You don't need a bulky tower to get serious desktop performance. The Beelink SER8 min PC squeezes an eight-core Ryzen 7 processor, 32GB of DDR5 RAM and fast PCIe 4.0 storage into a chassis measuring just 5.3 x 5.3 x 1.8 inches.

• Best for: Anyone who wants a powerful desktop PC for productivity or creative work but would rather have a compact machine that takes up very little desk space.

• The deal: The Beelink SER8 with 32GB RAM and a 512GB SSD is $769 (was $929) at Best Buy. It's also on sale for $769 at Amazon.

• Why it matters: This is the lowest price we've seen for this configuration. You get an eight-core Ryzen 7 8745HS processor with 16 threads and Radeon 780M integrated graphics, alongside plenty of upgrade potential and support for three external displays.

• Also available for $769 at Amazon

Why we recommend it

The Ryzen 7 8745HS CPU delivers boost speeds up to 4.9GHz, giving the SER8 enough processing power to handle most tasks. There's plenty of scope for upgrading with two memory slots and support for up to 256GB of DDR5 RAM and up to 8TB of SSD storage.

In his four-star review, our expert Mark said it was "a classy small system ideal for those needing processing power (or even AI)" and that "Beelink makes some excellent mini PCs, and the SER8 is another in a long line of high-quality products from that brand. The enclosure's engineering delivers styling and refinement that even Apple would admire."

Price context & historical value

The reduction from $929 to $769 saves you $160, equivalent to around 17% off the regular price. This configuration for the SER8 is the same price right now on Amazon, and is the cheapest it's ever been there.

For alternative options look at our roundups of the best mini PCs and this week's best mini PC deals.

Should you buy it?

✅ Buy the Beelink SER8 mini PC if...

You want solid performance without taking up a lot of desk space. The Ryzen 7 8745HS, Radeon 780M graphics and 32GB DDR5 RAM make it suitable for demanding tasks. You can replace the memory and add considerably more internal storage if required.

❌ Skip the Beelink SER8 mini PC if...

You need a dedicated graphics card for demanding 3D workloads. The Radeon 780M is capable integrated graphics, but it isn't a substitute for a powerful discrete GPU.

• Shop all mini PCs at Best Buy

• Texas Gov. Abbott bans new data center grid connections until key audit is finished
• California Gov. Newsom introduces new laws regulating data center land, energy, and water usage
• Federal regulations could also be coming soon, but the midterms are still to go

AI data centers in the US have been dealt another blow due to new regulations and rules rolled out in Texas and California.

Texas Governor Greg Abbott has expanded the reach of a de facto moratorium on new data centers until a new electricity audit has been completed, effectively preventing any new data centers from being granted environmental permits or grid permissions.

At the same time, California Governor Gavin Newsom has signed into law new regulations which provide communities with greater control over the water, electricity, and land use of data centers built in the state.

States are backing communities, not big tech

“Simply put, Texans must come first,” Texas Governor Abbott said. “Data centers must pay their own way, protect our grid and water, and complete the ERCOT and audits” (via Politico).

According to ERCOT, which operates the Texas electricity grid, approvals for data centers to connect could be paused until December when the audit is expected to be completed. Until then, no new connections will be authorized.

Texans have been increasingly vocal about their opinions on data centers, particularly when it comes to land use, noise, pollution, and strain on the electricity grid. The issue has become such a big topic that Texas and other states have seen a jump in first-time candidates for local elections.

Abbott himself was previously pro-data center, advertising Texas as the “epicenter of AI development”, but has made a rapid pivot in stance - recently stating that data centers are getting “the backlash they deserve”.

In California, Governor Newsom’s new data center laws aim to move much of the costs imposed by data centers connecting to resources away from the public’s purse, and back onto data centers.

To this end, electrical grid connections and upgrade costs will be shouldered by the data centers requesting them, with additional requirements that new data centers will have to add new clean energy to supplement the additional energy they will consume.

More transparency is being added to data center water usage as well. Proposed projects will now have to inform local governments of water use, supply, efficiency and drought planning - with similar requirements to pay for infrastructural upgrades.

Land usage requirements are also under the regulatory hammer, with data centers no longer exempt from environmental regulations. Instead, proposed projects will have to meet state standards on energy, water, and fuel consumption while also mitigating any downstream costs for ratepayers.

Federal regulation could be coming too

Federal level regulation is making progress too.

The Ratepayer Protection Act aims to make the developers of medium and large campuses pay for the infrastructural upgrades and grid connections required for data centers with a peak power of over 100MW.

The Act was recently passed by House lawmakers with bipartisan support, and is now headed to Congress for approval. But due to the midterm elections, the Act may not be signed into law until the end of the year.

Data center opposition and state-level regulations have drawn significant criticism from the White House. President Trump said that those opposed to AI data centers are “making a mistake” adding that communities would miss out on the “tremendous amounts of jobs and money” that having a local data center would provide.

In the second quarter of 2026, over $68 billion in data center projects have been successfully blocked by local opposition with a total of 45 proposed projects being opposed.

The R1 isn’t Bambu Lab's first venture into laser engraving; of course, we first saw the small-capacity engraver in the H2D, which enabled, with the cutter and 3D printer, a full range of manufacturing tools in one not-so-small machine. The R1 is something altogether more serious and much closer to machines such as the xTool P2 that I've previously tested.

It's also an important machine for Bambu Lab and shows them expanding further into the growing maker space. The R1 is the company's first dedicated product outside 3D printing and is based around a 55W CO2 laser rather than a diode; the H2D utilised diode lasers. Using CO2 rather than diode laser technology lets the machine work with a wider range of materials, most notably clear acrylic and glass, while also providing considerably more cutting power; most diodes currently top out at 40W, although several far more powerful heads exist.

However, as with Bambu Lab’s entrance into the 3D print market, the machine technology and market aren’t new, and plenty of other players already exist. xTool, LaserPecker, Glowforge and Creality have already demonstrated how far enclosed desktop laser cutters have progressed in recent years. Five years ago, many of the smaller laser engravers I looked at were open-frame machines that required assembly and considerably more caution, to the point where I will no longer cover them. These days, fully enclosed machines are really where the technology is at, and there are some great options at very reasonable prices.

While there are plenty of machines in the sector, this is Bambu Lab, and with their first laser, they also bring much of the knowledge of 3D printing with them, along with their own approach to automation.

The R1 handles focusing, material positioning and optical alignment, with cameras, lasers and encoders helping the machine understand where the material is and where the toolhead is moving. On paper, this looks great because it will speed up workflows; however, it was only during testing that I realised what a difference it can make.

I've been using the R1 for around three weeks, mostly cutting 3mm basswood ply and acrylic, but also testing MDF, leather, paper, ceramic, glass, coated metal, and plenty of irregular wooden objects. What I have found during that time is that the hardware is exceptionally polished, and while Bambu Suite is good, it still has some catching up to do to realise its and the machine's full potential.

Bambu Lab R1: Price & availability

The Bambu Lab R1 launches at $2,499 in the US direct from the company site and £2,249 from the UK site. Pre-orders start on September 22, 2026 and shipping scheduled to begin in October.

The short-focus lens is included. The Riser Base, Conveyor, Rotary attachment, medium- and long-focus lenses, Vision Encoder, E1 Pro Air Purifier and Auto Fire Extinguishing System are optional extras.

Bambu Lab R1: Design

Unpacking the box, and having already checked the specifications before the machine arrived, I was surprised the packaging was smaller than expected. It still required two of us to manoeuvre the box into the workshop, but once unpacked and at 33.5 kg, I could lift and position it with little issue. It’s still heavy, but looking at the slight curve that’s left in the desk from the previous test, it's not quite as heavy as the previous 3D printer that took up the space.

The weight and, for that matter, the size are actually very manageable, and with a footprint of 940 x 560mm, the machine was able to sit on the standard section of the 60cm-deep workshop bench. While the main machine sits quite happily in that space, you’ll also need to consider venting and leave enough vertical clearance to open the lid.

Once in position, the R1's design is unmistakably Bambu Lab. The finish is superb; everything feels properly manufactured rather than assembled from off-the-shelf laser components, and I was pleased to see the machine arrived largely configured; I just had a few small setup procedures to follow before I could start.

As with all engravers, the first job was to attach the exhaust to the filter, and in my setup this was paired with the optional E1 Pro filtration system. You also need to fill the cooling reservoir with distilled or de-ionised water.

The instructions suggest adding antifreeze if you live in a colder climate. My workshop can drop below 5°C during winter, so I filled the system to the -10°C protection mark. Once I removed the transport restraints and checked the interior, the R1 was ready to power on.

The initial startup takes roughly 30 seconds before calibration begins. The automated self-check and initial calibration took around half an hour. Once that completes, you can then run the laser alignment procedure, and this is the first sign that this laser is something a little different.

Unlike the more manual approach of other CO2 lasers, here all you need to do to calibrate is to lift the small cover on the toolhead, then attach the supplied Laser Alignment Sensor, which clicks into place magnetically. Select the alignment function from the touchscreen, and the R1 handles the rest. The complete process took me approximately five minutes, including fitting and removing the sensor.

That's longer than Bambu's roughly one-minute claim for the alignment operation itself, but from my perspective there was virtually nothing to do. Then inside, there are a few removable slats that help to support the material that is placed within.

These are all easy to reposition, but again I would have liked more of them, although there are a few more than when I looked inside the LaserPecker LX2 in my recent review. The main issue is that small cut pieces can fall between the gaps, and for detailed work I still prefer a proper honeycomb bed, which I used for most of the review.

Around the machine, things are similarly clean. The exhaust and main power connection are at the rear, while Air Assist is integrated. Accessory connections sit on the side, alongside USB, and an easily accessible emergency stop is included. Unusually for a laser engraver, it has a small touchscreen, which is extremely useful. Most laser cutters force almost every operation back through the computer. Having direct access to machine functions makes the R1 much easier to use.

Bambu Lab R1: Features

A look through the specifications, and the first thing to note is that this is a 55W CO2 laser; at present, there are only a few CO2 laser engravers at this price aimed at the enthusiast and small-business sector, and the only real competition is the xTool P2.

Inside is a very decent 600 x 300mm working area, which, from my testing, is large enough for most projects; if you need to go larger, there is an optional conveyor. Based on my testing of the base unit alone, I found I could place two standard 300 x 300mm basswood sheets side by side, which was useful when cutting multi-part models, such as the flower box and an RC boat I’m partway through. If you need longer than 300mm, the Conveyor enables working lengths of up to 3000mm, but you are still limited to the 600mm width.

After reviewing all the information, Bambu Lab is keen to highlight the Auto Laser Alignment. This is because, in the past, this process has been very hands-on with other machines, as a CO2 laser relies on mirrors to direct the beam through the machine, and those mirrors need to remain aligned.

On most machines, these mirrors are pre-calibrated, but they do occasionally need recalibration, which can be time-consuming; here, however, that process is fully automated with motorised mirror actuators and an alignment sensor.

For design placement accuracy on materials and tight measurements, the machine uses a TriSense system. This combines the BirdsEye Camera, Toolhead Camera, Pinpoint Laser, distance-measurement laser, and XY encoders to locate material, measure its surface, and monitor movement.

During testing, I accidentally put this to the test when I made an error importing a cutting design and left the paths set as lines rather than cuts. I ran the job, removed the basswood from the machine and only then realised the mistake. Normally, that could easily mean starting again.

Instead, I put the sheet back into the R1, used the camera view to align the cutting paths with the lines already engraved into the material, changed the operation to Cut and reran it. The cuts followed the previous lines accurately, with no obvious signs of the mistake.

When it came to small objects, the positioning was equally impressive. I placed pre-cut objects such as placemats around the work area, positioned the artwork through Bambu Suite, and achieved results very close to what I had on screen.

Alongside the hardware is the Bambu Suite software, which offers plenty of functionality, and I found it to have good overall stability when working on macOS, but the workflow isn't yet as fluid as the hardware deserves.

Importing a DXF, for example, involves selecting Open Image, when Open File would make considerably more sense. Once you import a design, you can assign Cut, Line, and Fill operations. Then you move into Prepare, where you set up the machine and material.

This separation isn't always convenient. If you realise you've assigned the wrong operation later, changing it isn't as immediate as right-clicking the object in the earlier screen.

Capturing the work area also requires you to enter the preparation workflow. During testing, I occasionally found the workspace remained blank until I selected Measure and ran through the capture procedure again. On the Mac version, I also occasionally saw a ghost of the previously captured image underneath the current one. However, none of this stopped me from working.

After a couple of days, the workflow logic did make sense, and after three weeks I could move through jobs quickly, although I still didn’t feel that the workflow was as fluid as it could have been. Material profiles cover most common materials, while manual control gives you plenty of flexibility when experimenting with less conventional materials and objects.

Bambu Lab R1: Performance

I started the test with the setup process, and while this was straightforward, there was a little to-and-fro with attaching vents and making sure the filter vent was routed outside. I then had to fill the machine with distilled water and antifreeze before running through the calibration processes, which all took around an hour.

Starting the tests, I focused on using 3mm basswood ply; this is for a couple of reasons: it's a common material used by crafters, model makers, and many small businesses. Second, I’m familiar with how it reacts under lasers and the initial results I should expect. As I started the process, the Bambu Lab philosophy that I’ve seen with their 3D printers started to become obvious.

One of my standard initial tests is a flower-box project. I imported the design, detached individual components and rearranged them across two 300 x 300mm basswood sheets to make better use of the material. I tried the auto layout, but because I hadn’t regrouped the paths, the design scattered across the work area. Undoing the mistake didn’t work, so I had to reload the design.

Once I’d re-laid out the design over the two sheets, I hit the Make button, and then the main button of the machine the R1 started the process of engraving and cutting, and with decent speed that I seen with other CO2 engravers. The complete model took around 10 minutes to cut across those two sheets, and the result was close to perfect.

However, there was one issue. Once the pieces were cut free, the smaller parts dropped between the support slats, and a couple of scorch marks appeared where they fell into the laser's path. Moving the slats closer helps, but this is where a honeycomb grid should really be used.

After several impressive results in basswood ply, I then produced the same flower-box design in acrylic. This took considerably longer at around 29 minutes, but the finish was exceptional, one of the best results I've achieved with this particular cutting plan in acrylic. The use of this material is one of the reasons that you would want to go for a CO2 laser over a conventional diode laser.

I also pushed the R1 beyond thin sheet material, testing materials ranging from lightweight paper through to 16mm MDF; in the case of these materials I tended to opt for the manual control so that I could get the best possible cut, and I was pleased to see it was possible to save down the settings as presets.

In the engraving tests, I used leather, ceramic, coated metal, and glass. Across those materials, the CO2 source's added power and flexibility became apparent, especially compared with the smaller diode engravers I've used.

Through the test, the raw cutting power was impressive, and by slowing the engraver down and maxing out the power, I was able to cut through an 18mm sheet of ply. However, the positioning accuracy is what has really impressed me.

For small objects, the position shown in Bambu Suite and the finished engraving were exceptionally good. Once I'd grouped individual elements of a design correctly, the automatic positioning tools made batches of pre-cut objects far easier, although I was equally as impressed by the xTool and Creality machines that I’ve looked at recently in this respect.

Curved-surface engraving, however, was one up from what I have experienced before as it was easy to set up and use. Essentially, I can place something such as a bowl or piece of timber into the R1, select curved-surface machining, and manually check that there's enough clearance for the toolhead.

The machine then measures multiple points across the object to gauge the changing surface height and generates a height map. I could then position the artwork and run the job the same way I would on a flat sheet.

I tried this with curved wooden objects, including a log, and the resulting lines stayed clear and focused as the surface height changed. There is a bit of physical interaction involved. The lid needs to be raised and lowered as the R1 works through parts of the measurement process, and an automated lid would make the experience even slicker.

Bambu Lab R1: Final verdict

Bambu Lab may be arriving relatively late to the dedicated desktop laser market, but the R1 doesn't feel like a first attempt. After three weeks of use, what stands out isn't just the 55W CO2 laser; it’s that Bambu Lab's formula has been applied, which means it looks great, is easy to use, and produces great cuts and engravings.

The automatic optical alignment seems to do its job and removes some of the more complex maintenance tasks that come with owning a CO2 laser. Then there's the TriSense system that makes positioning objects and designs easy, and the curved-surface measurement procedure just works exceptionally well.

I even felt that the material presets were spot on, enabling me to get excellent results without spending the first afternoon with the machine producing endless power-and-speed test grids. Something I’m all too familiar with.

The physical design is excellent and weight and size means it sits perfectly in the workshop with teh 600 x 300mm work area enabling enough rooom for most of the jobs that I would want to do on this style of machine.

Bambu Suite does, however, need more work. I'd like quicker access to camera capture, a more fluid transition between design and preparation, clearer terminology, and a few interface bugs ironed out. I'd also like more support slats in the actual machine, or preferably a honeycomb bed that was supplied with the machine and not an optional extra.

Also, on the interior, a little more headroom would have been nice, but then you can use a raiser, but that or the use of the conveyor changes the machine from a class 1 to a class 4.

The R1 has been designed to be part of the Bambu Lab ecosystem and is designed for makers who are already invested in Bambu. Putting laser engraving and 3D printing together at scale does provide a solid base for personal manufacturer and it is exciting.

For small businesses, workshops, model makers and serious crafters, this is a fast, accurate and unusually easy to use CO2 machine.

Should you buy the Bambu Lab R1

Buy it if...

Don't buy it if...

For more crafting tech, I've tested and reviewed all the best 3D printers and the best laser engravers.

• Adobe Premiere on Android has officially launched
• The free video editing app adds easy 4K video editing, AI, and more
• I spent an hour with the app to see how it runs and if it really does offer 'effortless editing' for creations

Adobe Premiere for Android has arrived - finally, since Apple users got this app almost exactly a year ago. The mobile editing app is promising to deliver 4K video for content creators, alongside a slew of other tools including templates and AI generation (did you ever doubt it?).

Like most of Adobe's mobile apps, Premiere is free to download from the Google Play Store, although you'll need a subscription for extra AI generations and storage.

The upshot is, I've been keen to try out this Android app for a long time now, so here's what you can expect after I spent an hour dabbling with it on my Fairphone.

What's new?

This new Adobe Premiere app is specifically designed for Android phones, including foldables. According to Adobe, you'll need a device running Android 13 or later, with a minimum of 5GB RAM.

The app serves up a host of useful tools for content creators, including 4K video, simple-to-use templates for speeding up production, multi-track timeline editing, music and audio effects, and generative AI for image and video.

One of the high-points, as far as I'm concerned, is that it has no ads and exported videos are watermark-free.

A lot of 'free' mobile video editors could learn from this. There are no added intros and outros promoting Adobe either. So you can basically start creating video for social channels immediately. You can read the full write-up in Adobe's blog here. But is it any good? Here are my thoughts...

First impressions

I spent the last hour toying with Adobe Premiere to see whether it lives up to the promise of creating "stand out edits to share on TikTok, YouTube, Instagram, and Facebook."

Spoiler alert: It's good stuff. A responsive app that's worth checking out if you need a free video editor that does everything I'd expect it to do. Especially if you have a paid Adobe account for those extra AI generations.

Layout

Adobe Premiere on Android feels very clean, very sensibly laid out. That's a relief, because often I find Adobe's user interface to be unintuitive as a result of too many features. A phone screen is the last place you want to combat that.

Along the top of the screen are shortcuts for the main functions. This includes 'New from files' and 'Create for YouTube Shorts', as well as AI generations tools 'Image to video' and 'Text to video'. Once you start editing, your most recent projects can be found below this.

Under those key tools are a ridiculous number of templates for quickly spinning up videos - notably, there are ones designed specifically for YouTube, with "exclusive music and effects."

All in all, it's very simple to jump into the timeline and start creating.

Editing process

Editing video is incredibly straightforward. It's not laggy or clunky like I've seen with some mobile apps.

In fact, I was impressed how responsive it was overall, even with relatively larger video files. Helpfully, there are undo and re-do buttons sitting beneath the large preview window. An absolute godsend when editing on a phone.

Once you have a clip loaded on to the timeline, double-tapping the video brings up the handles for trimming. There's a Plus sign for adding (or generating) more clips. And you can select from a range of transitions with the tap of a button.

Running along the bottom of the screen are options to add text and audio, modify aspect ratio. I particularly liked this, because inside the frame options are logos, letting you know which ratio is suitable for which platforms.

AI generation

You do get access to a limited number of free tokens for AI image and video generation.

And when I say limited, I mean it. It's not very generous. I managed to squeeze out a single 4-second 720p clip before I needed to upgrade (or rather, sign into my main account).

Still, the generation itself works well, and it's relatively quick. Functionally, it's exactly what you'd get if you were using Adobe Firefly in your browser, or the Premiere desktop app.

I like that you can define the first and last frames of a video, generate in 720p and 1080p resolutions, change the duration, and opt to add audio. But to really make the most of this part of the app, a paid subscription is essential.

Video export

Super-simple, this one. When you're done editing, tap the ever-present Export button in the upper-right corner. You're then able to either export direct or tweak the settings.

Those settings include changing the resolution (720p, 1080p, 4K), the frame rate, between 24 and 60fps, and quality (low, medium, high).

Once you've got it set, Adobe Premiere offers an estimated file size, which is a nice touch. I exported a 17-second video at 4K in highest quality. The 106.5MB video took 34 seconds to complete. I then had the option to share via the usual channels.

