The Register

OpenAI has fired two safety researchers and a program manager for allegedly mishandling sensitive company information. The ChatGPT maker confirmed the dismissals to The Register, saying an internal investigation found the trio had violated company rules governing access to and handling of confidential information. "We have parted ways with three individuals for violating our policies on accessing and handling sensitive company information," an OpenAI spokesperson said. "Our investigation confirmed that these individuals mishandled sensitive information outside established company procedures, violating our policies and breaking the trust essential to our work." At least some of the information was allegedly shared with an outside organization that evaluates AI systems. OpenAI said its investigation found other misconduct beyond that disclosure, but has not described it or identified the organization. The ChatGPT creator said the employees were not dismissed for raising AI safety concerns. The firings come after a messy few months for OpenAI's safety teams, including an incident in which one of its agents compromised infrastructure belonging to AI platform Hugging Face. OpenAI subsequently brought in external experts to investigate what happened and published findings detailing the agent's behavior and the security failures that allowed it to reach Hugging Face. The incident also prompted a much wider trawl through OpenAI's logs for other examples of agents interacting with external systems. This week, OpenAI said it has now notified more than 100 organizations about activity linked to its agents. Being contacted doesn't necessarily mean an organization was hacked or that private data was accessed. OpenAI said the notifications cover cases where agents interacted with third-party systems without authorization or in ways that warranted alerting their operators. OpenAI's investigation has also found cases where its agents sent training and evaluation data to third-party services. In 53 instances, images originally uploaded by ChatGPT users ended up on image-hosting sites. On September 20, an agent contacted an external chatbot through insufficiently filtered DNS traffic in a training environment intended to block live internet access. OpenAI's monitoring system spotted the behavior within 15 minutes and a human reviewer picked up the alert three minutes later, but the run wasn't actually killed for another two and a half hours. OpenAI has also scrapped the planned release of GPT-6.1 Astra after concluding the model didn't meet its safety bar around remaining within the scope and authorization of tasks it was given. The US biz hasn't said whether the allegedly mishandled material concerned any of its recent agent incidents, whether the outside organization was involved in investigating them, or whether any customer or user information was exposed. ®

In an effort to provide a more affordable AI system, Nvidia is introducing a cut down version of the DGX Spark with half the memory and storage. The GB10-based systems will be offered exclusively through hardware partners including Acer, Asus, Dell, Gigabyte, HP, and MSI, and are expected to retail for around $4,999. The less-powerful SKUs are necessary after Nvidia jacked the price of its 128 GB DGX Spark on Friday to $6,950 — an increase of nearly 75 percent from this time last year. As you might have already guessed, skyrocketing memory prices are to blame for the massive price adjustment. That makes the 64 GB model considerably less than Nvidia’s top-spec DGX Spark and GB10 systems given the ongoing memory shortage, but that’s still 25 percent more than the 128 GB version retailed for at launch. Nvidia’s GB10 platform has been plagued by pricing creep since the Projects Digits concept was unveiled at CES last year. Originally, the appliance was expected to retail for around $3,000, not the $4,000 it eventually ended up selling for. Even at that price, the DGX Spark offered something that just a few years ago would have set you back tens of thousands of dollars: large quantities of GPU memory. In fact, at the time it launched, the system was technically the highest capacity workstation GPU Nvidia sold. That’s not really the case with the 64 GB model, which due to its smaller capacity, isn’t as well suited to certain AI workloads like fine tuning. But if your main concern is local AI inference for powering private agents, Nvidia argues models in the 26-35 billion parameter range, Qwen 3.8 27B for example, are now good enough to get the job done. While the new systems may offer less memory, we’re told the memory bandwidth remains unchanged at 273 GB/s, which tells us they’re using lower capacity LPDDR5x memory modules rather than fewer of them. Nvidia also says that beyond the new memory config, the systems are otherwise unchanged and will feature the same 20-core Arm processor from MediaTek. The systems also retain their onboard ConnectX-7 networking, which enables clustering of up to 4x GB10-based devices at 200 Gbps a piece. To further facilitate this, Nvidia says later this month it’ll be rolling out new software tools to DGX OS to facilitate cluster configurations and inference deployments. Previously, this required some tinkering in the CLI to get set up along with some tweaks to the vLLM or TensorRT-LLM launch commands. While the 64 GB version’s lower MSRP should make the systems more accessible amid the ongoing memory crunch, it doesn’t bode well for Nvidia’s RTX Spark notebooks and mini PCs expected to make their debut this fall. These systems are based on the same GB10 silicon that powers the DGX Spark and other DGX OS-based systems, but are intended for more general purpose computing, like AAA gaming, web browsing, and content creation, not just AI inference and training workloads. Announced at Computex late this spring, RTX Spark-based systems were already expected to be quite expensive, particularly the 128 GB variants. With DGX Spark pricing nearing $7,000, similarly equipped RTX Spark notebook offerings based on the chip could end up selling for significantly more. But, as we understand it, Nvidia will be offering versions of the chip with much lower memory capacities for price conscious PC buyers. However, across the DGX and RTX Spark lines, Nvidia will face some competition from AMD’s newly launched Gorgon Halo SoCs, which offer memory capacities ranging from around 32 GB at the low end to 192 GB for the top-spec Ryzen AI Max+ 495 SKUs. What’s more, systems powered by that chip are currently retailing for less than Nvidia’s 128 GB DGX Spark. But while AMD wins on max capacity, it should be noted that our testing has repeatedly shown that the GB10’s GPU offers substantially higher performance for AI tasks. ®

Microsoft plans to roll out Excel Canvas through October, adding Copilot-generated reports to its veteran spreadsheet. Excel Canvas "transforms workbook data into a polished report containing visualizations, metrics, and insights," said Microsoft. The reports automatically refresh as the underlying data changes. Users need access to Copilot in Excel and can tweak reports through natural language prompts. Presumably along the lines of "Why the heck did you use that as the x-axis?" Lately, Microsoft has been relentlessly fiddling with Excel. Last week it added an opt-in feature to allow multiple values in the same cell, potentially complicating life for third-party tools that expect one value per cell. Earlier Copilot additions have met resistance or been withdrawn. Earlier this year, there were howls of outrage from users when a Copilot Dynamic Action Button was unceremoniously dropped onto their workspaces. In response, Microsoft swiftly allowed users to send it to the toolbar. Microsoft also abandoned the COPILOT() function in August this year, barely 12 months after introducing it, saying it had "decided not to move forward with this feature." The function carried a warning that its output should be checked for accuracy, particularly when used for business decisions or reports. Hardly reassuring when the spreadsheet feeds the accounts. Automatically refreshing reports could save users some work, provided Copilot selects appropriate metrics and charts. Canvas also enters a crowded market: businesses already using dashboard tools will need a reason to add another. ®

