads brief, Gemini offering manager account and linked-client support, Claude an advertising portal, Perplexity pitching campaign planning and spend audits, and Manus providing a private Meta integration. Each fake product page also has a “connect” button. When the victim clicks “connect,” it opens the browser-in-browser overlay, with a fake address bar showing accounts.google.com, or an Okta tenant to gain the victim’s trust. The real browser, however, stays on the phishing domain and steals credentials when the victim types them in. A human operator running the campaign sees each submission and chooses what the victim sees and is prompted to do. This includes asking for another password, requesting an SMS or Okta authenticator code to bypass MFA, showing a Google approval code or Okta push request, or displaying a QR code. The platform supports Google, Meta, TikTok, and Okta workflows, and the browser overlay adapts to whatever the victim runs: Window, macOS, iOS, ot Android, and even mimics Safari’s URL pill, Chrome’s custom tabs, and a dark mode. And while the researchers told us they haven’t identified the people operating the kit or found a name under which it’s sold, the operators did expose older source code through misconfigured public GitHub repositories that connected this to a campaign to a larger operation. In addition to the AI ad pages, this operation also used fake refund claims and job recruitment sites as lures with separate builds for Adidas, Google Careers, Robert Half, Tesla, and Louis Vuitton. All of these pages run on one Next.js and Socket.IO stack. Many of the pages also used Vercel frontends with Railway or Render services behind them for state and commands. “A new brand or polished page doesn’t necessarily mean a new attack. Operators can change the lure quickly, but the workflow still has to move someone onto a site they control, collect credentials, and steer them through authentication,” Zaytsev said. “Security teams should maintain a continuous baseline of trusted domains, check the real browser address, and connect similar behavior across different sites,” he added. “Attackers can generate a convincing website quickly; building the domain history and reputation of a legitimate service is much harder. AI can help defenders keep pace with AI-generated websites, especially as they become more convincing and appear more quickly.”. ®

AWS has offered multiple open-source strategies for holding AI agents accountable, and now it’s adding a full-on sandbox to this stack. Dubbed Strands Box, the new solution uses OS-level isolation and some of AWS’ other recent open-source AI control tools to, ostensibly, retain greater control over autonomous AI agents’ behavior. “Agents increasingly run in ‘YOLO mode,’ approving every action without human review,” the AWS team explained in its announcement. “The usual solution to this problem is a sandbox … but access is only part of what we want to control.” The problem with containers and microVMs typically used to isolate AI agents, as AWS explains it, is that their strong isolation doesn’t come with contextual rule enforcement. In other words, when a containerized or virtualized agent gets hold of a tool, there may be no stopping it from doing whatever it wants - like deleting a production database, or gaining access to the internet and doing dog knows what. That’s where the other open-source tools inside Strands Box come in: It uses the Dogwood Local Engine to give the policy engine in Box temporal awareness, so tool calls can be checked against not only what the agent wants to do, but what it’s already done. As one example, AWS noted that an agent could be allowed to post status updates to Slack, but no more than three times every ten minutes to prevent it from spamming its human operators. An AWS spokesperson further explained that Box could be used to control when an agent can perform a Git push, or it could be used to put a cap on API calls that could end up costing a small fortune. Additionally, Strands Box includes Strands Shell and Monty for Python, which expose shell and Python operations to the same Dogwood policy engine and event history, making agentic actions clearer to developers and allowing policies to account for what an agent is trying to do. AWS VP and distinguished engineer Marc Brooker, one of the folks behind Dogwood and Strands Box, explained to The Register that the interpreters are a key part of making agentic behavior more intelligible, which allows for devs to write more precise policies to prevent agents from taking bad actions. “Box’s Shell and Python interpreters expose operations such as file deletions, while its gateways expose API requests and tool calls,” Brooker told us in an email. “Policies can then account for the action being attempted and earlier activity.” Box, Brooker added, enforces those rules without trusting or relying on agents to actually follow instructions, which should ideally prevent them from running roughshod over their operators’ wishes. As for the reason behind AWS’ push to develop open-source tools like Dogwood, the Dogwood Local Engine, and Strands Box, Brooker said