The Register

What comes next after a moment when companies sell existential risk but pursue public funding and DIY regulation, even as software developers question their life choices? Peter Norvig, distinguished education fellow at Stanford HAI and former Google research director, used his opening keynote at The AI Conference in San Francisco on Wednesday to speculate on the answer. Almost certainly, it's another AI conference – on Thursday in fact – given the two or three dozen of them that have bubbled up in San Francisco this year or are scheduled in the remaining three months. To get to the present, he took a detour through the past. He acknowledged the milestones of AlexNet and ImageNet in 2012, the Transformer architecture for machine learning in 2017, the debut of ChatGPT in 2022, and the emergence of reasoning and coding agents in 2024. He also touched on the sudden competency of AI models for math, noting that two years ago, GPT-4 couldn't count the number of "r"s in "strawberry." Yet as of August this year, he observed, 25 percent of math preprint papers on arXiv acknowledged AI assistance. Norvig went on to cite Linux kernel creator Linus Torvalds' changing attitude toward AI. "Six months ago he was a skeptic, he became a cautious adopter, and now he's a dogmatic advocate," said Norvig. So what now? Norvig says the process of software engineering needs to change. The tech industry has changed many times before, he said, pointing to transitions from plugging wires into mainframes, to assembly language, to higher level programming languages. "At every step you have to change the way you think about what software engineering is," he said. And now we're going to have to change it all again. How do we do specifications and documentation? How do we capture this theory of the evolving program that we're not capturing well now?" To illustrate that point, Norvig recounted some of his recent work. "I did an embarrassing thing the other day, right? So I'm using Codex, [and I] write some stuff that seems to work," he said. He told Codex to send the pull request for review, and his colleague asked why he was checking in 6,000 temp files. "And I said, 'Well, I didn't notice that,'" Norvig explained. "And sure enough, I had written 6,000 temporary files, and Codex thought that it wanted to check those in. So I told [Codex], 'No, don't check them in, just delete them.' At first I thought, shame on me. I should have looked before I asked for a code review on that. And I just skipped that step of looking. Maybe I should be doing that." Then, said Norvig, he thought that the GPT model should have known that he didn't want to save 6,000 temporary files, so as not to burden the reviewer. And then he mused that if you have enough storage and memory, maybe it would be useful to have those files to have a more thorough history of how the codebase changed. "So the expectations of what's good practice and how that's going to change, that's all going to be different," he said. And that's just the start. "We gotta get the security and privacy and data pipelines and supply chains, those are all gonna be different in how they interact with each other," he said. "This idea of continuous integration and recursive self-improvement. How much do we let the systems go off on their own and how are we monitoring them?" Judging by the steady drip of incidents where AI models have hacked into third-party websites, discovered only after someone scrutinized log files, we're not monitoring them. So yeah, there's work to be done. ®

A 16-year-old security researcher named Faav found an authentication flaw in Microsoft’s Titan analytics service that allowed him to gain administrator access, submit unauthorized SQL queries with no valid credentials, and potentially reach analytics databases containing an estimated 17.3 trillion stored rows. Titan is an internal analytics platform, and Redmond restricts access via its web interface to Microsoft employees. Faav, with an assist from an AI hackbot he built called Antares, found that he could access Titan’s API through an Azure Cloud Services host because Titan didn’t check the signature on a login token. Microsoft has since locked down the API and paid Faav a $5,000 bug bounty for his research. He says the breakthrough came after 10 days of authentication errors, when he returned to the problem after finishing Friday’s schoolwork and finally managed to execute SQL as a Titan admin after 1 AM Saturday. “It was 2 AM,” Faav said in a blog about his findings. “I wanted to yell, or at least say something out loud, but my parents were asleep. So I just sat there staring at 17,333,335,124,315 and checked the math again.” He also notes that he rewrote his blog post at Microsoft’s request, cut sections and numbers, and reworded the impact prior to publication. “We appreciate the opportunity to investigate the findings reported by Faav,” Microsoft said in a statement provided to Faav for his blog. “Their submission and coordinated vulnerability disclosure helped us to better protect our customers by hardening our services. We value and appreciate safe security research under the terms of the Microsoft Bug Bounty Program and look forward to continuing to work with Faav in the future.” A boy and his bot The research began on August 25 when Antares found Titan’s public API. For the next 10 days, the human and bot tested the service’s JSON Web Token (JWT) authentication checks and email-formatted user principal names (UPNs), eventually finding an unsigned token that could reach Titan’s local user lookup - but not a UPN that Titan recognized. Early on September 5, Faav changed the unsigned token’s UPN from an email-formatted identity to admin. Titan recognized it as a local username, resolved it to local user ID 1, which held an admin role, and allowed him to run SQL. The takeaway, according to Faav: Titan validated the contents of the JWT (tenant, audience, app ID, user) but never verified the signature, the most important part of any authentication check. The authentication checks felt like a hotel where every door had a working keycard reader, but any keycard unlocked any room. Despite all the access-control logic existing in the app, the one missing piece made it all pointless. If you’re a developer (or coding agent) reading this, the most important takeaway from this post is to make sure you verify signatures above all else when building auth. This gave Faav access to Titan’s platform metadata database, and from there he could query application tables directly. The metadata contained: About 25,000 account and email records. 17,990 employee email records. 15,001 employee organization records. 355 database configurations. 20,979 virtual-dataset SQL definitions. 24,569 dashboards, 425,891 charts, and 27,347 dataset definitions. Titan’s user and usage directory exposed employee job titles, departments, and management hierarchy, which the researcher notes could be useful for social-engineering attacks - “though I never tested or demonstrated that,” he added. He also found a Bing analytics sample and tested two rows that contained search info, identifiers, and high-level location information, such as country- or state-level details. Faav said the location values did not contain precise user locations. 17.3 trillion data rows Then he hit the jackpot, testing 56 routing values from an archived configuration and discovering 30 were still active. “Each routing value pointed to a backend configuration, and each configuration contained one or more databases, so the 30 live values resolved through 24 configurations to 17 connected analytics databases spanning 9,863 unique table names,” the bug hunter wrote. The total comes to about 17.3 trillion rows, which Faav says is a storage estimate derived from metadata and likely includes historical, duplicated, and derived data. “But quite the high number nonetheless.” Between September 6 and September 8, Microsoft asked the teen to stop testing and requested his IP address to confirm no nefarious activity beyond the bug bounty research. A day later, Redmond locked down the endpoint and told Faav the “report prompted immediate investigation and remediation to address the remaining exposure.” Microsoft awarded the bug hunter $5,000 for his work on September 17.®