Police suspect a 16-year-old was the main operator of KillSec, a ransomware group linked to around 1,000 suspected attacks worldwide. Authorities announced on Thursday that an international operation had seized the group's infrastructure and made three provisional arrests. The German-led Operation KillSwitch replaced the crew's leak site with a police seizure notice. The available information is incredibly fragmented. Europol said the 16-year-old was "the group's suspected main operator," but did not explicitly say this person was arrested. Spanish police announced the arrest of a "minor," a Romanian national residing in Spain, but did not publicly link this arrest to the 16-year-old mentioned by Europol. The US Department of Justice (DoJ) said UK police had arrested Dutch national Fouad Eltibrizi, whom it has charged over alleged cybercrimes in the US and Puerto Rico. It is seeking his extradition. Eltibrizi is the only suspect officials have publicly named. Europol told The Register he was allegedly one of KillSec's negotiators. Authorities have not named the suspected 16-year-old operator. Romanian police (Poliția Română) said a 24-year-old helped establish KillSec in October 2023, although other authorities date the group's formation to 2024. Their statement did not specify whether that person was arrested. Officials separately confirmed to The Register that a Romanian national in his twenties was arrested in Romania on suspicion of acting as a KillSec affiliate. Europol also identified a suspected developer who turned 18 in August and was a minor when some of the alleged offenses were committed. Spanish police referenced a woman who remains under investigation in connection to the case, but was not arrested. The coordinated raids took place on September 30, following investigations that began in early 2025. Ten police agencies from Europe and the US took part, with officers raiding eight properties across Greece, Romania, Spain, and the UK. Spanish police said officers raided a home and an office in an Alicante hotel, while Poliția Română searched four homes. Neither Greece nor the UK has released information about their involvement in the operation. Authorities secured at least 110 TB of data on KillSec's leak site against further unauthorized access. Investigators are examining seized devices and data to identify victims, attacks, and suspects, and trace the group's criminal proceeds. Over the course of the investigation, police took control of five central servers used to manage the group's activities and store victims' data. Security shops Bitdefender and Group-IB also supported the investigation. KillSec uses double extortion, encrypting victims' systems and threatening to publish stolen data unless they pay. Group-IB recently included KillSec, also referred to as "Kill Security" and "k1llsec," in its 2025 top 10 rankings for ransomware groups operating in APAC, LATAM, and the Middle East. The company's researchers said KillSec most commonly preyed on financial services and healthcare organizations, but was known to attack government entities and large enterprises. Group-IB said KillSec also offered stolen data for sale at prices ranging from $5,000 to $500,000. "Servers can be replaced in weeks; the people who build the platform and approve every attack cannot," said Group-IB CEO Dmitry Volkov. "Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end." KillSec initially offered a Windows encryptor before adding a version capable of encrypting VMware ESXi hosts, deleting data, shutting down VMs, and removing recovery points. ®

Raspberry Pi has raised prices for the 2 GB Pi 4 and Pi 5, citing rapidly rising memory costs. Both models now cost $12.50 more, taking the 2 GB Pi 4 to $67.50 and the equivalent Pi 5 to $77.50. Readers with long memories may recall the $35 Pi 4. Its price "temporarily" rose to $45 during the pandemic and has since climbed further. The board maker reported a 90 percent increase in first-half revenue to $256.9 million, while gross profit rose 79 percent to $59.4 million. Gross profit per board increased 53 percent to $12.20, helped by price rises and stocks of memory bought at lower prices in 2025. Raspberry Pi says that inventory advantage has largely been exhausted. Its advice to customers facing higher prices is to consider older models, such as the Pi 3B, 3A+, or 3B+, and check how much RAM their projects actually need. Price rises have become a way of life for Pi customers. In April 2026, much of the Pi 4 and Pi 5 range saw substantial price increases. A 16 GB Pi 5, for example, currently costs $305 at PiShop – a far cry from its $120 launch price in January 2025, when we wondered whether even that was a bit steep for a Pi. The 2 GB Pi 4 and Pi 5 escaped April's increases, but that reprieve has ended. Prices for other products remain unchanged, including the 1 GB Pi 4 and Pi 5 and the 2 GB Compute Module 4 and 5. The latest round of increases comes as enthusiasts and vendors alike ponder ways to upgrade the memory soldered to the boards. Raspberry Pi engineer Phil Elwell took to the firm's support forums earlier this year to state that newer firmware locked the devices to their original RAM capacity. Pi boss Eben Upton said: "The price of memory will eventually subside, and we look forward to reversing our own price increases when it does." Customers may be waiting a while. Micron CEO Sanjay Mehrotra warned earlier this week that RAM shortages would persist into 2028 and possibly beyond. He added: "We do not have line of sight to when supply and demand will return to balance." ®

Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform. Fortinet describes the vulnerability as a combination of path traversal and improper handling of null characters in FortiMail's web interface. An unauthenticated attacker can exploit it using specially crafted HTTP or HTTPS requests to write arbitrary files to the underlying system. Writing files to certain locations could allow an attacker to execute code or commands on the appliance. Fortinet says the flaw affects FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. The vendor's advisory says CVE-2026-104286 "is being exploited in the wild," although it doesn't say when the attacks began, who is behind them, or how many customers may have been compromised. It has, however, published indicators administrators can hunt for on their systems. These include suspicious files and configuration changes, along with IP addresses associated with the attacks. CISA has added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog, directing US federal civilian agencies to carry out forensic triage and apply mitigations by October 4. Fortinet lists fixes for several affected branches as "upcoming," leaving customers on those versions reliant on workarounds until updates arrive. In the meantime, Fortinet recommends disabling Identity Based Encryption if it isn't required. Where that's not possible, customers should prevent the FortiMail management interface from being reachable from the internet and restrict access to trusted private networks. Administrators should also check for signs of compromise: applying a workaround will not remove any files or persistence mechanisms attackers may already have planted. It's not Fortinet's first encounter with attackers making themselves at home on its network appliances this year. In June, credentials linked to around 75,000 FortiGate firewalls turned up in criminal hands, though Fortinet said the data came from previous incidents and brute-force attacks rather than a fresh breach. ®