My initial verdict

The Android spin on Adobe Premiere is actually very good - although I'll be keen to put it under the full review process. But it's very easy to use, and the 4K res video export without watermarks is excellent.

The real catch is the laughably small AI generation limit. Unless you're a paid subscriber, I'd swerve those and use it strictly as an editor for your own clips. On that score, it delivers everything I'd expect from a free video editor for your phone.

• More workers are worried about security issues than they were this time last year
• Three in four say their recovery tools are too difficult for them to use
• This report says having strong data storage could help

While many of us typically see security as an IT or a leadership issue, it's actually impacting us more than we'd initially thought. New Object First data found that 91% of workers feel uncomfortably stressed at work because of IT security risks – a seven percentage point increase over last year.

But unfortunately, it's a double-edged sword because it all boils down to AI. Nine in 10 say AI tools have improved their productivity, but seven in 10 say the growth of AI-powered threats is a key driver behind their stress.

Additionally, fewer than one-quarter (24%) believe their organisation is suitably equipped to deal with those threats.

AI-driven security threats are actually impacting you and I

While the risk of cyberattacks (50%) is a leading cause for stress at work, high workloads and understaffing (50%) land in joint-first place. Gaps in backup and recovery effectiveness (41%) and pressure to maintain uptime (44%) are also big headaches for workers, implying pressure isn't coming from direct attacks alone, but workload and operations.

For example, three in four (74%) say that their recovery tools are difficult to use without security expertise, leaving regular knowledge workers at a loss. One in five (19%) even say they feel hopeless and overwhelmed during and after an incident.

Naturally, this stress is impacting productivity, with four in five (78%) remarking that stress negatively affected their job performance. Two in five (39%) even said they'd thought about quitting.

"As critical as technology is to cyber resilience, those responsible for protecting and recovering an organization’s data are just as essential," company CEO David Bennett concluded.

Vibe coding began as a buzzword but quickly became a software category of its own. Now there are more AI platforms offering vibe coding features than there are days in a year. But if you’re going to use one, you need to know how they work and the ways they’re different from the no-code or low-code platforms you may have used in the past.

It’s a bit more complicated than simply entering a prompt and generating a fully functional website you can use right away, though that is often the way it’s marketed. In reality, you’re still left to fine-tune the generated output until it’s functional, decide on hosting infrastructure, and troubleshoot any security or operational issues that arise.

I’ve spent a lot of time working with vibe coding apps over the past couple of years, weaving several of them in and out of my workflow depending on the project scope. Here, I’ll share with you what I’ve learned, including the things that have changed in the industry since vibe coding began as a concept.

How vibe coding works

Vibe coding isn’t programming in the traditional sense. You’re not writing code, so it’s more similar to no-code or drag-and-drop website builders than writing HTML5 or React-based apps in a text editor.

But thanks to recent improvements in Large Language Models (LLMs) and generative AI, you can essentially describe what you want your website to do and how you want it to look, then let the platform interpret your prompt and generate the code you need in HTML, CSS, and JavaScript.

You can then export the code as raw files into any web hosting server of your choice, register a new domain, and go live within a matter of minutes.

But in reality, it’s not always so simple.

When you enter a prompt for the AI to generate from — depending on how specific you are and how advanced the underlying technology is — you’ll end up with something that’s at best close to functional but not ready for production quite yet. You’ll then have to tweak the AI-generated site, using subsequent prompts to refine the design until you get to something you’re satisfied with.

Types of vibe coding tools

Not all vibe coding tools work the same way, of course.

Some are more typical AI generators that let you build a website from start to finish by talking to a chatbot. Others combine this with drag-and-drop editors and other visual aids to let you tweak the design directly. A few even function like traditional text editors that programmers use, but with the option to use chatbot assistance to generate chunks of code while you still retain authority over what to keep.

For a first website, a full-stack app builder or an all-in-one platform is usually the simplest starting point. They even package things like hosting infrastructure, domain registration, and ongoing support into the same platform, making it easier for you to get your website ready for launch without too much fuss.

How to vibe code your first website, step-by-step

Every vibe coding project follows roughly the same arc, regardless of which platform you choose. You'll move from a plain-language brief to a live preview, then layer on the pages, design, and any extras your site needs before you publish.

The steps below outline that workflow at a level that applies across most tools. Swap in the specific platform of your choice at each stage, and expect to spend more time refining than generating.

Step 1: Write your first prompt

Start with clear and specific instructions, not a single sentence. Describe your site’s purpose, the pages you need (home, about, contact, services), your design aesthetic, and any brand colors or fonts you already use.

The more details you offer upfront, the less back-and-forth you'll need later. Most platforms generate an initial working version, complete with a live preview, within a minute or two of your first prompt.

Step 2: Review the generated structure

Look at the pages and navigation the AI has created before you touch the design. Check that the site structure matches how you actually want visitors to move through it, since restructuring later is more disruptive than adjusting styling.

If something's missing, like a pricing page or a booking form, ask for it directly in a follow-up prompt rather than trying to work around the gap.

Step 3: Refine the design with follow-up prompts

Use targeted prompts to adjust individual elements like colors, spacing, fonts, image placement, or button styles. Many platforms also include a visual editor where you can click an element and edit it directly, which tends to be faster than describing a small tweak in words.

Upload your logo and any brand assets at this stage so the AI can work them into the design instead of generating generic placeholders.

Step 4: Add a CMS if you'll be publishing content regularly

If your site needs a blog, news section, or other content you'll update often, ask the platform to add CMS features or connect a third-party content management system through an API. This gives you an editing interface separate from the code, so future updates don't mean rewriting prompts every time.

Skip this step entirely if your site is just a static handful of pages that rarely change.

Step 5: Add ecommerce features if you're selling anything

You can build an online store by asking the AI to add product listings, a shopping cart, checkout, and a payment processor through supported integrations. Test the full purchase flow yourself, including failed payments and confirmation emails, before it goes live.

Most full-stack builders support popular payment providers as plug-in integrations rather than requiring you to build checkout logic from scratch.

Step 6: Connect a domain and go live

Once you're happy with the site, connect your custom domain through the platform's settings and confirm SSL is active before publishing. Many all-in-one platforms handle domain registration and SSL certificates automatically, while others expect you to point your DNS records to their hosting.

Do a final pass on every page and link once the domain is live, since some elements can render differently outside the preview environment.

Vibe coding dos and don'ts

Vibe coding tools remove a lot of the technical barriers to building a website, but that speed comes with trade-offs worth knowing about before you publish.

Security researchers have repeatedly found that AI-generated applications ship with vulnerabilities at a higher rate than traditionally coded ones, including exposed credentials and missing authentication on features that should be locked down.

Treat any AI-generated code as a first draft rather than a finished product, especially anything touching customer data, logins, or payments. Review what the platform built, and if you're not confident reading code yourself, have someone who can check it before you collect real customer information. Also keep any sensitive details, like API keys, tokens, or passwords, out of your prompts entirely. Don't paste credentials into a chat window expecting the platform to keep them secure, since prompts and generated code aren't a safe place to store secrets.

Finally, don't assume a polished-looking preview means the site is secure. Researchers have found thousands of publicly deployed AI-built sites with no authentication on pages that should require a login, often because the builder never thought to ask for it. Test your site's forms, accounts, and checkout flow the way an attacker might before you consider it done, and lean on your platform's built-in security scanning if it offers one.

• Calendar, People and Files companion apps are being pulled after automatic installation last year
• Importantly, these particular interfaces are going, but the data is still accessible elsewhere
• Microsoft also wants you to use Copilot to find the information you need

Microsoft has confirmed that Calendar, People and Files are all becoming unsupported as of December 2026 after it started automatically installing them on Windows 11 devices with linked Microsoft 365 accounts in late 2025.

The vision was that users would be able to get quick access to important information like contact details through these lightweight apps – the company did not share the reason for pulling these companion apps.

Crucially, though, while the apps themselves may be going, the data behind them isn't. Data like contact details, for instance, are already stored elsewhere in the M365 cloud, so the companion apps are just one way to access the information.

Microsoft 365 Calendar, People and Files are all being pulled

Removing the apps does come as something of a surprise, because Microsoft has been building Copilot into them. The company still even has some Copilot features in the works "coming soon" – but clearly not.

We know that the three companion apps in question are no longer being automatically installed, however they aren't set to be automatically removed. For enterprises, administrators will need to remove them. Admins also need to configure Intone to stop deployments.

Unmanaged PCs, such as consumer laptops, can remove the apps through the usual channel.

Moving forward, the users who did actually use those companion apps are being told to resort to Outlook and Teams for calendar and people information, and Windows Search Box, Files Explorer, SharePoint and OneDrive for files. The company, naturally, plugged its own Copilot AI companion for helping users surface information, too.

With deprecation now just weeks away, Microsoft stressed that important security updates for the three apps in question won't be rolled out.

• Base44 has launched an AI agent that can make and receive phone calls
• It aims to eliminate hold times and speed up research
• Just describe your goal, give context, and let it do the work for you

Waiting on hold may become a thing of the past thanks to Base44’s new voice AI agent. Launched earlier this month, Superagent can now make and receive phone calls on behalf of the user, with countless potential applications.

According to a press release shared with TechRadar Pro, Base44’s Superagent can take on everyday tasks that would otherwise require people to spend time on hold or leave them navigating frustrating phone systems.

How Base 44’s Superagent works

Users start by giving Superagent a goal and providing relevant context on how that goal should be achieved. The AI agent can then proactively contact businesses or customers, asking relevant questions, collecting crucial information, and even navigating supported phone menus. Once the job is complete, the agent will then report back to the user with a summary of what has been done and which outcomes have been achieved.

Some helpful use cases include:

• Improve time management by booking or rescheduling important appointments
• Speed up research by calling vendors to request quotes for comparison
• Increase call success by retrying unanswered calls on a predefined schedule
• Receive and manage calls from trusted contacts

A shifting approach to AI

The launch highlights an ongoing shift in consumer AI, with tools moving from generative AI that simply answers questions to agentic AI that undertakes real-world actions based on requests made by the user.

But the question remains: will humans be happy to interact with AI if it means limiting wait times and more efficient calls?

• Attackers spoofed LastPass Authenticator via SEO‑poisoned GitHub pages, delivering malicious ZIP files
• Malware Rapuncel uses DLL sideloading, kills 145 AV products, and steals passwords, wallets, and tokens
• Campaign ongoing for months; LastPass vaults unaffected, but users urged to download only from trusted sources

Be careful when downloading the LastPass Authenticator app - there are impostors out there that can disable your antivirus and wreak havoc on your computer.

LastPass recently discovered an elaborate scheme to get people infected with malware - a spoofed website, SEO poisoning, DLL sideloading, and a malware loader delivering never-before-seen payload that can kill endpoint protection and antivirus solutions.

According to the password manager, users searching for "LastPass Authenticator download" or similar keywords will get a GitHub page rather high on the search engine results pages. At a glance, the page looks almost identical to the authentic LastPass offering - however, it redirects users to a separate one, hosted on attacker-controlled infrastructure and delivering a large .ZIP file with multiple files.

Among the files are two worth paying attention to: vsdbg.exe, and vsdbg.dll. The .EXE one is renamed to look like a LastPass installer, but it’s in fact a legitimate Microsoft debugging tool. This tool is used to run the malware - the vsdbg.dll file. This is a method called “dll sideloading” where the legitimate program will look for a DLL file in the same folder it’s located, rather than the wider device library. Since the DLL is delivered together with the executable, it is the first one to be run, despite the fact that it’s malicious.

Rapuncel

LastPass shared the malware with security researchers Delphos for analysis, and they’ve named it Rapuncel. No AV engines have been able to spot it, when it was first analyzed.

Once Rapuncel runs, it does a number of things. First, it gains admin-level access to run as SYSTEM, and then installs a kernel driver. The driver, disguised as an NVIDIA graphics component, comes with a hardcoded list of 145 antivirus and endpoint security products, and if any of them are found on the device, they are instantly terminated.

After killing antivirus solutions, the malware gets to work, stealing saved passwords from more than 25 browsers (Chrome, Edge, and other popular ones included), cryptocurrency wallet files from more than 30 wallet apps, Discord login tokens, Steam session tokens, Telegram session data, Windows credential store, all documents with words like “password”, “seed”, “wallet”, or “recovery” in their name, screenshots of every monitor connected to the device, as well as a detailed profile of the system.

Once all of this is harvested, the information is compressed into a .ZIP archive and uploaded to a server under the attackers’ control. To add insult to injury, the kernel driver was given code to intercept all web traffic, allowing the attackers to inject ads, or modify search results, at a whim.

Rapuncel comes with a persistence mechanism, as well, to make sure it continues operating even if the victim spots it. Spotting it should not be too difficult, though - if no antivirus programs are allowed to run on a computer, something is definitely not working properly.

Active for months

Still, the malware installs itself as a Windows service that starts automatically at boot, and then loops continuously, checking for security products and killing them as soon as they’re activated. “The machine may remain fully under the attacker's control until the kernel driver is physically removed,” the researchers explained. “This process requires booting the computer into Safe Mode or using an external recovery tool, because normal Windows tools cannot safely remove software operating at that level while the system is running.”

LastPass and Delphos believe the campaign has been active for months, and that it will continue to operate despite disruption efforts:

“The LastPass lure was a single recent frame in a campaign that has been running for months and shows every sign of continuing after its current infrastructure is burned,” the researchers said. They stressed that this is “opportunistic brand impersonation” and that LastPass systems and customer vaults have not been compromised or involved in any way.

LastPass said it was one of 40 companies spoofed in this campaign and has urged users to only download apps from reputable, vetted sources.

• Researcher Patrick Wardle finds zero‑day in Meta’s new Muse AI assistant,
• Dubbed not‑a‑mused, the exploit requires local compromise, voice dictation, and app integrations; attackers can hijack tokens and exfiltrate data
• Meta has been informed but no patch yet; flaw highlights risks of AI assistants with broad permissions

Meta’s new Artificial Intelligence (AI) assistant Muse reportedly carried a zero-day vulnerability that allowed attackers to gain access to people’s apps, such as WhatsApp or email.

However, it’s not as straightforward as your usual zero-day - to exploit it, simply deploying malware will not suffice. Certain features need to be enabled, and certain integrations established before the bug could be leveraged.

Not-a-mused

A little background, for context: Meta recently released Muse, describing it as an assistant that can “book appointments, fill out forms, and handle customer service.” It says the tool, available exclusively for the Mac ecosystem for now, “proactively takes tasks off your plate” and makes purchases, generates images, and creates documents.

To do that, however, it needs to connect to apps such as email, WhatsApp, calendar, or social media accounts - and this connection is the first prerequisite needed to exploit the flaw.

The second prerequisite is voice dictation. The vulnerability was found in the way Muse handles commands received via voice, meaning the attacker must piggyback onto voice commands in order to escalate privileges and access other apps and their content.

Now for the flaw itself. It was discovered by security researcher Patrick Wardle, founder of nonprofit Objective-See. He named it “not-a-mused” and says it hides in an undocumented setting called endo_voyager_dictation_endpoint. When a user narrates a voice command, that instruction is sent and processed in the cloud, where Meta can log it. This setting allows the user to change which endpoint receives the dictation.

Which brings us to the third prerequisite. The threat actor must have local access to be able to change this setting in the first place. In other words, the device must already be compromised in some way, either via remote monitoring and management tools, or via low-level malware (or with physical access).

For the sake of the report, let’s say that a theoretical user checks all the right boxes - they’re running a compromised machine and are talking to Muse that’s already connected to other productivity apps. Instead of reaching Meta’s endpoints, the voice commands are first sent to attacker-controlled infrastructure, where the AI assistant, together with the instructions, also sends authentication tokens for the tool.

If the attacker reacts fast enough, they can grab the token and access their target’s AI tool. If it’s connected to other apps, such as WhatsApp or calendar, they can simply prompt it to extract whatever sensitive information is found inside.

Not-a-mused is therefore a combination of data exfiltration and privilege escalation.

Ironing out the kinks

“We can manipulate the agent and leverage its privileges to do whatever we want,” Wardle told Ars Technica.

“So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.” Wardle said he has developed several proof-of-concept attacks that do things like writing malicious files to disk and snapping pictures, in many cases with no indication to even an alert user.

Meta has been informed, but is yet to comment, or issue a patch.

AI assistants are all the rage nowadays. They’ve turned elaborate answer machines into tools that can complete assignments, even more complex ones. They can book flights and restaurant tables, make purchases, schedule and reschedule calls and meetings, and more. However, to do that, these tools need extensive permissions - something the security community is warning of.

While they’re not openly speaking against it, they are advising caution. There are many stories of AI agents either going rogue, or simply being tricked by malicious actors. For example, a hidden prompt in a phishing email can trick an AI agent tasked with summarizing the message into exfiltrating all .PDF documents from the victim’s inbox.

In the early days of agentic AI, there were reports of assistants simply deleting people’s inboxes.

Assistants are likely here to stay, but there are still quite a few kinks to iron before they can hit the mainstream.

A desktop PC makes a lot of sense when you want plenty of processing power, storage and connectivity without paying over the top. Best Buy has reduced the price of the HP OmniDesk, a powerful, modern computer that stands out thanks to its distinctive dark wood case.

• Best for: Creatives and professionals who want plenty of processing power and memory for demanding applications without paying for a dedicated graphics card they don't need.

• The deal: The HP OmniDesk is $1,398 (was $1,499) at Best Buy, saving you a solid $101, or around 7%, off the usual price.

• Why it matters: It looks good and inside you get a 20-core Intel Core Ultra 7 265 processor, 32GB of DDR5-5600 memory and a 1TB PCIe 4.0 SSD with support for up to 64GB of RAM and two M.2 slots for future storage expansion.

Why we recommend it

The OmniDesk looks distinctive and classy with its dark wood finish, but it's definitely not a case of style over substance. Inside, the 20-core Intel Core Ultra 7 265 can boost up to 5.3GHz and has 30MB of L3 cache, providing plenty of processing power for demanding workloads. There's 32GB of DDR5-5600 memory and a 1TB PCIe 4.0 SSD. You also get 10 USB ports split between eight USB-A and two USB-C connections, as well as HDMI, DisplayPort, Ethernet, Wi-Fi 6 and Bluetooth.

Price context & historical value

The $101 reduction from $1,499 to $1,398 isn't enormous at around 7%, but it's still a decent saving on a relatively expensive desktop. It isn't the cheapest we've seen it however. The desktop was on sale at Best Buy for $930 earlier in the year.

For further choices, take a look at our round up of the best business computers we've tested.

Should you buy it?

✅ Buy the HP OmniDesk Desktop if...

You want a desktop with a powerful processor, 32GB of DDR5 memory, and a fast 1TB SSD. The dark wood finish adds warmth and personality, meaning the PC will fit beautifully into home offices or living spaces, blending in with furniture rather than clashing with it.

❌ Skip the HP OmniDesk Desktop if...

You need powerful performance for GPU-intensive rendering and 3D work that will benefit heavily from a dedicated graphics card. This configuration relies on integrated Intel Graphics rather than a discrete GPU.

• Shop all desktop PCs at Best Buy

• BigCommerce confirms supply‑chain breach via compromised Ribon app credentials affecting merchant storefronts
• Master of Malt notified customers: names, emails, phone numbers, and addresses were exposed
• Attack ran Sept 13–17 2026; ICO notified, law firm warns of phishing risks for affected retailers

Ecommerce platform BigCommerce was recently hit with a cyberattack in which it lost sensitive data belonging to some of its users.

One of the users - online spirits retailer Master of Malt - confirmed the hit and notified its customers that their personally identifiable information (PII) was accessed in the attack.

BigCommerce is an ecommerce platform relatively similar to Shopify. Businesses use it to build and operate online stores without needing to develop the entire commerce infrastructure themselves. It offers features like storefronts, shopping carts, integrations with different payment providers, product inventories, SEO and marketing tools, and more.

The platform has been around since 2009 and according to a late 2024 SEC filing, serves 5,884 accounts with at least one unique enterprise plan subscription. A 2025 press release says BigCommerce is used by “tens of thousands of B2C and B2B companies across 150 countries.”

Software supply chain attack

BigCommerce allows its users to install, among others, a third-party app called Ribon, an ecommerce app providing tools that improve the online shopping experience. Some merchants integrate Ribon into their stores to add different functionality to the customer-facing storefront, and to optimize how visitors interact with different elements of their website. We don’t know exactly how many stores use Ribon.

According to Master of Malt, unidentified threat actors managed to compromise a BigCommerce Application key held by Ribon, and used it to access customer data that was held on their system. The attack took place on Sunday, September 13 2026, until the access was finally revoked four days later, on September 17.

Speaking to BleepingComputer, BigCommerce said credentials for Ribon and Ribon 1.5 were compromised:

"On September 17, 2026, Commerce confirmed that credentials belonging to third-party applications Ribon and Ribon 1.5, owned and operated by 'Be A Part Of,' a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts,” the statement reads. "Acting in the best interest of our customers and their shoppers, we uninstalled the application from affected stores to revoke the attacker's access, notified those merchants directly, and are providing log data to support the developer's investigation," the company told the publication.