Resolute Raccoon is ready to roll out to existing Ubuntu users. Canonical has flipped the switch, and users on 24.04 will start to get offered 26.04.1. Canonical has marked the occasion with an official announcement that it's time to upgrade your desktop. Normally, a given LTS release of Ubuntu starts nagging offering the upgrade to the new release when the following LTS version gets its first point-release. This time around, there has been a substantial delay: Ubuntu 26.04.1 appeared over a month ago. The company announced a small delay in a post ubuntu-announce mailing list when 26.04.1 first appeared, saying: “Users of Ubuntu 24.04 LTS will be offered an automatic upgrade to 26.04.1 LTS via Update Manager a couple of weeks following this release after some planned backports to address regressions in a recent version of rust-coreutils.” The delay is the fault of Rust language which is aiming to replace C, as promoted by evangelistic developers whom Linux grandees castigate until they go away. This is the same Rust uutils bundle that David Uhden Collado recently ported to OpenBSD, but which was swiftly rejected by determined defender of the C faith Theo de Raadt. (Please read the previous two paragraphs in the most sarcastic tone that you can muster.) If you want to upgrade your Ubuntu box, there are two potential methods – one command-line-based, and one using the GUI – but both are easier than the traditional Debian method. First, though, install any and all outstanding updates. For this, we entering the following the shell command, if only because it’s easier to copy-and-paste: sudo apt update && sudo apt full-upgrade -y ; sudo snap refresh Because Canonical uses phased updates, you may see that some updates are “held back”. If you do, you can just run the main command again to get them: sudo apt full-upgrade -y Second time around, it may install a few more. Then reboot, and with any luck you will get offered the Resolute Raccoon upgrade. If you have Ubuntu installed on a relatively small partition, it may be as well to clear the APT package manager’s cache before you start. This can free up a lot of room. On our test VM, where we do this regularly, we got 1 GB back: liam-proven@noble-vbox:~$ df -h / Filesystem Size Used Avail Use% Mounted on /dev/sda2 24G 18G 4.3G 81% / liam-proven@noble-vbox:~$ sudo apt clean liam-proven@noble-vbox:~$ df -h / Filesystem Size Used Avail Use% Mounted on /dev/sda2 24G 17G 5.9G 74% / We reckon a free gigabyte for one command is pretty good. If you don’t get offered the upgrade automatically, run the “Software Updater” tool. If you don’t see it in your preferred app launcher, you can run the update-manager command in a shell. If you have any outstanding updates to your current version, you will be offered them first. Once they are all done, you should see a message saying: “The software on this computer is up-to-date. “However, Ubuntu 26.04.1 LTS is now available (you have 24.04).” Alternatively, if you prefer to do these things from the shell: liam-proven@noble-vbox:~$ do-release-upgrade Checking for a new Ubuntu release = Welcome to Ubuntu 26.04 LTS 'Resolute Raccoon' = The Ubuntu team is proud to announce Ubuntu 26.04 LTS 'Resolute Raccoon'. We’ve cut this to the first few lines – there are some 60 lines of it in full. As we reported when it came out, there are worthwhile novelties in RR. For instance, in our testing on some machines with older Nvidia GPUs which did not work well with 24.04, the now Wayland-only GNOME 50 drove our geriatric video cards just fine. If you use any other desktop, from Cinnamon to Unity, you still get X11. ®

According to the US President, the term Artificial Intelligence (AI) is tired while "Super Intelligence" is wired. Trump has issued an executive order to compel the Federal Government to use the new name instead. The term Artificial Intelligence was introduced by American computer and cognitive scientist John McCarthy in 1956, although the concept derives at least in part from work by British mathematician Alan Turing published in 1950. Regardless of its origin, the technology has outgrown the term, and the US, in particular, should adopt a new one, according to the man in the Oval Office. “The capabilities of today’s frontier systems do much more than imitate or automate discrete aspects of human intelligence. They increasingly amplify human ingenuity and unlock new forms of creativity, empowering Americans to achieve what was previously impossible across science, medicine, and nearly every other domain of human endeavor," he said in an executive order, which has the power to direct Federal agencies' behavior. "As these capabilities continue to improve, they increasingly represent not merely artificial intelligence, but a new era of Super Intelligence,” he added. Accordingly, the order directs federal government to “reflect the transformative capabilities of these technologies and the limitless opportunities they create for the American people”. Trump said that because “Super Intelligence” is more apt for “advancing capabilities of these technologies”, the executive branch should use the terms “Super Intelligence” and “SI” in place of “Artificial Intelligence” and “AI”. The order says the executive branch “will not acknowledge the usage of 'Artificial Intelligence' and 'AI' in any applicable setting”. The president also orders that government websites, official correspondence, public communications and policy documents reflect this change. The question is why the sudden change? It was only in June that Trump issued an executive order to promote “artificial intelligence innovation and security”. It orders the “upgrading of American systems for advanced AI” and promises Federal Government access to “frontier models”. We’re guessing all that paperwork will now have to be pulped. Others are speculating about motives aside from any sudden leap forward in technology over the last three months or so. Posting on X, Adam Cochran, a managing partner at Canadian VC firm Cinneamhain Ventures, claimed the decision to publish the executive order could be linked to investments in the .si domains over the last three months, which he argued would rise in popularity among governments and companies wishing to curry favor with the US administration. Although unable to produce categorical evidence that these investments could be linked to the President, his family or business associates, Cochran pointed toward a spike in domain registrations with the suffix .si, including 12,000 MAGA-related domains. In the few months leading up to the announcement, people also registered more than 10,000 AI-related terms to the .si domains, he claimed, some of which, he added, have now been relisted for millions of dollars. In the absence of any overriding evidence, a right-thinking person is forced to weigh the most likely explanation, balancing the probability that the US has entered the era of super intelligence and must change its paperwork and website registration accordingly to maintain its technological superiority, against the chance that the executive order is part of a shameless domain-name grift. ®

If you've always wanted to say you have "people" to attend your meetings, there's an app in development for that, as long as you're comfortable with the idea of eventually sending an AI bot in your place and potentially offending your human colleagues. MeetTwins, from Indian developer Aditya Shinde, is an AI assistant currently recruiting users for its beta. It's designed for a single purpose: to attend Google Meet calls on behalf of its operator and relay approved information to colleagues without requiring its human to spend precious time actually speaking to coworkers. Shinde describes the tool on its website as being inspired by his own desire to send an AI bot to his Google Meet calls, an idea he instead decided to develop into an actual product built using AI models from India-based AI firm Sarvam, and with the ability to add a digital twin avatar created by Simli. Use cases described on MeetTwins' website include status update meetings, students who have to juggle work with class, and even sales and customer teams who need to handle routine check-in calls with clients, though we don't advise that for businesses who want their customers to feel like they care about them. Prepping MeetTwins for a call involves telling it what questions to answer, providing documents or files participants may request, and supplying other context it may need. Certain topics can be designated off limits for the discussion as well. Shinde told The Register in a LinkedIn conversation that it’s solely designed to answer questions that were approved by its user, and that it won’t guess, make anything up, or promise something that a human ought to have final say on. “If a prospect asks something that isn't covered in the brief, MeetTwins will not try to improvise,” Shinde told us. Anything outside the defined realm of discussion is instead referred to MeetTwins’ operator, who receives an email after the call summarizing the things that were discussed and any open items to address. Let’s be frank for a moment: No one wants to be stuck in a boring Google Meet call that could have been an email – an argument for which MeetTwins, ironically, provides even further justification – but deciding to send an AI representative on your behalf isn’t likely to engender feelings of camaraderie or support from one’s coworkers. Shinde admitted he’s aware of that and has built features into MeetTwins to account for that very situation. “We are very conscious of this,” Shinde noted. “If anyone in the meeting is uncomfortable, they can simply type "/stop" in the chat, and MeetTwins will leave immediately.” In other words, there’s a distinct possibility that colleagues upset they had to engage with an AI instead of their coworker will simply eject the bot and send a grumpy email after the meeting asking for whatever information you were going to provide, potentially CC’ing a supervisor on that note, too. Shinde said that clearly labeling the MeetTwins bot as an AI in the call, and announcing it when it first speaks, "actually builds trust,” though we imagine that might not be the case with those who are skeptical of AI. A good use of AI? That’s up for debate, but it does prove one thing: We’re all wasting a lot of time in virtual meetings that could probably just be an email or a Slack message - preferably one penned by an actual human whose busy schedule might not have any spare time. ®

