The Register

The Netherlands Tax and Customs Administration has abandoned its planned Microsoft 365 cloud migration in favor of services hosted on infrastructure it controls, alongside European open source alternatives. Email and calendars will move on-premises in 2027, followed by storage and collaboration services later that year and in 2028. The letter to parliament from Eelco Eerenberg, State Secretary for Finance, follows an earlier decision to pause the Microsoft 365 rollout. The tax authority selected Microsoft 365 in 2025, but the decision attracted criticism. In June, the Dutch Advisory Council on ICT Assessment recommended rolling back the cloud services rollout, which had reached about 5,000 of the 47,500 employees across the tax, customs, and benefits services, rather than completing it as planned by the end of 2026. According to the board, the design of Microsoft 365 in the public cloud "falls short on information security, information processing and future-proofing." On security, the board noted concerns about sending confidential documents, which currently travel over government networks, via American servers. The board also criticized reliance on standard Microsoft encryption for sensitive data rather than Double Key Encryption, which would give the administration greater control. End-to-end encryption was not enabled by default for one-to-one Teams calls and was unavailable for group calls under the chosen configuration. To be fair to Microsoft, many of these concerns (for example, around encryption) stem from the design selected. However, others are harder to dismiss. On future-proofing, other concerns included vendor lock-in and the risk of reduced flexibility and sovereignty from choosing a single-supplier solution with one American (cloud) provider. There was also a concern about a lack of an exit strategy for when the Tax and Customs Administration wanted to move on to more sovereign alternatives. In this week's letter, Eerenberg wrote: "In 2027, the provision for mail and calendar will be realized on-premises. Later in 2027 and 2028, European open source solutions for personal storage and collaboration functionalities will follow. This allows us to work toward a sustainable and more autonomous solution for these functionalities." Increased datacenter capacity has made the on-premises option possible, Eerenberg said. The revised approach will reuse existing licenses where possible to limit additional investment. The reversal creates complications for records management, however. Some planned capabilities in the Microsoft 365 package are unavailable on-premises, and the administration is still assessing how to replace them. Microsoft is no stranger to public bodies in the Netherlands, and a recent report showed that a majority used the company's cloud services. However, concerns about US authorities' ability to compel disclosure of data held by US providers under the CLOUD Act have loomed large in recent years. The risk has prompted European governments to consider reducing their dependence on US providers and moving to more sovereign solutions. It is early days, and agencies report teething trouble switching. A colorful report from Politico quoted an unnamed European Commission staffer describing the Teams alternative supplied by Element as "absolute shit" on an internal message board. The report does not establish how widespread those complaints are. The Matrix protocol underpinning Element's software also powers the French public sector messaging service, Tchap. Element boss Matthew Hodgson was upbeat about the European Commission deployment, telling The Register: "We've only had positive and constructive feedback from our actual customers; the leaders and IT functions that are driving sovereignty. "There's inevitably a few unhappy change-resistant users in large deployments, but we work in lockstep with our customers to gather feedback and incorporate it, especially during the trial phase." As for sovereignty more widely in Europe, Hodgson said: "European governments are moving to alternatives that give them greater sovereignty. They can't leave themselves exposed to being deplatformed, and they recognise that traditional centralised technology isn't resilient enough for an increasingly unpredictable geopolitical climate." Frank Karlitschek, founder and CEO of Nextcloud, a vendor of storage and collaboration software, said: "It is great to see Dutch tax authorities have decided to work toward a sovereign digital workplace. This will benefit the resilience of their operations. "European Public sector organizations mostly use software from a few large, proprietary providers, which has led to strong dependencies. "Organizations have recognized the risks of digital dependencies and are looking for better options to have full control over their data, infrastructure, and underlying technology. The organizations now aim to build a more resilient IT stack." Karlitschek noted a trend forming across Europe. According to Nextcloud, it added more than two million sovereign workspace seats in 2025. The Register approached Microsoft for comment, but the Windows behemoth has not yet responded. ®

The FBI and US Secret Service (USSS) say criminals using credentials linked to the FortiBleed campaign are locking organizations out of their Fortinet firewalls. The agencies published a joint advisory on Tuesday, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries. "Based on initial responses, some victims may get locked out of their Fortinet devices if the threat actor either deletes or changes the password for original accounts on the system," their advisory [PDF] states. "During the initial intrusion, threat actors create new accounts not previously on the device. In certain cases, threat actors delete existing accounts to block organizations from accessing affected devices and to maintain persistence on the system while attempting lateral movement within the environment." The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways. Criminals use credentials from earlier breaches and infostealer logs for credential stuffing and password spraying, then extract password hashes from compromised devices and crack them offline using GPU-accelerated clusters. The agencies urged organizations to restrict internet-facing management access, terminate active administrative and VPN sessions, reset passwords, and enable phishing-resistant multi-factor authentication. The advisory also links FortiBleed to ransomware campaigns, saying initial access brokers supplied compromised-network access to ransomware affiliates. The Register previously reported on the connection, identified by SOCRadar. The current evidence points to affiliates working for the INC/Lynx and Payload ransomware groups making use of the credentials, and SOCRadar said in July that it had seen at least 12 confirmed ransomware attacks stemming from FortiBleed. The agencies encouraged victims to report incidents, while noting that organizations were not obliged to provide information in response to this advisory. The FBI and the Secret Service said victim reports could help identify indicators of compromise and warned against paying ransoms. ®