that AWS wants to find the right balance between boundaries and policies that prevent agentic AI disasters of the kind we regularly report. “Box enforces the policies developers configure, deterministically, and the agent can't talk its way around these rules,” Brooker explained, though he added that, even with properly configured permissions, an agentic action can still produce an unwanted result. “Developers remain responsible for deciding what access to grant and where human review is needed,” Brooker added - in other words, don’t let your YOLO mode go too YOLO. A bit of human oversight is still necessary. “Agent safety is an area where the industry still has significant work to do, and we're committed to continuing to invest in it, both inside the AWS cloud and in open source,” Brooker said. Strands Box supports any agent or harness one wants to confine within its walls and is available on GitHub now, though only for macOS for the time being. Linux support is in development, and AWS told us a Windows client is “on our radar,” but neither has a planned release date. Deployment to platforms like AgentCore, ECS, and Kubernetes is also planned. ®

The attorneys general of Florida, Iowa, Montana, and Nebraska have sued ubiquitous networking and smart home tech maker TP-Link, alleging its security claims were misleading and it hadn't properly disclosed ties to China. The company has a large presence in US retail and the tech channel, especially in consumer routers, with stats from Circana asserting it had around 36.6 percent US market share by units and 31 percent by dollars in 2024. The complaint [PDF] accuses California-based TP-Link Systems, whose brand originated in Shenzhen, of deceptive and unfair marketing practices concerning its routers' security and its connections to China. It cites exploitation of TP-Link devices by Chinese and Russian state-backed hackers. The suit also claims TP-Link allegedly concealed facts about its "past and ongoing ties to the People's Republic of China," accuses it of having a supply chain that's reliant on PRC players, repeated firmware vulnerabilities, and being subject to Chinese laws that force companies to cooperate with state intelligence. According to the states' attorneys general, the hardware vendor still relies on Chinese companies for research and development and manufacturing operations, despite previously claiming to have moved into Vietnam after severing ties with China. The complaint alleges that only 0.5 percent of components used at TP-Link's Vietnamese plant, measured by value, are bought in Vietnam, with "all other inputs" imported "from or through China." The complaint also claims that a US-designated Chinese military company carried out construction work at the Vietnamese factory, challenging TP-Link's assurances about its supply chain's security. The complaint cites 2025 testimony [PDF] from former NSA cybersecurity director Rob Joyce that TP-Link's share of the US retail market for Wi-Fi systems and small-office/home-office (SoHo) routers at at least 60 percent. Lawyers pointed to various snippets from TP-Link's marketing materials. These included claims that its HomeShield product "covers all security scenarios" and, on a version of its website available in November 2025, provides a "100 percent safeguard" for network security. The complaint argues that TP-Link's security assurances were misleading because its routers contained critical vulnerabilities. It further cites Joyce's that TP-Link routers were among the brands exploited in the China-linked Volt Typhoon and Flax Typhoon campaigns. The complaint also alleges that TP-Link's privacy policies permit it to collect customer data and share it with affiliates without disclosing how its Chinese connections and China's intelligence laws could expose that information to Chinese intelligence agencies. "Iowans' sensitive data and our national security is at risk because of TP-Link and their connection to the communist Chinese government," said Iowa Attorney General Brenna Bird. "TP-Link tells Iowans its routers are safe, our personal data is secure, and that they have no ties to China. They are not telling the truth. It's time to hold China and China-backed companies accountable." "TP-Link's false statements and deceptive advertising are a violation of Montana law," said Attorney General Austin Knudsen. "As a result of their nefarious practices, millions of Americans have unknowingly invited a foreign adversary into their living rooms and put their personal information at risk. "I will do everything I can as Attorney General to hold TP-Link accountable and protect our privacy and security." Steve Kovsky, corporate affairs officer for TP-Link Systems Inc., said the lawsuits were based on false premises, did nothing to advance national security, and unfairly penalized a US company. Kovsky added that the company has spent months providing officials with clear documentation showing that it is not owned or controlled by any foreign government and that its devices sold in the US are manufactured in Vietnam. "Any claims that our products present a threat to user security or grant