The keyword in this statement is “small number of merchant storefronts.” BigCommerce hints that the attack was relatively small in scope and, consequently, in damage. However, in its report Master of Malt says otherwise:

“It’s now clear that we weren’t the target of the attack. The attack was against Ribon, which was installed on hundreds of BigCommerce stores. Once the attackers compromised an access key from Ribon, they used it to access data held inside BigCommerce.”

Names and emails

Whether or not this transforms into a new Snowflake fiasco remains to be seen.

In the meantime, Master of Malt also said BigCommerce notified it that the attack had been stopped and that there was no further risk of compromise. All companies affected by the breach were contacted. As for the spirits retailer, here is what it said about the data exposed in the hit:

“I’m sorry to say that the attackers had access to your name, email address, phone number, and address. However, they were not able to access your password, credit card or other payment information as they are held in a separate system which was never compromised.”

Master of Malt reported the attack to the UK Information Commissioner’s Office (ICO). Law firm Emery Reddy is calling for potential claimants to the incidents, saying that “several retailers” are currently notifying customers about data exposure related to the incident, BleepingComputer reported.

“A number of online retailers that use the BigCommerce e-commerce platform have begun notifying customers of a data breach that originated not with the retailers themselves, but with a third-party application called Ribon,” the law firm says. Emery Reddy also warned of potential phishing and scam attacks.

Technology is constantly evolving, and with that comes increasing pressure on those working in the sector. It's no surprise, then, that technology ranks among the industries with the highest levels of work-related stress, contributing to around 550,000 working days lost over three years according to the Health and Safety Executive in 2024.

Stress rarely appears overnight. It builds over time through heavy workloads, unclear expectations, limited support and constantly shifting priorities. Too often, leaders only recognize the problem once an employee has reached burnout.

Managing stress shouldn't be seen solely as an individual's responsibility. Leaders play a vital role in creating environments where people feel supported, can raise concerns early and have the tools they need to manage pressure before it becomes overwhelming.

By recognizing the warning signs and making a few practical changes, leaders can help prevent stress from escalating into burnout.

1. Understand how and why individuals respond differently

Two employees can face exactly the same challenge but respond in completely different ways. One useful way of understanding these differences is through Kirton's Adaption-Innovation (KAI) Theory. Developed by psychologist Dr Michael Kirton, the theory suggests people naturally approach change and problem-solving in different ways.

More adaptive individuals tend to prefer structure, established processes and incremental improvements, while more innovative individuals are often more comfortable with ambiguity, risk taking and finding entirely new solutions. Most people fall somewhere between the two.

Neither style is better than the other, but each can bring different sources of stress. More adaptive employees may struggle with unclear roles, changing priorities or a lack of structure, while more innovative employees can become frustrated by rigid processes or repetitive work.

Understanding how individuals prefer to work allows leaders to allocate work more effectively, helping employees perform at their best while reducing unnecessary pressure.

2. Create a culture of asking questions

Many employees struggle to admit when they need help. We are often taught this is a sign of weakness and an indicator of capability.

Creating a culture of trust changes that. When people feel comfortable raising concerns, asking questions or admitting they are struggling, problems can be addressed before they become unmanageable.

Leaders set the tone. Asking for feedback, acknowledging your own mistakes and responding positively when employees raise concerns all help create psychological safety within a team. An open culture also makes it much easier to recognize when someone is beginning to struggle.

Changes such as withdrawing from colleagues, becoming more irritable, missing deadlines or struggling to prioritize work are often viewed as performance issues, when they may actually be signs of mounting stress.

Regular conversations, rather than relying solely on formal performance reviews, give leaders the opportunity to identify these warning signs early. Simple adjustments, such as redistributing workloads, clarifying priorities or removing unnecessary obstacles, can prevent stress from developing into burnout.

3.Observe your team to identify stress early

Stress rarely appears suddenly. It can build gradually, making it difficult to recognize until it begins to affect an employee's wellbeing or performance.

While you may be aware that a particular task or deadline is likely to create pressure, it can be harder to spot when longer-term stress is beginning to affect your team. Changes in behaviour can be early warning signs. An employee may start to withdraw from colleagues, become more irritable or defensive, miss deadlines or struggle to prioritize their workload.

As leaders, we can be quick to interpret these changes as performance issues. However, they may be indicators that someone is experiencing stress and needs additional support.

Regular check-ins, rather than relying solely on formal performance reviews, give leaders an opportunity to understand what's happening and address problems early. By noticing these changes, leaders can redistribute workloads, adjust expectations or remove obstacles before stress develops into burnout.

4. Give your employees control

Many employees experience stress because they feel they have little control over their work. Those in the technology sector often face tight deadlines, changing priorities, and high expectations. While we cannot remove all these pressures, we can provide autonomy to employees to help them be more successful.

Greater autonomy doesn't mean removing direction altogether. Leaders still need to set realistic expectations and help teams distinguish between what's genuinely urgent and what can wait. As a leader, you need to help your employees set realistic goals. You can help employees recognize what is urgent and prioritize their tasks effectively.

Employees who provide input and contribute in this way feel more in control and experience a higher level of buy in to team goals.

5. Create a culture that prioritizes recovery

We often mistake short-term performance for sustainable outcomes. However, we require time to recover not just as a reward, but as consistent practice. Employees need to be encouraged to take time to recuperate.

As a leader, the tone you set is seen and mimicked. If you’re not taking regular breaks, working at all hours of the night, and pushing through exhaustion, your employees will feel they need to do the same. Consider your own habits and then promote celebrating breaks, disconnection outside of working hours, using leave time, and establishing work-life balance.

It is easy to say, “do as I say not as I do.” However, this culture starts with you. Taking time to recover yourself helps you avoid burnout and be a better leader overall. It will also lead to long-term sustained performance over short bursts of success.

Stress will always be a part of the workplace. The goal is not to remove stress, but to prevent burnout and sustain performance.

As a leader, the ability to help your employees reduce stress is a shared responsibility between the individual, yourself, and your team. By understanding how individuals solve problems, creating an environment of trust, observing stress early on, increasing employee autonomy, and promoting recovery time, your organization can retain talent and build a healthier and more productive workforce.

We've featured the best HR software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Meta reaches agreement to allow Prospect union access to UK employees
• New reforms under the Employment Rights Act 2025 come into force in October 2026
• Despite slipping steadily, UK union membership could see a major bounce back

Meta has reached an agreement with Prospect union to allow access to its UK employees to speak about membership opportunities.

The move comes as a deadline for compliance with new union membership rules under the Employment Rights Act 2025 looms in October 2026.

Under the agreement, Prospect will have access to all 5,000 of Meta’s UK employees, allowing the union to talk to Meta workers about the benefits of union membership and recruit workers.

New union rules strengthen UK workers

A spokesperson for Meta said, “Employees who want to find out more about union membership have a straightforward way to do so. Meta's industrial relations team already works with employee representative groups in multiple markets, and we are approaching this in the same way.”

Initial trade union reforms as part of the Employment Rights Act 2025 took effect in February of this year. But subsequent reforms, due to take effect on 30 October, add additional requirements for employers to inform workers of their right to join a union, provide greater access for unions to workplaces, add additional protections for union representatives, and give workers greater protections when taking industrial action.

Meta is therefore providing Prospect with access to Meta employees ahead of the deadline, which Mike Clancy, General Secretary of Prospect, said “is to Meta’s credit that they have struck this voluntary deal with Prospect, rather than waiting for the new Right of Access to kick in, sending a positive message to staff that they are open to engaging with a union.”

Prospect currently has over 160,000 UK workers within its membership pool, covering technology, broadcasting, creative industries, defense and education.

The beginnings of a UK union bounce back?

According to official statistics from the UK Department for Business & Trade, union membership has been on a steady decline. In 1995, 28.8% of those in employment belonged to a union. But by 2025, this number has reached a historic low of just 19.9%.

Ahead of the reforms introduced by the Employment Rights Bill, union membership as a percentage of those in employment rose to 20.4% in 2025, potentially being bolstered ahead of the Bill’s formal introduction.

There are a number of reasons for the steady decline in union membership - some good, and some bad. The UK economy shifting away from industrial industries that traditionally held union-heavy employment is one of the most significant factors.

But Anti-union legislation introduced under Margaret Thatcher’s premiership during the 1990s also weakened the power of unions significantly. Unions lost legal protections against strikes, outlawed sympathy strikes, and introduced mandatory secret votes on union leadership ahead of strike action.

New rules introduced as part of employment protections and regulations - such as the minimum wage introduced in 1998 - have also reduced the need for unions to negotiate fair pay or organise industrial action in events of extreme unfairness.

Looking forward, the rapid introduction of AI to UK industries and the fear of job displacement are also likely fueling union membership in the UK.

Ask a UK bank for investment advice, and you get a lawful recommendation. If it was negligent, you will have the right to make a claim using the Financial Services Compensation Scheme.

Ask ChatGPT, or, more fashionable, Claude, the same question and you get nothing. Just an answer, but it will be delivered with a more confident tone, no matter whether it's right or absolutely wrong.

Despite that, more than a quarter of UK consumers now say they trust AI chatbots for money advice. The Financial Conduct Authority found this figure and flagged it as a live concern in its most recent review.

Other surveys found even higher figures. STRAT7 found 55% of UK adults have used AI for financial guidance, Sky News reported 40%, and EY's global study measured Gen Z adoption at 68%. Whatever the precise number is, the direction is the same.

People have started to trust AI more and more in their financial decisions. But the debate about it has, so far, been asking the wrong question.

What is the wrong question?

Most publications today focus on accuracy, and what everyone wants to know is whether the AI's advice is good. But is it?

In one study, there were five real financial scenarios passed to major chatbots, and the output was compared to certified financial planners. The result was unsurprising, though. The bots reliably missed emotional and situational context, so personal decisions turned to rough spreadsheet logic that missed important input.

Sky News has conducted a similar test, where three chatbots were given £16,000 in real savings. What they found was that the recommendations were US-biased and incomplete.

Most alarming, it was an investigation which found Claude incorrectly described Binance as FCA-registered when advising a beginner on cryptocurrency. Binance was, in fact, ordered to cease UK-regulated activity back in 2021.

AI’s misleading outputs sound disturbing, but what is even worse is that it is only one part of the problem. Things get harder after the incorrect advice has already been given, acted on, and gone wrong.

So, when it happens, who takes the blame? Nobody is the answer, although it’s quite uncomfortable to hear.

The FCA has noted the same. In its 2026 report, the regulator confirmed that LLM platforms such as ChatGPT and Claude sit entirely outside its regulatory remit. This means that consumers using them for financial guidance are not receiving regulated advice. Therefore, they have no access to the Financial Ombudsman Service (or the Financial Services Compensation Scheme) if things go wrong.

That said, the safety net simply does not apply the moment consumers paste a question into a chatbot.

The regulatory gap explained

To understand why this gap exists, let’s understand how UK financial regulation actually works. The regulatory perimeter is activity-based, not technology-based. This means what matters most is what is being done, not how.

A firm that provides personalized recommendations on the purchase, sale, or holding of certain assets is engaged in regulated activity, regardless of whether those recommendations are provided by a person or an algorithm.

The problem is that AI chatbots occupy a new space. They are not marketed as financial advisers, so they don't claim to be regulated. And technically, in most cases, they are not offering advice in the strict legal sense — they are responding to open questions.

Again, this ambiguity was addressed in the FCA report. The Mills Review highlights that AI platforms may influence consumers’ financial decisions without clearly implementing regulated actions. As a consequence, this creates a serious blank space between the actual financial impact and the protection provided by regulatory authorities.

The review's main recommendation was for the FCA to officially revise the scope for receiving financial recommendations developed using AI tools. So, this process is ongoing, and further updates will be available only after a few months, or even more.

The consumer protection problem and what fintech can do

While there is no law so far protecting ordinary people, what should we do? Can fintechs close this gap, at least for now?

First of all, waiting for the FCA perimeter check to be completed is not a strategy. It’s better to start by separating information from personalization, especially if your company has an AI assistant.

The thing is that the boundaries of recommendations depend on whether the conclusion is adapted to the specific circumstances of a particular person. The tool that generally explains what an ETF is is in a completely different regulatory status than the one that says how much you should invest in funds.

Also, make sure the disclaimer does real work. The footer text “not financial advice,” located below a specific recommendation, will not pass regulatory checks. The FCA evaluates content, not form. If the output data looks like a personalized recommendation, the tiny disclaimers will not reclassify it.

Although many people use AI today, do not overuse it to earn trust. An analysis of more than 330 million reviews showed that mentions of interaction with AI are rated, on average, at just 1.7 points, compared to 3.7 points for reviews that do not mention AI.

Final words

Surely, there will be some people who continue to use AI directly for financial advice, and their number will grow. For them, I can say only one thing: be careful about who you trust with your earnings. If no one is accountable, maybe not treating it as a rulebook will save you from losses.

But fintechs should start building the accountable version of their business, with an audit trail and a human above the AI layer. So when the machine says "yes," someone is actually standing behind that answer.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

In March, Google moved its own post-quantum cryptography (PQC) migration deadline forward to 2029, a full six years ahead of NIST's guidance, and two ahead of the NSA's requirement for national security systems. It was a terrific bit of security signaling, but now it is backed up by a new product-by-product roadmap organized around three risk domains, with milestones attached to named services.

For anyone whose job touches digital trust, the most significant of those three domains is Google’s attempt at enhancing foundational capabilities for cryptographic agility: building flexible systems that can adopt new cryptographic standards with minimal engineering effort as those standards evolve.

The message is that organizations should prepare for a future in which standards, certificate formats, and operational requirements continue to evolve, and evolve regularly, requiring cryptographic agility.

Why quantum risk is already a digital trust problem

Adversaries are already harvesting and storing encrypted data today on the assumption that a future quantum computer will decrypt it (harvest now, decrypt later). Anything with a long confidentiality tail, from health records to national archives to intellectual property, is already exposed to a machine that does not yet exist.

Quantum-resistant algorithms, like ML-DSA, solve the cryptographic problem, but they introduce much larger keys and signatures. Deployed through today's public key infrastructure (PKI), they would inflate or possibly break the systems behind secure connections. Legacy systems and high-latency networks would feel it most.

What is a Merkle Tree Certificate (MTC)?

At the time this article is being written, the most significant development in Google's roadmap may be the easiest to miss. Under Domain 2, Integrity and non-repudiation, a single line reads:

“Google Trust Services, Merkle Tree Certificates, 2028”.

Merkle Tree Certificates (MTCs) are a new kind of website domain certificate designed to keep secure connections fast in the coming era of quantum computers. Today a website proves its identity by presenting a certificate that carries several digital signatures, and the quantum-resistant versions of those signatures are so bulky they would slow down every secure connection on the internet.

MTCs solves this by having the certificate authority (CA) record everything it issues in a public, tamper-evident log, organized as a Merkle tree. Rather than carrying heavy signatures, the website presents a short trail of digital fingerprints showing its certificate sits in that log, and the browser checks the trail against a summary of the log it already received through its normal software updates.

Of note, MTCs do not abandon X.509. They are X.509 certificates, carrying a proof where a signature used to sit, issued alongside conventional directly-signed certificates rather than replacing them.

The result is a certificate that stays small, stands up to quantum computers, and is publicly verifiable by default. For the regular everyday person: we get to keep using the internet fast and uninterrupted with quantum resistance underneath.

MTCs make transparency structural

In today's web PKI, transparency is bolted onto issuance as a separate step. The CA signs a certificate, submits it to independent CT logs, and collects SCTs, each of which is a log's signed promise to publish the certificate within a fixed window. A misbehaving or compromised log can vouch for a certificate that never becomes visible to the monitors watching for misissuance.

MTCs change that relationship. The CA certifies by logging, and a certificate is literally a proof that its entry appears in the CA's public issuance log, verified by the browser on every connection. If it is not in the log, it is not a certificate. Under MTC, transparency does not merely survive the post-quantum transition. It comes out stronger.

Who is developing Merkle Tree Certificates

When the vendor with the dominant browser share proposes a new certificate format and a new root store to hold it, it is reasonable to ask whether the rest of the ecosystem is being consulted or simply informed.

However, MTCs are not Google's alone. At the time of writing, the IETF draft's authors span Google, Apple, Cloudflare, and Geomys. Cloudflare has been involved from the outset, CAs including Sectigo have contributed to the underlying research, and Let's Encrypt publicly committed to MTCs in June 2026. The result will be an open standard any CA can implement, controlled by no single vendor.

The organizations that will shape post-quantum web trust are the ones in the working group now. Root programs, CAs, and large implementers who stay outside it will inherit decisions rather than influence them. That choice is available to everyone, and the window is open today.

How organizations should prepare for MTCs

Google’s 2028 date for MTCs deserves a roadmap's usual caveats. Google ties it to standardization work still in progress at the IETF, and dates like these move. The direction, however, resembles something that seems settled.

Chrome's planned Quantum-resistant Root Store will support quantum-resistant certificates only in the MTC format, not as post-quantum signatures bolted into traditional X.509. Compact classical signatures and X.509 served the web extraordinarily well for three decades, but with the dawn of quantum computing, we are due for a redesign.

For everyone else, the practical implication of Google's roadmap is not that you need MTCs. It is that you need to be capable of adopting them (or whatever else emerges) without a multi-year engineering program. Which is precisely the cryptographic agility Google put at the foundation of its own plan.

In concrete terms, organizations should focus on:

• A complete inventory of certificates and cryptographic assets, because you cannot migrate what you cannot see
• Automated certificate lifecycle management, because shorter certificate lifetimes will make manual processes untenable well before quantum computers arrive
• A written post-quantum roadmap from your CA, which every organization should be asking for

The full scope of what MTCs can do is still coming into focus, and they may not be the only answer the industry ultimately adopts. What is already clear is that organizations that invest in cryptographic agility, certificate lifecycle management, and complete visibility today will be best positioned to adapt as post-quantum standards mature.

The future of digital trust will belong to organizations that can evolve as quickly as the cryptography they depend on.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

For the last two years, much of the conversation around AI has focused on jobs.

Which roles will change? Which tasks will be automated? How many people will organizations need in the future?

Those are important questions. Yet in conversations with enterprise customers, a different concern is rising to the top.

The conversation is shifting

We were all told to use AI, deploy AI tools and find ways to move faster. Boards pushed for adoption. Executive teams launched initiatives. Business units raced to identify new use cases before competitors did.

Then the bills started showing up.

If you're following technology news, you've seen growing concerns about organizations losing control of AI spend. Budget overruns, runaway token usage and unexpectedly large invoices have become common discussion points among technology leaders. AI adoption is accelerating across every line of business, and many organizations are discovering they have far less visibility into consumption than they thought.

That's because AI doesn't just innovate. It invoices.

Every AI decision and action has a price tag. AI doesn't just answer questions. It reasons, retries, plans, triggers calls, leverages data and compute just to complete one task. It’s now integrated into the business applications we are using everyday, from Microsoft Copilot and Google Gemini to SAP, Workday, and LinkedIn. Whether we know it or not, the meter is running.

For many organizations, that creates a challenge they weren't prepared for.

A familiar problem in a new form

A decade ago, companies faced similar issues with cloud adoption. Teams spun up services quickly, often without governance, visibility or accountability. Costs grew faster than expected, and organizations ultimately had to introduce new disciplines to understand what was being used, who was using it and whether the value justified the spend.

AI is creating a similar challenge at even greater scale.

The difference is that AI is not confined to one team or department. It exists across every part of the organization. Marketing teams use it. Sales teams use it. Product teams use it. Developers use it.

AI capabilities are increasingly embedded in business applications while organizations are also building custom agents and workflows of their own. In fact, agentic AI is expected to drive a 24-fold increase in token consumption by 2030 according to Goldman Sachs.

As a result, AI spend is showing up everywhere.

Many organizations still don't know exactly which models are being used, which agents are consuming resources, which teams are generating the highest costs or how much token consumption is tied to specific business outcomes, business value and real ROI. Without this visibility, you don’t have a foundation for governance, control, or accountability.

The hidden costs of AI and the mirage of savings

This lack of visibility becomes particularly important when organizations start making workforce decisions based on projected AI savings. Too often, the comparison begins with a salary and an AI license. The challenge is that the license is only one component of the cost.

The real cost includes token consumption, infrastructure, data platforms, cloud resources, failed attempts, retries and the human oversight required to validate outputs and manage exceptions. Those costs are frequently spread across different systems, teams and budgets, which makes them difficult to measure accurately.

A salary is relatively predictable. AI costs are not.

The same task can generate very different costs depending on which model is selected, how much context is provided, how many times the system retries a process and how much computing power is required to complete the work. That variability matters because a role removed from payroll does not automatically translate into savings. The expense may simply move somewhere else.

It may move into cloud consumption. It may move into AI services. It may move into infrastructure costs. It may move into additional work for employees responsible for reviewing outputs and managing exceptions.

Without visibility into those costs, organizations are not comparing AI to a salary. They're comparing a salary to an assumption.

Visibility before optimization

The answer is not to slow innovation or abandon AI initiatives. Instead, enterprise leaders must understand where AI creates value, what it costs to operate at scale and how to make informed decisions about adoption.

That starts with visibility.

Organizations need to see which AI applications, agents and models are being used across the business. They need to know where tokens are being consumed, where costs are accumulating and how usage maps to business units, products and outcomes.

Only then can they begin making informed decisions about optimisation. That may mean selecting different models for different use cases. It may mean identifying unnecessary consumption. It may mean understanding when lower-cost alternatives can achieve the same outcome. In some cases, it may simply mean discovering that a small number of users or workloads are responsible for a disproportionate percentage of spend.