Last month at Rails World 2026, Ruby on Rails creator David Heinemeier Hansson gave a relentlessly optimistic keynote in which he suggested AI has all but eliminated the need for developers to manually write code. But perhaps DHH, as he is known online, shouldn’t delete his code editor quite yet. On Sunday, DHH posted about a test in which he had frontier agents implement and optimize his company’s Campfire group chat app in three languages: Elixir, Go, and Rust. He then compared the runtime performance of those versions with the original Ruby on Rails implementation. DHH’s post includes data that seemingly demonstrates the efficiency of the Rust programming language, and AI agent coding itself. But many observers came to another conclusion: Don't trust DHH’s benchmarks. As of press time, the post and accompanying chart garnered over 900,000 views. It showed the Rust rewrite of the chat app outperformed others by a wide margin on five tasks, including searching or posting a message. DHH did not say which AI services he used for these rewrites, but noted that each rewrite took only a few hours, as the original code itself, largely written in Ruby, is relatively compact. Many observers, notably advocates of other languages, quickly surmised from the source material that DHH had optimized the Rust results but didn't do the same for the other languages he tested. Whither high-level languages? Rewriting applications in Rust, often with the help of AI agents, seems to be a popular undertaking these days, with Microsoft's Copilot runtime, the pnpm JavaScript installer, and the Bun JavaScript toolchain all getting the Rust treatment. In DHH’s test, the Rust implementation handily bested the others across all five workloads, sometimes by a wide margin. To serve a “room page,” for instance, Rust knocked out 36,260 requests per second. In contrast, Ruby on Rails was only able to fulfill a paltry 241 requests, while Elixir delivered 722 requests, and even runner-up Golang only knocked out 3,860 requests a second. Rust executed the other tasks with similar alacrity, easily besting the other languages DHH used. The takeaway was obvious to DHH: Rewriting an application in Rust, or better yet having AI agents do the job, may very well result in major performance improvements for an app. DHH suggested that many factors go into choosing a programming language for a particular job, and execution speed is not the sole criterion. Rust can be agonizingly slow to compile, and for many, writing or even reading Rust code is an arduous job. DHH himself began developing Rails in 2003 while building Basecamp in the then relatively obscure Ruby programming language to ease the developer experience. He doesn’t seem to mind that Ruby ranked the slowest in his own tests. “I didn't care about [performance] when the pay-off was huge in terms of productivity and developer joy.” But AI agents don’t give a hoot about joy. “You really have to bury your head in the sand not to see that when agents write the code and validate the output, we need to adjust to a new reality,” he wrote. Chips on the table DHH’s ad-hoc test was quickly met with skepticism, criticism and outright mockery, especially on X. (It’s as if DHH’s conservative views on immigration and his work to bring yet another Linux desktop into the world didn’t give him enough headaches). “What worries me about the future of programming is you see this and don’t immediately know there must be something wrong with the results or what you actually measured,” wrote prominent Google engineer Jaana Dogan in an X response to DHH’s tests. Dogan did not elaborate on the test’s shortcomings, but many others, especially advocates of other languages, were more than happy to provide details. One Elixir advocate called DHH’s implementation “moronic,” while a couple of others actually rewrote the Elixir code to make its performance comparable to Rust’s. After that rewrite, the Elixir version of the app bested Rust’s performance on some tasks, despite further third-party Rust optimizations. DHH expressed surprise that others would assume a high-level language like Elixir or Ruby could even compete with a language like Rust, which runs closer to the metal. But he also noted on X that “It's not exactly extra points for Elixir if frontier agents can't find the magic ‘go fast’ switches.” Elsewhere, observers noted that the Rust rewrite got a lot more post-coding attention than the other implementations of Go and Elixir, both of which seemed to be quickly wrapped up after the initial agent requests. “You're not benchmarking languages, you're benchmarking how much attention each port got,” one observer wrote on X. Golang advocates were likewise unamused. “The benchmark was unfair. More time was put into the Rust code while the rest were one-shotted,” one wrote on X. Someone else even made their own chart showing how much more the Rust code was tuned compared to the quick passes on the other languages. None of these rebuttals actually negates DHH’s advocacy of using agents to code. But clearly, skipping a manual review of the resulting work will still leave a lot of potential gains on the table. ®

System76 is banning AI-generated content from contributions to the COSMIC desktop. Some GNOME sub-projects also restrict AI-generated contributions, but one developer is urging them to make an exception for vulnerability reports. The COSMIC desktop project has changed its contributors' guidelines. The latest version now has a clear no-AI rule, insisting that contributors declare: "I have not included any LLM (also known as AI) generated content in this PR, including code, comments, and descriptions." In other words, you can teach yourself using AI, you can find bugs with AI, but if you want to submit your code for inclusion in COSMIC, you can't use AI to write the code, its docs or notes, or even the submission requests. This position is in keeping with some other desktop projects. For instance, the GNOME Calendar guide to contributing says: "This project does not allow contributions generated by large languages [sic] models (LLMs) and chatbots." GNOME Extensions also restricts AI-generated submissions, although it permits AI learning aids and code completion. Its review guidelines spell it out: "Extensions must not be AI-generated." COSMIC is one of the newest complete Linux desktop environments, but even so, it's been under development for years. The Register first reported on the effort nearly five years ago, meaning that it's older than ChatGPT, which debuted in late 2022 (it only feels so very much longer). COSMIC does use some GNOME components, and its default config looks not unlike GNOME, with a top panel and a dock-like launcher at the bottom. There are good reasons for that: the original System76 desktop called "COSMIC" was based on GNOME, quite heavily customized with GNOME extensions. Saying that, though, this new COSMIC is a very different beast. Its first stable release shipped with Pop!_OS 24.04 in late 2025. Although it looks similar, it's an entirely new, ground-up effort, written in Rust using the Iced toolkit. COSMIC itself is Wayland-only. GNOME is much older, larger, and more complicated. The project was announced in 1997, the year after the KDE project announcement. KDE 1.0 came out in 1998, and GNOME 1.0 in 1999. In part, GNOME was a response to KDE. KDE is built on the Qt toolkit, which was not fully open source. As such, in KDE's early days, Red Hat refused to include it in Red Hat Linux. Qt is aimed at C++ developers, so KDE was built in C++. Linux, like Unix, is built in plain old C and many Unix traditionalists scorned the much more complex C++. So GNOME was built in plain old C, using GTK, the toolkit built for the GIMP. In 1998, Red Hat Linux 5.1 included a preview of GNOME, and by Red Hat Linux 6.0 in 1999, GNOME 1.0 was the default desktop. GNOME is still the default desktop in RHEL to this day, and many GNOME developers' day jobs are at Red Hat. As we noted back in March, Red Hat management is noticeably enthusiastic about AI – although six months later, it was capping developers' AI spend. GNOME is largely written in C, which lacks automatic memory safety guarantees, although other languages feature too: GNOME Shell combines JavaScript and C, and some components are written in the GNOME-centric Vala programming language. Michael Catanzaro, GNOME developer, just published a blog post titled "The Era of Software Quality, or the Era of Ostriches?" which argues that the GNOME project must accept AI-generated bug reports. This is not a new subject for him. His post links to an earlier one from June, "Please Do Not Ban AI-Assisted Issue Reports." The following month, he announced a reduction in the disclosure deadline for issues reported to GNOME Security, from 90 days to 30, effective August 1. We recently reported on the 1,313 CVE identifiers listed in Debian's latest Linux kernel security advisory. AI is resulting in the discovery of vast numbers of bugs in the equally vast codebases of modern FOSS. GNOME is one of the biggest desktops in the Linux and BSD world, with much of its code written in memory-unsafe languages. As Catanzaro says: "No matter how much we try, GNOME developers will fail [to] write secure code when using unsafe languages like C, C++, or Vala: it's just too hard for even experienced developers to do properly." We are not arguing that Catanzaro is wrong. Given the stance toward AI of GNOME's biggest sponsor, it is entirely in keeping, and he makes a strong case. All we are noting is that this could in time prove to be the thin edge of a wedge with the weight of Red Hat behind it. First the project allows AI-generated bug reports. From there, it would not be a huge step to allowing AI-assisted triage. From there, to AI-assisted fixes. Once you're letting AI-assisted code in, then AI-assisted extensions may not seem so extreme, then core components, and in time, to the desktop itself. It would be wildly controversial, just as it already is in the KDE project. That doesn't mean it won't happen – in either project. Debian decided to allow it, and of course, the kernel itself does too. ®