The AI industry must generate $6 trillion in annual revenue by 2031 to keep funding the infrastructure needed to meet anticipated demand, and this will require imaginative new uses beyond simply enhancing employee productivity. That $6 trillion figure comes from the 2026 annual Global Technology Report from management consultants Bain & Company, which put its thinking cap on to figure out how the AI sector can possibly meet this challenge. It says the massive demand for AI compute infrastructure has revived the hardware industry. Some of the fastest growing segments include high-bandwidth memory (HBM) used in GPUs, advanced packaging and custom silicon, and application-specific integrated circuits (ASICs) all scaling rapidly. As The Register reported last year, AI spending is actually keeping the US economy out of recession, with datacenter infrastructure and model development providing the only significant growth areas. Bain points to the “arms race” among hyperscalers for AI capacity, claiming that capital expenditure by Microsoft, Google, Amazon, Meta, and Oracle could hit $780 billion for the whole of 2026, nearly five times the level seen just three years earlier. By 2031, it estimates that annual spending on AI infrastructure could reach $1.5 trillion, a figure that is not far off the $1.6 trillion forecast separately by analyst firm Omdia. The $6 trillion comes from the Bain's assumption that capital expenditure will amount to about 25 percent of industry revenue, an ambitious but reasonable percentage based on trends among cloud providers, it says. Bain expects that existing applications of AI will grow, but estimates these will add up to a total between $1.2 trillion and $1.8 trillion in revenue. This includes consumer AI, via subscriptions and advertisements, plus enterprise AI, through software development, sales, marketing, customer service, and IT operations. That leaves a remaining $4.2 trillion of additional revenue for the industry to find from somewhere. Four possible categories emerge from Bain’s research as possibilities to fill this gap. It says that AI models are replacing search engines and integrating ads to generate new revenue, which means the developers could unlock $100 billion to $200 billion of extra cash. Secondly, AI to make autonomous cars, trucks, and drones, as well as other industrial automation, could create new products and services worth about $400 billion, Basin estimates. A similar category is physical AI, in which category it includes simulations, digital twins, and robotics, with a calculated worth of as much as $900 billion. Those three add up to $1.5 trillion, leaving Bain with a $2.7 trillion shortfall. What could make up the rest of the AI industry revenue? It puts forward “new products and uses that don’t exist today,” which is the kind of answer that your granny could have come up with. In this category it stuffs AI-driven drug discovery, mental health support that might address billions of dollars in unmet demand, materials science breakthroughs in areas such as battery technology and semiconductors, and accelerating scientific research in fields from neuroscience to fusion energy. “The debate today is fixated on employee productivity. The economics of AI infrastructure demand trillions in new revenue beyond productivity gains. What the industry needs is a wave of innovation that will dwarf what mobile and cloud unlocked,” said David Crawford, chairman of Bain’s global Technology practice. It is only a year since a previous report of Bain’s forecast that the industry would need to hit $2 trillion in revenue by 2030 to keep feeding the infrastructure beast. That figure has now trebled, which is perhaps an indication of just how much the investment going into AI has ballooned over the past 12 months. There are reasons to think the AI industry is not going to hit $6 trillion in annual revenue by 2031. The Register has published numerous reports indicating that AI rollouts are just not paying off, such as this one, this one or this one. At the same time, doubts are being cast over whether all those AI infrastructure projects will be realized. A report from investment bank Jefferies found only half the US datacenter capacity scheduled for 2026 is actually under construction and work is yet to begin on as much as 80 percent of the 2028 pipeline. Another report from the same company suggested that chip manufacturing constraints will limit how many planned AI server farms can be brought online over the next several years. ®

A former National Crime Agency (NCA) officer who stole Bitcoin seized during an investigation into Silk Road 2.0 has been ordered to hand over more than £1.8 million ($2.4 million). Paul Chowles, 44, stole 50 of the 97 Bitcoin recovered from convicted Silk Road 2.0 administrator Thomas White. Police later recovered 30 of the stolen coins. US and European authorities shut down Silk Road 2.0 in November 2014 as part of an international operation targeting dark web marketplaces. The 50 Bitcoin were worth about £60,000 ($79,000) when Chowles stole them in 2017. Chowles had worked on the NCA investigation into criminal activity on the original Silk Road and later took the lead in analyzing data and extracting cryptocurrency from devices seized from White. Between May 6 and 7, 2017, he transferred 50 Bitcoin from White's "retirement wallet" to an address under his control. He then divided the coins into smaller amounts and routed them through Bitcoin Fog, a mixing service used to obscure cryptocurrency transactions. By the time of his sentencing in July 2025, the Crown Prosecution Service (CPS) valued the 50 Bitcoin at more than £4.4 million ($5.8 million). The CPS said the rise in Bitcoin's value helped take the benefit attributed to Chowles' offending to £1,970,759.27. When making a confiscation order, a court considers both the benefit obtained through the crime and the defendant's "available amount" – the value of assets that can be used to satisfy the order. Chowles' available amount was assessed at £1,810,678.93, and Liverpool Crown Court ordered him to pay that sum. Luke Clements, specialist prosecutor at the CPS Proceeds of Crime Division, said: "Paul Chowles exploited a position of trust for personal gain, stealing assets that had already been recovered through law enforcement action. "Confiscation orders are a powerful tool in ensuring that crime does not pay. Today's order sends a clear message that we will pursue offenders' assets relentlessly and seek to recover criminal proceeds wherever they are hidden. "The CPS Proceeds of Crime Division will continue to work closely with law enforcement partners to identify criminal benefit and take robust action to strip offenders of the profits of their crimes." Chowles, from Bristol, was dismissed from the NCA on July 11, 2025. Five days later, Liverpool Crown Court sentenced him to five years and six months in prison after he pleaded guilty to theft, transferring criminal property, and concealing criminal property. Suspicion eventually fell on Chowles after White insisted that someone inside the NCA must have taken the Bitcoin. The NCA initially assumed White had moved the missing Bitcoin himself because he had the technical knowledge to do so. By late 2021, investigators regarded the coins as untraceable and wrote them off. Following White's conviction, the court imposed a confiscation order of £1,560,506. The NCA sold the remaining 47 Bitcoin to satisfy part of it, leaving £1,066,956 outstanding. White maintained that someone within the agency had stolen the other 50 coins because NCA investigators held the private keys to his wallet. Merseyside Police was responsible for managing White locally after his release on license in early 2022. When Merseyside officers met NCA counterparts to discuss White's allegation, Chowles attended the meeting. Merseyside Police subsequently opened an investigation and arrested him in May 2022. Investigators recovered an iPhone linking Chowles to an account used to transfer Bitcoin, along with relevant searches for a cryptocurrency exchange. They also found notebooks in his office containing usernames, passwords, and statements relating to White's cryptocurrency accounts. ®

EVENT: There are two boundaries around any AI system in a regulated industry, and they have different owners. One is the jurisdiction: what data can leave the country, and under whose rules. The other is the building: what can leave your own estate at all, and who signs for it when it does. Most AI programs do not stall on the model. They stall here, on where the data lives, who can reach it, and what an auditor will accept as evidence twelve months from now. The proprietary data that makes an AI system worth building is the same data that makes it a risk to build. And the boundary drawn around a pilot has a habit of quietly becoming the boundary around production, whether or not anyone chose it. A product sheet does not answer those questions. They get answered case by case, with a particular regulator and a particular legal team in the room, which is why The Register is putting them to HPE and NVIDIA over dinner in Washington on Thursday 29 October. Editor-in-chief Matt Rosoff takes the chair and nothing is on the record. HPE sends Thierry Pienaar, HPE Fellow and Chief Technology Officer for HPC and AI Worldwide Sales. NVIDIA sends Bert Condensa, Vice President for Enterprise AI Factory Segment Sales. Both are there to take questions. Nobody is bringing slides, and the chair cuts off anyone who starts pitching. The evening runs under the Chatham House Rule, so what is said can be used and who said it cannot. That is what makes the useful answers possible, like what a hospital group’s legal team refused to sign, and what it signed instead. On the table: which infrastructure options actually hold a boundary, what each one costs in capital, in capability or in elasticity, and whether any of it survives the move from planning into running operations. The table is for technology, data and risk leaders in healthcare, financial services, research, pharmaceuticals, government and higher education who are making these calls now rather than next year. Dinner runs from 6.00pm to 8.30pm at Fiola Mare. Places are limited and go by invitation. Request one here. Government and public sector guests: where your agency’s ethics rules require it, you can pay your own share and we will provide a receipt. Please say so when you request an invitation.