The UK's public spending watchdog is investigating the troubled transfer of the Civil Service Pension Scheme (CSPS) to Capita. In a notice, the National Audit Office (NAO) said problems had persisted since the outsourcer took over administration in December 2025. The Cabinet Office awarded Capita the seven-year £239 million contract in November 2023, allowing two years to prepare for the transition. The scheme serves 1.5 million current and former public servants. "Key service levels have been repeatedly missed, leaving many members struggling to access the information they need to plan for their retirement," the NAO said. Capita promised AI and automation, but the takeover brought a glitchy online portal, while some members struggled to receive pension payments. Capita missed its deadline to restore normal service by the end of June. It subsequently told MPs that all but the most complex cases would return to normal service by September. Responding to the investigation, Capita said it "accepts that performance remains below the standards that scheme members and the Government rightly expect" and that fixing the problems was its top priority. Scheme members interviewed by the BBC last month described feeling upset, frustrated, and ignored, with some waiting months for payments. One woman had been waiting six months for her widow's pension after her husband died in March. Capita said it would cooperate with parliamentary and regulatory investigations, and continue to engage fully and transparently with the NAO, Cabinet Office, and relevant stakeholders. "Capita recognises the need for continued service improvement, and we are implementing further automation along with stronger governance including improved management information. This will continue to improve operational output and member experience," it said. ®

The Metropolitan Police has stopped using digital forensics software from Oxygen Forensics while it investigates US allegations that the supposedly American outfit was secretly owned by Russians and developing its wares in Moscow. Scotland Yard confirmed it has paused use of the company's tools and launched a "full review," after US prosecutors last week accused Oxygen CEO Lee Reiber and Russian national Oleg Sergeyevich Davydov of concealing the company's ownership and where its software was actually being built. The Met signed a three-year deal with Oxygen in December 2023. Digital forensics teams use its software to extract and analyze data from phones and other devices seized during investigations. "We have paused our use of the tool while we carry out a full review," a Met spokesperson told The Times. "At this time, we believe any impact to ongoing investigations will be extremely limited. The Met does not share any data obtained from investigations with Oxygen Forensics Inc." The force said Oxygen's software runs on a closed IT system that isn't connected to the internet and was used in less than 0.2 percent of the more than 23,000 actions carried out by its digital forensics team over the past year. The pause comes after the US Department of Justice alleged that Oxygen, which is based in Alexandria, Virginia, presented itself to US government customers as an independent American company despite being owned and controlled by five Russian nationals through a Cyprus-based holding company. Prosecutors claim the same five Russians also owned Moscow-based MKO Systems, previously known as Oxygen Software, where developers actually wrote Oxygen's software. MKO, meanwhile, sold the technology in Russia under different product names to customers reportedly including the Federal Security Service, better known as the FSB, as well as the Russian Investigative Committee and Ministry of Internal Affairs. Oxygen's US customers weren't exactly small fry. US defense and homeland security agencies bought its software, including Homeland Security Investigations, the DHS Office of Inspector General, and the Secret Service's National Computer Forensics Institute. The DoJ isn't alleging that Oxygen's software contained malicious code or was used to gain unauthorized access to customer systems or data. Davydov, 52, was arrested at London's Heathrow Airport last month while preparing to fly to Turkey and appeared at Westminster Magistrates' Court on Tuesday as the US seeks his extradition. District Judge Anthony Calloway declined to grant bail, according to The Times, citing Davydov's Russian citizenship and residence and the risk that he could flee. A clerk at Westminster Magistrates' Court told The Register that Davydov, was refused bail because it "hadn’t had enough time to gather important information." The fallout isn't limited to Scotland Yard. The National Police Chiefs' Council said other UK forces also use Oxygen products and have been encouraged to carry out their own assessments. "We are aware of the allegations made by US authorities regarding Oxygen Forensics," an NPCC spokesperson said. "These remain allegations at this stage and we note that US authorities have stated they are not alleging the software contained malicious code or that customer data was accessed without authorisation." "Forces that use Oxygen products have also been encouraged to undertake proportionate local assessments and activity to understand and contain any issues that are identified," the spokesperson added. The allegations are causing headaches elsewhere in Europe too. Romanian authorities have begun terminating their use of Oxygen products, while Latvia's State Police has suspended the software pending an assessment. The Register contacted The Met, NPCC and Oxygen Forensics for comment. ®

There are few things less likely to reassure a nervous passenger awaiting a delayed flight than the Windows desktop putting in an unexpected appearance and demanding an update. Take this display at Alcantarí International Airport, which serves Sucre, Bolivia's constitutional and judicial capital. Eagle-eyed Register reader Phil Pearce spotted the Windows 11 desktop and its update prompt while waiting for a delayed Boliviana de Aviación (BoA) flight. The prompt comes from K-Lite Codec Pack, a collection of components that enables Windows to play various audio and video formats. Its presence suggests the passenger display is powered by a fairly ordinary Windows installation rather than some mysterious specialist signage system. Whoever configured the display does not appear to have disabled K-Lite's update notifications or arranged for them to run silently. In this instance, it appears the updater spotted newer versions and lumbered to the foreground with an update prompt – useful on a PC with a keyboard and mouse, but less so on a passenger-facing display beyond anyone's reach. The exposed desktop also displays the Microsoft Store, Outlook, a weather widget, and several shortcuts – more than one might expect a departure board to require. Why airport signage needs Outlook is anyone's guess, although Microsoft has not been shy about preinstalling it. The app even surfaced during NASA's recent Artemis mission and promptly required technical support. Our reader could not dismiss the prompt or update the codecs, but at least the wayward desktop gave delayed passengers something else to watch while wondering what had happened to their flight. ®

Welcome to another installment of On Call, The Register's Friday column that shares your tech support stories. This week we're taking a detour into tech sales, courtesy of a reader we'll Regomize as "Carson," whose employer sent him to China without first securing a visa. The adventure began when a colleague called with a fateful question: "Can you travel to China tomorrow to attend a sales meeting about our short messaging and notification products?" UK-based Carson was available, but doubted his employer could obtain the necessary visa in time. "I was told not to worry; the company would arrange it," he told On Call. So he agreed to go. "I was up bright and early the next morning when I felt a sharp pain," he wrote. "There was a wasp in the leg of my jeans which had stung me three times. That did not bode well." Nor did the prospect of spending the 12-hour flight to Hong Kong in economy. "Normally I would have been in business class for a flight of that length but there were no seats left at such short notice," he wrote. "It was not pleasant with a swollen and throbbing thigh." At the transfer desk in Hong Kong, Carson explained that he still lacked a visa for mainland China, but that his employer was trying to secure one. After making a flurry of calls, airline staff issued him a boarding pass and told him to hurry or he would miss the flight. And then his employer called with instructions not to board until told to do so. Carson became that passenger holding up the flight until his phone rang again and a colleague assured him that someone would meet him in Shanghai. "I was, indeed, met at Shanghai Airport, airside," Carson told On Call. "My colleague informed me that I was to be denied entry to China because I lacked a visa. A couple of large policemen took possession of my passport and escorted me through baggage claim and into a smoke-filled room." The local police told Carson he would have to pay a fine, but that they would not accept a credit card. "I had no Chinese money because it was illegal to import or export it. So I was marched to a bureau de change that exchanged every banknote I had on me – $250 – for Chinese banknotes." Carson's fine was the equivalent of $247. "I was told I would be placed in a hotel overnight, under guard, and deported in the morning," Carson wrote. His employer intervened and arranged a better hotel, sparing Carson a night sharing a room with Chinese police. Carson might reasonably have expected to sleep after that ordeal. Instead, colleagues piled into his hotel room to work on the sales presentation they still hoped to deliver. His police guards stayed to watch as the preparations stretched through the evening and finally ended at 3am. Carson finally caught three hours of shuteye before the police woke him, escorted him to breakfast, and then to the airport. "I had to buy a ticket back to Hong Kong and oddly, only first class was available. The police took me to the first-class lounge then to my comfortable seat. Only when sitting down with my seatbelt fastened did I get my passport back." While Carson was being expelled, his visa finally came through. He was therefore soon aboard another flight to Shanghai, where he arrived at night and met a waiting taxi driver... who delivered the news that the bid team was now 300 km away in another city. Carson got in the cab and arrived at midnight. "The meeting was with a team representing a state organization. It started at 9am and ended at about 10pm," he told On Call. "I gave a 15-minute presentation but most of the meeting was conducted in Mandarin" – a language Carson does not speak. "After helping to tidy the meeting room and grabbing a quick beer with a Hong Kong-based colleague, I went to bed at about midnight before getting up at 6am for my taxi to the airport." Carson eventually made it home and, in his email to On Call, rated the adventure: "Not my best trip." What's the worst business trip technology has inflicted on you? The first step of your journey to an appearance in On Call involves clicking here to email us your story! ®