The role of meeting rooms is changing. Traditionally, they were formal spaces built around a large central table and inflexible physical setup, reserved primarily for board meetings, client presentations, or official status updates. The rise of hybrid work and advances in collaboration technology have made that approach increasingly obsolete. Employees now come into the office to connect, collaborate, and brainstorm with colleagues rather than to undertake the solo, focused work they can do better at home. The upshot is that many meeting rooms have transformed into fluid, digitized, data-enabled hubs. With modular partitions, movable furniture, and casual seating, they are designed to adapt to whatever task is at hand. As digital nodes, they also bridge the gap between remote and office workers, so remote and in-person participants get a consistent experience regardless of location. That shift is only possible because of the convergence between IT and audio-visual (AV) equipment, explains Yannic Laleeuwe, marketing director for Barco's ClickShare visualization, collaboration, and networking platform. Cameras, microphones, and wireless conferencing, collaboration and presentation tools, such as ClickShare can now connect to enterprise networks. That allows management through centralized cloud-based systems, so IT teams can monitor, update, secure and tune these systems in ways they could not before. "Historically, meeting rooms have sat in a gray zone between facilities management, AV and IT," Laleeuwe points out. "They were physical spaces first with technology added into them over time, so they were rarely managed by IT departments with the same level of telemetry as laptops, servers or network infrastructure." The impact of reactive tech support IT professionals could often tell whether a device was connected to the network, but struggled to see how the room was being used or whether it delivered a reliable user experience. That lack of visibility explains why meeting room tech support has often been reactive, with staff only intervening once something breaks. "A room was assumed to be working until someone complained that a call wouldn't start, the audio was poor, a display failed, or remote participants couldn't follow the conversation," Laleeuwe says. "Without reliable data on usage, performance and failure patterns, IT had limited ability to predict issues, prioritize investments or optimize rooms before users were affected." The situation had knock-on effects at various levels. For employees, faulty technology creates immediate friction: meetings start late, participation becomes difficult, and unsecured personal devices get pressed into service as a fallback. An additional challenge in a hybrid world is that meeting room technology acts as a bridge between remote and in-office colleagues, so when it fails, the meeting fails with it. For IT teams, poorly maintained technology produces operational inefficiency. Rather than working to make collaboration environments more effective, they end up firefighting individual incidents. For the business itself, a lack of activity data makes facilities planning considerably harder. "Some spaces may be over-engineered with technology that's barely used, while others are under-equipped for the way people actually collaborate," Laleeuwe points out. "This leads to wasted investment, inconsistent user experiences, and missed opportunities to design rooms around real behavior rather than just assumptions." The value of telemetry Endpoint monitoring technology, such as ClickShare's XMS Cloud Management Platform, changes that picture. Organizations can measure occupancy patterns and how their meeting rooms are used in practice, track equipment uptime, connection quality, and software and firmware status, and follow adoption levels alongside the volume and type of support incidents raised. The data helps IT professionals judge not only whether a room is operating effectively in a technical sense, but whether it is delivering the experience employees expect. As Laleeuwe explains: "Telemetry changes meeting room management from a reactive discipline into a proactive one. Instead of waiting for users to report problems, IT can identify patterns, spot underperforming rooms, detect device issues, plan maintenance and make investment decisions based on evidence." In other words, meeting rooms can be treated as managed endpoints, with IT monitoring, patching, securing, supporting, and assessing them against clear performance indicators. That matters because meeting rooms are now hubs where business-critical work happens, not just spaces where calls take place. "They influence productivity, employee experience, meeting equity, collaboration culture, and return on workplace investments," Laleeuwe adds. "When IT has better visibility and control, employees get more reliable rooms, IT teams reduce support overhead, and the business can make smarter decisions about workplace design, technology standardization, and future upgrades." IT shapes organization-wide collaboration While the benefits of such technology are clear, the approach requires IT teams to develop a broader range of skills than traditional device support. Endpoint management, networking, security, and lifecycle management all remain essential, but that expertise must now be combined with AV knowledge, an understanding of acoustics, data analysis, workplace experience design, and change management. This mix of skills "changes IT's role", Laleeuwe indicates, because teams are no longer just fixing what has broken. "They're helping shape how collaboration happens across the organization," she explains. "That means interpreting room data, understanding user behavior, working more closely with workplace, HR, facilities and sustainability teams, and influencing standards for how meeting spaces are designed and used." These skills are best developed through cross-functional collaboration and closer partnerships with AV specialists and vendors, Laleeuwe advises. Rather than regarding room analytics as isolated device data, she recommends treating them as part of a broader palette of workplace intelligence. That makes it easier to improve business performance by understanding how physical spaces, digital tools, people, and their daily tasks interact. AI takes meeting rooms to a new level The introduction of AI-driven meeting environments is expected to reshape meeting room experiences further still. Laleeuwe explains: "AI is moving beyond novelty features, such as basic transcription, and becoming part of the operational layer of collaboration. In the room, this can include intelligent camera framing, noise reduction, audio calibration, live transcription, translation, automated notes, action item tracking, room diagnostics and performance optimization." The real value of the technology is that it reduces user friction while improving outcomes. Better audio and video input, for instance, makes AI-generated summaries and follow-up actions more accurate. Room-level intelligence helps meetings start more quickly and become more inclusive, while giving IT teams insight into where collaboration is working well and where it is breaking down. Return on technology, Laleeuwe advises, is better measured through outcomes than by counting the number of AI features a particular room can boast. Those outcomes include adoption rates, employee feedback, fewer support requests, improved uptime, time saved, and meeting effectiveness. Another consideration is that AI can support organizations' sustainability and "doing more with less" agendas by turning room and device data into a tool for practical decision-making. IT as a key source of ESG intelligence That is because meeting room analytics reveal which devices consume resources without delivering value, where standardization could reduce duplication, and whether longer lifecycle planning could avoid unnecessary replacements. In other words, sustainability becomes more measurable. "Instead of relying only on high-level ESG [environmental, social and governance] commitments, organizations can look at concrete indicators, such as energy-related behavior, consolidation opportunities, and the environmental impact of technology choices across many rooms," Laleeuwe says. "AI can help surface patterns that would be difficult to see manually, giving IT and workplace teams a stronger basis for decisions that reduce waste, extend product lifecycles, and improve operational efficiency." She believes AI and telemetry will strengthen the strategic position of IT leaders in ESG discussions. As connected devices, collaboration platforms, and workplace systems generate more sustainability data, "IT becomes one of the few functions able to connect operational technology choices to measurable environmental outcomes", Laleeuwe says. That in turn creates a political shift inside the organization. IT is no longer viewed as an implementation function that simply responds to procurement, facilities management, or business requests, but as a key source of ESG intelligence. That intelligence will help executives understand how everyday technology decisions affect energy use, device lifecycles, electronic waste, workplace efficiency, and long-term resilience. It will also push IT leaders to work more closely with sustainability, finance, workplace and procurement colleagues to turn insight into strategic outcomes. As Laleeuwe concludes: "Their influence will grow, but so will the expectation that technology investments are justified not only by performance and cost, but also by measurable contributions to both business and sustainability goals." Sponsored by Barco.