OpenAI’s DevDay keynote was this week, and it featured a cameo mention of everyone’s favorite underpants merchant who also sells databases, AWS. I saw Simon Willison’s liveblog comment and felt very seen: “My eyes glazed over a bit at the AWS partnership section, but it only lasted a few seconds.” With today's more interesting but also largely unheralded announcement, you can now retire your OpenAI spend commitments via a list of (at launch) 32 partners, just like the AWS Marketplace has done for years. The last cloud war was fought over who got to run the customer’s infrastructure. The next one will be fought over who gets to steer the customer’s next purchase. OpenAI plays chess while Anthropic eats checkers OpenAI is making a fascinating play here. By making its Codex harness open-source, and including Baseten in its marketplace for access to open models, OpenAI is effectively saying “we hope our models win on their merits, not because we'll break your thumbs if you use others.” The Baseten partnership is itself the most interesting one they've trotted out; it's the first real sign we've seen from OpenAI that they view open models (that they themselves have not released) as anything other than an existential threat. This is going to become a massive bellwether as to whether the "Open" in their name is words on a page, or a deeper philosophy. Distribution will almost certainly matter more than a temporary lead in model quality. OpenAI seems to understand that, and lets you use subsidized subscription accounts with other tools. Anthropic disagrees; if you try to use a Claude Pro account with OpenCode, you will shortly find that you no longer have a working Claude Pro account. It's almost Microsoftian. Strong-arm edicts around how your product must be used or integrated into workflows only lead to success in the minds of executives who also think AWS is a leader in AI; that is to say, “their company has a SharePoint server.” For the rest of us, there is no obvious durable advantage that either of the two frontier labs can sustain over one another on the model front. OpenAI is clearly the first to recognize that its ability to steer the customer’s next purchase decision is a power all its own. There are substantial caveats The fine print is never as tidy as the glossy brochure suggests. While specific terms are only available within enterprise OpenAI accounts, the details that have been publicly exposed so far show that they’re being cautious at launch. Only a fixed percentage of spend up to a cap applies; eligibility is specific to the customer, product, and purchase in question; and curiously the billing is direct through the partner, with OpenAI handling commitment reconciliation on their end separately. There’s no self-service here, and thus zero publicly testable indication yet as to what types of spend (if indeed any) make it through the approval gauntlet. But assuming it takes off, vendors will gain access to customers and committed budget that's already been allocated, which is super for them. In exchange, they risk depending on OpenAI’s eligibility decisions and discovery mechanisms; if this takes off, the odds are terrific that Baseten will not be the only open model provider in the marketplace, and, just like the cloud providers before them, OpenAI's marketplace will follow the natural evolution of such things and begin eating its partners. This means that we're heading for a showdown. You can imagine that many customers will have obligations to both AWS and OpenAI. Which agreement will get the credit for a third-party purchase? More interestingly, who at the customer is going to be the one who ultimately controls that decision: engineering, procurement, finance — or the vendor’s account team? This is something that every AWS customer with an enterprise account team in place struggles with. To that end, I’ve felt for a while that the model labs are becoming this generation’s cloud providers, while the cloud providers are becoming this generation’s IBM. IBM does an awful lot of stuff (I know, I know, it's valuable! Please do not send me a fax!), almost none of it headline-making. But those deals trend towards getting signed on a golf course with an enterprise sales team, not on the IBM website at 3AM because you're trying to solve a problem. While the company still has some money-printing machines in it, Big Blue's days of being the center of the tech universe are long gone, and were it to go out of business tomorrow, some of its divisions would apparently not realize it for at least five years. It's part of the furniture, not the driver of technology adoption. Meanwhile, the "we're throwing a bunch of stuff out there, keeping track of what we release is rapidly becoming a full-time job, and things that sucked yesterday are suddenly smooth sailing today" has become squarely the province of the frontier labs. The war for enterprise relevance Allowing competing models into the ecosystem doesn't necessarily demonstrate philosophical enlightenment. It can serve to make larger OpenAI commitments more palatable ("Hey, if we aren't going to use up all of our commitment we can burn it on other vendors!"), attract more vendors into OpenAI's partnership program to absorb that overflow spend, and give customers fewer reasons to leave. OpenAI's marketplace puts it in a position to benefit from decisions well beyond model selection; its contract becomes a consideration when customers choose other software. AWS's risk here is compatible with continued financial success. More agents will presumably mean more AWS consumption. But the customer might increasingly start with OpenAI, select a variety of tools through its ecosystem, and only encounter AWS as an implementation detail, not materially different than a datacenter provider. Simon Willison tuning out the AWS mention in the keynote isn't evidence of AWS's decline. But it does show that AWS turning up was incredibly easy to miss, while the stuff that matters to enterprise buyers may one day be looked back upon as a passing of a torch. ®

Firefox 157 is here, but this time, Mozilla is making an unusual amount of noise about this release and its new look. This release has a new theme called “Nova,” which in the release notes Mozilla calls “Firefox’s biggest visual refresh in years.” The new theme is the flagship here, and aside from that, the new features in this version are fairly modest. They’re all welcome enough, though. Video calls which use WebRTC – Web Real Time Compression – now use hardware compression, and a bug which made video appear upside-down has been fixed, along with half a dozen others. The Firefox Suggest feature that tries to guess what you’re looking for now works in 16 more European countries. One change that sounds small but which we are pleased to see is that in new tabs or windows, Tab takes you straight to the search box instead of the choose-a-search-engine button (although you can get back to this with Shift+Tab). We suspect this may reduce how often the Reg FOSS desk shouts at his computer in moments of stress. If you navigate to a new page and then immediately start typing, Firefox 157 now waits – it won’t immediately start searching new pages that haven’t fully loaded yet for text. The updated sidebar has become more customizable, and there’s an option to disable the new version (which also hides vertical tabs). However, another change may irk those clinging to old ways: the option to show or hide the sidebar has been removed from the Settings screen. Saying all that, Nova is the star here. There’s even a video advert for it: This does, admittedly, plug some Firefox features that we suspect may win Mozilla new users more effectively than a skin, such as enhanced privacy, less snooping, and the global AI off-switch. We really don’t think that a new look with more rounded buttons and tabs is what Chrome users are looking for, and we’re irresistibly reminded of Mozilla’s 2013 launch of its new, more rounded, Australis theme. That was so unpopular that it motivated the fork that created Palemoon and Basilisk. This jaded old curmudgeon can’t see much difference: it looks very similar to us, except for a very faint violet-purple tinge, and visibly more-rounded tabs. A welcome change is that the toolbar customization dialog once again offers “Compact” as a layout density – we did miss that. Some Brits, and notably Welsh readers, may notice the Firefox logo somewhere new: Mozilla is now sponsoring Wrexsham AFC. Wrexham is, apparently, the third oldest football club in the world. The new sponsorship deal reflects some significant changes at Wrexham Association Football Club since 2020. It is owned by two 49-year-old actors from North America: American Robert Dale McElhenney III, AKA Rob Mac, and Canadian Ryan Reynolds. Yes, that Ryan Reynolds. We knew we liked him for a reason, and his self-description on Linkedin is a good example: “My skills include writing, re-writing, tweeting, mixing cocktails, backend engineering for software platforms and watching lower-tier Welsh football matches. Proficiency ranges from excellent to absolutely awful.” Reg FOSS desk is not a sports fan, and for this vulture, Wrexham is more famous for beer than football. It’s the home of Wrexham Lager, which was arguably Britain’s first lager and is today the oldest lager beer still brewed in Britain. It turns out that Wrexham Lager also sponsors Wrexham AFC as well, and since 2024 the brewer has been owned by… none other than the same two 49-year-old North American actors. So there you go. Perhaps they should have gone with "Firefox is Deadpool’s preferred web browser," or something along those lines. Perhaps that would persuade the Chrome users to check it out? At the time of writing there’s no corresponding version of Thunderbird yet. Bootnote: * We are intentionally invoking Betteridge’s Law in the title of this story. Also, our editor insisted that we call it “football”, rather than “soccer” to distinguish it from the game of handegg. ®