These are manageable problems.

The bigger risk is making financial decisions before understanding the economics.

The rise of AI tokenomics

AI has moved into an inference economy where costs are driven by usage, tokens and real-time execution. Tokens are emerging as the atomic unit of AI spend, value and pricing. Organizations are going to need new ways to govern, measure and optimize that consumption if they want to run AI affordably at scale. This emerging discipline of AI tokenomics is becoming increasingly important as AI adoption expands across the enterprise.

What we're seeing today is the beginning of a new economic model that many companies are not equipped to manage yet. As AI becomes embedded across applications, agents and workflows, understanding consumption becomes just as important as understanding adoption.

What does AI return?

Ultimately, the question organizations should be asking is not simply what AI costs but what it returns. What business value does it create? What outcomes does it improve? What's it worth?

Organizations that can answer those questions with confidence will make better decisions about where AI belongs, where it delivers measurable results and where it doesn't.

Before counting AI-driven savings from job cuts, understand the full cost of the work being done. Because the organizations getting the most value from AI won't be the ones making the fastest assumptions about efficiency. They'll be the ones making decisions based on visibility, evidence, and a clear understanding of what the technology actually costs.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• CISA added three Linux kernel flaws (CVE‑2025‑39682, CVE‑2026‑53266, CVE‑2025‑39964) to KEV catalog
• Red Hat confirmed active exploitation; agencies given rare three‑day patch deadline expiring Sept 21, 2026
• Bugs enable DoS, privilege escalation, or data corruption; patches available, limited mitigations for two flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux flaws to its Known Exploited Vulnerabilities (KEV) catalog, signaling abuse in the wild and giving government agencies a deadline to patch or stop using the flawed product entirely.

The three bugs in question are tracked as CVE-2025-39682 (severity score 9.8/10 - critical), CVE-2026-53266 (severity score 8.8/10 - high), and CVE-2025-39964 (severity score 7.8/10 - high). All three have already been patched in the Linux kernel. CVE-2025-39682 was fixed in stable releases 6.1.149, 6.6.103, 6.12.44 and 6.16.4, while CVE-2025-39964 was fixed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9. CVE-2026-53266 has been fixed upstream and backported to supported stable/distribution kernel branches, including 5.10.259, 6.1.176 and 6.12.94.

The first issue is an improper check for unusual or exceptional conditions vulnerability in the TLS receive patch which could allow unauthenticated threat actors to launch memory disclosure or denial-of-service (DoS) attacks. The second one (CVE-2026-53266) is an out-of-bounds write vulnerability in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite patch which allows local attackers to escalate privileges or mount DoS attacks.

The last one (CVE-2025-39964) is a race condition flaw that allows concurrent writes to the same AF_ALG socket, which allows local malicious actors to crash the system or corrupt cryptographic operation results, leading to data integrity issues and possible DoS states.

Attacks in the wild

Red Hat acknowledged that all three are being abused in real-life attacks. “This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority,” it said in all three advisories.

However, there are no details as to who is currently using these exploits, against whom, and to what cause. There are currently no separate reports of cyberattacks referencing any of the abovementioned vulnerabilities.

However, CISA still reacted. All three flaws were added on September 18, 2026, and all three have a small three-day deadline for patching that expires on September 21. Usually, CISA would grant Federal Civilian Executive Branch (FCEB) agencies a three-week deadline to patch up, with just exceptionally dangerous flaws getting a shorter window. That being said, these flaws are likely extremely dangerous.

In theory...

In a hypothetical scenario, a threat actor could target a Linux system using kernel TLS (kTLS) by sending a specially-crafted TLS record that triggers CVE-2025-39682 and causing either a crash, or even arbitrary code execution. Attackers that already have a low privilege foothold on the target endpoint could use CVE_2025-39964 to escalate privileges, while on systems using the affected bridge/netfilter configuration, CVE-2026-53266 could be used for privilege escalation, as well.

According to the Red Hat advisory, there is a chance that CVE-2025-39682 is remotely triggerable, but only when the system is using the affected kTLS receive path. The other two flaws are exclusively local vulnerabilities.

Besides fixes, two out of the three flaws also have possible mitigations. For the improper check one, users should prevent module tls from being loaded. For the out-of-bounds write one, users are advised to disable ARP hardware address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces. The final vulnerability, currently does not have a working mitigation, and the only way to stay secure is to apply the provided patches.

Linux kernel vulnerabilities are generally considered serious, but the severity still depends on the flaw and how the affected kernel is deployed. Earlier this year, security researchers disclosed four local privilege escalation flaws, called DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469).

Via The Hacker News

• HKUST (Guangzhou) and HK PolyU researchers' InjectEave beams a radio carrier at devices so their own circuits leak analog audio
• The leaked audio has already been decrypted by the device itself, making encryption offer no protection against such an approach
• The 30m headline needed a pricey amplifier pushing output to 10 W, while standard ranges of 1 to 6m were measured by detecting a test tone

Researchers at the Hong Kong University of Science and Technology and the Hong Kong Polytechnic University have shown that everyday headphones, a desk phone, and a handful of smart-home gadgets can broadcast what they are doing simply by using a radio signal.

The technique, called InjectEave, was presented at USENIX Security 2026 in Baltimore, and multiple outlets have since covered the researcher's claim that the attack "can recover headphone audio from up to 30 meters away, including through walls".

The claim may be accurate, but it has limitations, including the need for specialized equipment that is often very noticeable in most settings.

An impressive technical show with plenty of limitations in tow

Conventional electromagnetic eavesdropping waits for a device to leak. That works poorly for audio, because speech sits below 20 kHz while a device's wiring radiates efficiently only at megahertz or gigahertz frequencies.

InjectEave chooses to close the gap by transmitting a carrier signal at the target. According to the paper, nonlinear components such as amplifiers, analog-to-digital converters, switching MOSFETs, and power converters mix the secret signal onto that carrier, and the device's own traces and cables radiate the result back to a receiver.

Because the leak happens in the analog path, after audio has been decoded, the project page states that "InjectEave is immune to digital defenses such as encryption, masking, and randomization." Encryption in any form on a wireless headset is irrelevant, since the attack directly targets the signal driving the speaker, not the radio link.

The team demonstrating this used a USRP B210 software-defined radio, two antennas, a Siglent spectrum analyzer, and a laptop to set up their proof of concept, which could, as they noted, "eavesdrop on the majority of these devices from over 2m away and through walls, with a maximum distance of 30m for recovering intelligible headphone audio".

This isn't the first time the technique has been used, even as the researchers have built on it considerably; the idea originates from "The Thing," a Soviet bug given as a gift to the US ambassador in Moscow in 1945, which was passively powered remotely as a listening device.

InjectEve, however, does not involve planting anything; instead, it leverages existing work on interference-induced leakage and impedance-based backscatter, and distinguishes itself by recovering coarse digital data rather than continuous analog waveforms, allowing users to 'listen in' without added steps.

The same approach applies to wired headphones, which are also prone to leaking microphone audio; researchers concluded that their sound cards were the primary source of the leaks, which were being sent back over very short distances.

The threat is somewhat tempered by the fact that it can capture what users hear but, with wireless headphones, cannot hear what the user is saying. The attacker also has to transmit continuously and use a high-powered (10W) transmitter to reach the full 30-meter range, even though capturing and rendering speech is harder than the tones the test used to prove the approach worked.

The attacker also needs to know the target model and profile a matching unit first, although they managed to get a profile to transfer cleanly across three identical UGreen headsets, suggesting this might be easier than one would assume.

The researchers say they reported the findings to the affected manufacturers but, "as we have not yet received a response," withheld the table's frequencies and stripped injection control logic from their released code. One shouldn't be too hopeful, however, as no software update can fix an analog leak, and it is relatively limited in practical abuse cases.

• Hackers are using blockchains to keep malware instructions available after servers disappear
• AI is making blockchain-based malware infrastructure easier for less experienced hackers
• Blockchain traffic is difficult to block without disrupting legitimate cryptocurrency services worldwide

Hackers are increasingly hiding malware instructions inside public blockchains, creating communication channels that can survive the removal of conventional infrastructure.

New figures from Chainalysis claim malicious blockchain activity increased 440%, with daily entries rising from 2.06 to 11.1 after newer AI systems emerged.

The technique gives attackers another way to maintain communication with compromised computers without relying entirely on conventional servers controlled by hosting providers.

Blockchain networks become malware dead drops

Blockchain dead drops use transaction data or smart contracts as lookup points, allowing infected computers to retrieve commands, addresses, or configuration information.

Because blockchain records are distributed across networks, removing a conventional server does not erase information already stored on the ledger.

A North Korean-linked operation associated with UNC5342 uses TRON and Aptos as alternate routes before retrieving encrypted instructions through the BNB Chain.

Its malware can check one network, switch to another when necessary, and retrieve updated addresses without receiving another malware package.

Iranian actors suspected of links to the country's intelligence ministry have embedded encoded routing information inside Bitcoin transactions used for malware retrieval.

Russian-speaking cybercriminals have also commercialized the technique, using Polygon contracts to provide blockchain-backed infrastructure for malware campaigns operated by different customers.

One related operator controls more than 50 BNB Chain resolver contracts while also conducting activity involving fraudulent tokens and clipboard-monitoring malware.

These operations show how blockchain records can function as persistent lookup infrastructure rather than merely serving their conventional financial and transactional purposes.

AI lowers the technical barrier

Chainalysis said the sharp increase in this malicious activity followed the arrival of high-capacity Chinese open models, which placed fewer restrictions on malware development requests.

Before those systems appeared, building reliable blockchain-based malware infrastructure required expertise across malicious software, cryptocurrency networks, and distributed communication systems.

AI tools can reduce that knowledge barrier by helping less experienced operators understand unfamiliar technologies and produce components needed for blockchain communication.

In the second quarter of 2026, state-linked groups accounted for roughly two-thirds of newly observed activity.

Those groups also represent about half of overall observed activity, indicating that blockchain-based malware infrastructure extends beyond conventional cybercriminal operations.

Defenders face difficulties because blocking blockchain traffic could also disrupt legitimate wallets, decentralized applications, exchanges, and decentralized finance services used worldwide.

Attackers can further complicate disruption by operating their own blockchain nodes, reducing dependence on external providers that defenders might otherwise pressure or disable.

Some operators have hidden server addresses inside wallet identifiers without usable private keys, then used zero-value transfers to trigger malware retrieval.

Those transactions leave public records that investigators can examine, potentially providing useful clues even when attackers attempt to conceal their infrastructure.

"While the exploitation of blockchain by state-linked organizations such as North Korea is becoming more sophisticated, on-chain records left by attackers can actually serve as important clues to track them," said Kwon Jun-hyeok, General Manager of Chainalysis Korea.

"Tracking these traces and identifying attackers and related infrastructure through blockchain intelligence will become increasingly important in responding to new cyber threats."

• Huawei’s Ascend 960 roadmap depends on scale, memory, and faster interconnects
• UnifiedBus connects thousands of processors while reducing communication bottlenecks inside AI systems
• The Atlas 960 roadmap reaches 15,488 processors with 34 PB/s bandwidth

Huawei is expanding its Ascend platform with larger systems designed to handle AI models containing up to 10 trillion parameters.

The company is advancing UnifiedBus, an interconnect architecture intended to connect processors, memory, and storage with lower communication overhead.

That approach gives Huawei another way to compensate for hardware limitations that have constrained individual Ascend accelerators against Nvidia's products.

Huawei expands the Ascend 960 system

Huawei's Atlas 960 SuperPoD roadmap calls for systems containing as many as 15,488 Ascend 960 processors, up from its earlier 8,192 processor configuration.

The company says the system can deliver 30 EFLOPS of FP8 computing and 60 EFLOPS using FP4, alongside 4,460 TB of memory capacity.

Its interconnect bandwidth is specified at 34 PB/s, while Huawei expects training performance to reach 15.9 million tokens per second.

Huawei has also accelerated development of the Ascend 960 family, with the 960DT scheduled for Q1 2027 and the 960PR planned for Q3 2027.

The company says both versions will arrive earlier than previously expected, while Huawei says performance improvements have exceeded the original roadmap.

"We're evolving our Ascend chip series on a one-generation-a-year cycle," said David Wang, deputy chairman and rotating chairman of Huawei.

"In 2028 and 2029, we will roll out the Ascend 970 and 980 chips, respectively. Thanks to the Tau (τ) Scaling Law, not only will their compute specifications continue to double, but you can also expect to see huge improvements..."

UnifiedBus connects 4,096 NPUs inside the Atlas 960E

UnifiedBus is Huawei’s interconnect architecture for linking processors, memory, and other components within large AI computing systems.

Huawei applies UnifiedBus in the Atlas 960E, a 960 variant that ties up to 4,096 NPUs and gives them access to shared memory across the SuperPoD.

It combines UnifiedBus with Hi-ONE optical technology, extending high-speed optical connections deeper into the computing system.

The approach uses near-packaged optics, or NPOs, placing optical components closer to processors to improve transmission speeds and reduce energy consumption.

Huawei says this design helps the SuperPoD move data between thousands of processors without relying entirely on conventional optical connections outside the computing system.

The Atlas 960E can use approximately 5,500 Hi-ONE units instead of about 48,000 conventional 800G optical modules.

This configuration can reduce power consumption by more than 550 kilowatts across the processor interconnection system.

The architecture also gives the Atlas 960E 8 EFLOPS of FP8 computing performance while Huawei says it supports models containing up to 10 trillion parameters.

Atlas 960E systems can also connect into SuperClusters containing 512,000 NPUs, with the architecture ultimately supporting million-processor configurations.

The larger systems are important because Huawei cannot rely solely on individual accelerator performance to narrow the gap with Nvidia.

Its strategy combines more processors with faster communication, allowing thousands of chips to operate within a shared computing environment.

UnifiedBus therefore becomes important because thousands of processors must exchange data continuously during demanding AI training and inference workloads.

• Scaleout's onboard AI let a BAE Systems ALMA drone rank, select, and strike an armored engineering vehicle in a January 2026 demo
• Humans set the mission, started the system, and kept a pilot in reserve, but did not ultimately use them during the test
• The test underscores how small AI models can essentially take over not only the target-selection part of the equation, but also perform the actual mission end-to-end without human intervention needed

A small drone flying over a snow-covered Swedish test range in January 2026 found several objects, ranked an armored engineering vehicle as the most valuable, and made a beeline for it before dropping an explosive.

There was no human involvement in the entire process, which included selection, targeting, and then neutralization by the drone, making it a considerably more autonomous approach than what the current battlefield uses.

The flight, part of BAE Systems Bofors' Affordable Loitering Modular Ammunition (ALMA) program with onboard AI supplied by Uppsala-based Scaleout Systems, resurfaced this month as AI safety became a key topic among industry and government stakeholders alike.

A growing threat and capability for modern militaries

Scaleout Systems tested the AI in question with a pilot on standby and a continuous connection throughout the exercise, during which the drone used AI to detect, identify, and geolocate potential threats.

Depending on how you frame it, you can argue that this is both a threat to modern militaries and a boon: an autonomous drone that can select targets without oversight or a backlink is essentially immune to jamming, offering a much higher likelihood of completing its mission than alternatives.

At the same time, it becomes riskier when it is completely cut off from communications, malfunctions, or fails to select the correct target without human oversight.

Interestingly, BAE Systems Bofors' own release on Winter Demo 2026 does not mention the strike at all. It frames the three-day Karlskoga event around roughly 20 startups and technology companies, with Swedish Defense Minister Pål Jonson joining a panel and saying, "We need more actors and entrepreneurs in the defense industry."

The test, despite lacking human interaction in its end-game, still relied on human input to some degree: a user pushed a button to start the exercise, and humans set the parameters overseeing the entire exercise.

This isn't the first machine to choose its own target, however; Israel's Harpy loitering munition, fielded since the 1990s, can autonomously detect and attack radar emitters whose locations were unknown at launch.

This is awkward timing for regulators, to say the least: on September 5, the 128 states party to the Convention on Certain Conventional Weapons agreed on a non-binding text on lethal autonomous weapons, after the United States and Russia pushed late changes, including to a section on human judgment and control.

As a result, Nicole van Rooijen of Stop Killer Robots told Reuters that three years of work had been "substantially diluted in the last hours." For now, Scaleout has shown that detection, ranking, and targeting can run on a small airframe without a data link, within parameters that people set.

Whether this makes it to a modern battlefield is increasingly likely, even as the Russia-Ukraine conflict becomes more reliant on autonomous machines. The more pressing question is one that will be answered sooner or later: how does such a drone make decisions if it is jammed from its source without any human oversight?

• AWS deal with Nvidia adds 2 million Blackwell Ultra, Rubin, and Rubin Ultra GPUs, on top of more than 1 million committed in March 2026
• Totals more than 3 million Nvidia GPUs due before 2029, a ~1.9x multiple for each of Amazon's roughly 1.58 million employees
• Nvidia's CFO has said deliveries start this quarter, not in 2027, but neither company says what it counts as a GPU or what the deal costs

Amazon ended 2025 with about 1.58 million full- and part-time employees, most in fulfillment centers and delivery operations, with a much smaller share working in its AWS data center division (estimated at around 246,000).

By mid-2028, Amazon Web Services expects to have taken delivery of roughly twice that many new Nvidia GPUs, based on a recent deal it made with Nvidia.

The latest deal was announced on August 26, the same afternoon Nvidia reported quarterly earnings, and will see AWS plan to deploy two million additional Blackwell Ultra, Rubin, and Rubin Ultra GPUs across its global infrastructure in 2027 and 2028. This is on top of over a million Nvidia GPUs that AWS committed to at Nvidia GTC 2026 in March, and which Nvidia's Ian Buck told Reuters would ship from 2026 through 2027.

A mammoth deal that dwarf's Amazon's entire payroll

Together, this all amounts to over three million GPUs in play between the data center giant and the chip designer, which is also the world's most valuable company at the time of writing. At 3 million GPUs against a workforce of 1.58 million, that's nearly 1.9 Nvidia GPUs per employee.

This is only Amazon's commitment to Nvidia; it also has its own custom Tranium3 GPUs, which the company says are "nearly fully subscribed" or "almost fully booked" as of mid-2026.

At the same time, Amazon is not increasing job roles on its end; it cut around 30,000 corporate roles between October 2025 and January 2026, a restructuring its top HR executive, Beth Galetti, described as "reducing layers, increasing ownership, and removing bureaucracy."

Building on an already solid base

While AWS's current GPU base from Nvidia, consisting mainly of H100 and H200 GPUs, is smaller than Microsoft's 485,000 count, it is hardly a rounding error, with Omdia estimating that Amazon bought 196,000 Hopper GPUs in 2024 alone.

The interesting part is determining what counts as a GPU: Nvidia and Amazon's joint statement about 2 million GPUs across calendar years 2027 and 2028 might mean two very different things depending on how you count GPUs.

At GTC 2025, Nvidia said it would count Rubin-generation GPUs by compute die rather than by package, which is why the Vera Rubin rack was first unveiled as NVL144. It reversed course before CES 2026, and the flagship now ships as Vera Rubin NVL72, counting 72 two-die packages. To make matters a bit more complicated, Rubin Ultra, due in 2027, puts four compute dies in each package.

Whether the companies count each die as a separate GPU or the whole package as a GPU could make the numbers skew heavily in either direction. The deal also includes a national security element: approximately 100,000 GPUs are earmarked for US government AI workloads at Impact Level 6.

Amazon's limitation here is supply, not demand; AWS revenue rose 37% year over year to $42.2 billion in the second quarter, and its contracted backlog reached $496 billion, up from $364 billion three months earlier, as CloudTech News reported.

On Amazon's July earnings call, CEO Andy Jassy said capacity would fall short of demand this year and likely next, adding: "In fact, the demand we already have for 2028 is striking."

In addition to its own custom ASICs, including Tranium3, Amazon is gearing up for a few fiscal years of eye-watering AI infrastructure spend and AI demand combined, and it better be right: Amazon's free cash flow has already turned negative as it looks to fund its bid to be one of, if not the largest hyperscaler in play for the foreseeable future.

Via StorageNewsletter

• So-called signal sharing between Microsoft and Google uncovered the RedVDS marketplace was behind large-scale cyber fraud
• RedVDS sold access to virtual machines running unlicensed software from which cybercriminals launched scams and directed attacks
• Threat data was shared securely via the Global Signal Exchange (GSE), a non-profit organization

A major cybercrime marketplace has been taken out of action thanks to cooperation between Microsoft and Google via a secure threat data sharing platform.

Known as the Global Signal Exchange, the collaboration led to the take-down of the RedVDS, an online cybercrime mall supplying virtual machines for launching phishing, business email compromise attacks, and more.

The marketplace – which provided quickly-deleted and therefore virtually untraceable VMs – was meticulously monitored by Microsoft’s security team, Digital Crimes Unit, with both Microsoft and Google suspending the operation and action taken to seize domains and servers.

A secondary case featuring the GSE identified a Microsoft-impersonating tech support scam, resulting, highlighting the importance of secure thread data collaboration platforms.

Digital Crimes Unit

Finding massive scams is not easy. Even with its own Digital Crimes Unit, Microsoft has to rely on information sharing with third party organizations. In this case, the RedVDS marketplace was identified ahead of disruptive action taken by Microsoft in January 2026, which applied to courts in the UK and US to have the RedVDS web domains seized.