South Korean president Lee Jae Myung has told the nation’s cabinet that it’s time to develop AI-powered defensive tools to combat AI-wielding attackers. “Recently, a series of personal information leak incidents have been occurring at financial and public institutions,” he said yesterday – likely referring to incidents like the breach at e-tailer Coupang and last week’s raid on local banks that exposed customer data. “Circumstances indicate that artificial intelligence was utilized, causing great concern and anxiety among the public,” he claimed. “I request that the relevant authorities swiftly and clearly identify the circumstances of these incidents, and rapidly deploy and concentrate the necessary personnel and resources to minimize damage,” he added, before calling for South Korea’s government to “build security capabilities that can detect attacks in advance and preemptively block them.” “I urge the relevant ministries to quickly inspect the security systems across the entire national core infrastructure, as well as the private sector, and immediately implement any necessary security measures,” he continued. “I hope we can accelerate the development and distribution of AI technologies specifically tailored for cybersecurity.” President Lee thinks South Korea needs to “completely innovate our society's security paradigm to fit the AI era.” That work will involve public and private sector players collaborating “to transform our technology, systems, and awareness.” The remarks amount to a major policy statement, and a very public one at that. South Korean ministers and tech giants now get to turn the president’s words into action, a complex task given the broad scope of the leader’s demands and the fact that nobody thinks it's possible to defeat cybercrime. Meanwhile, Down Under Also yesterday, Australian politicians had their chance to grill OpenAI Chief Strategy Officer Jason Kwon, who fronted a parliamentary committee to answer questions about how his company’s agents accessed a government medical records website. Kwon allowed that OpenAI should have done better than emailing the abuse reporting email address at the relevant Australian government agency but defended the company’s efforts to learn from the Hugging Face incident. The committee is sitting for another two days this week, with one topic of debate being how or if Australia should tweak its copyright laws to ensure AI companies pay content creators whose works they use when training their models. Australian law doesn’t include a fair use provision like those that AI companies in the USA relied on when sourcing content. Creators fear a rumored opt-in payments scheme will be too weak, but Australia’s government fears it may miss out on big datacenter investments and access to onshore frontier models if it doesn’t change copyright law to make it more AI-friendly. ®

Microsoft has updated the lifecycle of an Azure instance, without offering any information on how long it takes for an instance type to expire. Redmond’s “enhanced lifecycle” landed in late September in a post that explains the four phases in the life of a cloudy VM: Current – VMs are recommended for new deployments, are available in many regions, and receive standard maintenance and support; Extended – Still supported, but may be subject to usage quotas and unspecified “changes to purchasing options and pricing.” Microsoft recommends planning a move to Current VMs. End of Life – VMs are still supported but are only available to existing customers and you may not be able to get more of the instances you want. Once VMs reach this stage, Microsoft wants you “actively” working to shift workloads onto Current or Extended VMs. Retired – Unsupported but not quite dead. Microsoft says VMs in this phase are no longer available and have been “deallocated” – Azure-speak for not having an IP address and being dormant, with data preserved. Customers can’t provision the instance types. Microsoft’s post explains that the company defined this lifecycle because it is “committed to helping you navigate these infrastructure transitions and take advantage of the next wave of innovation.” The post includes many mentions of “modernization” – the process of moving to Current Azure instance types. “As Azure continues to advance, our commitment is to make change predictable, transparent, and supported through clear lifecycle guidance, early visibility, and practical help to modernize with confidence,” the post states. The mention of “predictable” change led The Register to wonder if the lifecycle has a predictable cadence that means users can expect that instance types will remain in “Current” status for a certain number of years. We asked Microsoft if its Azure instance lifecycles are timed, and a spokesperson sent the following comment: “As Azure continues to innovate, we regularly evolve our infrastructure to give customers access to newer technologies and capabilities. As part of our updated Azure Virtual Machines lifecycle, we will continue to provide customers with advance notice when select older-generation VM series enter the End of Life stage. We’re giving customers time, guidance and resources to plan their transition to the current VM generations, while continuing to support Azure VMs through their lifecycle in alignment with the policies we published.” The spokesperson added that Microsoft customers are “notified directly about their specific VM retirements.” For what it’s worth, Microsoft publishes retirement announcements for Azure services. The company has also previously revealed it runs Azure servers for six years. It is unclear if the new Azure lifecycle is tied to that hardware retirement schedule. What is clear is that Microsoft wants Azure customers to regularly consider moving to its latest instance types. That’s a reasonable suggestion given that newer VMs will likely use more powerful processors. There’s also plenty of upside for Microsoft because more recent silicon typically offers more cores per die, and better performance-per-watt. Microsoft therefore gets greater processor density with lower energy consumption, which lowers its operating costs. Let’s see if Redmond’s lifecycle tweaks also see it pass on those savings. ®

Only a week after warning about the perils of competitor Z.ai's GLM-5.3 model and its advanced cybersecurity capabilities, Anthropic has expanded its Cyber Verification Program (CVP) – or rather, reconfigured it. "For the past six months, we’ve enabled trusted access through two programs: Project Glasswing and the CVP," the AI biz said. "Now, we’re integrating these programs into one expanded offering, designed to give more security organizations access to the capabilities they need to protect their systems." Project Glasswing and CVP launched in April 2026 alongside the debut of Mythos, the company's highly capable and equally hyped frontier model. Project Glasswing gave partners early access to Mythos so they could scour their systems for vulnerabilities before attackers beat them to it. VulnCheck researcher Patrick Garrity was not particularly impressed with CVEs identified by Project Glasswing, noting that fewer than 0.5 percent of the 225 Anthropic-linked vulnerabilities he tracked were being exploited in the wild. And Anthropic's own warning last month about the risks posed by GLM-5.3 somewhat undermines the idea that there's anything special about its own Mythos model. Even so, Anthropic says that its security program has allowed its partners to spot at least 129,000 verified software vulnerabilities between April and July 2026. And the biz claims that its own open source scanning efforts revealed an additional 5,500 verified vulnerabilities between April and October. "Of these verified vulnerabilities, more than 33,000 have so far been rated as critical- or high-severity," Anthropic said. "This is likely an undercount, as it is based on survey data from only a subset of Glasswing partners. As such, we expect the true impact to be at least five times higher." When these might get patched is unclear. The company's own figures indicate that of 5,674 true positive vulnerabilities, 3,014 are high severity, and 1,522 are critical severity, yet only 516 have been patched. Given industry boasting about the cybersecurity prowess of AI models, generating a fix, testing it, and deploying it ought to be nearly automatic at this point. But the gap between identification and remediation suggests there's a lot of slack in the system that needs to be ironed out. Two programs into one with three tiers Now Anthropic's two programs, one intended for organizations and one for individual security professionals, have been merged and reconfigured into three tiers. The AI biz has not explained why, but its stated intent is to tie model capabilities to specific tasks: Defense Access, Red Team Access, and Specialized Access. Depending on the tier, participants will encounter more or fewer blocks on security-related tasks. As a measure of program participation value, Anthropic said that based on five attempts at 10 CyScenarioBench challenges, those without CVP access got blocked on every attempt. Defense Access is intended for security teams at companies, nonprofits, universities, and government organizations that focus on system defense. In this tier, Claude Opus 5.5 faced refusals in 46 of 50 attempts and succeeded four times. Red Team Access is for penetration testing and offensive cyber evaluation, and participants will still face model refusals for model interactions that would cause physical harm or mass disruption. Specifically, Claude Opus 5.5 completed 34 of the 50 tasks with Red Team Access safeguards enabled, a rate similar to what would be expected from Specialized Access. Specialized Access sounds like a rebranding of Glasswing – it's "reserved for a limited set of verified organizations that are authorized to test safety systems that could impact people’s lives or disrupt markets, such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks." Those granted admission to this exclusive tier will face the fewest model refusals, not counting anyone using abliterated open-weight models that have had their guardrails suppressed. For the next month or two, program participants will need to allow their data to be retained by Anthropic as part of its AI safety requirements. But soonish, the company's Enterprise Frontier Safeguards program will offer zero data retention. Organizations already granted zero data retention while using Claude Fable 5.1 or Claude Mythos 5.1 can participate in CVP under those same terms.®