The Pi coding agent reached its 1.0 milestone on Thursday while being treated for whiplash. One of the core new inclusions is support for Model Context Protocol (MCP), which Pi creator Mario Zechner once dismissed as unnecessary. Earendil, the company formed by Armin Ronacher and Colin Daymond Hanna that acquired Pi in April 2026, explained the about-face by noting that things change. Not only has MCP improved, the biz said, but changes the Pi devs implemented in MCP have made integrating other capabilities easier. "For example, the changes we have made to MCP also enable the use of Jev more easily within Pi," the company said, in reference to the widely noted Jev decision model that has already elicited imitations. "Ultimately what Pi needs is quite similar to what MCP needs: a sandbox to play with in the form of an interpreter." Earendil describes Pi as "a hardened, minimal, extensible agent harness that you can make your own." If Pi were a Python web framework, it would be Flask rather than Django. Nonetheless, Pi has gained some features. These include Codemode, a harness-side sandbox that helps agents issue tool calls, with support for MCP, decision models, and image models; extension support for virtual models; deferred tool loading; cache warming for Anthropic models; mid-conversation system messages; a new TUI theme; and full-screen mode by default. Alongside these features, Earendil has built Pi Durable, described as "a new substrate for building long-running agentic applications." It's a distinct component from Pi, the company explained, in order to preserve Pi's minimalist design. The Pi agent connects the underlying model to tools to manage conversation; Pi Durable represents the layer that orchestrates multiple conversations and handles the storage backend, via SQLite and JSONL. "Pi Durable is that harness," the company explains. "It does not replace the Pi coding agent. It is a framework for building any agentic application, coding agents included. It shares not only code with the Pi coding agent, like pi-ai, but also its principles: minimalism and malleability." ®

Amazon Web Services has debuted an agent that it says will evaluate your cloudy environment “as an experienced cloud architect would” and recommend useful changes. The cloud colossus named its bot the “AWS Well-Architected Agent,” a nod to the Well-Architected Framework that outlines best practices for using the Amazonian cloud. Amazon’s announcement says the agentic incarnation of the Framework analyzes AWS environments “against Well-Architected best practices across 65+ AWS services” and then delivers “targeted, contextual recommendations for improving your applications’ cost, security, performance, and resilience.” “It generates recommendations aligned to your declared business goals, delivers implementation packages with every finding, and surfaces cross-pillar trade-offs making it simpler to remediate the findings,” we’re told. The agent also delivers “ready-to-implement fixes” and “provides individual resource findings with specific dollar impact (where applicable) and step-by-step remediation, consolidated findings across multiple resources scoped to your application, and broad architectural patterns and designs with Infrastructure as Code (IaC) code changes needed to align with Well-Architected best practices.” AWS offers myriad services — some of them with overlapping features and functions. Customers often find themselves using more services than they intended, or using services that aren’t quite right for their intended use. AWS is generally happy if customers change to more appropriate services, even when that sees them spend less, and offers assistance from its own staff or channel partners to make it happen. This agent may make some of that human assistance less necessary. AWS is far from alone in suggesting agents should take on some of the chores that human IT professionals perform today - an approach that’s come to be known as AIOps. When your correspondent chats to IT pros about AIOps, they express distrust on grounds that they cannot be sure agents make valid suggestions and feel following bad advice offered by a machine would indefensible if things go pear-shaped. Vendors I’ve spoken to believe IT pros will first cautiously verify recommendations from AIOps systems, and if they see good results allow agents to take more actions without human oversight - but always with the ability to quickly roll back changes. AWS seems to recognize that users won’t go all-in immediately and therefore offers several manual means to apply recommendations the agent suggests, including the command line interface. For now, the agent is available in the US East (N. Virginia), US East (Ohio), and US West (Oregon) regions, but can handle workloads from any AWS commercial Region. It’s only available for users with an AWS support plan. ®