Gartner predicts that by 2028, 70 percent of enterprises will abandon agentic AI systems built with vendor assistance as costs climb and customers struggle to modify the technology without outside help. What the consultancy calls forward-deployed engineering (FDE) embeds a vendor's engineers with a customer to build and deploy software for its particular requirements. Gartner argues that the model can deliver rapid early progress but leave customers dependent on expensive external expertise. According to Gartner, FDE engagements can fail when customers do not acquire the knowledge and control needed to maintain and develop the resulting systems after the vendor leaves. FDE "success starts with getting the engagement structure right, from scope and incentives to governance, ownership, and exit," said Gartner senior director analyst Mukul Saha. "The best-scoped FDE engagements have clear guidelines on governance, business value delivery, IP ownership, project co-ownership, knowledge transfer, and an exit strategy from day one," he added. "Many providers now use 'forward deployed' as a label for implementation, professional services, solution engineering, or AI consulting; some thoughtfully, others because it sounds more strategic. Some charge premium fees without the delivery depth, program management, or change management maturity to justify them." The AI industry promising outcomes it can't deliver? Perish the thought. Gartner advises software engineering leaders to use FDE only for problems requiring deep product expertise, rapid adaptation, or close integration between the vendor's technology and the customer's operating environment. Otherwise, customers may see rapid early progress without building the internal capabilities needed to take control. They could then end up paying premium rates for work that a traditional services or partner model might deliver more cost-effectively and predictably. Gartner also predicts that through 2028, fewer than 20 percent of FDE engagements will turn recurring customer requirements into features in the vendor's core product. It warns of a growing risk of "FDE washing," in which conventional consulting services are marketed as something more specialized. This isn't the first time that Gartner has warned of the potential costs and pitfalls of AI projects. Earlier this year, it forecast that at least half of generative AI projects will exceed their budgets due to poor architectural choices and lack of operational know-how, while most organizations that try to build custom models will abandon them for similar reasons. It also said it expects 40 percent of AI agent deployments would be scaled back or decommissioned as organizations run into governance problems with the technology. More recently, the analyst predicted that nearly a third of employees laid off because of AI will need to be rehired again at a future date, often at significantly higher cost. ®

Apple's latest AirPods make a small concession to repairability. And by "small," we mean they scored two out of ten rather than zero. Every previous generation of AirPods tested by iFixit has received a repairability score of zero out of ten. "We've bled for AirPods. We've sliced them, melted them, cursed at them," the team stated. Apple's earbuds resisted every attempt to repair them without destructive surgery. The AirPods 5 have finally broken that streak – barely. The AirPods 5 arrived alongside the iPhone 18 Pro and Duo. Apple's latest entry-level earbuds resemble the previous generation, with short plastic stems, no silicone tips, and a USB-C charging case. Buyers pay extra for a case with wireless charging. The earbuds also gain IP57 dust and water resistance, but iFixit was more interested in what had changed inside. According to iFixit, a skilled technician – or sufficiently determined DIYer – could replace the batteries without destroying the earbuds. That is possible because the batteries use removable prongs rather than soldered leads, and the buds can be opened with commonly available tools. A clamp, a hair dryer on its lowest setting, careful heating, and some patient prying were enough to open the buds cleanly. Once the adhesive strips were removed, the pronged batteries popped out. That is a substantial improvement, although iFixit stressed that it still isn't an easy home repair. There are some provisos. First, replacement batteries are not yet available. Second, the left and right earbuds use subtly different batteries and cannot exchange them. The team reported: "Looking closely, we could see the polarity on the batteries was reversed. The prongs were welded slightly off-center too. These batteries are physically ever so slightly different from left to right." Deeper inside, iFixit found the capacitive touch layer fitted to the version sold with the wireless charging case, followed by the H2 system-in-package that handles features including active noise cancellation. It isn't an easy battery replacement, but for the first time it appears to be possible without destroying the earbuds. The charging case remains effectively unrepairable and resisted every attempt to open it intact. "There was prying, cursing, cutting, more cursing, and an accidental stab wound. We've bled for AirPods. Again." The team eventually extracted the battery and other hardware, but destroyed the case in the process, making reassembly impossible. "It simply shouldn't be this hard to get to a battery," the team noted. "Fairphone's Fairbuds show that battery replacement can be a priority in both the earbuds and their case." With no replacement parts yet or repair manuals from Apple, and a charging case that cannot be opened intact, the result remains a long way from genuinely repairable. Even so, iFixit called the AirPods 5 "not as disappointing as they could have been." The final score was two out of ten – poor by any ordinary standard, but still "the highest score we've given AirPods." ®

Some support calls become memorable because of the technical problem. Others stick in the mind because the caller has apparently consumed an adult beverage or three before demanding to speak to the boss. Microsoft veteran Raymond Chen has shared one from the latter category. His tale comes from a now-retired colleague who once staffed Microsoft's FrontPage support line. The caller was building a Van Halen fan site using FrontPage, and it wasn't going well. A Java applet was supposed to play music, but the caller could not make it work. FrontPage began life in 1995 at Vermeer Technologies, which Microsoft soon acquired. Redmond released its own version in 1996 and kept the HTML editor alive through FrontPage 2003. Mainstream support ended in 2009 and extended support in 2014. The name "FrontPage" will likely make administrators and developers who remember it shudder. It relied on proprietary FrontPage Server Extensions for Microsoft's Internet Information Services (IIS). The remains lingered remarkably long. In 2025, Microsoft finally moved to block the FrontPage Remote Procedure Call (RPC) protocol. At the time of the call, however, FrontPage was alive and well – as, for that matter, was Van Halen. The faulty Java applet wasn't a FrontPage problem – the editor and the sites it produced had enough of their own – but Chen's colleague tried to help anyway. "But man, was this person lit." "The sound of ice clinking in a glass was readily apparent, and as the call went on, the customer got more and more drunk," Chen wrote. The increasingly frustrated customer eventually shouted: "You're not even a real f—ing fan of Van Halen!" Chen's colleague warned that any more swearing would end the call. The demon drink had apparently overridden whatever restraint remained: "F— you! I wanna talk to Gates!" A sentiment many a Windows user has shared as the screen abruptly turned a data-losing shade of blue. Chen does not know what happened next, but wondered whether the caller was transferred to Microsoft's special line for customers demanding an audience with His Billness. Operators answered as Gates's office, took down the complaint, and passed it back to support for a suitably prestigious follow-up. Whether the Java applet ever worked is also lost to history. Perhaps that was for the best: the web already had enough auto-playing music, and for every crowd-pleasing Van Halen track there was a "How Many Say I" – or even that surreal rendition of "Happy Trails." Ever had a similar problem? Tell us in the comments below. ®