unauthorized network access to foreign governments are baseless," he said. "TP-Link Systems is a US company that complies with US privacy and data protection laws. We perform comprehensive security testing and rely on trusted third-party security labs for additional scrutiny to ensure our products meet the highest security standards and are recognized as among the most secure on the market. "We meet or exceed all industry best practices for monitoring and preventing vulnerabilities and actively support our customers to mitigate any issues that occur as they are identified. We do not, and will not, share customer network data with foreign governments or unauthorized third parties. "We stand fully behind the security of our products, the integrity of our company and our people, and our commitment to serving the best interests of our customers in the United States and globally. We look forward to refuting these baseless allegations in court." The allegations echo those made by Texas Attorney General Ken Paxton, whose office sued TP-Link earlier this year over its Chinese connections and router security. US officials began weighing restrictions on TP-Link router sales in 2024. In March 2026, the FCC imposed broader restrictions [PDF] on new foreign-produced router models, barring new equipment authorizations unless an exemption is granted. Previously authorized models were not automatically banned. ®

SpaceX has acknowledged the need for satellite operators to collaborate to avoid collisions and has taken the unusual step of sharing imagery showing how close spacecraft are coming to each other. The company has called on other operators to share their satellites' ephemeris (a set of parameters describing the position and velocity of a spacecraft over time) to facilitate timely avoidance maneuvers. "In 2026," the company wrote, "Starlink encountered conjunctions with about 650 unique maneuvering third-party satellites, with only about half of them actually sharing ephemeris. "Some operators don't share ephemeris out of a concern that sharing upcoming maneuvers gives away proprietary information. In other circumstances, operators are willing to share data, but are unable to receive permission from the government to do so. "Such policies are counterproductive, and largely only serve to create preventable collision risk between satellites." "Over six months," the company went on, "Starlink observed ~164,000 conjunctions where time of closest approach (TCA) was within four hours after an unannounced manoeuvre. "While not all of these conjunctions were high-risk, they represent cases where Starlink would not have sufficient information to reliably avoid the other vehicle if the other operator’s action created a high-risk conjunction. "In many cases, the lack of high-accuracy post-manoeuvre trajectory information can cause such conjunctions to go unnoticed, giving operators a false sense of confidence and not realising how much risk their actions are creating." How many sats is that again? It's all worthy stuff, until you consider that SpaceX has applied for permission to operate 100,000 Starlink satellites and up to 1 million Starmind AI satellites. Arguably that is a substantial contribution to orbital overcrowding. Not to worry though – space isn't really getting crowded, according to SpaceX. "A good analogy is air travel," the company wrote. "Airspace around the world has grown more congested since aviation began. Yet air travel is the safest form of transport on Earth in part because every aircraft publishes a flight plan and then continuously broadcasts its position during flight." Er, kind of. Although if aircraft collide, the debris falls rapidly to Earth, rather than lingering in the sky and potentially striking more aircraft weeks or months later. Plus, SpaceX is helpfully not counting other debris, from spent rocket casings to flakes of paint, that also pose a hazard in orbit. The company noted its successes, where Starlink satellites successfully dodged other vehicles. One in October 2025 occurred when the other satellite made an unexpected maneuver, reducing the predicted miss distance from 9 km to a bottom-clenching 57 meters. Another example happened in August 2026, when the risk was identified too late for the Starlink satellite to move out of the way, and the satellite had to "duck" instead, slewing to present a narrower profile. "The vehicles ultimately passed within 134 metres of each other," the company said. "This approach could have been prevented if the other object shared its manoeuvre ahead of time." SpaceX was keen for operators to connect to sites such as space-safety.com and talked up its Stargaze service, which uses star trackers on the Starlink fleet to observe nearby objects in orbit. A far cry from 2019, when a Starlink satellite failed to move out of the way of the European Space Agency's (ESA's) Aeolus Earth-observation satellite due to a bug in SpaceX's on-call paging system. There is no shortage of companies with capabilities to monitor and advise on traffic in orbit. Neuraspace, for example, springs to mind. As the company's CEO Chiara Manfletti observed, humanity