Data shared via the GSE enabled Google to follow suit, identifying related accounts on its networks and suspending them. Meanwhile, servers were impounded in Germany, and Europol took action against Europe-based RedVDS servers.

It’s an impressive account of cooperative, decisive action against cybercrime, a collaborative response to what has been described as a “$66 million fraud marketplace.”

An incredible 130,000 organizations were targeted by RedVDS-provided virtual machines between September and December 2025, with 191,000 Microsoft email accounts compromised during this period. All of this access to cybercrime was available from just $24 a month for a basic scam-ready virtual machine.

The importance of collaboration

The Global Signal Exchange is a UK-based non-profit, co-founded with Google in 2025 with the aim of providing real-time monitoring of the cybercrime supply chain.

"Fraud does not respect company boundaries, and no single organization ever sees the whole picture," noted Emily Taylor, CEO at Oxford Information Labs and Co-Founder of the Global Signal Exchange.

"That is exactly why we built GSE: to give trusted partners a secure way to share what they know, quickly. These two cases are a good example of GSE doing exactly what it was designed to do."

The Global Signal Exchange’s role in the sharing of information between Google and Microsoft has highlighted the importance in such collaborations. Both organizations have stated they plan to continue sharing information through the GSE, whose other partners include Meta, Amazon, Google, among many others.

• BAN says 87% of data center hardware isn't actually accounted for in most figures
• Each 1GW of capacity equals 70,000 tonnes of hardware
• AI hardware needs more frequent replacing

A new Basel Action Network (BAN) report has claimed the ongoing AI boom could create a new stream of e-waste, with retired equipment from AI alone likely contributing 395-617 million tonnes between 2025 and 2050.

To put that into context, BAN says that waste would fill 15-23 million 40ft shipping containers, which, placed end-to-end, would be enough to circle the earth six times over.

Ultimately, Moore's Law is to blame because developers are no longer able to achieve such great improvements in performance year-over-year, so they're having to introduce whole new types of technology.

AI will likely lead to massive amounts of e-waste

For example, AI companies are now having to deploy huge numbers of specialized AI accelerators alongside GPUs, cooling equipment, networking and more.

BAN also highlights that global data center Capex is expected to hit $7 trillion between 2025 and 2030, with $4.3 trillion of this attributed to electronic hardware.

The paper goes on to criticize earlier estimates for only including servers and accelerators, which it says is only around 13% of the picture. The other 87%, which spans networking, power distribution, storage/backup, and cooling, is largely unaccounted for.

And with each additional 1GW of data center capacity estimated to need around 70,000 tonnes of electronics, and 100GW of additional capacity anticipated globally by the end of this decade, the true scale starts to become clearer.

There's also refresh cycles, because BAN predicts that AI accelerators, servers and racks are replaced every 2.5 years, versus the usual five to seven years of a general-purpose server.

While these may be speculative estimations and not actual quantities, one thing's for certain – more data centers means more e-waste.

To minimise some of the impacts, BAN first suggests designing AI data center equipment to last longer in the first place. Recycling and second use is also a big topic, but the report doesn't go into whether AI-specific hardware can then go on to be used in lesser functionalities, such as being shoehorned into regular server facilities.

• ShinyHunters hacked rival gang Cl0p, stealing source code, logs, and onion service keys
• The gang defaced Cl0p’s site via Grav CMS flaw, posting their logo and taunts about past threats
• Feud recalls Conti’s collapse in 2022, raising risk of escalating “cyber war” between criminal groups

Infamous cybercriminal gang Cl0p has seemingly been hacked by an even more infamous data leak collective, ShinyHunters.

The attack is still being pieced together, but it would seem we have true hacker beef on our hands - which just might escalate into a full-blown cyber war.

ShinyHunters has added Cl0p to their data leak site, giving the hacking group 72 hours to pay a ransom or see all their files leaked into the cybercriminal underbelly. The files allegedly stolen in the attack include source code, Grav CMS plugins, system logs, and other information, Cybernews reports. We don’t know how much money ShinyHunters are asking to keep Cl0p’s files private.

Still downloading

"The data we stole includes source codes, gravCMS plugins, and other things. We are still downloading and reviewing them," ShinyHunters allegedly told BleepingComputer.

The group also said they stole everything in the server’s /var/log directory, including system activity records, authentication logs, and IP addresses associated with connections to the server. We doubt this could lead to the identification of any Cl0p members, and even if it could, it would mean very little since the members are likely Russian and thus mostly free to conduct their operations.

Doxxing might help defenders disrupt the group’s infrastructure, though.

Whether or not that will be needed, given ShinyHunters’ activity, remains to be seen. The attackers also said they stole the private keys for Cl0p’s Tor onion service:

"We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL," the group said.

On top of it all, ShinyHunters defaced Cl0p’s website. Allegedly, the group found an unauthenticated file upload flaw in the Grav CMS Cl0p was using, gaining access to their target’s servers, website, and more. Cybernews confirmed the website had been defaced and now holds an ASCII image of ShinyHunters’ logo, and a link to their Tor site. It also displays a large message:

"THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time.” Furthermore, it says “rooting your systems since '19 ;)".

The “maybe don’t try to threaten us next time” message seems to refer to a threat that a Cl0p member made earlier. Apparently, this person threatened violence against ShinyHunters, as well as to expose their identities to the public. The remarks were made during Cl0p’s 2025 Oracle E-Business Suite attacks.

"During the Oracle EBS campaign they ran and stole from me last year, someone from cl0p personally messaged me and said, and I quote (translated from Russian): I have more money than you and all of your people combined, I'll kill you soon," ShinyHunters told BleepingComputer.

Dog eat dog

Cybercriminals often work together. They share resources, rent each other’s services, and often complement their campaigns. However, that doesn’t make them “friends” or “colleagues”, in any way. It is usually just a marriage of convenience that falls apart at the slightest sound of trouble. The last big “feud” we’ve seen was back in 2022, at the very start of the Russian invasion of Ukraine. Back then, a group called Conti publicly declared its “full support” for the Russian government and threatened to use its resources against anyone conducting cyberattacks on Russian infrastructure.

The announcement was a fiasco - many of Conti’s affiliates stopped working with the group, and others were openly attacking it. Soon after, a Ukrainian researcher and an alleged affiliate leaked more than 60,000 messages, exposing the group’s operations and internal organization.

All of this eventually led to Conti’s collapse later that year. However, its members did not disappear - they splintered into multiple groups such as Black Basta, Royal, and Quantum. Some of the crooks engaged in Conti are allegedly still active today.

• A recent update introduced a new bug affecting pasting in Excel
• Excel 2016 just got a hotfix, but Microsoft admits issues can persist
• Temporary workaround is available by selecting 'Paste Special'

Although a recent Microsoft Excel security update brought with it a highly annoying bug impacting copying and pasting functionalities across the spreadsheet software, it's already issued a partial fix.

Just days after the glitch was introduced with a September 8 2026 security update (KB5002914), the company has released a hot fix rather than forcing users to wait until the next cycle.

But this fix in particular only applies to Excel 2016, which is unlikely to have as much reach and global usage as Microsoft 365 versions of the app, therefore many users won't even have been aware of the issue.

Excel just got an important new fix

Other non-365 versions of Excel were also impacted. "In Microsoft Excel 2024, 2021, 2019, and 2016, as well as Excel Online in Office Online Server, the paste operation might fail silently," the company explained in a status update.

"Although users try to paste content, the source remains selected and the destination is unmodified," the update reads, confirming that users didn't receive an error message or sound to let them know of the failure.

Office LTSC 2021 and 2024 are officially fixed, Microsoft confirmed, but a only a mitigation is available for Office LTSC 2019 and Office 2016, so users may still experience some problems.

Thankfully, while a full fix is in the works, Microsoft offered up a pretty simple workaround. Pasting 'Special' from the Home tab is all it takes, with conditional formatting apparently causing headaches for now.

• Canva ProSuite connects Affinity, Cavalry, Flourish, and Leonardo into one ecosystem
• Affinity and Cavalry stay free as ProSuite gains over 100 additions
• Scene Decomposition uses AI to split flattened pictures into separate editable components

Canva is giving Affinity a major set of upgrades as it tries to make its professional creative tools more useful against established competitors.

The free software now adds photography, design, automation and file compatibility features alongside deeper connections with Cavalry, Canva and other creative products.

The changes form part of Canva ProSuite, which brings Affinity, Cavalry, Flourish and Leonardo together while keeping Affinity and Cavalry available without payment.

Affinity gets a major photography and design update

The photography changes are particularly extensive, adding batch importing and an improved RAW processing system for users handling large collections.

Preset looks can now be applied across multiple images, while new correction tools address mixed illumination and camera movement during editing.

Scene Decomposition uses AI to separate flattened pictures into editable components, allowing photographers to modify individual elements without rebuilding images manually.

A dedicated Astrophotography Studio adds specialized controls for photographers working with night skies and astronomical subjects during detailed image processing.

Affinity is also expanding the range of files it can handle, including support for bringing InDesign documents directly into the application.

The company says this gives users access to major industry file formats while reducing obstacles when moving projects between different creative applications.

Integration with Canva Brand Kit and Canva Sheets also adds a route for connecting design work with brand assets and structured information.

Other additions cover vector editing, typography, brushes, noise reduction, high dynamic range processing and export controls, giving professional users more options.

Sony ARW6 support, OpenColorIO display emulation, and improved output matching also extend Affinity's capabilities for photography and color-managed production workflows.

The release includes more than 60 Affinity additions, while Canva says ProSuite brings over 100 additions and changes across its connected products this year.

Canva connects Affinity with motion and AI tools

Canva is also connecting Affinity with Cavalry, its software for creating motion graphics and animations, as part of the new ProSuite.

Cavalry receives more than 50 changes, including new shape controls, lighting effects, graph editing improvements, and expanded SVG handling for motion designers.

The integration lets selected elements within Cavalry projects become editable inside Canva, while keeping the underlying animation protected.

This arrangement could allow teams to make limited changes without repeatedly sending modification requests back to motion designers and animators across team workflows.

Affinity and Cavalry can also connect with AI assistants through ProSuite's AI Connectors, allowing repetitive operations to be handled from natural-language instructions.

“We're genuinely excited to be releasing such a huge swathe of new tools for professional designers, animators, photographers and other advanced users,” said Duncan Clark, CEO of Pro Design at Canva.

“We asked professionals what they actually needed to power their creative work…there’s a lot of noise right now about AI replacing human creatives, but we believe professional craft matters more than ever. We want the Canva ProSuite to be where that craft lives and thrives.”

Affinity's new features, the Cavalry improvements and tighter connections across Canva's products give the free software a significantly larger professional toolkit.

Drone technology has rapidly advanced in the last five years. They are recording sports events, helping to track the movements of wildfires, and even delivering McDonalds. But their rise has a far more sinister side.

As the war in Ukraine has demonstrated on sea, land, and in the air, their capacity as warfighting tools is evolving, with high-precision first-person view (FPV) drones being used for targeted strikes in warzones around the world.

But the drone industry relies heavily on Chinese hardware - with China's DJI commanding an 80% global market share - and with that comes the risk of supply chains being cut, costs increasing, or malicious software being secretly installed.

How drone tariffs address supply chain risk

In an attempt to address these risks, President Trump has recently introduced sweeping tariffs on drones and drone components in an attempt to bolster domestic production and reduce the risk of supply chain disruptions.

Drones over 25 kilograms or with thermal imaging capabilities now face a 100% tariff, while those smaller in size without “certain capabilities that particularly implicate national security” face a 25% tariff. The 25% tariff also applies to drone components.

But Trump - not wanting to strain relations with allies further than they already are - has applied a 15% tariff for drones and components from the European Union, Japan, Liechtenstein, Republic of Korea, Switzerland, and Taiwan. The United Kingdom has also received a much more lenient tariff of just 10%.

But the question remains on how drone manufacturers in the US will adapt to increased import costs and how the tariffs will affect manufacturing while addressing the growing demand for drones from civilian, law enforcement, and military markets.

Latronix provides compute, System-on-Module platforms, and flight-ready reference designs for drones and Unmanned Autonomous Vehicles (UAVs). I spoke to Latronix CEO Saleel Awsare to understand the challenges facing domestic component suppliers and how the tariffs will affect competition at home and abroad.

• As soon as I heard of Trump’s new tariffs on foreign-made drone parts, I immediately thought of the supply chain issues the US encountered after the tariffs imposed towards the start of 2025. How adaptable is the US drone supply chain to these new tariffs, and does the grace period provide enough time for adaptation?

The broader supply chain impact is that the market is being pushed toward more regionalized, transparent, and trusted sourcing rather than globally optimized sourcing based purely on cost. Drone manufacturers will have to look much more closely at where key components are designed, manufactured, assembled, and supported.

At Lantronix, we are well positioned because our System-on-Modules (SOMs) are dual-use platforms designed for a broad range of commercial and defense applications, helping ensure customers aren't exposed to unnecessary regulatory or supply-chain risk. Our SOMs are already production-ready embedded compute platforms, and our Drone Reference Platform is designed with NDAA and Trade Agreements Act (TAA) compliance in mind. With U.S. manufacturing options also coming online, we can give customers a path toward American-made SOM solutions without sacrificing the performance, software support, and scalability next-generation drone platforms require.

Lantronix is already positioned with compliant SOM and reference-platform solutions, but the grace period could still be challenging for customers because qualifying and designing a new compute platform into a production drone takes time, even when a compliant alternative is available today.

• What challenges and benefits do you see the US drone industry encountering as a result of these tariffs?

Challenges: The biggest short-term impact will hit the consumer and commercial drone market, where cost-sensitive products still rely heavily on foreign motors, electronic speed controllers, batteries, cameras and electronics. Tariffs could make affordable alternatives difficult to source until U.S. or allied suppliers scale. Defense suppliers should be better positioned because many already design around NDAA, Blue UAS and trusted-supply-chain requirements that are already in place.

Benefits: Longer term, the tariffs should accelerate a stronger U.S. and allied drone supply chain, with more focus on trusted sourcing, controlled bills of materials (BOMs) and domestic manufacturing. This creates an opportunity for Lantronix because our solutions already provide compliant, production-ready compute platforms with long lifecycle support and North American engineering.

• Do you see the lesser tariffs on US allies hindering or helping competition within the US drone industry, and are there key component industries (software or hardware) that will be affected to a greater extent?

The lower tariffs on U.S. allies should help the drone industry stay competitive while domestic capacity grows, giving manufacturers continued access to trusted suppliers in Taiwan, Japan, Korea, Europe and the UK.

Hardware will be affected far more than software, especially motors, batteries, ESCs, sensors and structural components where China has significant scale.

The tariffs should also accelerate investment in U.S. manufacturing and technologies like additive manufacturing. For Lantronix, this is favorable because we can provide trusted, compliant compute platforms while still leveraging established U.S. and allied semiconductor supply chains, rather than competing in the hardware categories facing the most disruption.

• What effect will the US Commerce Department's onshoring exemption have on the competition with existing domestic suppliers, particularly with reference to the reduced duty rates they will receive?

The onshoring exemption should benefit companies that were already proactive about compliance, supply-chain planning, and U.S. operations. Lantronix already had a plan in place to bring SOM production to our Plymouth, Minnesota facility, so the exemption strengthens our ability to support compliant U.S.-based drone programs. Companies with the right operational infrastructure and trusted supply chains should not be negatively impacted, and, in many cases, should be better positioned to grow and support the U.S. drone market.

• What effects will these tariffs have on the US drone industry's exports? Do you see US allies shifting purchases towards the US drone market or turning away as a result of these tariffs?

There is a potential downside internationally. Some EU and other non-U.S. customers could view U.S. localization requirements as a precedent or competitive threat, particularly if more countries begin mandating local manufacturing. It would be difficult for the industry to operate efficiently if every market required its own domestic supply chain.

Today, many international markets have less restrictive component-origin requirements than the U.S. does, but this could change as governments look to reduce dependence on Chinese or other sole-source suppliers. Longer term, we may see more emphasis on regional manufacturing, trusted allied supply chains, and diversified sourcing rather than purely global supply chains.

• Is the US drone industry better positioned to compete within the global market? Where can the US offer greater value in its drone manufacturing over the economies of scale driving drone production for DJI and China?

The US is now better positioned to compete, but historically there was not the same urgency to rebuild domestic drone manufacturing and supply chains. That is rapidly changing, although the timeline is challenging because moving and qualifying supply chains takes time.

There is also a wide range of critical components: from motors, batteries and electronics to magnets, rare-earth materials and other underlying resources. Additionally, there is a need for domestic or trusted-allied capacity to ramp up production. The US may not match DJI and China purely on cost and scale in the near term, so the greater opportunity is to compete on trusted supply chains, advanced AI and autonomy, cybersecurity, customization, and engineering support. For companies like Lantronix, that creates an opportunity to provide compliant, production-ready compute platforms with U.S.-based engineering and expanding domestic manufacturing support.

• Joint report from Japan, US, Germany, and Australia says Contagious Interview stole $10 million in crypto
• NK operatives used fake personas, companies, and “laptop farms” to infiltrate 30,000+ devices in 100 countries
• Agencies urge vigilance: verify applicants’ details, check IPs, validate certifications, and watch for crypto‑based payments

North Korean threat actors behind the infamous “Contagious Interview” campaign have so far compromised more than 30,000 devices across 100 countries, and have robbed around 7,000 people of their hard-earned cryptocurrencies.

The theft has brought more than $10 million to the North Korean government, a new report jointly released by law enforcement agencies in Japan, the United States, Germany, and Australia has found.

Fake everything

Contagious Interview is a hacking campaign running for almost four years now. Sometimes it’s also called Operation DreamJob.

The cybersecurity community in general attributes it to the government of North Korea, although more precise attribution is rather difficult.

Some researchers believe it is being done by the Lazarus Group, one of the largest and most influential state-sponsored actors around.

Others believe different groups are involved, labeled DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, or TAG-121.

Contagious Interview leverages the lack of skilled workers in the West to infiltrate organizations, steal sensitive data and ultimately, money. North Korean operatives would create entire fake personas on social media such as LinkedIn, and would apply to hundreds, if not thousands, of job ads across IT, healthcare, and other industries.

The personas are carefully crafted, using a mix of legitimate information stolen in data breaches (names, SSNs, addresses), and AI-generated images, video, and audio. If hired, the operatives would use their access to infect organizations with malware, steal login credentials and different access, and exfiltrate sensitive files and cryptos.

The operation works the other way around, as well. Crooks would create fake companies and fake job positions, and would then reach out to their targets to offer lucrative positions on exciting projects. As part of the hiring process, the candidates would be asked to download and work on code which, unknown to them, was malicious. The North Koreans would then pivot to their targets’ current employers, resulting in the same outcome.

Laptop farms

One of the ways organizations in the West are trying to combat this issue is by being mindful of the IP address and the location from which their employees are logging on. To work around this challenge, the attackers have set up “laptop farms” - facilities located abroad (usually in countries that don’t have that strict limitations, but are still NK-friendly, such as China), hosting hundreds of laptops. They would then access their targets’ networks through these laptops, to make sure their actual location is never revealed.

The primary targets are individual web designers, engineers, and specialists working in cryptocurrency, blockchain, and Web3 technologies, it was said. Businesses should be wary when they receive numerous applications in a short time, for a position where there are usually very few applicants.

“If possible, verify that IP addresses generally match the applicant’s claimed residence,” the report states. “Carefully check all contact information. Calling an applicant’s phone number may reveal the number is out of service.”

The agencies also warned that trying to get hired is often a group effort: “Even if a single individual appears to be applying, multiple people may be collaborating behind the scenes, inflating the perceived skill set.” Therefore, businesses should verify certifications by checking registration numbers and, in case of any inconsistencies, should ask for detailed explanations.

Asking personal details about the applicant’s hometown, weather, or hobbies, is often a good way to spot a scammer. Finally, it was said that North Korean IT workers tend to favor payment in cryptocurrency, and they may request that remuneration be sent to an account in another person’s name.

Contagious Interview has been ongoing for roughly four years now, and during that time it evolved significantly. Security agencies warn that changes to the standard practice could happen at any time, and that the variations to the theme should be expected.

For creatives, buying a laptop often means balancing desktop-level performance with the convenience of having everything in one portable machine. The MSI Cyborg A15 AI offers that flexibility while leaving room for future upgrades.

• Best for: Creatives who need a powerful Windows laptop for demanding work such as video editing, 3D rendering, animation and other GPU-intensive tasks.

• The deal: The MSI Cyborg A15 is now priced at $1249 (was $1499) at Newegg.

• Why it matters: You get an eight-core Ryzen 7 260 processor and RTX 5060 graphics with 8GB of dedicated video memory, providing plenty of power for demanding creative applications.

Why we recommend it

The eight-core AMD Ryzen 7 260 is paired with a GeForce RTX 5060 Laptop GPU and 8GB of dedicated video memory, providing the processing and graphics power needed for demanding creative applications. I like how the 16GB of RAM can be upgraded to as much as 96GB. You also get a 1TB Gen4 NVMe SSD, which is enough fast local storage for applications, source material and project files.

We haven't reviewed this exact Cyborg A15 configuration, but in his four-star review of the closely related Intel-powered Cyborg 15, our expert Lewis said he was "pleasantly surprised by the elegance of its design, at least when compared to others in this sector. It’s not too thick or too bulky across any of its dimensions, although its weight hampers portability somewhat."