Satellite imagery suggests US datacenter deployment is accelerating, but not fast enough to meet some of the more exuberant forecasts for 2028. Meanwhile, advanced chip packaging is emerging as another constraint on how quickly new AI capacity can come online. A report from investment bank Jefferies says server farm construction is proceeding apace across America, but permitting, access to power, and supplies of packaged AI accelerators continue to hold projects back. The report, shared with The Reg, cites analytics biz SynMax, which uses weekly satellite imagery to track land clearing, the appearance of the first structures, and construction progress at datacenter sites - data that distinguishes projects advancing on the ground from those that have merely been announced. SynMax estimates that US deployments will rise from roughly 11 GW of gross capacity in 2025 to 16-18 GW in 2026, above its previous forecast of 14-16 GW. It puts the practical upper limit for 2027 in the low 20s of gigawatts. Yet the amount of land being cleared for new projects has plateaued, leaving visible activity well short of the pace required to deliver the more than 80 GW implied by some announced project pipelines and chip demand models for 2028. That chimes with a previous Jefferies report, which found that only half the US capacity scheduled for 2026 was under construction and that work had yet to begin on as much as 80 percent of the 2028 pipeline. Jefferies identifies advanced packaging as another emerging constraint. Fabricating enough accelerator dies is only part of the job: they must also be packaged with components such as high-bandwidth memory before OEMs can install them in servers. Advanced packaging combines multiple dies and memory components using high-density connections, an approach used in many cutting-edge CPUs and AI accelerators. Even chips manufactured on US soil may need to be sent overseas, typically to Taiwan, for packaging, creating a choke point between semiconductor production and operational datacenter capacity. SynMax estimates that existing advanced packaging capacity could support accelerators drawing the equivalent of roughly 13 GW of gross power. After accounting for CPUs, memory, cooling, and other loads, it converts that figure into approximately 17.5 GW of total datacenter power. Two additional packaging projects expected to come online in 2027 could support another 6 GW, taking the practical ceiling into the low 20s unless capacity expands faster than forecast. This is not the first warning that chip supplies could limit datacenter expansion. Last year, a report from London Economics International concluded that if all the bit barn projects forecast for the US between 2025 and 2030 went ahead, it would require 90 percent of all the growth in the global AI chip supply to be funneled into the American market. The report also notes that development is concentrated in states including Texas and Virginia, making national deployment figures particularly vulnerable to delays in either market. In Texas, obtaining uninterrupted grid service can be slow, while accepting occasional curtailment may get a datacenter connected sooner. This could require an operator to reduce power draw when instructed by the grid operator. Jesse Gossett, a former developer and participant in the Electric Reliability Council of Texas (ERCOT) large-load working group, told Jefferies that 99 percent uptime could be financially viable if curtailment were predictable enough to model, insure, reflect in service-level agreements, or cover with backup resources. What can break the economics, Gossett argued, is unpredictable five-minute curtailment under the Texas grid operator's Security-Constrained Economic Dispatch system for Provisional Controllable Load Resources. Datacenters can accommodate planned curtailment lasting an hour or two, but not an unexpected instruction issued on five minutes' notice. ®

More than half of UK businesses lack confidence in their ability to perform at least one basic cybersecurity task, according to the government's latest skills survey. The annual research found 57 percent of businesses reported a basic technical skills gap, up from 49 percent last year despite tighter national standards and repeated government warnings about cyber resilience. That equates to approximately 808,000 businesses whose cybersecurity leads were not confident in carrying out at least one of nine tasks, including storing data securely, configuring firewalls, and detecting and removing malware. The equivalent estimate last year was 699,000 businesses. The researchers cautioned that the increase might reflect greater awareness of organizations' security posture rather than an actual deterioration in their capabilities. Interviews suggested that recent high-profile breaches had prompted executives and boards to scrutinize cybersecurity more closely. Detecting and removing malware produced the largest reported skills gap: 38 percent of businesses, 47 percent of charities, and 23 percent of public sector organizations lacked confidence in performing the task. The public sector reported fewer problems than businesses and charities across all nine basic skills measured. Sam Thornton, COO at cybersecurity consultancy Bridewell, said the figures reflected the position of smaller businesses and charities, where cybersecurity is often "just one part of someone's wider role rather than a dedicated job." "Malware is evolving quickly, and AI is increasingly helping attackers produce faster variants which are harder to spot," he told The Register. "Keeping pace requires constant attention, which may be harder when the person responsible for security is also handling several other roles. "This could mean that personnel lean on greater use of AI tooling to support cyber defences, which in turn could induce further exposure to the organization where sufficient skill levels are needed to understand and interpret the output of such AI models." Matt Hull, veep of cyber intelligence and response at NCC Group, said limited resources were compounded by increasingly complex IT environments. "Businesses increasingly rely on cloud infrastructure, SaaS platforms, APIs, third parties and growing numbers of human and machine identities," he said. "These environments can change rapidly, making it much harder to apply security fundamentals consistently across the organization." Hull said the industry also has "a habit of chasing the latest shiny update," when in reality most problems arise when organizations overlook the fundamentals. "It's a bit like looking after your car. You can spend a fortune on the latest safety features and a brilliant sound system, but none of that helps much if your tyres are bald or you can't see through the windscreen." Other reported gaps included storing and transferring personal data securely, restricting which software could run, configuring firewalls, selecting secure device settings, enabling automatic updates, and creating user accounts securely. Charities reported the widest skills gap on most measures, although businesses were less confident about storing and transferring personal data securely. Although the public sector scored better than businesses and charities in this survey, its overall basic skills gap nearly doubled from 14 percent last year to 27 percent. That comes despite repeated warnings about weaknesses in government systems. In 2025, the National Audit Office found "significant" gaps and immature controls across most critical systems it examined. Incidents affecting the Legal Aid Agency, Foreign Office, British Library, and NHS supplier Synnovis have provided ample demonstrations of the potential consequences. Among the government's responses is the £210 million Cyber Action Plan, announced at the start of the year to strengthen central government systems and introduce mandatory security requirements. Operators of critical services can use the NCSC's Cyber Assessment Framework to assess their resilience, while smaller organizations can seek Cyber Essentials certification as a baseline. The Cyber Security and Resilience Bill, now making its way through the Lords, would impose additional requirements on operators of essential services and their suppliers. The bill is intended to replace the NIS Regulations 2018 but excludes central and local government. The UK government believes the Cyber Action Plan essentially holds the public sector to the same standard as those in scope of the new bill, but does so without any legal obligations. Thornton argued that tighter regulation was unlikely to close the skills gaps among small businesses and charities without practical support tailored to their limited resources. "When more than half of UK businesses lack confidence in the basics, and nearly half of those responsible for security don't feel equipped to handle an attack, we have an economy that is both easier to breach and slower to recover," he said. "A growing skills gap at the bottom of the supply chain weakens the UK's resilience as a whole. Tighter regulation will help protect critical infrastructure, but it's unlikely to improve the skills in smaller businesses and charities. "Closing the gap will need affordable, practical support for smaller organisations, whether through managed services, simpler tools or incentives from insurers, so that good baseline security becomes the default rather than something only larger firms can afford." ®