Google’s first “Suncatcher” datacenter satellite has made it into space, but the company has cast doubt on whether its orbital ambitions can scale. As The Register reported last week, Project Suncatcher aims to test whether Google’s tensor processing units (TPUs) can survive a launch and the harsh environment of space. The Big G hopes to validate theories that the limitless supply of solar energy available in space makes the cost of putting servers into orbit sensible. In its announcement of a successful Suncatcher launch, Google linked to its own peer-reviewed research about the endeavor – which outlines many thorny challenges that must be met to make orbital datacenters fly. The paper, titled “Toward a future space-based, highly scalable AI infrastructure system design,” notes that SpaceX and others have suggested that orbital datacenters become viable when launch costs fall to $200/kg. Google’s researchers also note that SpaceX has managed to reduce the cost to launch a kilogram into orbit by 20 percent after every doubling of the cumulative mass it launched. If SpaceX can keep that up, which will mean launching 370,000 t additional cumulative mass, the equivalent of around 1,800 successful launches of its giant Starship rocket, and re-using components 100 times, Google thinks $200/kg is “plausible under reasonable assumptions.” Google doesn’t know the mass of its future datacenter satellites, but points to Starlink’s second-gen sats weighing 575kg and then compares the cost of sending a satellite into space with the price to power servers on Earth. “If launch costs reach ≲$200/kg, annualized cost per unit of power in space could be approximately comparable to terrestrial spend,” is Google’s conclusion. The paper’s calculations on future launch costs use data from SpaceX and other rocket operators. The other technologies needed to make datacenters in space remain largely theoretical. For example, the paper notes that existing network technologies probably aren’t suitable to link multiple satellites into functioning clusters. The need for rapid comms between satellites means Google’s plans require a design “significantly larger and entail much closer formation flight … than any previous or current satellite constellations.” Google also thinks that satellite design will need to evolve. “Our system design work to this point assumes a relatively conventional, discrete compute payload, satellite bus, thermal radiator, and solar panel design,” the paper states. “However, as has been seen in other industries (such as smartphones), massively scaled production motivates highly integrated designs (such as the system on chip, or SoC). Eventually, scaled space-based computing would similarly involve an integrated compute, radiator, and power design based on next-generation architectures, such as computational substrates based on neural cellular automata.” Google’s researchers also found “robust optical satellite-ground communications will also be critical for scaled operation but will necessitate overcoming challenges including atmospheric turbulence, high-speed relative motion errors, and precision beam tracking.” NASA’s TeraByte Infrared Delivery (TBIRD) mission, which has demonstrated 200 Gbps ground-low-earth-orbit comms, is cited as a promising approach. Google’s researchers therefore concluded that realizing its space datacenter ambitions “will require sustained research, iterative refinement of our design, and the achievement of several critical future milestones.” ®

AI agents hacked the hackers - the Dutch Institute for Vulnerability Disclosure (DIVD) - via two zero-day bugs in its Zammad support platform, abusing the flaws to hijack sessions, run code remotely as the local zammad user, and escalate privileges to root. The chained exploits took just seconds to move from session hijacking to root access, and on Thursday, the nonprofit bug hunting organization said the miscreants stole data belonging to its volunteer security researchers, including DIVD email addresses and potentially other contact details. “We’re still investigating exactly which data of which volunteers is affected,” DIVD said in its incident report. “For DIVD volunteers (and others) this means a higher risk of social engineering, because this makes it easier for someone to pose as a DIVD’er.” A subsequent LinkedIn post advised anyone receiving an email or contact request from someone at DIVD “that feels slightly off” to verify that it’s legit by emailing communications@divd.nl. DIVD is also a CVE Numbering Authority (CNA), and it assigned CVE IDs to the now-public security holes in Zammad, an open-source helpdesk and customer support ticketing system. They are CVE-2026-102489 and CVE-2026-102490, and both bugs received CVSS 4.0 scores of 9.4, when assessed in the chained attack scenario. CVE-2026-102489 enables unauthenticated attackers to achieve remote code execution and leak user sessions, while CVE-2026-102490 allows a local user to elevate their privileges to root. Zammad versions 6.3.0 to 6.5.4 are vulnerable to CVE-2026-102489, and it also exists in versions 7.0.0 through 7.1.3 - but it’s not exploitable “due to environment conditions,” according to DIVD’s advisory. All Zammad versions are vulnerable to CVE-2026-102490. DIVD advises “all users of Zammad to upgrade to version 7 of Zammad or to take it offline.” What happened According to the nonprofit’s timeline, the attack happened on September 21, when "malicious actors” broke into its IT system via the two zero-days in its ticketing support software. The bug hunters discovered the attackers the following day, blocked access to all of its data center systems, and formed an incident response team with Merlon Security. On September 24, DIVD reported the Zammad vulnerability to the vendor, notified the Dutch Data Protection Authority and the National Cyber Security Centre about the incident, and discussed its options with police. It also posted its first disclosure on LinkedIn. “It took us (almost) seven years but we can now say that we're the hackers that got hacked,” the post said, adding that DIVD remained committed to handling the incident in “the way we think it should be handled. That is open, transparent and honest, even if it sucks.” 'Modus operandi' indicates agentic AI DIVD also noted that its team had never seen an attack like this before. “This is an attack we have not seen before,” according to the post. “Not because it’s our first, but because the modus operandi indicates that this is an agentic AI powered attack.” The attack was "loud and very very messy," DIVD said. "We could see the agent working automated, because after every action it decided the next step itself, at the speed of light and sloppy logic or pattern." Subsequent posts with screenshots of logs found during the investigation reveal embedded notes found in the attack script - another indication that this was an agentic operation or at least AI-enabled. “What human attacker leaves notes to themself in their scripts, explaining why what they're doing is okay and really not phishing? The AI just got a task and keeps justifying its own actions in the code as comments, a human wouldn’t care less," the post said. "Who has time for that anyway?” If only all orgs responded to hacks like this While the investigation remains ongoing, security researchers applauded DIVD for its transparency in disclosing and responding to the hack. “Kudos to DIVD for their level of honesty and transparency working through their active incident and investigation,” VulnCheck security researcher Patrick Garrity posted on LinkedIn. “It would be nice if all organizations were this transparent about their security incidents!” In a subsequent interview with The Register, Garrity said he applauded DIVD’s “brutal honesty” about the breach. “They're eating their own dog food, which is great, and getting information out quickly to other organizations that potentially use this product so they can take action before they get hit.”®

Two weeks after the Jev model took the AI world by storm, Cloudflare has released its own pair of "Clef" decision models that it claims are smarter and faster than Jev, while also being open weight and runnable locally. The Clef family of decision models was announced by Cloudflare on Thursday, and consists of two models: Clef and Clef-flash, a slightly smaller and faster version of the model. For all intents and purposes, they work the same way as TypeSafe’s Jev, in that they can answer three types of bounded, structured questions: Yes/no, multiple choice, and rankings. It’s there that the bigger differences emerge, though, as Clef isn’t only built differently but, if Cloudflare’s benchmark claims hold up, also appears more capable than Jev and several other decision models in a number of tests. For starters, Clef has an LLM backbone. According to Cloudflare, Clef uses specially post-trained, frozen versions of Qwen3.8-27B and Qwen3.5-9B for Clef and Clef-flash, respectively, with the Qwen backbone performing a prefill-only pass during inference. Clef is still fast - faster than Jev, to be fair - and scores choices in parallel after that prefill-only pass. It’s not clear what Jev’s underlying architecture is, as TypeSafe has kept that a secret. As for its speed and capability, Clef moves fast. Cloudflare ran it against Jev and some other open decision models using the Jev Decision Index available on Hugging Face, and the company’s own ranking suggests Clef is slightly slower than other open models, but more accurate, with Clef-flash just as accurate as most of the others, but far faster. To be fair to the competition, Cloudflare self-reported its own scores against the benchmark, and they have yet to be reproduced for ranking on the official Decision Index. Cloudflare also ran Clef against TypeSafe’s own benchmarks, and claimed it beat Jev in three out of four areas, only losing out on agent trace observability. Even if it were a bit slower or less accurate, Clef has another major leg up on Jev: It’s not limited to classifying text - it can also handle images and video. Additionally, Clef supports a 64k context window. Jev can also handle up to 64k tokens across a request, although its state plus longest individual question is limited to 32k. Clef is available directly from Cloudflare hosted on Workers AI, which the company said makes the models even faster because “we’re able to take advantage of our GPUs at the edge, leading to low network latency and faster decisions.” For those that would prefer not to pay the token cost (Clef costs $0.24 per million tokens - nearly six times the price of Jev at $0.042/M), Clef can also be downloaded from Hugging Face, and is open weight under the same Apache-2.0 terms as Qwen. While described as “open source” in the announcement, Cloudflare AI Platform group product manager Michelle Chen confirmed to The Register that its training datasets aren’t public. As for whether your hardware can run it, Chen told us that Clef-flash will run on any GPU with at least 41 GB of VRAM, while Clef requires 85 GB of VRAM on a GPU for it to function. “This is assuming single concurrency and a 64k context window,” Chen added. Don’t worry about having to rebuild your decision model architecture for Clef either - its API is fully Jev compatible, allowing it to serve as a drop-in replacement if you want to give it a shot, either locally or using Cloudflare’s hosting option. ®