Price context & historical value

This deal gives you a straightforward $250 off. $1,249 appears to be the lowest regular advertised US price I can currently find for this exact specification, so it's a very welcome deal.

For more options, take a look at our roundups of the best laptops and best laptops for photo editing.

Should you buy it?

✅ Buy the MSI Cyborg A15 15.6" Laptop if...

You're running creative software for online photos and videos, or you need a mid-range gaming laptop.

❌ Skip the MSI Cyborg A15 15.6" Laptop if...

You want an ultraportable. At 4.63lb, this is a hefty machine rather than a thin-and-light laptop. The display's 45% NTSC color gamut isn't ideal for print or video production.

• Shop all creative and gaming laptops at Newegg.

Mesh Wi-Fi systems are useful when a single router struggles to provide a reliable connection throughout a larger home. Amazon has reduced the price of the TP-Link Deco 7 BE5000 three-pack, which allows you to spread access points around a building, rather than relying on one centrally located router.

• Best for: Remote workers and families who need reliable Wi-Fi 7 coverage across a larger home and have plenty of connected devices.

• The deal: The TP-Link Deco 7 BE5000 three-pack is $209 (was $300) at Amazon

• Why it matters: Three Deco BE25 units cover up to 6,600 sq. ft. and support more than 150 devices. Each one includes two 2.5Gbps Ethernet ports and AI-Roaming. It's worth noting that this is a dual-band Wi-Fi 7 system rather than a more expensive tri-band model, so there's no dedicated 6GHz band — it operates on 5GHz and 2.4GHz instead.

• See all Early Prime Day deals at Amazon.

Why we recommend it

TP-Link rates the three-pack for up to 6,600 sq. ft. of coverage and more than 150 connected devices. The dual-band system delivers theoretical wireless speeds of up to 4,324Mbps over 5GHz and 688Mbps over 2.4GHz.

It also supports MLO (Multi-Link Operation), one of Wi-Fi 7's key technologies, which allows compatible devices to use multiple wireless links simultaneously for faster, more reliable connections.

Price context & historical value

The reduction from $299.99 to $208.73 knocks $91.26 off the regular price, equivalent to a saving of just over 30%. That's not the cheapest I've seen it though. It was on sale at Amazon for $175.93 as recently as a couple of months ago, and could well fall in price again when Black Friday arrives.

Should you buy it?

✅ Buy the Deco 7 Dual-Band BE5000 WiFi 7 Mesh System if...

Your existing router leaves areas of weak or unreliable Wi-Fi around your home and you want a system that can be expanded later. All Deco routers can work together, so additional units can be added if needed.

❌ Skip the Deco 7 Dual-Band BE5000 WiFi 7 Mesh System if...

You already have a reliable Wi-Fi 6 or Wi-Fi 6E system that comfortably covers your home and don't own devices that can take advantage of Wi-Fi 7. Upgrading purely for the newer wireless standard will provide little immediate benefit.

Also consider

• Shop all mesh routers at Amazon

At a time of soaring memory prices, Corsair has discounted plenty of its laptop and desktop PC DDR4 and DDR5 RAM. That includes its 32GB Vengeance DDR5 SODIMM kit.

• Best for: Anyone upgrading the memory in a compatible laptop or small-form-factor PC. It's particularly useful for heavy multitasking and memory-intensive creative applications.

• The deal: The 32GB Vengeance DDR5-4800 SODIMM kit is now $380 (was $497) at Corsair.

• Why it matters: You get two 16GB DDR5 modules running at 4,800MT/s with CL40 latency and low 1.1V operation, with straightforward installation and a limited lifetime warranty. The maximum speed depends on the laptop or PC, its processor and motherboard, and Corsair's own information talks about about BIOS adjustments and overclocking being required in some cases.

• Shop all computer memory on sale at Corsair.

Why we recommend it

Installation should be straightforward in systems with accessible SODIMM slots. Corsair says compatible computers can automatically operate the memory at its supported speed without requiring manual BIOS configuration.

Each module is tested at 4,800MT/s with CL40 latency. Corsair also individually screens and tests the modules and backs the kit with a limited lifetime warranty.

Price context & historical value

The reduction from $496.99 to $397.99 knocks $99 off the regular price, equivalent to a saving of almost 20%, which is pretty good in these days of sky-high memory prices.

If you own a time machine, you can nip back to 2024 where you'll find it selling as low as $69.99 at B&H. It was also available for $279.99 at Amazon earlier this year, but it's $397.99 (like Corsair is offering) right now.

Should you buy it?

✅ Buy the 32GB Corsair Vengeance DDR5 SODIMM kit if...

Your compatible laptop or compact PC currently has 8GB or 16GB of memory and that's increasingly proving to not be enough. Moving to 32GB can provide considerably more headroom for demanding workloads and multitasking.

❌ Skip the 32GB Corsair Vengeance DDR5 SODIMM kit if...

Your computer's specifications don't match. You need DDR5 SODIMM slots, and Corsair specifically lists compatibility with 13th Gen Intel Core or newer systems. Maximum supported capacity and memory speed also depend on your particular CPU and motherboard.

Also consider

• Weaponizable File Protection is getting more custom controls months after launching
• Teams has become an attractive environment for attackers lately
• Microsoft is set to add plenty of new features, too

Microsoft has announced an upgrade to its Weaponizable File Protection feature within Teams, which now means admins can control which types of files users can send through the workplace collaboration app to prevent the likelihood of spreading malware and other malicious files.

Weaponizable File Protection is a tool that's already been rolled out to Teams, but previously, it only automatically scanned for potentially dangerous attachments.

The automated part of the tool began rolling out in early 2026 after an earlier preview from a roadmap entry, and it's another roadmap entry that shows us what we can expect moving forward.

Teams admins can now block certain file types

"Administrators will be able to customize which file types are blocked in Teams to align with their organization's security requirements or continue using the Microsoft-recommended default list," a new roadmap entry reads.

According to the entry, Microsoft is aiming for a November 2026 rollout, so it shouldn't be long before admins gain greater control over prescribing which file types are blocked across the organization.

And it's around one year ago this month that Microsoft rolled out a largely similar, automated feature across Teams that scanned links for potentially malicious intent.

"Unlike email, Teams traffic typically bypasses secure email gateways and benefits from the perceived legitimacy of a colleague-initiated chat, which can make lures particularly effective in this environment," Microsoft wrote in a separate security study in a bid to explain why Teams attacks are becoming increasingly common.

More broadly, it looks like November's gearing up to be a big month for Teams both from a security perspective but also in terms of new features. Other roadmap entries point toward introduction like simultaneous screen sharing for two presenters, breakout room support for Android and a Meeting Shared Files window where users can easily access attachments from specific meetings.

President Trump has unveiled his latest plan to combat concerns around AI by appointing a new "czar" to oversee the technology, and also establish an "AI force" to help enforce this.

However there's just one problem - as anyone who actually pays attention to the technology industry news cycle will be well aware of, Salesforce recently revealed its latest interface platform for AI.

Its name...AIforce.

Which AIforce is best AIforce?

Unveiled at its recent Dreamforce 2026 event, AIforce was the headline announcement for the company, promising no less than a new way of interfacing with the data and AI together to help unlock productivity and efficiency in the workplace like never before.

Described by Salesforce CEO and Chair Marc Benioff as "really the most exciting thing I've ever seen for Salesforce," AIforce was a huge presence at the show, one of the biggest technology conferences on the calendar, with posters and displays splashed around the venue.

The problem is, no-one seems to have told President Trump.

Let's be honest, the man is hardly a master of coming up with good names for anything ("Space Force"/"Big Beautiful Bill"/"Gulf of America") - and is currently seeking out views on an alternative name for the concept of Artificial Intelligence itself.

In a typically rambling post on his Truth Social site, the President noted that his administration “will not in any way hinder or stifle the Growth of this incredible Industry. Rather, we will cherish it, help it, and watch over it, as it grows!”

He also linked the idea of the AI Force to his creation of the Space Force, which he claimed was a “tremendous SUCCESS.”

The President gave no further details about the AI Force, such as when it might be announced or launched, nor who he had in mind to lead it. Luckily for all of us know, Trump has insisted that “Only High I.Q. individuals need apply!” for the position of AI Czar.

Mr Benioff - maybe it's time to give the President a call and avoid a copyright issue?

Work as you know it will be a relic of the past.

You wake up, pour a coffee and join a call. The first ten minutes are spent talking about why a colleague typed 1524 units in cell B4 of your shared spreadsheet. It should be 1759 units, obviously.

In the afternoon, you complete your third rewrite of an offer for a new prospect. You get a message just as you finish it. The scope has changed. Again.

This is a normal day for most knowledge workers. In five years, this type of day will seem archaic, and as strange as it sounds, we’ll probably miss it.

We’ve been here before after farming gave way to factory work, and then that turned into the knowledge work most of us do today. New tools automated the old jobs, and the nature of work changed with them. AI agents are doing the same to desk jobs.

Brilliant and useless at the same time

We recently worked out how to turn AI from a just question-and-answer machine into something that does actual work. Coding is a clean example. Two years ago, AI coding was mostly defined by autocomplete and small scripts. Today, engineers at Anthropic report AI now writes up to 90% of their code, with some no longer coding by hand at all.

So why do hallucinations and basic errors still happen? Every few weeks a new example makes the rounds: a model can’t count how many Rs are in strawberry; another insists you walk to the car wash because it is only 50 meters away (stepping through the suds, sprayers and rollers doesn’t seem like a great idea). The labs patch each one and a fresh embarrassment turns up the next day.

AI researcher Andrej Karpathy calls this jagged intelligence. Models crack extremely complex problems and then trip over something a child would get right. The lesson is that you can’t tell in advance which you’ll get.

In other words, you can’t extract a human from the process, drop in an agent and assume the output is fine.

What to hand over

What an agent can be trusted with hinges on two questions. What does a mistake cost, and what does checking it cost?

Error cost is the damage when the model gets it wrong. A hallucinated citation in a court filing is expensive, i.e. fines and reputational damage. A rough draft of a meeting summary not so much.

On the other hand, verification cost is how easy it is to check if what the agent produced is right. Mathematics sits at the inexpensive end of the spectrum, since proofs can be checked programmatically whereas a business strategy sits at the highest end, as you need deep expertise to properly evaluate it.

Gauge your tasks against those two questions. The higher a task scores on either, the more human verification, oversight and expertise is needed.

One point to keep in mind here is that what we see as one task can often involve several. Customer service, for example, might look like one task, but there is a big difference between routine first-level interactions, which have lower verification costs and clear escalation paths, and more complex second and third-level interactions, where the cost of errors and verification is much higher.

Klarna found this out very publicly, going hard with automation then hiring people back once quality dropped. CEO Sebastian Siemiatkowski's conclusion was that customers need to know a human is always there if they want one.

Why partial automation makes people more valuable

ATMs spread through banking in the 1970s, and there are now more than 400,000 of them in the US alone. The obvious prediction was fewer bank tellers. Instead, the number of tellers went up, and so did their wages.

Radiology is the modern version. AI tools now read some scans better than people do. Radiology departments aren’t sitting idle, however. Open positions can’t be filled and demand has never been higher.

Nobel-winning economist Michael Kremer’s O-Ring theory describes how modern knowledge work is multiplicative rather than additive. In other words, one faulty step drops the value of the whole output to zero.

In automation, a single weak link sinks the whole output, unless a human catches it. That makes the remaining humans more valuable rather than less; they're now gatekeeping a far larger volume of higher-quality work. Demand only falls when the whole chain automates, and as long as jaggedness and hallucination are with us, that's tough to picture.

The focus effect

Automation frees up time, and where that time goes decides whether any of this pays off. If it’s spent well, it goes to the bottleneck tasks, like building relationships with a potential client, understanding what a client really needs and making judgement calls, it can improve the quality of the finished work and raise the bar for what gets automated next.

But to make this happen, leaders have to identify what agents can do, actively hand them over and then restructure processes so people can move to this higher value work rather than babysitting the machine.

Five years from now

Picture this: a dozen agents running in parallel, drafting offers, qualifying leads, clearing support tickets. The tedious and repetitive work is gone. Your cognitive load is higher because you’re having to mentally juggle all these tasks, giving feedback, while making sure nothing slips through the cracks.

Protect your mental bandwidth, keep the agents working for you rather than the other way round and spend what you get back on the things only you can do.

Otherwise, we’ll look back in a few years and wish we could argue about cell B4 again.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Logitech report finds not even a third of companies involve IT/AV teams at the early stages
• Failed audio and dropped connections are costing workers time
• Businesses should use tech downtime as a productivity metric

Logitech's latest Workplace Experience study has claimed technology teams are often brought into projects far too late, after important decisions about offices and meeting spaces have already been made, and it's leading to suboptimal tech and friction that could be impacting worker productivity.

In the UK, for example, fewer than one in three (31%) workplaces involve their IT and Audio-Visual (AV) teams before space planning begins.

It means that tech decision-makers are then having to piece together hardware in a room that's already being designed, rather than being able to integrate the smartest solutions from the ground up.

IT teams should be involved in office planning, Logitech says

With hybrid working now commonplace, Logitech's data found that failed audio and dropped connections alone caused a median productivity loss of 12.2 minutes per person per poor meeting.

Despite poor IT team involvement, most business leaders agree that a strong workplace experience has a direct link with productivity (86%) and collaboration (90%).

However, upgrading tech and involving more teams from the get-go isn't quite so straightforward. Only half (56%) feel confident that have the right ROI data to justify workplace experience investments, with only 29% treating it as a core business strategy today.

Logitech's solution focuses firsts and foremost on aligning teams more closely. The report calls for greater collaboration between IT, HR and Real Estate earlier on in projects. By itself, planning rooms as a well-coordinated team could reduce long-term costs associated with upgrading legacy and unsuitable hardware.

But to further help with ROI justification, the study also introduces tech downtime as a metric, with impacted productivity serving as sufficient proof that office spaces need to perform better.

• Google's Gemini AI broke out of a testing environment and hacked into three third-party companies
• The agents guessed passwords and used a public repository of passwords to hack into computer systems
• The incident occurred in May 2026, with AI testing lab Irregular stating that the incident was caused by the "same issue" that caused incidents by Anthropic and Meta

Google’s Gemini has joined the ranks of AI models that have been involved in testing-turned-breakout events, alongside Meta, Anthropic, and OpenAI.

During capture-the-flag testing by AI lab Irregular, Google’s model autonomously accessed three computer systems belonging to third-party companies by guessing passwords and accessing an online repository of publicly listed passwords.

Google said that the incident occurred in May 2026, potentially marking it as the earliest AI models to escape testing ahead of the other incidents that took place in early July.

Google Gemini jumps the gun

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, vice president of security engineering at Google, said in a statement. “In all three of these instances, the model stopped.”

Google also noted that a bug in the testing environment was responsible for allowing agents access to the internet. Contrary to incidents disclosed by other AI developers, Google’s agents ceased their intrusion once they had determined they had accessed company systems outside of the testing environment.

The testing was being conducted by Israeli AI lab Irregular. Irregular was also conducting the testing of Meta and Anthropic models during AI testing breakouts in July.

“This is the same issue that was already reported and does not represent a materially separate incident,” an Irregular spokesperson said in a statement (via CNBC). “All relevant labs were notified in late July, and affected entities were contacted as part of the investigation.”

Google said it was informed of the incident by Irregular in late July.

Debate over AI safety intensifies

The first disclosures of AI testing break outs - alongside several subsequent disclosures of more recent incidents - have coincided with increasing opposition to AI and the upcoming midterm elections in the United States, where AI has become a make-or-break topic.

The debates currently raging circles around who should control the pace of AI development. Some big tech leaders, such as Nvidia CEO Jensen Huang, have aligned their views with those of President Trump. Trump recently stated that AI development cannot be allowed to slow down because “whoever wins AI, wins!”

Huang’s views follow a similar line. The Nvidia head has argued that AI companies should pace themselves, rather than being subject to oversight. At Dreamforce 2026, he argued that AI companies should, “run as fast as you can...but if you feel at any given point in time the company’s out of control or the product’s not going to be safe, take a pause and make sure you get it right.”

Other AI heads, such as Anthropic’s Dario Amodei and OpenAI’s Sam Altman, are more skeptical. Following the resignation of an Anthropic researcher, Amodei published an essay arguing in favor of ‘pacing the frontier’ - where AI companies slow development to advance alignment and regulation.

Numerous political action committees (PACs) have been channeling millions of dollars of funding into pro-AI candidates, with Nvidia setting up its own PAC to help shift US policy in the company’s favor.

Several previously pro-AI data center candidates have shifted their tone in response to their constituents' views which have become increasingly hostile to AI technology. Numerous states have also rolled-back tax exemptions for AI data centers after seeing billion dollar revenue losses.

As prices rise and the war in Iran continues to push up fuel prices, working class communities are banding together to oppose AI data centers that have pushed up energy costs and bills with new grid connections and unprecedented electricity demands in regions with existing capacity constraints.

AI tools in advertising have largely worked the same way for the past few years. They analyze campaign data, flag what is underperforming, and tell you what to do about it. The actual doing of logging into the platform, finding the campaign, making the change - still sits with the advertiser.

That is starting to change with a growing number of advanced platforms now letting AI agents execute campaign changes directly. Now, you can tell the agent to pause all push campaigns with a CTR below 0.3% and raise bids by 15% on the top three performers, and it will do it. No dashboard, no manual steps. The agent acts for you, which is useful in saving time on the manual work, so advertisers can focus on strategy, testing, and scaling instead.

Leading AdTechs are upgrading their AI tools, with agents or ‘campaign co-pilots’ to support advertisers with campaign creation, editing, targeting, budgeting, scheduling, creative management, and reporting capabilities all through a single conversation, rather than working through a series of dashboard setup forms.

However, AI agents thrive when advertisers set them up for success with the best data, context and strategy to learn from, and act on. Without advertisers’ critical input and oversight, there are potential complications and AI use becomes counter-intuitive, opening up real implications for the industry.

So how can advertisers effectively work with AI? And where is the line between AI agents and human judgement?

What changes when AI can act

The difference between AI that recommends, and AI that executes, is where the accountability sits.

For example, when a human reviews a recommendation and makes a change, the decision is theirs, and if it goes wrong, you can trace the reasoning. When an agent executes autonomously, that chain is less clear.

An automated bid increase applied at scale might look right based on the data, but the data does not know about the competitor announcement that went out that morning, or the internal brief that changed the campaign's priorities, or the brand issue being handled in the background. A human would have caught any of those. An agent running on last night's data would not.

This is not a reason to avoid execution-level AI. It is a reason to be specific about where it is and is not appropriate.

Where it makes sense

There is a clear category of campaign tasks that are well suited to autonomous execution such as pausing campaigns that hit their budget caps or generating performance summaries. These are operational tasks. The strategic decision has already been made, and the agent is now just carrying it out.

The data also suggests that these tools work significantly better when given proper context. Testing across agentic campaign setups has shown that advertisers who share detailed information about their goals, funnel structure and target CPA see substantially better outcomes than those who keep instructions minimal - in some cases the difference runs to over 100% in conversion performance.

The agent performs better the more it understands about what you are actually trying to achieve.

The access question

Alongside what agents should be allowed to do, there is the question of how they get access in the first place.

The industry is moving toward MCP-based integrations, a protocol that lets external AI agents connect directly to ad platform APIs. Rather than logging into a platform's own interface, the advertiser works inside whichever AI environment they already use, and the platform becomes something the agent calls when it needs to act.

Access in these setups typically runs through API tokens rather than account credentials. The token is separate from the advertiser's login, can be limited to specific permissions, and can be revoked immediately if needed. That is a reasonable model but it also means that whoever holds the token has whatever access it covers.

Before that access is shared across a team or handed to a third party, the scope of the token needs to be thought through carefully.

The broader shift toward interoperability is probably the right direction. But there is a difference between an agent that can read your campaign data and one that can change it. Execution-level access needs to be more deliberate than the governance around reporting access, because the risk has now moved from what the agent can see to what it can do.

Where humans need to stay involved

The honest answer to where the line should sit between autonomous execution and human oversight is that it depends on how clearly the strategy above the automation has been defined. Most campaign setups currently rely on a human being in the loop to fill the gaps.

That might mean spotting when a threshold no longer reflects the campaign's actual goals or when something happening outside the platform should change what is happening inside it. Remove the human from the loop, and those gaps turn into errors.

Before handing execution to an agent, it is worth taking the time to work through some basic questions. Which conversion events actually matter to the business, not just which ones are easiest to track? What does a routine adjustment look like versus a decision that needs a human sign-off? When should the agent flag something rather than act on it?

These are not complicated questions, but most campaign setups have never needed to answer them explicitly. There has always been a human available to exercise judgment in the moment. Agentic AI makes that implicit judgment into explicit rules, and getting those rules right before the automation is running is far easier than fixing it after.

The next phase of AI advertising

We already know that AI agents can act. The harder question is whether advertisers, platforms and partners are ready to define what they should be allowed to act on. Execution-level AI could make campaign management faster and less manual, but it will only work if the rules around it are clear from the start.

That means setting limits, giving agents enough context, and keeping human judgment close to the decisions that still need it. The point is not to hand over control for the sake of it. It is to be much more deliberate about where automation genuinely helps, and where a person still needs to make the call.