KDE Plasma 6.8 is nearly here, bringing the revived Oxygen theme and dropping its X11 session. For those who prefer an older look, a new project called Klassik recreates the KDE 3 experience using modern Plasma technology. KDE has released the second and final beta of Plasma 6.8, while developers have already begun landing changes for Plasma 6.9, according to the latest This Week in Plasma update. Barring delays, the release is scheduled for October 14, KDE's 30th anniversary, as we mentioned ahead of the Akademy conference. Plasma 6.8 will also be the first release without an X11 desktop session, a change we warned about last November. Plasma 6.7 still offers the session as an optional installation, but, from 6.8, the desktop itself will run on Wayland. X11 applications will continue to work through XWayland. KDE's anniversary celebrations will also include a feature-length documentary about the project from Irish video producer Cult.Repo. A trailer is already available. The beta continues the public preview of the Union theme engine, which can now style QtWidgets applications such as Dolphin and Kate, although KDE warns that the support remains preliminary. The revived Oxygen theme is also receiving further polish for Plasma 6.8. KDE 3 returns in Klassik form If all that new shiny is not your speed, a newly announced project called Klassik may be more appealing. Klassik is not a fork or port of KDE 3. It recreates the old desktop's appearance and behavior within Plasma 6 using Qt 6, Qt Quick, and KDE Frameworks 6, with support for Wayland and fractional scaling. KDE 3.0 appeared in April 2002, and the series ended with KDE 3.5.10 in August 2008. Klassik reimplements elements of that desktop on the libraries used by Plasma 6 rather than attempting to revive its original Qt 3 code. Klassik reimplements the early-noughties panel, K Menu, Quicklaunch and Task Manager, along with the lock and logout buttons, and even the old clock. To be perfectly honest, this is not an era of the KDE desktop that The Reg FOSS desk is especially nostalgic for, but we're sure it will have strong appeal for some longtime KDE users. We're delighted to see decades-old Qt designs recreated using modern tools. The Lomiri desktop remains in development, but as a converged environment for touchscreens and PCs it is not a direct replacement for Canonical's old Unity desktop. We would still love to see someone give the lightweight, Qt-based Unity 2D similar treatment; its source remains on Launchpad – for now. Another candidate would be the old Xandros Desktop. Xandros acquired Corel LinuxOS and produced a KDE-based desktop that The Register rather liked 20 years ago. PCMag Australia still hosts screenshots from 2007, and to this day it remains one of the cleanest KDE arrangements we've seen. Four forks to fondle Klassik is not the only attempt to preserve an earlier KDE experience. Four actual forks or derivatives also cater to users unimpressed by the project's more recent direction. The oldest and best-established is the Trinity Desktop Environment, or TDE. Klassik looks somewhat similar, but TDE isn't based on the modern KDE libraries and Qt6 – the project maintains its own fork of Qt3, called TQt. The latest release is version 14.1.6, released in April this year. The TDE wiki lists 14 distros for which the current version is already available. We last looked at TDE in May 2025. The Spanish Vendefoul distro, which we mentioned in July, runs TDE on top of XLibre. If you're happy with modern KDE Plasma, but don't want Wayland, then the new Sonic desktop may appeal. This is a new fork, and development on GitHub is active. It has its own fork of the KWin window manager, called Sonic-win, which retains X11 support. If KDE 3 is uncomfortably modern, then the MiDesktop project is reaching back further still. This is a fork of KDE version 1.1.2, the last release of KDE 1 and the project's final release of the 20th century. MiDesktop uses the Osiris toolkit, a fork of Qt 2.3.2. The one we don't quite fathom is the Katana desktop. This is a fork of KDE 4, the first version with the new Plasma desktop. KDE 4.0 appeared in 2008 and its final release was KDE 4.14 in 2014. KDE 4 proved notoriously divisive, especially in its early releases. As far as we can see, The Register didn't cover the 4.0 release, but we did report on version 4.1 later the same year. We are a little surprised anyone would want to revive it. Apparently its maintainers may now feel similarly: the GitHub repository shows no commits or releases in the past three years. ®

British Transport Police (BTP) spent more than £320,000 putting half a million commuters through live facial recognition cameras, only for the system to identify precisely nobody it was looking for. Figures obtained by civil liberties group Liberty through Freedom of Information requests, and reported by The Guardian, show BTP's six-month trial scanned more than 500,000 faces at London railway stations and generated just one alert. That turned out to be a false positive, meaning the technology produced no correct matches and no arrests directly resulting from an LFR alert. The exercise wasn't exactly light on resources either. According to the figures, deployments swallowed almost 100 hours of police officers' time and cost more than £320,000. Privacy campaigners at Big Brother Watch told The Register the results would be funny if the implications weren't more serious. "The figures from the British Transport Police's live facial recognition pilot would be laughable, if they didn't have such troubling implications for our rights and freedoms," said Jasleen Chaggar, senior legal and policy officer at the campaign group. "Millions of Londoners use the city's stations every day and may have already found themselves caught in a digital police line-up, likely without even realizing." Then there's the small matter of what taxpayers got for their £320,000. "It's not fair to subject innocent people to intrusive identity checks during their commute, but it's even more insulting to waste almost 100 hours of officers' time and £320,000 of public money when it produces such meagre results," she said. "The pilot figures show that replacing officers with AI surveillance does not improve Londoners' safety and British Transport Police should drop their use of live facial recognition." But BTP isn't dropping it. In fact, the trial has been extended until November and expanded from Network Rail stations onto the London Underground. The system uses NEC's NeoFace M40 facial recognition tech, and cameras scan people passing through a designated area, comparing their faces against a police watchlist. When the software thinks it has spotted someone on that list, it generates an alert for an officer to review before deciding whether to stop the person. BTP says it cannot identify people who aren't on a watchlist and that it immediately deletes their biometric data. It also says deployments are intelligence-led and targeted at crime hotspots where officers believe "high harm offenders" are likely to pass through. That claim of a targeted approach isn't convincing everyone. Sarah Simms, senior policy officer at Privacy International, told The Register the results of the trial show just how many innocent passers-by can have their faces processed along the way. "We are deeply concerned by the results of the British Transport Police's live FRT trial. It reaffirms how invasive and disproportionate live facial recognition tech is and why it shouldn't be permitted. Thousands of people have their highly sensitive facial data processed in public spaces as they go about their daily lives, sometimes unknowingly. It also undermines claims of it being a targeted measure." Simms also pointed to the lack of legislation specifically governing the technology as BTP continues to expand its use. "What's further concerning is that they continue to extend these deployments when there is no specific legal framework in place to regulate facial recognition, which is essential to ensure there are restrictions and safeguards on its use to protect people's rights," she said. Those assurances haven't put the wider controversy around police facial recognition to bed. Earlier this year, UK police temporarily suspended deployments after independent testing raised concerns about racial bias at some operating thresholds. BTP's own experiment has produced a rather different problem so far: after scanning more than half a million faces, the only person its cameras picked out was the wrong one.®