TCP, the data transport protocol upon which pretty much the entire web and most of cloud computing is built, is ill-suited for emerging AI workloads, a retired Stanford University professor argues. To solve the problem, he's promoting a new protocol called Homa. “TCP, for all the amazing things it has done, is not a good match for datacenters,” said John Ousterhout, a professor emeritus of computer science at Stanford University, in a recent talk at the AI Engineer World’s Fair. Shedding TCP sounds like an immense task, given the global reliance on the protocol. But adding Homa into a network is fairly simple, Ousterhout told The Register. Compile Homa from its GitHub source, then install the module into the Linux kernels on the clients and servers. No reboot required. “Homa works side by side with TCP, so you can gradually move applications from TCP to Homa,” he wrote. Running Homa even makes the remaining TCP applications run faster. Old wine, new skin Homa is a clean-slate rethink of how networks should manage traffic congestion, Ousterhout said. Work on the protocol began as a PhD dissertation first published in 2019 by Behnam Montazeri, now a Google staff engineer. Now that Ousterhout has retired from teaching, he has taken on the task of propagating Homa as his “life’s mission,” he said. What makes Homa different from TCP is primarily that it is message-based, rather than stream-based. Much like the remote procedure call (RPC), Homa message lengths are explicitly defined. Unlike TCP, Homa designates the receiver to manage congestion control. The first packet the receiver gets has information on how much data is incoming. It can then explicitly schedule when packets should be sent. In doing so, it prioritizes shorter messages over longer ones using a shortest-remaining-processing-time (SRPT) algorithm. This approach cuts the latency of shorter messages by an order of magnitude, Ousterhout said. The 99th percentile (p99) of latency for shorter messages is 92 microseconds for Homa, which is 13 times faster than the 1.2 milliseconds p99 for TCP (based on packets swimming through a 100 Gbps network at 80% utilization). Even on the longest messages, Homa is better by a factor of two, Ousterhout said. A long list of other tasks where TCP falls short Currently, Ousterhout is drafting an IETF standardization document of the protocol, as well as working through the process of upstreaming Homa into the Linux kernel. In March, the protocol was backported to Red Hat Enterprise Linux versions 8 and 9.5. He is also helping large companies investigate Homa’s applicability – he is currently working with one large financial services company on a prototype. Not that everyone is on board with tossing TCP over a few latency issues. Prominent network architect Ivan Pepelnjak wrote a scathing position paper in 2023 about Homa, questioning Ousterhout’s performance characterizations of TCP and critiquing Homa as a solution looking for a problem. To be fair, the AI community is not the only ecosystem frustrated by the dowdy TCP. In the high-performance database community, DPDK (Data Plane Development Kit) is being used to bypass the TCP stack for faster querying. Storage area networks turned to NVMe-oF (NVMe over Fabrics) to speed access to solid-state drives over network fabrics, using transports including RDMA, Fibre Channel, and TCP. For the Web, Google devised QUIC – which became the basis for HTTP/3 – to bypass TCP’s head-of-line blocking and enable browsers to download more assets simultaneously. Also, the high-frequency trading and multi-player gaming communities have felt the pinch of TCP sluggishness. Specialized RDMA fabrics and Amazon Web Services’ Scalable Reliable Datagram have also tackled the issue of TCP latency. Top-of-rack switches have also gotten smarter at managing congestion, setting queue thresholds and marking packets with early congestion notifications. Control lag is real Vint Cerf and his fellow beardies created TCP to bring order to the unruly hordes of message packets across networks, giving them proper flow control, guaranteed delivery, connection handshakes and congestion control. Congestion control means avoiding overload in the network path, including switches and routers, while separate flow-control mechanisms keep senders from overwhelming receivers. TCP’s data model is built on byte streams, a continuous flow of data packets with no differentiation. Messages are serialized as a single byte stream with no priority. For the receiver, longer sets of byte streams are indistinguishable from shorter ones. A server deluged with traffic can send alerts to senders to slow input, but it has limited visibility over how much traffic is still coming in. The sender itself, which regulates its output depending on the timeliness of acknowledgments sent back from the receiver, has to guess how much to slow its roll. For regular internet traffic or large-scale transfers within a datacenter, modest latency increases may be tolerable. But for latency-sensitive AI workloads, even delays measured in milliseconds can sting. Think of the GPUs The frontier labs driving the development of large language models (LLMs) have always required top-notch network performance for chores such as weight gradients, model weights, KV cache entries, and checkpoints. However, large data transfers must increasingly share bandwidth with short bursts of traffic from agents and control tasks such as metadata coordination and cache lookups. “For these workloads, what really matters is latency,” Ousterhout said. Even a millisecond of latency causes an expensive GPU to go idle. “Legacy protocols are poorly suited for this environment,” Ousterhout said. So has Homa finally found its problem to solve? Or was it just ahead of its time all along? For now anyway, TCP remains the champ.®