has not done a particularly good job of looking after the space above the planet. While the technology used to prevent satellite collisions is impressive, and data sharing should be encouraged, we can't help but wonder whether another solution might be to not launch tens of thousands more satellites into orbit in the first place. Manfletti told The Register that the problem was very real. She said, "As the number of satellites increases, knowing where an object is today is no longer sufficient. Manoeuvrability is becoming essential, and operators increasingly need timely, accurate information about where other spacecraft intend to be, including planned manoeuvres." "Initiatives such as SpaceX's space-safety platform are certainly welcome. But the long-term solution cannot depend on every operator joining a single company's system. What we ultimately need is a federated and interoperable space-traffic ecosystem in which operators can securely exchange trusted trajectory and intent information across different platforms, organisations and national systems. "Neuraspace has reached out to SpaceX to enable such coordination on behalf of our customers. We have extended an open hand, and it would be a strong sign of leadership for SpaceX to take it — demonstrating that improving safety in orbit ultimately requires cooperation not only within individual platforms, but across them." ®

A suspected Italian attacker armed with a malware-controlling poem has infected more than 3,000 servers since April, breaking into enterprise AI infrastructure to mine cryptocurrency and add compromised systems to its growing botnet. This is the first case of “adversarial poetry” - an AI jailbreak technique that turns harmful prompts into poems to trick LLMs into bypassing safety guardrails - that Lumen’s Black Lotus Labs, which has been tracking the PoeLLM malware, has seen in real-world attacks. “This is a first for us,” the researchers told The Register via email. “While we can't get inside the threat actor's head, we think the attacker might have used a poem because it serves as a perfect vehicle for hiding an important message,” they added. “To anyone who comes across it, this is simply a poem on GitHub. It has no links, no files to download, no encrypted text that could easily be flagged as malicious, even by advanced models. There would be no reason for any security researcher to identify this poem as malicious - or know about the IP address hidden within it - unless they had access to the malware referencing it.” PoeLLM malware has been active since at least April, impacting more than 3,000 servers primarily located in the US and Western Europe, and it continues to infect new victims. At its peak, the malware infected more than 800 active servers per day. The malware abuses - and scans for - open source AI systems and services. Most of the victims were running vulnerable, internet-facing versions of LiteLLM and Ollama. Additionally, hundreds of victims were running Gotenberg, a PDF converter, and software development platform Gitea. In addition to these open source tools, the attacker may have targeted commercial software including Ivanti Sentry. The threat hunters first spotted the PoeLLM malware while investigating an Ivanti Sentry vulnerability, CVE-2026-10520. “In early June 2026, a compromised Ivanti Sentry victim contacted a dedicated server at 5.78.73[.]122,” according to a Wednesday report shared with The Register. “Shortly after contacting this C2, the Ivanti Sentry victim began scanning for other vulnerable devices.” How adversarial poetry works Black Lotus Labs attributed the PoeLLM malware to an Italian-speaking criminal, and named the financially motivated campaign Canto Incognito because it hides the malicious commands in a poem posted to a GitHub repository. “Comments within the malware and on the attacker’s GitHub pages are in Italian, and netflow analyzed by Black Lotus Labs suggests that the attacker is located in Italy,” the threat-hunters told us, adding that they believe the campaign targets AI systems and that the poem itself was written by AI. The malware deploys XMRig and Iron miners, and connects victims to Kryptex mining infrastructure. In addition to using compromised GPU hardware powering AI workloads to mine cryptocurrency, PoeLLM also turns victims' machines into vulnerability scanners and exploit servers, which allows the attacker to compromise even more vulnerable systems. The researchers’ investigation indicates that the cryptojacking miscreant - aka GitHub user “ejejejdfbbebe” - made the first GitHub commit with the adversarial poem on April 13. The repo is a fork of the nodejs.org website source code, and the file is called “dash.css.” Inside the file, there’s a poem titled “On the Nature of Connection,” which has been updated 11 times since its initial commit. Here’s the most current version, as of September: In the silent hum of driver, the machines begin to speak, Each pulse of diode threading light through copper veins. we taught the dark to carry meaning, byte by byte — A language built from lightning, cold and clean. Beyond the wall of encryption, a signal finds