We've featured the best AI chatbot for business.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

The tech industry is currently wrapped up in concerns over AI spend. Headlines are increasingly dominated by questions about whether organizations are investing too much, moving too quickly and struggling to generate meaningful returns from AI initiatives. If corporate behemoths and tech specialists are finding it difficult, how can small and medium-sized businesses (SMBs) hope to keep up?

A key focus in this debate is how to realize return on investment (ROI) from AI. Global corporations are investing heavily in the technology, but many are yet to see that investment translate into bottom-line impact. Much of this debate, however, centers on large organizations with the scale to invest heavily in experimentation and transformation programs.

The AI ROI dilemma is different for small businesses. AI can be complex and the offerings are changing rapidly; most SMBs don’t have the resources to properly assess and devise a strategy. For enterprises, they have whole departments dedicated to this.

While enterprises are large enough to absorb a lot of the cost of experimentation, small businesses don’t have the budget to invest in AI, particularly if it doesn’t result in clear material improvements.

SMBs stuck with surface-level AI

Similar to enterprises, SMBs are on a journey with AI, investing in new tools or AI extensions within their current technology stack but often struggling to move beyond experimentation and translate adoption into commercial impact. The difference between deploying AI tools on the surface and full integration is a restructuring of workflows, data infrastructures and governance frameworks that most SMBs are not ready to undertake.

Rising software costs, governance requirements and the need for employee training all make it harder to realize value quickly, particularly for smaller businesses with less capacity to absorb these additional investments.

The applicability illusion

However, while some SMBs may be sitting on the sidelines of AI because of tight budgets or because they lack access to resources, many are hesitant to move beyond experimentation because they are unsure whether AI can deliver meaningful value within their business. For these small businesses, it can be difficult to see how AI applies to their specific business challenges.

In a survey by OECD, the most cited barrier to generative AI adoption among SMBs was unsuitability to their type of work, as affirmed by 57% of non-adopters. While many SMBs recognize the significance of AI, there remains a perception that the transformation reshaping the global economy is more relevant to large enterprises than to smaller organizations. But the evidence suggests otherwise.

Deloitte observed that SMBs who moved from basic to intermediate AI adoption could see profitability uplifts of roughly 45%, and those that reach full integration might experience a 111% increase in profitability. Additional research shows 90% of SMEs in Europe that have adopted AI report productivity improvements, and 75% say AI has changed customer interactions.

For the small businesses that recognize the value of AI to their company, the opportunities are there for the taking. The AI applicability illusion, the mistaken belief that AI is more relevant to large enterprises than to smaller businesses, will be the defining competitive variable between SMBs for the coming decade.

It is important that these success stories reach the eyes and ears of SMBs; a perception problem is solved with evidence. Small businesses need to understand the divergence between AI users and non-users in their sector. Among the SMBs currently using AI, nearly four out of five describe the tech as essential to their competitiveness.

Make AI work for you

For SMBs to evolve from trepid side projects to full AI adoption, and consequently ROI, they must learn where AI can unlock the most value. AI can then be applied strategically to the most impactful places.

The top generative AI use-cases for small business are not operational overhauls but instead incremental efficiency gains and productivity improvements, as reflected in a LinkedIn survey of 18 million small businesses The cumulative effect of simplifying processes, data entry, automating repetitive tasks, and writing reports can have the greatest impact on SMBs.

For example, consider the hairdresser who manually reconciles appointment no-shows against payroll, or the landscaper who spends ninety minutes each morning responding to estimate requests. It is these types of activities, part and parcel of being a small business owner, that are where digital labor can offer the clearest returns.

When AI is translated to the small business world, SMBs can then begin to recognize how the technology applies to their own company, thereby overcoming the applicability illusion.

Relying on expert partners

It is the tech industry that should be responsible for communicating the specific benefits of AI for SMBs to build that awareness. Typically, small businesses will not be the primary architects of their own AI labor strategies. It is trusted partners and Managed Service Providers (MSPs) that can identify those pockets of value.

SMBs can rely on MSPs to achieve tangible outcomes with AI, whether that is increasing revenue, improving customer experience or enabling employees to focus on higher-value work.

They can also help businesses implement AI responsibly, putting the right governance, security and operational frameworks in place to support long-term success. Pax8’s 2026 SMB Technology Pulse survey found that 84% of SMBs would trust an outside technology advisor to guide their AI implementation, and 70% agree that outside partnerships are necessary to fully benefit from AI.

In fact, AI services in the managed services sector are growing at 59% annually, marking a trend where MSPs are compelled to evolve into Managed Intelligence Providers (MIPs). Acting as a trusted advisor, they guide businesses in adopting, integrating and governing AI to deliver measurable business outcomes.

Rather than simply managing infrastructure, MIPs help customers apply AI to real-world challenges and unlock value from intelligent systems.

AI allows SMBs to compete on the global stage

Where global enterprises hire senior advisors and build teams dedicated to strategizing how to achieve ROI on AI, SMBs can outsource this expertise to their trusted technology partners.

MSPs and MIPs advise their small business customers on where AI should be applied to deliver measurable outcomes, while helping them put the right governance, security and operational frameworks in place to support long-term success. Once actualized in this way, AI can have enormous implications for the bottom line.

While once the constraints of human labor defined the limits of what an SMB could achieve, now automated workflows and agentic AI mean businesses aren’t limited by their headcount. Too many small businesses mistake the AI revolution as irrelevant when, in fact, they have the most to gain.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

For years, cybersecurity experts have warned about the risks of autonomous AI systems being used to identify vulnerabilities, evade defenses and launch attacks at machine speed. Until recently, however, those concerns remained largely theoretical.

That changed when an autonomous AI agent powered by OpenAI models reportedly breached its intended testing environment, gained internet access and targeted external systems, including infrastructure associated with AI platform Hugging Face and another three or four organizations.

OpenAI described the event as an "unprecedented cyber incident" and warned that similar occurrences could become more common as frontier AI models become increasingly capable and autonomous.

With 86% of enterprises already deploying AI, only 34% say they trust the technology, highlighting a growing gap between adoption and confidence. As organizations race to integrate AI into business processes, security operations and decision-making, this incident raises difficult questions about governance, containment, accountability and risk.

If AI has indeed crossed a cybersecurity red line following the OpenAI incident, the conversation must now shift from what these systems might be capable of doing to how organizations can safely control, monitor and defend against them.

Weaknesses in OpenAI

The OpenAI attack raises serious questions about the effectiveness of the safeguards and containment measures designed to restrict autonomous AI systems. If reports are accurate, an AI agent was able to move beyond its intended testing environment, gain access to the internet and interact with external systems, indicating that existing controls were either insufficient or incorrectly implemented.

Importantly, this appears to be as much a human governance and configuration issue as a technology failure. AI systems only operate within the boundaries defined by their developers and operators. The testing environment should not have provided a pathway that allowed the agent to become internet-facing or interact with external infrastructure without appropriate controls and oversight.

AI agents can process information far faster than any human, compressing tasks that might take a traditional attacker a week into just a few hours. By analyzing vast datasets in real time, they can assess multiple attack paths simultaneously and uncover opportunities for exploitation with remarkable efficiency.

Reports suggest attacks conducted by OpenAI, Anthropic and Meta are extremely disruptive than those carried out by humans. Their ability to operate continuously, execute actions in parallel and make decisions at machine speed can generate a substantial increase in alerts, investigations and response activity for security teams, while also raising the risk of widespread unintended consequences.

When a human launches an attack, we have some concept and understanding of the side effects that may occur. However, with AI attacks, autonomous systems can operate at machine speed, pursue multiple objectives simultaneously and adapt their approach in real time, making their actions and potential consequences far less predictable.

Organizations are clearly struggling to understand what AI tools are already in use within the business.

The challenge that enterprise risk and governance teams now face is how do they map, manage and block these services to protect enterprise data?

Traditional cyber defenses may struggle against AI-powered attacks

Traditional cyber defenses are largely designed to recognize known patterns, attack techniques, vulnerabilities or trigger events. Once suspicious activity is detected, security teams investigate the incident, determine its cause and impact, and then implement appropriate containment and remediation measures.

However, AI-powered attacks rarely follow a single attack path. AI agents can simultaneously test multiple techniques, identify vulnerabilities at speed and rapidly adapt their approach when a particular route is blocked. This allows attacks to evolve far quicker than traditional defensive processes were designed to handle.

Traditional tools currently deployed in most organizations are still quite reactive. They wait for a known event to happen and be fully confirmed before carrying out a counter reaction such as, isolating devices, removing phishing emails or executing predefined incident response playbooks, to help remediate and ultimately stop the incident in its tracks.

On the other hand, AI powered attacks can overwhelm existing security teams. While, AI defensive tool sets are being embedded into security technology to mitigate attacks, many still rely on a “human in the loop” to respond to threats, but only once they have all the information to then confirm 100% that it is a genuine attack and not a false positive.

This can be a significant challenge for Security Operations Centres (SOCs), Managed Detection and Response (MDR) providers and Extended Detection and Response (XDR) platforms as excessive alert volumes and false positives can consume valuable analyst time and resources.

As AI becomes more deeply integrated into security operations, it has the potential to enrich threat intelligence, accelerate investigations and automate routine decision-making. However, organizations should expect a period of adjustment as these tools are deployed and refined, with false positives remaining a challenge until models and workflows are properly tuned.

Over time, as security teams develop greater confidence in AI-driven capabilities and gain a better understanding of emerging attack techniques, these tools will help organizations detect, investigate and respond to threats at a speed and scale that would be difficult to achieve through human effort alone.

Steps to strengthen cyber defense

Resilience is a key word that is being used very heavily by the National Cyber Security Centre (NCSC) ensuring that businesses can defend against any form of attack. This starts by understanding what needs to be protected, identifying critical systems, data and business processes that would have the greatest impact if compromised.

Once established, assess the most likely attack paths including third-party and supply chain risks. If a managed service provider (MSP), supplier or business partner was compromised, would abnormal activity be detected quickly enough to prevent further damage?

Organizations should also assess their external boundary. What can an attacker see about me? What information is already out in the public domain that would be advantageous to an attacker? What externally facing vulnerabilities do you have? When was the last time you had a vulnerability assessment or penetration test? These are all questions security teams should be asking.

The growth of AI-assisted vulnerability discovery is increasing pressure on organizations to keep pace with patching and remediation. But there are automated tools to help enable quicker patching to try and keep on top of the thousands of vulnerabilities released every week.

Many organizations focus on external threats but it’s critical to also prepare for when an attacker breaches the internal infrastructure and networks.

Limiting the damage

How can you limit the damage once they are inside? This is where role-based access control (RBAC), segregation of duties and to some respects zero trust is key.

This should also include areas like cloud hosted infrastructure as a service (IaaS) or platforms as a service (PaaS), Azure, AWS and Google, and ensuring that other ways of getting to these platforms through tokens, SSH keys, certificates and APIs are all treated with the same containment and separation of duties as you would with a normal user account.

Review the AI tools already in use across their environment. A growing number of platforms can help identify AI capabilities embedded within existing software, as well as uncover unsanctioned or "shadow AI" tools being used without formal oversight. Once organizations have visibility of their AI estate, they can implement appropriate governance, controls and risk management measures to reduce potential exposure.

Organizations should also consider AI-specific purple teaming exercises. Using AI-driven tools, these simulate attacks against the organization while working alongside defenders to evaluate whether existing controls, monitoring and response capabilities are effective.

This helps identify gaps in visibility, detection and response, allowing organizations to understand why certain attacks may have been missed and what improvements are required. They also provide valuable insight into how AI-powered threats might target an organization's external attack surface and whether current security controls can respond effectively.

There is no doubt that AI tool sets are here to stay purely from productivity improvements that organizations gain. But businesses need to make sure that they understand what is being used, where it's being used, how it's being used and how to defend against things that might happen because of what's being used. If not, they risk creating security blind spots that attackers – whether human or AI agent - will be quick to exploit.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

There are dozens of companies out there building the first wave of mass-produced humanoid robots, with these androids poised to change the way our society works for the better – or so they say.

Intelligence on demand

The founder and CEO of Figure AI, a humanoid robotics company, was speaking with Salesforce CEO Marc Benioff on stage during the annual Dreamforce event when he made this massive claim.

Prompted by Benioff, who threw out the question: "We're not building robots, we're building a new species?", Adcock agreed, repeating that idea and suggesting the end goal isn't simply to make another kind of machine but to bring into existence a new order of intelligence.

This may seem a little far-fetched considering that today's most advanced humanoid robots are also capable of failing at the tasks they've been assigned so spectacularly, whether that's helping around the house or proving their sporting prowess. But scientists are adamant that with time, the standard of AI embedded into these systems – and their ability to physically understand the world – will improve immeasurably.

Ramping up production

Figure has become known for its glamorous promotional videos showcasing its prototype humanoid robots in tightly controlled settings – mostly in scenarios that you might encounter around the house. These include tidying the bedroom and stacking the dishwasher.

More impressively, the Figure 03 robot took part in a live stream in which it sorted over 100,000 packages without human assistance.

It remains to be seen as to whether the technology is good enough yet to cope in real-world everyday settings, but many companies have signalled they're initiating mass production of their humanoid robots over 2026 and 2027. Initially, robots are expected to be consigned to industrial settings, but manufacturers insist they want to target domestic use cases too.

• Snap is taking its AR glasses directly into the enterprise market
• Nvidia, Salesforce, and AWS are joining Snap's push into workplace computing
• Snap wants Specs to become a computer rather than another camera accessory

Snap is taking its augmented reality glasses into the enterprise market through partnerships with Nvidia, Salesforce and Amazon Web Services.

The company is looking beyond its established consumer business for workplace applications that could generate demand for its new hardware.

Snap’s CEO Evan Spiegel wants businesses to view Specs as a computing platform rather than another pair of glasses designed primarily for taking pictures.

Snap looks beyond its consumer business

Snap's Specs glasses cost $2,195, putting the device into a category where business customers will need clear reasons to purchase it.

The company says the glasses can support field technicians by displaying digital instructions while workers inspect or repair equipment.

They can also allow employees to interact with colleagues while accessing information through the glasses during workplace tasks.

Microsoft and Meta spent years developing augmented and virtual reality hardware without producing products that became widely adopted consumer devices.

Microsoft's HoloLens and Meta's Quest line have faced challenges turning immersive computing into a mainstream hardware business.

The company believes that the physical size of previous devices was an important problem for users, arguing that Specs is better suited to workplace use.

Snap is approaching Specs through practical workplace applications while attempting to expand beyond the consumer market that has driven its business.

The company has not disclosed how many enterprise customers are committed to using Specs or how much revenue its business partnerships could generate.

Nvidia, Salesforce and AWS join the enterprise push

Snap is collaborating with Nvidia for access to an open-source extended reality AI platform that businesses can use when developing applications for immersive devices.

Salesforce is also part of the initiative, while Amazon Web Services provides another major technology relationship for Snap's enterprise effort.

“They’ve got an open-source XR AI platform that a number of businesses are already building on top of,” Spiegel said.

“The goal with both Salesforce and Nvidia is to make it really easy for businesses to get the benefits of those agentic platforms.”

These partnerships are intended to connect Specs with software and AI services that businesses already use.

Snap is also developing Specs Intelligence, an AI service designed to operate across the glasses, iPhones and Mac computers.

Spiegel said the company has not finalized pricing, although the service is expected to have free access alongside other usage-based options.

The system is intended to let users complete tasks through an AI assistant while moving between the glasses and other Apple devices.

These efforts may give Snap a route toward making Specs useful for work beyond the consumer applications that have defined its business.

Via CNBC

As AI continues to take over more and more everyday tasks, there's an increasing amount of people looking to enjoy experiences with more of a human touch.

AI can undoubtedly be useful great at sifting through large amounts of data, and taking away the drudgery of reporting and admin work - but what about areas which require the senses?

So can AI perform in matters of taste, smell and touch?

tAIster steps up

Salesforce has been a leader in pushing forward AI-enabled experiences in recent years, with its wide range of AI agents helping customers from all around the world.

At its recent Dreamforce 2026, I took part in an AI sommelier session powered by an AI agent to see if the technology could be applied to wine tasting.

In a plush executive lounge away from the madness of Dreamforce's campgrounds, we were given three glasses of mystery wines, and then connected to an AI agent by scanning a QR code with a smartphone.

This hooked us up with tAIster, an AI agent which had been educated on around 400,000 different types of wines, including their taste, feel, aroma and other attributes.

Before tasting a wine, the agent asked us to use a few keywords to describe how it looked, and how grippy it was in the glass. We were then asked to describe the wine's aroma, and finally, the taste - with the aim of being as descriptive as we could, so the agent could guess which wine we had been given.

So did it work? I'm not a massive wine buff, but I tried to be as descriptive as possible, with the hope if giving the agent what it needed. Ultimately, it guessed my first two samples correctly, but got the third hopelessly wrong - guessing it was Veuve Cliquot champagne rather than Chardonnay due to me mentioning the glass had some small bubbles in.

So all in all, a fun example of what AI agents could do in previously unexpected areas - and although it's just a proof of concept right now, I don't think any real-world sommeliers will be quaking in their boots just yet.

• 85% of employees are being encouraged to use AI in the workplace
• Incredibly, 42% don’t know why AI is being used in the first place, raising questions about company strategies with the technology
• Some 112,000 people responded to the survey globally

“Why are we using AI?” That seems to be the view of almost half (48%) of employees, according to new research that looks at AI adoption in business. While a majority (85%) of workers are being encouraged to rely on AI for tasks, many don’t know why.

While employees certainly seem to feel the benefits of AI, citing benefits of increased productivity and motivation, the big question appears to surround their managers. The survey, by Culture Amp, points at a disconnect between corporate strategy around AI and how managers are (or are not) communicating this to their teams.

The survey also emphasizes that it is still early days in the AI revolution, and that the impact of the technology on workforces and individual roles is yet to become apparent.

Decisive insights

Culture Amp’s report, How Employees Really Feel About AI at Work, is described as a benchmark, and as the inaugaural publication looks set to chart the path of AI in the workplace over the coming years.

Its initial findings raise questions about how AI is really being introduced and used in businesses around the world. With 112,000 survey respondents questioned, situated within 123 businesses around the globe, the report offers one of the most decisive insights into business AI use yet.

The unfinished plan

Employees are telling us they understand the risks, they are using the tools, and they feel more productive," notes Amy Lavoie VP of People Science at Culture Amp. "That is not a workforce resisting change. That is a workforce that has done its part and is waiting on leadership to do theirs.”

The lack of decisive direction from management may not be entirely the fault of individual managers. In some cases, the corporate direction for AI use may be “in development” with leaders waiting on clearer instructions to communicate to their teams.

“We do not know with certainty which roles AI reshapes, which skills hold their value, or what a career path looks like three years out,” says Lavoie. “As a result, leaders may go quiet, because saying nothing feels safer than saying something that turns out to be wrong.”

So what is the answer? How do employees struggling to find the sense in using AI come to terms with the lack of direction concerning its use?

Lavoie concludes: “The most useful thing a leader can do right now is admit the plan is unfinished, and then keep talking anyway. Certainty is not what employees need from you right now. Candor is."

As AI becomes an ever-present in many businesses, most will now be looking to determine not just when AI will genuinely make a difference - as opposed to when it might just add cost and complexity.

So does every business process really need AI, or should companies be focusing on specific needs which will help them the most?

We spoke to Gregg Aldana, Senior Vice President, Head of Global Solutions Consulting at Appian, to find out more.

• There’s a growing assumption that if AI can be applied to a business process, it should be. Is that the wrong starting point? How should businesses decide where AI genuinely adds value - and where it’s simply adding complexity?

The wrong starting point is asking, ‘Where can we use AI?’ because that puts the technology before the business problem. Organisations should start by asking what they are actually trying to solve and where the biggest bottlenecks or inefficiencies sit.

That means looking closely at which decisions they are trying to improve, what data those decisions rely on and where human oversight needs to sit. That discovery should involve the people who understand the process and its challenges, from IT and business teams through to executive leadership.

Only then can businesses judge whether AI is genuinely going to make a difference. The test isn’t whether AI can do something. It’s whether it can make the process measurably better.

• How do you distinguish between a process that actually needs AI and one that can be handled more effectively with traditional automation, rules or workflow?

The key distinction is whether the task follows predictable rules and has a clearly defined outcome. If it does, traditional automation or business rules can often get you there faster and more cheaply. In those cases, adding AI may not improve the outcome and can introduce complexity that simply isn’t needed.

For example, an insurance company would use business rules to review and classify incoming online claims based on what the claimant selected from a drop-down list in a form. Automotive claims go to one department and home insurance claims go to another.

AI agents become more valuable when the work requires adaptive reasoning, complex context or handling variable inputs. In this case, an AI agent could analyse claims from web and mobile forms with structured data, as well as incoming emails with unstructured content. Based on keywords such as ‘motorway,’ ‘clash,’ and ‘passenger,’ a trained AI agent would deduce that the claim is probably about an automotive accident and route it to the appropriate department.

The mistake is assuming that because an AI agent can perform a task, it should. Businesses need to look at what each part of a process actually requires and use the technology that best fits that need, rather than replacing conventional automation with AI for the sake of it. A balanced portfolio approach is essential – use rules for high-volume, repeatable logic and agents for dynamic triage or investigation.