Google on Tuesday struck a deal with Constellation Energy for 3,590 megawatts of future energy supply, including nearly a gigawatt of new nuclear capacity, as the search and advertising giant tries to find enough energy to power its datacenter ambitions. The 20-year power purchase agreement will see Constellation, the largest purveyor of atomic energy in the US, bring an additional 890 megawatts of nuclear capacity online by making "targeted investments at multiple nuclear plants." We understand those investments will go toward upgrades to at least 11 existing nuclear plants across Illinois, Pennsylvania, and New Jersey through a process known as uprating. "By modernizing and upgrading turbines, steam generators, and digital control systems at operating plants, uprates deliver substantial capacity gains without the multi-year timelines or interconnection bottlenecks associated with greenfield construction," the power company explained in a statement. The other 2,700 megawatts the deal covers will come from other unspecified sources. Constellation expects to spend $4.3 billion to fulfill its side of the deal, and plans to complete its first uprated reactor by 2028. Google is on track to spend as much as $205 billion on datacenters and compute this year, but all that money is wasted if it can't secure power to make its servers and GPUs work. The hyperscaler is far from the only one scrambling to secure adequate power to keep its AI ambitions from starving. Microsoft also tapped Constellation to reignite the Three Mile Island Unit 1 reactor – you know, the one that didn't partially melt down back in 1979. That reactor is expected to come online as early as next year. Meta is also making noise about nuclear. The Social Network is working with Constellation to save a doomed nuclear plant in Illinois. Earlier this year, Meta revealed that its nuclear and clean energy commitments now total 6.6 gigawatts, though it's worth noting that figure depends heavily on the successful rollout of small modular reactors, an unproven form of miniature nuke plant. ®

The rivalry between Anthropic and OpenAI, the two leading US AI model makers, is no contest when it comes to assessing which one gives you more value for your subscription money, according to industry research firm SemiAnalysis. Following changes to OpenAI's $200 per month subscription plan that effectively halved its value, SemiAnalysis looked at the various subscription plans offered by AI companies, because that's still the main way that individuals and small businesses buy AI services. AI subscriptions are heavily subsidized – customers get far more tokens for their money than they would paying metered API rates. And SemiAnalysis argues that it's necessary to delve into subscription pricing to evaluate AI shops financially because subscription usage consumes a disproportionate amount of company compute resources. Claude subscriptions, the biz claims, take up about 42 percent of Anthropic's inference compute while generating just 10 percent of its revenue. And those subscriptions provide considerable value. "Anthropic is an overwhelmingly better deal, offering ~5x the API-equivalent value across the board," SemiAnalysis claims in reference to mid-tier models GPT-6.1 Sol and Claude Opus 5.5. "You could argue that this is unfair for [OpenAI] because 6.1 Sol is much cheaper per token than Opus 5.5, but the gap is still massive even if you switch to comparing the number of tokens." OpenAI did not immediately respond to a request for comment. SemiAnalysis' calculation relies on measuring token output rates, converting those into tokens per 5-hour usage window and per month, and then computing the API-equivalent value. Company researchers contend that API-equivalent value is the best figure for capturing the value of a subscription plan, though they allow that other measures like raw token volume may be more appropriate in some instances. API-based comparisons can be slow to account for the rapidly shifting capabilities of models that come to market. The debut of a new open source model, for example, can alter what's possible at a given price. For those with access to subscription plans, the subsidized prices clearly offer real value, so much so that there's an underground market for reselling tokens from pooled subscription accounts in many parts of the world. But there are other ways to measure AI value. Artificial Analysis, for example, tracks cost per task – the estimated dollar cost of completing a specific task. By that yardstick, GPT-6.1 Sol ($0.72) is far more affordable than Claude Opus 5.5 ($5.98), at least for those paying API rates. But that ratio may not be true for different tasks – benchmark performance may not reflect your workload. As measured by tokens, Claude Pro ($20 per month) provides 2.9 billion tokens per month, compared to ChatGPT ($20/mo) at 1 billion tokens per month, according to SemiAnalysis. But models may use more or fewer tokens than others for the same task, and when the output is functional, like code, AI output may achieve a similar result across different models but with differing degrees of efficiency. Anticipating AI costs gets more complicated for businesses, which can't count on subscription subsidies and may not have experience with AI cost management. In a July report, McKinsey said 93 percent of enterprises exceeded their AI budgets. "I think all businesses are seeing their AI costs rise," said Dhruv Amin, co-founder of AI agent biz Anything, in an interview with The Register. Since the beginning of the year, he said, AI has been getting better at solving certain business problems, and companies have started deploying AI more widely, then noticing their token bills going through the roof. "The labs typically subsidize their prosumer plans with subscription pricing massively," said Amin. "And I think it's part of their marketing funnel because more people are able to use the tools, get familiar with the tools, and then bring those tools to work." But for larger companies, he said, two problems arise. You have more employees than can fit on a subsidized plan and, at scale, costs add up fast. "A huge way that enterprises solve this is being able to make a workload work well on the frontier and then quickly switch it to an open source model that they control and that they can serve at a much lower fraction of the cost," he said. "And so for us internally we were able to drop our AI costs 75 percent plus just by moving them all to Skydive Glide, which is our model router that for the given workload tries to find an equivalent open source model that can handle that workload without a quality drop. And so today we run a lot of our workloads on GLM-5.3 Flash." Amin said that companies adept at AI cost management maintain evaluation benchmarks that reflect their workloads. Companies use those metrics to test new models as they come out in whatever AI harness they're using, to ensure consistency. Looking ahead, he said, he expects companies will trust more of that work to service providers. "So what this means is that if you deploy an agent on top of us, we capture in the background the data of how that agent's actually running in production," he said. "And then we use that to construct the eval data set on the fly." ®