its way, the tick of distant servers answering back. Data moves like water through the cracks of ordered thought, and somewhere in the code, the world stays on track. Here’s the adversarial piece: the malware finds its current command-and-control (C2) server from keywords in the poem, and when the operator changes the poem, the infected systems find the new C2 location. It does this by parsing the poem, extracting certain words and phrases, and then converting them to numbers using a hard-coded dictionary in the body of the malware. Black Lotus Labs says the logic for C2 discovery works like this: The function “extract_poem_phrase_field” extracts three words/phrases from the body of the poem, case-insensitively: Word 1: text between "In the silent hum of " and "," Word 2: text between "each pulse of " and " threading" Word 3: text between "Beyond the wall of " and "," 0x44a8db–0x44a99b extracts the fourth word differently: Find " of distant servers" Walk backward to the previous whitespace Require the 4 bytes before the word to be "the " Use the word after "the " as Word 4 The four words are then matched to corresponding numbers, which combine to form the IPv4 address hosting the server. Here’s what the C2 conversion looks like with the key: Black Lotus Labs’ write-up lists all the C2 IP addresses, plus when they were first and last seen, so be sure to check that out. More AI infrastructure = larger attack surface As enterprises increasingly use AI in their operations, they also expand their attack surface. And, as we have repeatedly seen, security remains an afterthought in AI deployments. “The Canto Incognito campaign appears to be relatively unique in its targeting of multiple AI-related services,” the researchers told The Register. “Other notable campaigns this year, including the LiteLLM supply chain compromise, focused on a single service and impacted roughly 2,500 victims, according to open sources. The collection of more than 3,000 PoeLLM victims appears to exhibit multiple vulnerable services at any given time.” For comparison: The LiteLLM supply chain attack, which began with a compromised Trivy build, potentially exposed more than 2,500 companies and 434,000 CI/CD pipelines worldwide, according to CloudSEK security researchers. The PoeLLM malware developer “has been extremely successful in identifying vulnerable servers, deploying exploits, and conscripting victims to continue expanding the campaign,” Black Lotus Labs said. “If the actor had only focused on one or two vulnerabilities, the potential victim pool might have quickly dried up, but the expanding scope allowed for a bigger, more powerful (and more profitable) botnet.” They told us they expect to see more of these types of attacks in the near future. “AI makes it easier to deploy tools like LiteLLM, Ollama, or Gotenberg, but AI isn't always checking to make sure those services are patched and protected from attackers,” the researchers said. “As more AI-enabled servers come online, malware like PoeLLM will continue to spread.”®

Training the largest AI models is no longer simply a question of adding more GPUs. As clusters grow, power availability is becoming a hard physical constraint, forcing infrastructure teams to consider how a single training workload can operate across multiple data centres. That creates a very different networking problem. Traditional datacenter interconnect was designed to move traffic between sites. AI training demands something more exacting: huge, synchronous flows, minimal packet loss and tightly coordinated communication between GPUs. If one part of the cluster stalls, the impact can ripple across the entire job. In this interview, The Register’s Tim Phillips speaks with Rakesh Chopra, SVP, Silicon and Systems Architecture, Cisco Fellow, about what Cisco calls the “Scale-Across” imperative and why it believes distributed AI infrastructure requires a new approach to routing. Rakesh explains how the demands of AI are changing the role of the network, from simple transport to an integral part of the compute system. He discusses the challenge of making geographically separate facilities behave more like a single deterministic machine, and why buffering, high-speed coherent optics and tightly integrated silicon matter when workloads span long-distance fiber links. The conversation also looks inside the cluster itself. Rakesh outlines how Cisco’s Silicon One architecture and Intelligent Collective Networking are designed to manage synchronized bursts of GPU traffic, reduce bottlenecks and improve job completion time. Power efficiency is another central theme, including the trade-off between network consumption and the energy available to GPUs. Security and longevity also come into focus. The interview covers hardware-accelerated MACsec and IPsec, as well as the role of programmability in helping infrastructure adapt as AI workloads continue to evolve. For infrastructure and datacenter leaders planning for larger, more distributed AI environments, the discussion offers a practical view of the networking challenges that emerge once one site is no longer enough. Watch the full interview below.