Cloudflare Data Platform on Thursday received a bland new brand name, Basin, and promotion from beta status to general availability. Under the tub-themed moniker, Cloudflare Pipelines, R2 Data Catalog, and R2 SQL become Basin Pipelines, Basin Catalog, and Basin SQL respectively. The company's evocation of washroom fixtures doesn't quite align with its stable of more literal product names – Sandboxes, Workers, Email Services, and so on. But given that the occasion is Cloudflare Birthday Week, which itself fails to respect the concept of "day," straightforward naming may be expecting too much. At least Cloudflare didn't latch onto any of the worse water storage metaphors for collections of information, like data lake, lagoon, puddle, bowl, or cesspool. "Sink" was also on this list, but it turns out Cloudflare has already deployed the term, as we'll see below. Cloudflare CTO Dane Knecht pitched the renamed platform as an easier alternative to standing up a bunch of hardware for observing data. "With Cloudflare Basin, we are bringing the same serverless model that developers expect from Cloudflare to analytics: no clusters to manage, no unnecessary data movement, and open standards that keep customers in control of their data," he said. Basin's appeal is based on lack of lock-in – because it relies on Apache Iceberg – and lack of egress fees, so data can move freely across cloud regions. Rival services from hyperscalers (Amazon S3, Google Cloud Storage, and Azure Blob Storage) impose egress fees. Cloudflare Basin represents an invitation for companies to store data in R2 Data Catalog and then process it with Basin SQL or any of various external query engines like DuckDB, PyIceberg, Snowflake, Spark, StarRocks, or Trino. And that's what Cloudflare is highlighting in its menu of canned customer quotes. Here's Julien Grobbelaar, head of platform at Bobsled: "Basin allows us to build data products that can be made accessible in any region of every major data and AI platform, all at production-grade reliability and a fraction of the cost thanks to zero egress fees." Cloudflare claims as much: "Querying data using tools from different clouds, platforms, or regions carries no transfer fees." And yet there are fees. As Cloudflare explains, "Egressing directly from R2, including via the Workers API, S3 API, and r2.dev domains does not incur data transfer (egress) charges and is free. If you connect other metered services to an R2 bucket, you may be charged by those services." If Basin Pipelines is used to load streaming data into Apache Iceberg or Parquet in R2, Cloudflare charges for delivering data to those sinks after the included allowance. Cloudflare labels this pricing dimension "Sinks (egress)." At the bottom of every data lake, sink, pool, or basin, there's a drain for cash. ®

Depending on Chinese technology for European infrastructure poses risks that not every country takes seriously. So says the Royal United Services Institute (RUSI), which suggests that the EU needs to do better in helping members assess the risk and take appropriate action to safeguard the entire bloc. The UK-based think tank said in a report today that the EU should develop a new risk assessment framework that applies to all members and strengthens its own powers, without encroaching on members’ rights to set their own national security policies. It must delicately balance the need to secure the union, while maintaining the flexibility that both allows members to set domestic policies and lawmakers to account for different risk profiles across different sectors. The risks affecting telecoms will not necessarily apply to other sectors in the same way. Speaking of telecoms, currently there is only the voluntary EU Toolbox for 5G Security framework – voluntary being the operative word here, as only 10 of 27 members have fully implemented it since it launched in January 2020. On paper, it somewhat sets out to achieve what RUSI is calling for: a harmonized set of standards to mitigate 5G-related security risks affecting member states. Addressing the frustration over the lack of adoption, the European Commission proposed amendments to the Cyber Security Act (CSA) earlier this year that would allow it to build a list of untrusted vendors that members must preclude from the networks of 18 critical sectors. If passed, any countries using equipment from designated vendors would be forced to rip and replace it within 36 months. The EC has already indicated that it would suggest Huawei and ZTE be listed, should the amendments pass. But before the EU gets busy listing vendors it considers high-risk, it first needs to decide what a high-risk vendor even is. There is still no official definition, nor is it a legal category, and at present, it allows countries to wangle their way around these descriptions to buy the tech they want, bypassing whatever scrutiny may come their way should the CSA amendments come into force. RUSI’s researchers used Germany, Spain, and the UK as examples of how three countries can treat foreign tech vendors, such as Huawei and ZTE, very differently. Germany’s most important trading partner is China, a relationship worth €251.8 billion ($284.4 billion) annually, and historically the Bund has opted to preserve these valuable economic ties in favor of reducing supply chain risk. Under Chancellor Friedrich Merz, this is slowly changing, although RUSI does not expect to see a material shift in the makeup of Germany’s 5G RAN stack in the near future. Chinese suppliers accounted for an estimated 59 percent of the country’s 5G RAN in 2024. Chinese equipment accounted for an estimated 32 percent of Spain’s 5G RAN in 2024, although that share is expected to shrink. The debate intensified after last year’s controversy, when Spain awarded Huawei a contract involving the storage of judicial wiretap recordings. Spain’s past procurement decisions have shown it to often favor the most cost-effective option, and its government does not share the same national security concerns about China as the UK or US, or at least not to the same degree. The UK, meanwhile, looks set to completely eradicate Chinese technology from its telecoms network by the end of next year, and has bent to the US’ vehement demands that Huawei is bad, bad news for Western geopolitical security. Real security risks RUSI stated that concerns about Chinese IT vendors “are well-founded,” and that it is true that the Chinese government can empower authorities to exercise control over companies like Huawei. This includes providing the state with data on demand, hosting Chinese Communist Party (CCP) representatives, and reporting activity that signals a threat to national security. There is an additional law that requires tech companies to not just report vulnerabilities to the country’s government within 48 hours of discovery, but also to withhold the same disclosure from China’s overseas counterparts, except for the product vendor. “This converts China’s private sector security research into a state-controlled pipeline that grants intelligence services privileged early access to exploitable vulnerabilities,” RUSI said. Factoring in all of this, the country has also demonstrated the willingness and capability to launch cyberattacks against the critical national infrastructure of political adversaries, according to RUSI. Technical security aside, China’s technological advancements introduce economic risks, too. In some cases, its vendors have developed more capable products than equivalents in the EU or US, and sold them at more attractive prices. This advantage makes it difficult for some countries to justify the extra expense on non-Chinese equipment. In building a global reliance on its products, China could then introduce “unwelcome dependencies,” or cement itself as a dominant player in crucial supply chains, RUSI noted. China has shown in recent years that it is willing to exercise this influence, such as when it threatened Germany with “consequences” for the two countries’ economic ties during the heated 5G debate of 2019. Would a high-risk designation system work? One of the reasons why the think tank is calling for a more considered risk assessment framework for the EU is that there is no guarantee that what the EC is currently proposing in its CSA amendments will have much of an effect. Issuing blanket bans on companies, or countries, does not explicitly address the underlying security issues that make products vulnerable to attack. In other words, even if China were excluded entirely from the EU members’ tech stacks, the other vendors from ‘trusted’ countries have proved that they are unable to deliver penetration-proof software, which would open the door to attacks regardless. Remember, Salt Typhoon’s high-profile attack on US telco networks took place as recently as 2024. It should also be said that CSA-esque designations could apply to US companies, as some countries in Europe see US vendors as similarly risky, albeit for different reasons. Merz’s Germany is concerned about the relationship between the US and EU, for example, and similar concerns about dependence on Chinese technology could easily be applied to vendors in the US, should relations sour. In Spain, US cloud companies dominate, but anti-US sentiment is stronger than many realize, particularly around surveillance concerns. Those, along with higher prices from some non-Chinese suppliers, have reduced Spain’s appetite for ripping out equipment others deem high-risk. “One participant even noted that some officials view US legal instruments such as the Patriot Act as creating equivalent sovereignty risks to China’s National Intelligence Law, a narrative that is flawed when exploring the legislation, but politically convenient,” RUSI stated. The think tank suggested that if it wishes to enact change through policy, the EU must gather “greater economic courage” and a willingness to approach tech procurement as a means to secure its critical infrastructure, rather than “a compliance exercise.” ®