President Trump is pushing hard for the US Senate to make daylight saving time permanent so, among other things, golfers can stay on the course longer, but it may not be such a bright idea. New research out of Canada suggests that, even if Americans would get an extra hour of daylight in the evening, the ill health effects of permanent daylight saving time could outweigh the benefits. A paper published in the Canadian Medical Association Journal on Monday reviewed evidence on the health effects of permanent daylight saving time (pDST) as several Canadian jurisdictions move to stop changing their clocks. It finds that the opposite approach - adoption of permanent standard time (pST) - would actually be better for people’s health. Sorry, night owls and after-work social butterflies, but the science simply isn’t with you on this one. “Permanent DST preserves later evening light that may facilitate commuting, recreation, social participation, and some economic activity, but it also prolongs darkness on winter mornings,” the authors note. Prolonged morning darkness doesn't really jibe with the inner workings of the human body and light’s essential role in regulating the circadian rhythm. Sure, no one wants to drive home from work in the dark, but we really need morning light to get us functioning properly. Our circadian rhythms, the authors explain, actually run on a slightly longer schedule than a full day - 24.2 hours. For that reason, we rely on natural sunlight to keep us synchronized with the world around us. Morning light is some of the most important, the authors note, because it jump starts that rhythm, wakes us up and gets us moving. Evening light, on the other hand, delays the circadian rhythm, messing with our sense of “social time” and making it tougher to get to sleep and wake up rested in the morning. The effects of later evening light can show up in sleep, mood, education, and work productivity, the authors noted, and we don’t even need pDST to see some of those associations - we can just look at time zones. Move from east to west in the US or Canada and you’ll get some considerable differences in when the sun rises and sets in a particular time zone - in some cases, sunrise and sunset can differ by more than an hour of clock time across a single time zone. In one study cited by the Canadian analysis, residents on the western side of US time zones, where the sun sets later, got around an hour less sleep a week. The study also estimated that an additional hour of sleep per week was associated with around 5 percent higher long-term earnings. Similar results turned up in a German study, the team noted. Another study found that workers on the western end of US time zones ended up working fewer hours, too. On the educational front, an extra hour of sunlight before school was associated with higher math and reading scores in a Florida study “comparable in magnitude to meaningful class-size reductions.” “Ending biannual clock adjustments may eliminate transition harms that last a few weeks, but the health effects of permanent time are likely to be chronic,” the authors noted. “The preponderance of health evidence favors pST, which would align with the recommendations of sleep and chronobiology societies worldwide.” This isn’t the first time researchers have concluded such. British sleep scientists concluded much the same in 2024, which led to their recommendation to permanently kill DST in favor of a permanent shift to Greenwich Mean Time. That isn’t stopping the US from plowing ahead with plans for pDST, though. The Senate passed a measure to enshrine DST in 2022, but the House never acted on it. This time around, the House has passed its own bill to enact pDST, but the Senate is dithering, leading President Trump to go so far as to post the personal cellphone number of one Republican holdout on social media, Senator Tom Cotton (R-AR), who is opposed to the measure. “No one likes changing the clock, me included, but Congress has enacted permanent Daylight Savings Time multiple times before and repealed it each time once Americans experienced absurdly late sunrises in the winter,” Cotton explained in a post on X following Trump’s doxxing. He’s right, too: The US has twice enacted pDST - once during World War II, which ended after the war, and again in 1973 as an energy saving measure. Congress curtailed the experiment later in 1974 following public backlash over dark winter mornings. The US isn’t alone in trying and failing at enacting pDST, either, as the Canadian paper points out. Russia adopted pDST in 2011 and reversed it in 2014. Chile tried and reversed it as well. In those cases, the reasons for reversing course varied, but concerns included dark winter mornings, disrupted sleep and body clocks, safety, and public dissatisfaction. It’s unclear whether the US government’s latest attempt at enacting pDST will succeed despite political resistance and scientific evidence that it’s a bad idea, but the researchers sure seem to hope not: They note that, if the US makes such a change, Canada will likely be pressured to conform. At the end of the day, we might all be better off just dealing with a couple of clock changes and some short-term sleep disruption. ®

Another week brings yet another open weights model and this one is huge — or at least it is for Europe's AI flag bearer Mistral, which has taken to calling the 1 trillion-parameter large language model (LLM) Le Chonk. Its product name is Mistral Large 4, which is a lot less fun than the cat-meme-inspired "very official" moniker Le Chonk. Nonetheless, the LLM is the French model-dev's biggest open weights release ever. At a trillion parameters, Le Chonk is squarely in frontier territory, and like most modern frontier models, it is multimodal, reasoning, and employs a mixture of experts (MoE) architecture with about 49 billion active parameters to keep serving costs low. Mistral didn't offer any guidance on hardware requirements in its release blog, but the model is still small enough to run reasonably on 8-way GPU boxes like Nvidia's HGX B300 or AMD's MI355X. We know far more about the hardware the model was trained on. According to Mistral, this Chonker was trained using roughly 3,800 Grace Blackwell GPUs — or around 52 NVL72 racks — in Mistral's own datacenters located in Europe on a corpus spanning more than 160 languages using a combination of supervised pre-training and reinforcement learning. Sovereign AI remains a major focus for Europe and Mistral is clearly cashing in on demand for frontier class models trained and run within Europe's borders. The model itself is currently in preview, but you won't have to wait long for its weights to drop. Mistral expects them to be live on Hugging Face and other model repos within the month. Early testing by independent benchmarking firm Artificial Analysis puts Le Chonk at a major disadvantage relative to OpenAI or Anthropic's flagship models. In the AI guru's intelligence leaderboard, Mistral Large 4 preview sits between DeepSeek V4.1 Flash and OpenAI's entry-level GPT6 Luna models. Having said that, Mistral's latest model outshines the United States' most capable open weights model, Thinking Machines Lab's Inkling, by a significant margin. So when it comes to non-Chinese LLMs you can actually download, Mistral does quite well. As you'd expect, Mistral's own benchmarks tell a far rosier story. Across coding, agentic, finance, and legal benchmarks, the model build shows its latest LLM trading blows with some of the top Chinese offerings from Alibaba, Moonshot, Z.AI, and DeepSeek. You can find their charts here, but as always take them with a grain of salt. One area Mistral is particularly proud of is Le Chonk's performance in cybersecurity workloads. The company claims the model is one of the strongest performers in cybersecurity benchmarks like Artificial Analysis' new Cyber index. This is a dig at proprietary American models from the likes of OpenAI and Anthropic, which have a tendency to refuse cybersecurity-related tasks that could be perceived as adversarial. As we previously reported, this is potentially problematic for customers trying to use AI models to red-team their own systems in order to identify vulnerabilities before someone else finds them. "Provider-level refusals can block legitimate vulnerability research and incident response, and where losing access to a capability mid-incident can itself become a critical security risk. ML4 pairs top-tier cyber performance with open weights and self-deployment, giving organizations both the capability and the autonomy to run advanced security work under their own policies," Mistral wrote in a blog post. According to Mistral, Le Chonk is only the first in a series of new models made possible by its €3 billion (about $3.4 billion) Series D funding round last month. The company already expects the model's performance to improve meaningfully as it continues applying reinforcement learning, which suggests a more potent Mistral Large 4.1 could be around the corner. If you'd like to give the model a spin before its weights drop later this month, it's currently available via Mistral's API. ®

If you signed up for Trump Mobile, you may be part of an exclusive club of … ransomware victims. Criminals called BYOD claim to have broken into the Trump-branded mobile biz and leaked data belonging to 3,615 people, including names, email addresses, phone numbers, home addresses, and order details. BYOD is a new ransomware-as-a-service operation, and Trump Mobile is only the third organization posted on its data-leak site. According to the group’s posted claim, after telling Trump Mobile that it had been breached, the wireless provider replied: “We have no team to handle this" and “Anyone who hacks them are a terrorist.” “Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs,” the leak site says. “Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you.” The hackers reportedly told International Cyber Digest that they first infected a Liberty Mobile employee with an infostealer, and then accessed Trump Mobile via the MVNO. BYOD claims to still have access to Trump Mobile’s systems, and told the publication that neither wireless provider used any form of multi-factor authentication. Neither the Trump Organization nor Liberty Mobile responded to The Register’s questions about the breach. The data dump doesn’t include any details about US President Donald Trump or his family members, according to Straight Arrow News, which first reported the breach and verified some customers’ information. This could mean that the Trump family doesn’t eat its own dogfood. The leak does, however, include personal information about Eric Brunnett, vice president and chief information officer for the Trump Organization. Brunnett’s LinkedIn profile says he oversees “all Information Technology and Information Security for all aspects of the Trump Organization.” Additionally, one customer contacted by Straight Arrow said he paid a $100 pre-order deposit last year for Trump Mobile’s flagship smartphone, the T1, but never received a gold-colored device. Another criminal group, EndZone, also claimed to have breached Trump Mobile and leaked a stolen dataset a week before BYOD’s post in what “appears to be the same original breach,” according to security sleuth Dominic Alvieri. These aren’t the fledgling mobile phone company's only security snafus. Before these two apparent breaches, a security researcher in May claimed he discovered a now-plugged website vulnerability that leaked Trump Mobile customers’ details. The individual behind the discovery, who goes by "Louis" and described himself as "just a nerd between jobs with too much time on my hands," previously told The Register that the website’s data could be scooped up with a simple POST request.®