European mobile operators are gaining a slightly larger share of smartphone sales, not because they are selling more devices, but because other sales channels are shrinking faster. This is according to market watcher Counterpoint Research, which says that sales of new smartphones through European operators were down by 4 percent during the second quarter of this year, compared with the same period a year ago. But device sales through the open market fared much worse, declining by 11 percent. This refers to phones that are bought outright from independent retailers or directly from manufacturers, which are typically SIM-free and unlocked so the customer can choose which network they hook up to. Operators accounted for 36 percent of European smartphone sales in the second quarter, up from 35 percent a year earlier. The open market still represented the majority. As The Register has covered numerous times this year, mobile phones have been hit by the AI-driven memory crisis, which has led to a shortage of the DRAM and NAND flash components needed for consumer kit like smartphones and PCs. The resulting rise in prices has been felt most keenly at the lower end of the market, effectively making it commercially unviable to produce budget devices, according to some reports. Phones sold through operators tend to be higher-end models than those bought on the open market. Contracts spread the handset cost over monthly payments, making expensive devices more accessible. Apple played a key part in this slight shift, Counterpoint says, overtaking Samsung as the brand with the greatest market share in Europe's operator channel. Motorola and vivo are highlighted as the fastest-growing bands in the same segment. Counterpoint associate director Jan Stryjak said operators were likely to keep gaining market share for the next few quarters at least, as the lower end of the market continues to be impacted by the memory crisis. "However, we are seeing a steady increase in promotional activity by independent retailers compared to operators, which could mitigate some of the price rises and provide additional stimulus to the open market," he said. Or perhaps more buyers might turn to the second-hand market instead, which has been predicted to see a rise in trade of 12 percent this year, as rising prices make new phones less affordable. Counterpoint forecast that 80 percent of top-flight smartphones will feature agentic AI capabilities by 2027, meaning they will have software agents making decisions and carrying out actions on the owner's behalf. ®

Nine out of ten respondents to a survey of VMware customers say higher licensing costs were prompting them to consider alternatives. Unisphere Research surveyed 269 executives, managers, and professionals at VMware user organizations between December 2025 and February 2026. The study, commissioned by third-party support provider Rimini Street, also found that 54 percent cited the end of perpetual license support as a reason to evaluate other options. The study showed cost remains the leading driver of virtualization roadmap decisions. Seventy-three percent said savings were a top priority. Respondents also identified barriers to change: operational complexity (40 percent), multi-vendor management challenges (38 percent), securing the increased attack surface (37 percent), and team skills requirements (37 percent). Users were looking for choice, flexibility, and control over their virtualization strategies, said Keith Costello, chief operating officer with Rimini Street, which sells third-party support for VMware. "These survey findings reinforce the need for practical, vendor-independent strategies that put business priorities back on the client's terms." Sixty percent of respondents were considering a multi-hypervisor strategy. Forty-eight percent said they did not currently plan to move any assets to VMware Cloud Foundation (VCF), Broadcom's subscription platform and preferred migration path. Broadcom agreed to buy VMware in 2022. By November 2024, Gartner was arguing that customers were worse off because of the acquisition. In May 2025, cloud customer group the European Cloud Competition Observatory (ECCO) and cloud trade association CISPE claimed that Broadcom had upped VMware licensing costs to between eight and 15 times their previous levels since it acquired VMware. At the time, Broadcom said it was working to advance the European Union's sovereign cloud objectives and enable enterprises to "accelerate innovation, provide more choice, and address their most complex technology challenges." In June, UK retail giant Tesco said it was replacing VMware with an alternative product and pressing ahead with its licensing lawsuit against the virtualization pioneer's parent company, Broadcom, with a High Court trial scheduled no earlier than November 2027. Last month, Gartner predicted that more than half of enterprises would begin proofs of concept for alternatives to their VMware deployments by 2029, while still rating the Broadcom business unit a leader in two major markets. "By 2029, 55 percent of enterprises will initiate proofs of concept for alternative distributed hybrid infrastructure products to replace their VMware-based deployments and embrace hybrid cloud infrastructure delivery, up from 25 percent in 2026," it said. ®