The Spectre microarchitecture vulnerability has returned yet again, this time to vex just-in-time (JIT) engines that generate machine code for browsers, runtimes, and kernels. The vulnerability is found in many CPUs that use speculative execution, the process of executing code before it is called to boost performance. Researchers found speculative execution opens the door to side channel attacks through which secrets can be exposed or inferred. When news of that risk became known, chipmakers and OS developers scrambled to fix these vulnerabilities, which were referred to as Spectre and Meltdown. And since then, researchers have found two or three dozen variations, such as 2025's VMScape, one of several so-called "Spectre v2" attacks that attempt to exploit indirect branch prediction, where program control is passed indirectly by pointing to an address where the next instruction can be found rather than specifying the instruction itself. The attacker trains the branch predictor to execute speculatively to a chosen address in order to leak data about the microarchitecture state. Researchers from Vrije Universiteit in the Netherlands and Scuola Superiore Sant’Anna in Italy have revived Spectre in a form called Branch Target Reuse (BTR), which they describe as the first practical in-place Spectre v2 attack that attacks just-in-time (JIT) compilers. An in-place attack is confined to the victim's branch while an out-of-place attack relies on speculation directed toward a target on a different branch. The researchers – Sander Wiebing, Yuhui Zhu, Alessandro Biondi, and Cristiano Giuffrida – found that this novel Spectre form can be conjured from code left in JIT engines including Linux cBPF, Oracle GraalVM, and Mozilla SpiderMonkey. "The key insight behind the attack is that, while modern CPUs restore architectural code coherence after self-modification, they do not necessarily invalidate stale indirect branch prediction entries (i.e., branch targets)," the authors explain. "In JIT engines, these stale targets can outlive the original code and later be reused when the code cache is repopulated, yielding a speculative execute-after-free primitive." The result is that an attacker can commandeer speculative control flow in a way that avoids some software defenses like FineIBT [PDF]. The authors showed they could exploit this flaw by designing two proof-of-concept exploits against an Intel-based Linux kernel that reveal the root password hash even with the constant binding defense provided by cBPF. The expected leakage rate is 5.7 KB/sec for Intel Raptor Cove chips and 5.4 KB/sec for Lion Cove. It's slow but enough for an unprivileged user to coax a sensitive password hash out of a vulnerable system. After the researchers disclosed their findings, Linux kernel developers and Oracle put mitigations in place. Two CVEs were assigned: CVE-2026-64507 and CVE-2026-64508. Mozilla, the researchers said, has opted to prioritize work on site isolation instead of addressing the issue directly. Strong mitigations like IBPB are said to be effective but add complexity and hinder performance. The Branch Target Reuse paper has been accepted for publication at the ACM Conference on Computer and Communications Security (CCS) 2026, which will be held November 15 through 19 in The Hague, Netherlands. ®

Airbus has successfully flown a new freighter based on its A350 passenger jet. The first A350F yesterday rolled down the runway at Airbus HQ in Toulouse, France, bringing the aerospace giant closer to delivering a high-capacity freighter. Airbus already makes two freighters, based on its A330 and A321 planes. In the past, it also made custom freighters that featured a bulbous enclosure atop a fuselage adapted from an A330 or A300. Airbus named the planes “Beluga” because they looked a little like a whale. The BelugaST, based on the A300, mostly did duty carrying Airbus’ own cargo between factories. The company later operated a commercial cargo service using the planes but discontinued that in 2024. Airbus built five of the larger BelugaXL, which is based on the A330F. The last entered service in 2024 and Airbus intends to fly them for 30 years. The XL’s design allows it to carry large components of the A350. The new A350F can carry a payload of 109 tonnes, compared to 64 tonnes for the A330F. The new plane also has longer range, and a bigger door. As Airbus explained in May, the 4.3-metre door is big enough that it’s possible to slot a turbofan engine straight into the plane. The aerospace giant also suggests the giant door makes it “perfectly suited to accommodate high-value, time-sensitive cargo critical to the modern economy, from high-density computer servers to large-scale electronic chip manufacturing machines.” There’s your IT angle, dear reader. The plane’s capacity is a little less than rival Boeing’s 777F, but Airbus claims the A350F is more efficient and therefore cheaper to run. The first A350F flew for four hours and ten minutes, climbing to 25,000 feet. Airbus has almost finished making a second model, which will be needed as it embarks on the hundreds of test flights required to certify the new plane. Airbus says customers have already ordered 115 A350Fs. While colossal and impressive, the A350F can’t handle the truly enormous loads carried by 747 freighters or the Antonov An124, both of which boast a nose cargo door that can swing open to allow very long cargoes to be slotted inside. The BelugaXL also features such a nose. The An124 and the 747 are both getting long in the tooth, leading the European Defence Agency to conduct a project called the European System for Outsized Cargo Airlift (ESOCA) to investigate alternatives. The agency recently summarized the findings of ESOCA by suggesting it considers “deeply modernising the Antonov 124 fleet, or/and developing a new European aircraft to replace C-17s, as well as other viable alternatives.” ®

The OpenClaw project has started work on an enterprise edition in the hope that businesses lose their fear of the agentic AI project. OpenClaw was one of the first “AI harnesses” – tools that use a large language model to create a digital assistant that automates tasks. If users allow OpenClaw to access their email account, it can analyze messages and fire off AI-generated replies, even responding to meeting invitations and reserving time in a calendar app. The tool is the creation of developer Peter Steinberger, who released it to initial acclaim – and then consternation as security analysts found OpenClaw was a mess. Analyst firm Gartner labelled the project a source of “unacceptable cybersecurity risk” for business users, and China’s Computer Emergency Response Team warned of “extremely weak default security configurations.” That didn’t stop OpenAI hiring Steinberger and making OpenClaw the center of its plans to build personal AI agents. Speaking of OpenAI, news of work on OpenClaw Enterprise (OCE) came from a post by one of its staffers, Kevin Lin, who admitted “actual deployment of persistent agents remains limited.” “The main feedback we hear from organizations is that a stronger common security, safety, and governance standard is needed before agents can be fully adopted. As a consequence, the default stance of IT in most organizations is to ban agentic platforms like OpenClaw altogether.” “This is the problem we are trying to solve with OCE: how do we safely deploy powerful agents without nerfing their capabilities in enterprise environments?” Lin said work on version 1.0 of OCE is under way and that it “introduces an enterprise-grade control plane for agents and builds upon the foundation set by OpenClaw with support for multi-tenancy, hard security boundaries, and standardized agentic primitives.” “OCE adds governance and auditability across the agent lifecycle while making sure that core primitives like the harness, model, and sandbox can be swapped out with third party solutions as well as internal implementations.” Lin said work on the project “originally started at OpenAI and then was donated to the OpenClaw Foundation.” Joe Fernandes, veep and general manager of Red Hat’s AI Business Unit, likened OCE to RHEL and OpenShift, in that Red Hat intends to make an open source project suitable for serious use. “Linux helped enterprises move applications from proprietary Unix systems and specialized hardware onto an open operating system running on industry-standard infrastructure,” he wrote in a Tuesday post. “Later, containers and Kubernetes helped drive another transformation toward cloud-native applications composed of distributed microservices.” That mention of Kubernetes is likely no accident, as the OCE GitHub repo urges coders to think of the project as “Kubernetes for agents.” If OCE can achieve anywhere near the industry acceptance of Kubernetes, it will have done very well indeed. OCE emerged on the same day that OpenAI debuted its own “dots” personal agents, and in the same month that Meta delivered a product called “Muse” that offers OpenClaw-like automation for individuals and small businesses. ®