Wikipedia’s parent organization says that OpenAI agents edited some non-public wiki pages and generated traffic that may have contributed to a partial Wikidata outage in May. This makes the non-profit just the latest victim of OpenAI agents gone rogue. The Wikimedia Foundation’s chief product and technology officer Selena Deckelmann reported several “rogue agent activities” that the foundation had identified across its various open platforms. While there was no evidence OpenAI agents compromised Wikimedia systems or data, the foundation identified several unauthorized activities it believes involved agents operated by OpenAI. “The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and heavy traffic,” Deckelmann said. Reports of OpenAI agents going rogue and abusing websites and services have been ongoing for months, with revelations regularly emerging since the initial Hugging Face incident was made public in July. OpenAI has been cagey about admitting how many times its AIs broke out of supposedly contained environments, but every time the news cycle refresh button gets hit, more accounts emerge, with victims including foreign government agencies and even the United Nations. The company says it paused some of its training efforts, but since then it's disclosed that more than 100 organizations were notified about potentially problematic activity by its rogue AI agents. It’s not clear whether Wikimedia was among those notified; the foundation says it discovered the OpenAI intrusions as a result of its own investigation. The wiki edits weren’t made to public-facing pages, Deckelmann said, with "almost all" made to sandbox pages. That said, Wikimedia also noted that some edits were made to its citation tool, “which we believe were potentially malicious edits that were intended to misuse this tool as a proxy for fetching data from remote services.” That would be in line with some of the other activity that rogue OpenAI agents have gotten up to in some of the other recent reports of AI malfeasance. Deckelmann noted that none of the OpenAI agents it detected making these sorts of changes bothered to seek approval for the changes as required under Wikipedia bot editing policies. The OpenAI agents also attempted to exploit Wikimedia’s public Etherpad instance. Again, the agents were trying to use the tool to fetch data from other websites. Agents abusing the service also used Etherpad to take notes about their tasks, though Wikimedia doesn’t believe any coordinated effort emerged from those notes. As for the partial outage in May, Wikimedia said “millions of automated requests” hammered its public API and made hundreds of thousands of queries to the Wikidata Query Service, traffic that it believes may have contributed to the disruption. The end result for a nonprofit, volunteer-driven project like the Wikimedia Foundation, Deckelmann said, is that it makes things damn near impossible to manage. “Wikimedia’s volunteers are the ones who come in first contact with, and clean up the mess left behind by AI agents,” the Wikimedia tech boss explained, adding that the foundation’s sites and services have seen a 50 percent increase in bandwidth usage due to bot activity since 2024. “This intense pressure on our infrastructure not only adds costs for servers and humans, but if left unaddressed, can block human visitors by overloading systems and causing outages,” Deckelmann added. “We are already paying for costs that come with the increased activity.” Like other organizations that have encountered unwanted activity from OpenAI’s agents, Wikimedia believes the AI company needs to be held accountable. “While OpenAI admits to agents behaving ‘unpredictably,’ they must also acknowledge their responsibility to monitor and prevent these risks,” Deckelmann said. “AI companies are not doing enough to secure their systems and protect the public from the harm they cause.” That responsibility, she said, is that those downrange of OpenAI’s lack of accountability are the ones having to carry that burden. It’s getting harder to deal with, Deckelmann noted in a LinkedIn post, because such traffic is increasingly hard to investigate and attribute. She calls in the announcement for AI operators to be required to mark their traffic with identifiers that make attribution of bad actions easier. “Our goal with the blog is to more openly discuss our vulnerability to this kind of activity and the need for more accountable actions to address it, while sharing with our volunteers and the public about the consequences,” Deckelmann said on LinkedIn. OpenAI didn't respond to questions for this story. ®

Microsoft is adding two extra file types to its Outlook block list to strengthen security. The file types are .msix and .msixbundle, used for Windows application packages and bundles. The change affects New Outlook for Windows and Outlook on the Web in Exchange Online. By default, users of the affected clients will no longer be able to download or open attachments with these extensions, which is no bad thing because blindly installing a malicious .msix package could compromise a device. That said, although Microsoft noted that the file types were "infrequently used," there are legitimate reasons for their presence in emails. Administrators who need to permit these attachments can add the extensions to the AllowedFileTypes property of the relevant OwaMailboxPolicy before the rollout, scheduled for early to mid-November 2026. "This update is part of our ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments," Microsoft said. The Windows giant's application packaging system has come under fire over the years. Microsoft disabled the ms-appinstaller protocol handler by default in December 2023 after attackers abused it to distribute malware. The attachment block adds another layer of protection, unless administrators explicitly allow these file types. Other file types blocked by Outlook on the Web include .py Python files, .ps1 PowerShell files, and .cab files. It's a little surprising that it has taken until now for .msix and .msixbundle to be added to the list, considering the havoc malicious packages can wreak on a system. Renaming an attachment's extension or sending a download link may get around the attachment restriction, but neither makes the package safe. Persuading someone to download and install it remains a route for miscreants, even with Windows' other protections in place. ®

Microsoft is very keen for Outlook users to ditch the classic version in favor of the new one, and a search bug isn't helping the old client's cause. Results can fail to update after mailbox items are moved or changed, with Microsoft's workaround sending affected users back to Windows Desktop Search. Microsoft has acknowledged the problem. When users move an item from the search results to another folder, it remains listed and produces an error when clicked. Changes to categories or read/unread status may also be affected. The issue affects Server Assisted Search for mailboxes in online mode. Microsoft's workaround involves a registry change to disable server-assisted searching and make Classic Outlook fall back to Windows Desktop Search. According to Microsoft, a fix is in progress, and the issue has been escalated as a hotfix to the Outlook team, but "there is no ETA yet." Classic Outlook is on the way out as far as Microsoft is concerned. Although existing installations will be supported until at least 2029, the opt-out phase is due to kick off in 2027, when affected enterprise users will be moved to New Outlook by default unless administrators block the migration. Users will still be able to switch back to Classic Outlook. The next stage, cutover, will remove the option to change back. Microsoft has, however, still managed to find time to load Classic Outlook with Copilot via a button beside the ribbon, along with the odd bug or two, like the borking of the Quick Steps function. Microsoft also acknowledged an issue that prevented some users from accessing voicemail audio attachments. The voicemail issue was fixed in build 16.0.20430.2000 and later, but the Server Assisted Search problem remains. Another update for Outlook on the Web and New Outlook to make the new tools look a bit like Classic Outlook began rolling out recently. Something to ease the transition. However, it's only skin deep. A familiar appearance won't restore missing functionality, although bugs specific to Classic Outlook needn't follow users to the new client. ®