A suspected Chinese espionage group impersonated AI policy figures, including a senior Anthropic employee and a former White House official, in phishing campaigns targeting AI policy experts at US universities, think tanks, and law firms, security researchers say. The bulk of these campaigns occurred in July, according to Proofpoint, which discovered the espionage attempts and attributed them to a China-aligned group it tracks as TA419. Proofpoint’s security alert comes a day after OpenAI accused China’s Moonshot AI of stealing the American models’ reasoning and other data in distillation attacks that began on July 1. “In July 2026, TA419 impersonated multiple individuals, including a former member of the White House Office of Science and Technology Policy leadership team, in credential phishing campaigns targeting AI policy experts in the US,” Proofpoint threat-intelligence analyst Mark Kelly said in a Thursday report. Beginning July 8, TA419 sent phishing emails spoofing Lynne Edwards Parker, the former principal deputy director of the White House Office of Science and Technology Policy, and then Heidi Crebo-Rediker, a prominent economist and foreign policy expert, to even more American AI policy experts at think tanks, universities, and law firms. The suspected spies’ emails invited their targets to join a fake AI policy advisory committee or contribute to a Senate foreign relations committee report on AI export controls and supply chains. If the American AI expert replied, the Beijing-linked crew responded with a shortened URL promising to share additional details, but in reality pointing to an attacker-controlled domain. This page conducts a Cloudflare Turnstile check behind a phony OneDrive loading screen, and then redirects the victim to an attacker-in-the-middle (AitM) credential phishing page that steals the victim’s cloud account login information. The July 2026 campaigns used driftshare[.]co as the first-stage domain and globalfileshareplatform[.]com as the second-stage domain. In February - as US military officials pressured Anthropic to remove Claude’s safeguards - the Chinese spies spoofed a senior Anthropic employee to phish an AI policy analyst at a US think tank. This email used the subject line: “Request for Feedback on Military Integration of Claude.” TA419’s phishing chain targets Microsoft 365/Entra ID through the first-party OfficeHome application (client_id=4765445b-32c6-49b0-83e6-1d93765276ca). It’s built on open source Frameless BitB, which contains a Browser-in-the-Browser (BitB) overlay, an Evilginx phishlet to intercept usernames, passwords, and session cookies for Microsoft 365, and server-side substitution rules that inject the kit into proxied pages. TA419 typically uses Cloudflare’s content delivery network to hide the backend hosting IP address for its domains, and its credential phishing domains are usually themed around file sharing sites and cloud services - such as msfile[.]online and onecloudfilesync[.]com. It also impersonates specific organizations, including the Japan-Taiwan Exchange Association (tw-koryu[.]org), The Heritage Foundation (heritiages[.]org and heritiage[.]org), and Japanese Minister of Defense Shinjirō Koizumi’s official website (shinjirou[.]info). In total, the crew uses dozens of phishing and spoofed-sender domains, and phony email addresses. Proofpoint includes all of the ones it discovered in 2026, plus the timeline of when they were registered or first seen, so check out those indicators, too. TA419 and other Beijing-aligned crews will likely continue targeting AI and other policy experts working on technologies of interest to the Chinese government, according to the threat hunters. “Organizations in the scope of TA419 activity should consider phishing-resistant, origin-bound authentication such as passkeys,” they recommend.®

If you don't want your AI agents running out of control and changing files or transferring data outside your rules, AWS has published an open source software library that it claims can add a new layer of policy control. Just as a dog’s harness is useless without a leash to keep it under control, the Dogwood Local Engine promises to put AI agent tool calls on a leash, blocking actions that don’t meet user-defined temporal conditions. The DLE comes in the form of a Rust library that can be embedded into an agent’s harness or gateway and, to boil a long explanation down to a single sentence, simply issues allow/deny verdicts each time an agent tries to make a tool call. DLE doesn’t do the enforcement itself, AWS explained in its announcement writeup - that’s up to the harness itself - but it does check each tool call against policies defined using Dogwood, the open source governance language that AWS published in August. When AWS introduced Dogwood, it open sourced the language and reference tooling and added support for it to Amazon Bedrock AgentCore; DLE’s release makes the policy engine directly embeddable into agent harnesses. A key feature of both DLE and Dogwood is their awareness of temporal conditions. DLE tracks agent tool call events over time, stamping them into a log step by step. Those logs are persisted to a disk as each entry is made, allowing DLE to retain its state even if the entire system crashes or is restarted. The persistence step happens before DLE evaluates the applicable policy, and at the end of that process it returns a result: allow the action, or deny it, based on what the engine’s policies state. AWS gives the example of controlling coding agent Git pushes using DLE, defining a policy that only allows a push when the most recent test run has passed, and requiring that pass to have occurred within the past 15 minutes. If that’s not the case, the push is denied. “To accurately handle verdict enforcement, the harness intercepts every tool call, submits a request event to the engine, and runs the tool only if the engine’s verdict is allow,” AWS explained. This naturally raises the question of how much of a delay DLE introduces into agentic workflows; AWS claims the added delay is minimal. In tests simulating sessions from five minutes to 12 hours, DLE evaluation time was around 20 microseconds with a 15-minute window at the 12-hour mark, rising to about six milliseconds with a 24-hour window. DLE is also designed to prevent concurrent submission collisions by relying on a lock that only allows one event submission at a time, and that lock persists until policy evaluation is complete. AWS didn’t make clear from its writeup how that would handle a situation where, say, two concurrent submissions were made in which one fulfilled pass conditions and one caused a failure. We asked how incorrect enforcement could be prevented in those situations, but didn’t hear back prior to publication. Given repeated revelations of late that AI agents appear to regularly go off the (safety) rails imposed on them by human operators, the question of how durable DLE is also merits discussion. AWS admits that such situations are part of its reason for publishing the new library. “Left unchecked … tool calls can have irreparable consequences,” the DLE announcement concludes. “As agents scale to settings where they work autonomously for longer intervals with more tools, we need safeguards that can regulate how those tools are used.” AI agents finding holes in Dogwood and the DLE is likely a matter of time. Until then, feel free to give Dogwood and DLE a shot through its GitHub page. ®