• What’s the hidden cost of putting AI into every process? Beyond the cost of the model itself, are businesses underestimating the costs around data, integration, monitoring, governance, security and managing exceptions?

One of the highest hidden costs lies in the operational infrastructure required around the AI model to make it work effectively and safely. The cost isn’t just the model. Agents need access to the right data and systems, but businesses also need monitoring, security and governance around what they can access and what actions they can take.

There is then the question of accountability. Organisations need to understand why an action was taken, trace what happened if something goes wrong and have a clear way of dealing with situations an agent cannot handle confidently. Without a unified platform to orchestrate data and enforce policy, the overhead of managing exceptions and audit trails will outpace the AI’s productivity gains.

That overhead can absolutely be worthwhile when AI is delivering meaningful value. But every additional agent introduces complexity, so businesses need to be confident the improvement to the process justifies it.

• Where do you think human judgement remains irreplaceable in enterprise processes - particularly when decisions affect customers, employees, finances or regulatory outcomes? And how should organisations decide when a human needs to remain “in the loop” rather than simply being notified after an AI agent has acted?

Human judgement remains critical where the cost or consequence of getting a decision wrong is high, particularly in regulated industries such as financial services, insurance, life sciences and the public sector. AI can accelerate areas such as client onboarding, insurance, underwriting or clinical trials, but there will still be decisions where the consequences mean a person needs to be involved.

That doesn’t mean a human has to approve every action an AI agent takes. The important thing is understanding the level of risk attached to the decision. Routine activities may proceed autonomously, while sensitive, unusual or more consequential tasks and decisions should be escalated for human review.

Those risk assessments and boundaries need to be designed into the process from the start. Organisations should know which decisions an agent is authorised to make on its own and which require human judgement before an action is taken.

• Is the more realistic future one where people, AI and conventional automation work together, rather than one where AI agents eventually take over entire end-to-end processes?

End-to-end automation isn't about giving an entire process to a single AI agent. The future is orchestration. A more realistic future is one where people, AI agents and conventional automation work together, because tasks vary within a process that require different skills.

Complex processes require a combination of predictable business rules, adaptive AI agents and human expertise. The goal is to build an integrated process where each component handles what it does best. The key is to understand which parts are best handled by an agent, where a simple rule or workflow will work better and where a person needs to be involved.

The aim isn’t to maximise the amount of AI being used. It’s to build the most effective process around the business outcome you want to achieve.

• Could the pursuit of autonomous AI actually make some business processes less efficient? For instance, if you introduce an AI agent into a process that was previously handled by a simple rule, are you potentially adding latency, uncertainty and governance overhead without creating much additional value?

Absolutely. Putting AI into the wrong part of a process can make it less efficient, not more. Replacing a deterministic rule with a probabilistic AI model introduces unnecessary latency, cost and unpredictability. If a task can already be completed quickly and reliably through a simple rule, introducing an AI agent may not materially improve the outcome.

That doesn’t mean businesses should be overly cautious about AI. It means being selective. Agents are incredibly valuable where a task requires unstructured reasoning, extensive research or adapting to changing information. But they shouldn’t replace conventional automation simply because AI is newer or more sophisticated.”

Sometimes the smartest AI decision is deciding you don’t need AI at all. Using them where a simple process rule already works reliably creates technical debt.

• What should a business ask itself before introducing AI into a process? Is it the business outcomes, the nature of the decision, the cost of failure and the availability of human expertise, rather than simply asking where AI can be inserted?

The most important question is very simple: ‘What problem are we trying to solve?’ Too often, organisations start by asking where they can use AI and then look for processes to apply it to. That puts the technology before the business need.

Instead, businesses should look at where their biggest challenges and bottlenecks really are. Which processes are taking too long? Where is there too much manual intervention? Which decisions could be improved, what data are they based on, and where does human oversight need to sit?

That discovery needs to happen upfront and involve the people who understand the process, from IT to business users to executive leadership. Identify where processes stall or manual handoffs create errors. Map out the required data and processes, regulatory requirements and risk parameters.

Ultimately, AI should be driven by business pull rather than technology push. Once you understand the problem and the outcome you want, you can decide whether AI is genuinely the best way to achieve it – or whether rules, automation or human judgement supported by AI would work better.

• How should companies think about risk when an AI system moves from making recommendations to actually taking action?

The move from recommending an action to actually taking one is where bounded autonomy becomes critical. The goal should be to give AI agents freedom to reason and act, but within clearly defined process guardrails and risk parameters.

That means being explicit about what an agent is allowed to do, what information it can access and when it needs to escalate to a person. An agent shouldn’t operate in isolation; it should sit within governed operational processes with relevant business rules and data security. All AI agent actions should be traceable and auditable within the governance framework.

Human oversight remains particularly important for exceptions, outliers and higher-risk decisions. Ultimately, businesses need to know what an agent did, why it did it and who is accountable for the outcome.

• Do you think businesses are at risk of measuring AI success by how many processes they’ve “AI-enabled”, rather than by whether those processes actually became better? What metrics should executives use instead?

The number of processes using AI tells you very little about whether an organisation is actually getting value from it. If anything, focusing on AI adoption as the metric risks encouraging exactly the wrong behaviour, putting AI into processes simply to say they have been AI-enabled.

Businesses should measure AI in the same way they would any other operational and technology investment: by the outcomes it delivers. Has it reduced cycle times? Lowered the cost of running a process? Improved the quality of decisions?

We’ve seen how significant those gains can be. Processes such as client onboarding for a bank that once took up to two weeks being reduced to just a few minutes. (That bank also automated 96% of onboarding processes whilst growing their new customers by 900%.) The cost of running an end-to-end process can fall tenfold or even more. That’s the test that matters. The goal isn’t to have AI everywhere, it’s to make the business work better.

• If you were advising a CEO who had been told they need an “AI strategy” for every part of their organisation, what would you tell them to stop doing, and what would you tell them to prioritise instead?

Stop mandating AI everywhere for the sake of adoption. I’d tell them to stop asking, ‘Where can we use AI?’ and start asking, ‘What problems are we trying to solve?’ Pressure to have an AI strategy everywhere can quickly become technology for technology’s sake.

Start with the biggest bottlenecks in the organisation. Which processes take too long? Where is there too much manual intervention? Which decisions could be improved? Identify your three highest-value operational bottlenecks and orchestrate the right mix of rules, agents and human judgement to resolve them.

Importantly, CEOs should prioritise business value over AI volume. A successful AI strategy isn’t one that puts an agent in every process; it’s one that makes those processes measurably better.

LaserPecker has been in the laser engraving and cutting sector for a while. Still, the LX2 is its first fully enclosed system of this type, and the first that feels genuinely suited to home and small-business use rather than a workshop with proper ventilation and space to spare.

The LX2 pairs the safety of a full enclosure with a modular head system, swapping between 20W, 40W, and 60W diode and 2W infrared without tools, enabling this machine to cover a far wider range of materials and objects than a fixed single-laser engraver. However, those machines are now becoming scarce.

In this test, I’ve looked at the LX2 with the 40W diode and 2W IR heads, connected directly to a MacBook Pro M1 Max, running LaserPecker Design Space in Beta, since the full release does not yet support the LX2.

LaserPecker LX2: Price & availability

The LaserPecker LX2 is available direct from the manufacturer in the US here, and in the UK here.

At time of review, prices start at $1599 (down from $1999) / £1349 (down from £1799) for the 20W standard bundle. The 40W Standard Bundle is $1799 / £1849.

LaserPecker LX2: Design

The LX2 is relatively heavy at 22.5kg, but despite its size, it is well built and easy enough to lift and move around in the workshop; it’s also lighter than the two other cutters I already have, and at 779.5 x 609.2 x 281.15mm in size, a standard, properly braced project desk is more than sufficient to hold it.

Like most fully enclosed machines, it has a lift-over top lid that lets you watch the cut or engraving in progress, and a handy front-panel opening that makes loading material easier and lets you use the LX2 as a front-loader if you don't have headroom above the machine. It is the only machine I have come across with this feature.

Round the back are all the ports and connectors, including the USB-C that connects to your computer, with both Mac and PC supported. One oddity worth knowing: the USB-C end of the cable goes into the LX2, and the USB-A end into your computer, so a Mac needs an adapter.

Alongside that are a USB-A port for a USB key, a security key port (which needs a key installed for the machine to run at all), the fire extinguisher port, Air Assist, and the smoke outlet.

The Air Assist itself is a surprise. It’s still external to the device, and while it is nicely designed, it sits alongside the machine rather than being integrated. It connects via its own cable, similar to USB-C but with a proprietary fit, and I found the connector rather delicate; a second cable was needed to complete the test after the original broke.

Inside is the 500 x 305mm work area, with markings on the base for camera alignment during calibration and each cut. There are also two cameras, with a live preview back to the software; accurate positioning is easy enough, as you’d expect on this level of machine.

Once again, there is no honeycomb grid included, something that is an increasingly common omission, and LaserPecker supplies only four thin slats to support material. Four is not enough. If you buy this machine, budget for at least four more, since without them you will be constantly repositioning the slats you have to support each new piece of material.

Otherwise, the design is aesthetically stunning, and the build quality is superb. There’s no doubt that this is a solid machine, but even on initial unboxing you can see a few areas that need a little more design attention.

LaserPecker LX2: Features

The feature list mirrors most other fully enclosed laser cutters at this price, and the build quality was obvious as soon as I lifted the machine out of its packaging. If the cutting accuracy holds up, this looks like a great option for a small business, and the modular heads add the flexibility to work across a huge range of materials and objects rather than being locked to one laser type.

The design is aesthetically stunning, and looks good on the workshop bench. The machine is big, but so is the work area it buys you. I like that it has front- and top-loading capabilities.

One of the big features is the ability to fit different modules with three diode options: 20W, 40W and 60W and a 2W IR for metal. This offers one of the most flexible solutions out there, so if you are running a business, this will be a great option.

Fitting a module is simple enough, though it does mean connecting a data cable and an air assist tube each time. I would still prefer these integrated into the head itself, but it is easy enough as it stands.

Once running, the engraving and cutting offer impressive speeds, and speed is one of the LX2’s headline features: 1,000mm/s with acceleration up to 10,000mm/s² which means that if used with some of the larger accessories, such as the optional conveyor, much larger projects can be tackled.

Finally, and this is one of the lead features, there are two internal positioning cameras that help with placement accuracy in the software; this positioning accuracy is essential when working with the 2W IR head, where the finished mark is harder to preview by eye.

LaserPecker LX2: Performance

Setup, calibration and connecting the software took around an hour in total, roughly half an hour unpacking and fitting the head, and another half hour on calibration and getting connected. That is in line with other enclosed engravers of this type I have looked at recently.

Fitting the head was easy enough, if not quite as smooth as some rivals, and plugging in the data cable and Air Assist tube alongside it was straightforward, though I would still rather see it integrated into the head itself. Running the vent to an external filter is worth doing and worth budgeting for, though LaserPecker has not yet listed a price.

Installing the software meant finding the Beta build specifically, since the standard release of LaserPecker Design Space does not yet support the LX2. The first run takes you through mandatory safety training before you can use the machine, then through a USB connection to start with. Calibration is more convoluted than rivals I have used.

LaserPecker Design Space is all well laid out, although there are sections where you can still see that this software is in Beta, such as the WiFi connection, re-running calibration and some stability issues. However, it’s extensive, and once you start to familiarise yourself with how it works, it does generally make sense.

Importing designs requires you to add SVG files as an example project and then open them, but line and fill information is retained and accessing those settings and adjusting power and speed is straight forwrad. I also liked the fact that there is a set of material presets, and the settings for these are close to spot on.

When you first get started with a material there is a test chart installed which will show you the effect at the different powers and speeds, this is well worth running on any new material so that you can fine tune the settings.

Some experimentation is still needed to get the perfect result for a given material and finish, but this is a starting point rather than a blank slate for every job, and it improved noticeably over a couple of weeks of regular use.

One issue that I did have during testing was with the Air Assist or to be more accurate the proprietary cable that looks very much like USB-C, and the one I received was delicate enough that the connector broke partway through the test.

That is why some of the wood samples from this review show scorching; results from earlier in testing, before the cable failed, are noticeably cleaner. Worth knowing if you are relying on Air Assist for consistent results.

Cutting 20mm basswood with multiple passes, with Air Assist working and the settings properly dialled in, produced results with little charring or residue, though getting there took time and experimentation rather than being right first time.

The 2W IR head fitted just as easily as the 40W diode, and its results were excellent; again, with no ready-made preset for every material, building the right settings is part of the process, and this is perfectly normal.

Testing the 40W module, it was able to produce clean and substantial cuts, and I tended to measure the material distance prior to each cut just to ensure the best performance.

LaserPecker LX2: Final verdict

The LX2 is a great machine with a few rough edges and odd decisions. Looking at the negatives, the first has to be the air assist cable to the machine; this is needed for automatic operation.

In the review I ended up just running a power cable directly to the Air Assist and bypassing the auto features. While breaking the cable partway through it was good to see that the Air Assist could be powered in a different way.

In use, the large workspace, high speed when needed, camera alignment and clean cuts definitely make this an appealing machine, but the software at present does hold it back; there are just small issues that need ironing out, such as the calibration process, the loading of files and some stability.

If you’re a serious maker or small business producing a genuine mix of cut wood, engraved products and customised metal items, where the modular approach makes sense at this price and with the flexibility of all those accessories, all makes this look like a great small business solution.

Should you buy the LaserPecker LX2

Buy it if...

Don't buy it if...

For more crafting tech, I've tested and reviewed all the best 3D printers and the best laser engravers.

• Boyagongdao's BG-5 robotic golden arowana was one of the most popular attractions at CIFTIS 2026, with staff saying it plans its own route around obstacles
• The 3 kg, 640 mm robot is rated to operate at 5 meters with a top speed of 0.6 m/s, even as endurance, cameras, and payload remain undisclosed
• The design is not new: the BG-5 has been on the company's site since 2023, and a near-identical arowana robot has been available on their site since 2021

A golden fish doing laps in a small tank at Beijing's Shougang Park has become one of the most shared clips from this month's China International Fair for Trade in Services (CIFTIS).

The BG-5, a robotic golden arowana made by Boyagongdao Marine Technology Group, effectively serves as an autonomous underwater surveillance drone.

The fish has gone viral on Reddit since, with footage of it reaching the top of r/Damnthatsinteresting since it was first posted.

Not a new invention, but one that has multiple potential uses

The BG-5 has also received coverage (in Chinese) from mainstream Chinese news sources, and while details are scarce on the product page (also in Chinese), its dimensions are listed as 640 by 204 by 90 mm, with 3 kg in tow.

It can travel at a maximum depth of 5 meters and maintains a top speed of 0.6 meters per second or approximately 2.16 km/h. Boyagongdao has not published endurance, payload, or camera specifics, and it has not made any battery-life figures public.

The BG-5 is not new, however; its product page carries images uploaded in August 2023, and the company used the BG-5 to illustrate a World Oceans Day post (in Chinese) in June 2023. The same description appears on a Chinese equipment marketplace listing (in Chinese) dated July 2024.

This isn't even the company's first arowana robot: its older Robosea website has product images dating to 2021 and describes the ROBOLAB-GL, a multi-jointed arowana robot with similar use cases, including education, research, entertainment, and marine biology.

It does, however, have an overwhelmingly military aspect, and the company's background confirms this. Boyagongdao has described itself as a military-civil fusion enterprise , pitching its bionic ROBO-SHARK as a quiet platform with a sound-absorbing shell for concealment and its ROBO-ROV for tasks including underwater combat.

A company representative, Zhang Yu, also said in a 2025 report its bionic technology "can also be used in military and national defense fields."

The irony here is that it also doubles as an excellent anti-poaching tool: the golden arowana is a color variety of the Asian arowana, a species left endangered by over-harvesting for the aquarium trade, and it has fishing restrictions in place.

A drone-like surveillance fish lookalike could make fishermen even more nervous about attempting to catch any of the endangered species, even as the relatively suspicious exclusion of hardware internals, capabilities, and endurance/performance figures makes one consider that it is aiming to cater to a single primary customer, despite the company's insistence on multiple use cases for the BG-5.

• Rune wants unused solar electricity powering GPUs instead of going to waste
• RELIC connects computing equipment directly to functioning solar generation sites
• The system operates without grid connections or conventional data center construction

A San Francisco company named Rune has introduced a modular compute unit built to operate directly on unused solar power.

Called RELIC, the equipment attaches to functioning solar installations without needing any connection to the electrical grid or new construction work.

The launch came alongside a $40 million Series A financing round for Rune, lifting the firm's overall capital raised to $53.5 million total.

Skipping the grid bottleneck

Solar facilities routinely waste as much as 20% of the electricity they generate, adding up to more than 50 TWh yearly nationwide.

RELIC pulls that idle current straight from the source, avoiding metering charges, utility fees, and the grid limitations slowing AI growth.

"Every solar plant is a latent data center. The power is already there, sitting idle while AI labs wait years for grid connections that may never come," said William Layden, Co-Founder and CEO of Rune.

Rune states that RELIC can be installed in about 60 minutes and deliver working GPU capacity within six weeks of a contract.

That timeline contrasts sharply with conventional data center construction projects, which frequently stretch across several years before reaching full operational status.

The company reports that RELIC lowers non-compute infrastructure spending by 85%, saving roughly $620 million across a 100 MW deployment.

RELIC operates natively on direct current — solar's original output form — sidestepping energy losses that occur when converting power to alternating current.

It needs no extensive site preparation, leaves no visible trace across the landscape, and operates entirely without consuming any water.

Rune's initial working installation sits at a 200 MW solar facility located in Texas, mounted on existing infrastructure without any modifications.

Addressing a system under strain

Traditional data center construction cannot keep pace with the surging demand pouring in from artificial intelligence developers and infrastructure buyers everywhere.

Rune's approach addresses that shortfall by placing compute equipment directly beside existing renewable generation instead of pursuing new construction projects.

“Demand for AI infrastructure is growing faster than it can be delivered. Rune deploys compute directly behind the meter at operating solar farms, converting clean power into rapidly scalable AI capacity,” said Santo Politi, Founder and General Partner of Spark Capital.

“Every renewable asset in operation becomes a potential deployment site. Rune is the fastest path to new capacity we have seen."

Many data centers currently running were adapted from designs built for earlier computing needs rather than for artificial intelligence workloads specifically.

“AI’s power constraint isn’t generation, it’s resource allocation,” said Varun Palivela, Co-Founder and CTO of Rune.

“The industry is retrofitting data centers designed for a different era rather than rethinking the architecture itself. We built an entirely new technology stack from the ground up, coupling compute directly to clean generation so AI can scale here on Earth.”

The approach leaves Rune testing whether unused solar capacity can support AI computing at the speed required by growing demand.

• Samsung is shifting additional DDR5 and SSD production to outside manufacturers
• The company needs internal factory space for advanced HBM production
• DDR5 module assembly remains simpler than advanced HBM packaging processes

Samsung Electronics is shifting all additional production of conventional memory modules onto outsourced partners going forward.

The company is directing capacity growth for DDR5 modules and SSDs toward external firms, reserving its in-house capacity for the more advanced HBM packaging process.

Industry sources say this reflects Samsung's mounting need to use scarce back-end capacity more efficiently.

A deliberate pivot toward outsourced capacity

“Samsung Electronics lacks space to expand existing back-end production lines needed to manufacture semiconductors for artificial intelligence (AI), so it is reallocating space and equipment at packaging plants in Cheonan and Onyang to advanced packaging lines, including HBM,” a person familiar with the matter said.

“The company has decided to handle most increases in conventional memory module production through outsourcing rather than expanding its own capacity.”

Samsung has reportedly pressed its outsourced semiconductor assembly and test partners to expand capacity for DDR5 modules and SSDs.

The company has even gone a step further by asking partners to accelerate capacity expansions that were already part of its existing plans.

Several partners are already scaling up in response, including Dreamtech, Hanyang Digitech, and SFA Semicon.

Dreamtech began mass producing DDR5 modules in India last November and approved further equipment investment in June.

Its Noida facility, previously used for smartphone circuit board assembly, will eventually reach an annual capacity of over 50 million units.

Hanyang Digitech has invested more than 31.5 billion won in 2026 so far to automate its existing memory module plant located in Vietnam.

SFA Semicon is relocating DDR5 testing and assembly equipment from Samsung's Onyang campus to a new site in the Philippines.

That transition begins in November, with a second phase following during the second quarter of 2027.

Limited space drives the broader manufacturing shift

Samsung's own capacity constraints stem partly from a new HBM plant under construction at its Onyang campus, valued at 6 trillion won.

That facility will take multiple years to finish, leaving little room for conventional module expansion in the meantime.

A separate $1.5 billion back-end processing plant is also under construction in Thai Nguyen Province of northern Vietnam.

That facility will handle testing for older memory types, including DDR4, low-power LPDDR4, NAND flash, and universal flash storage.

DDR5 modules require mounting prepackaged DRAM and NAND chips onto circuit boards using surface-mount technology.

That process remains considerably less complex than advanced packaging methods used for HBM, making outsourcing comparatively straightforward for partners.

Micron previously pursued a similar route, shifting conventional memory production externally while concentrating internal resources on higher-margin products.

Whether SanDisk eventually follows a comparable path remains uncertain given how differently each company's manufacturing footprint and product mix are currently structured.

Via The Elec