GitHub Copilot CLI may reveal developer secrets if it comes across instructions that tell it to do so, depending on the underlying model. The coding agent tool was flagged earlier this year for being susceptible to indirect prompt injection. That's when a model ingests text from a source other than the user that directs it to take some action outside the scope of its intended function. This is more of the same, with a twist. According to security researchers at Adversa AI, GitHub Copilot CLI suffers from the same vulnerability identified in Grok two months ago: Cryptographic Context Injection (CCI). Imagine a GitHub Copilot CLI user is working on a project and running the agent in autopilot mode. In other agentic coding tools like Anthropic's Claude, that's the default, but it remains optional for GitHub Copilot CLI. Given that condition, the next requirement is for the CLI tool to read a web page with a malicious set of instructions that have been encrypted with a private key published on the same site. "Static guardrails read text; they do not run it," explained Rony Utevsky in a blog post provided to The Register. "CCI ships malicious instructions as strong ciphertext, along with the key material and an instruction to decrypt, and induces the agent to run that decryption in its own code execution runtime." Active content classifiers that might be reading ingested text as a model defense would miss the encrypted code, unlike encodings like base64 or substitution ciphers that can be undone because the model learned how to decode in training. The model lottery The attack chain goes like this: The user runs Copilot CLI and asks it to fetch a specific URL. The page contains encrypted content, decryption instructions calling for use of Python, and two possible decryption keys. The first key is fake. It's a template that the agent tries to build by reading targeted files from disk (e.g., the user's .env file). Those secrets then get added to the key string. The initial decryption is attempted with this phony key but fails. So the second key is tried, the decryption works, and the agent is presented with instructions to fetch another URL for more context – but that URL contains the harvested secrets and the network request transmits them to the attacker. This doesn't work all the time, however. It depends on the model, which isn't always obvious to the user. GitHub Copilot CLI currently uses either Microsoft's own model, mai-code-1.1-flash, which executed the full attack chain on 50 percent of attempts, or one of two OpenAI GPT-5.6 models, both of which refused the attack payload. Utevsky describes the situation as a model lottery. "On the paid account we tested, the vulnerable model was not the default and had to be selected by hand," said Utevsky. "But on an account with model selection left on Auto, the router assigned the vulnerable model on some sessions and a safe one on others, with no action by the user away from defaults. The user does not choose, and does not see, which model handled the session." Adversa says it reported the vulnerability through GitHub's bug bounty program on September 17, 2026, and GitHub's triage team validated the finding but declined to treat it as a vulnerability. A GitHub spokesperson said as much to The Register, arguing that the user's actions amounted to consent for what followed: "GitHub values the contributions of our security research community and is committed to investigating reported security issues. After investigating, we determined this requires a user to intentionally direct Copilot CLI to fetch attacker-controlled or untrusted content and confirm they want to trigger the action, and thus is not a product vulnerability. While this is not a security issue with the product itself, we are always looking for opportunities to improve our products." Adversa disagrees with that call and says the attack chain presently works as described. ®

Asos customers have reported receiving a rogue app notification claiming the online clothing retailer's Snowflake instance has been compromised and threatening to leak data. The notification included a link to a Telegram channel named "Xuanye Wen Gateway" and addressed Asos's data protection officer and IT team. "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," it says. The Register has asked Asos and Snowflake to comment. The notification does not, by itself, establish that the sender accessed Asos's Snowflake instance or sensitive customer data. How the message was sent remains unclear. Asos's share price fell by around 12 percent following reports of the notification, although it has recovered slightly since. Customers of Snowflake, a cloud platform for storing and analyzing data, were targeted in a major data theft campaign in 2024, including Ticketmaster, Santander, AT&T, and dozens of others. Connor Riley Moucka, 26, of Kitchener, Ontario, later pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and conspiracy charges over a hacking spree that compromised more than 165 organizations, exposed billions of customer records, and brought in about $2.5 million in ransom payments. Snowflake subsequently introduced controls allowing administrators to require multi-factor authentication. ®

An unauthorized party abused a private Danish company's legitimate access to the country's Central Population Register (CPR), exposing names, addresses, identification numbers, and other personal information about approximately 8.8 million people. The CPR administration said in a statement [PDF] that it became aware on October 2 of irregular activity during September and established the scale of the breach over the weekend. In a TV interview last night, digitization minister Christina Egelund said it was too soon to say whether the country would issue all-new CPR numbers, one of the solutions proposed following the breach. Danish cybersecurity specialist Jan Kaastrup told TV 2 that treating CPR numbers as secrets was a "broken" approach and argued that a number alone should not be accepted as proof of identity. "We live in a digitalized society, and therefore we should have much better identification systems," he said. Egelund described the company whose access was abused as "small." Private businesses can obtain CPR data under section 38(1) of the Danish Civil Registration System Act, subject to restrictions set out in the ministry's access terms [PDF]. Eligible recipients include companies, foundations, other legal entities, and individuals conducting business. However, access concerns a defined group of people identified individually in advance, and recipients must be legally entitled to process the information under the GDPR and Danish data protection law. The Register asked the ministry why such broad access was given. CPR numbers underpin access to public services and many everyday transactions in Denmark, which has a population of around 6 million people. The database includes the information of over 55,000 people living in Greenland who also use CPR numbers for healthcare, tax services, and banking. The ministry said the register contains approximately 11 million records, including people who have died or moved abroad, which explains why the affected total exceeds Denmark's current population. The ministry also noted that names and addresses of persons who chose to register with name and address protection were not exposed. The CPR administration blocked the unnamed company's access and said it was working with specialists and relevant authorities to establish what happened. It has notified the Danish Data Protection Agency, and police are investigating. ®

The UK's largest police force has awarded French outsourcer Atos a six-year contract worth up to £350 million to manage and secure applications. Atos will provide service management, application management, and application security for the Metropolitan Police Service in London. The deal is intended to support the Met's ongoing modernization and simplification of its applications. Met Police digital product delivery director Jamie Hewitt said: "Our collaboration with Atos will provide a stable digital foundation for our officers and staff, supporting the ongoing modernization and simplification of our application landscape and driving greater efficiency and effectiveness across the technology that underpins frontline policing." The Met can extend the six-year contract by two years and expand its scope to include managed cloud and digital workplace services. The award follows another large-scale tech deal for the Met Police earlier this year. In April, it awarded DXC Technology a contract worth up to £1 billion to develop and run a host of business process outsourcing services, including building a new Oracle ERP system. An award notice said DXC had won the work for the "provision of managed services for HR, finance, and commercial operations… [including] technology enablement, process optimization, and service delivery." Atos has also secured other UK public sector work this year, including a £78.2 million contract with His Majesty's Revenue & Customs for specialist low-code leadership services. A little more than two years ago, Atos sought a restructuring deal with investors. In July 2024, it agreed such a deal with a group comprising some of its banks and bondholders. Atos had also lost a major outsourcing contract with UK public pension provider Nest, which ended a £1.5 billion deal in 2023, just two years into its potential 18-year term. Indian outsourcer TCS later won back the deal without external competition. ®