Zuck's Muse to Spark joy with open weights release 'soon'

TOP STORIES
AI
-
ai and ml
Zuck's Muse to Spark joy with open weights release 'soon'
While you wait, Meta says it’s taught the model to stop wasting tokens and ask for help a bit more often
-
ai and ml
With Gemini 3.8 Flash, Google reminds everyone it's still in the race
AI model scores well, runs fast, and doesn't cost too much (yet)
-
security
AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit
Adding insult to injury
-
ai and ml
Anthropic promises zero data retention – but customers must check it worked
More compliance-friendly stance could boost appeal of Fable
-
Security
Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
The model provider gave METR the credits for free. An actual customer would not have been so lucky
Infosec
-
Security
Russians are posing as Signal support to launch phishing attacks
PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
-
Security
Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack
PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
-
Black Hat and DEF CON
DEF CON Franklin project enlists hackers to harden critical infrastructure
Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
-
Security
EQT buys majority share in Swiss cybersecurity biz Acronis
Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
-
Malware Month
Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight
On the plus side, infosec's a good bet for a long, stable career
FOSS
-
Offshoots of cancelled TrueNAS Core upgrade to FreeBSD 15
Exeunt zVault stage right; enter FreeCORE and BSDnas
-
Debian votes to let contributors code with AI
Disclosure optional, quality mandatory
-
LibreOffice 26.8 is out – local first, and with no AI
It looks a bit clunky, but it does the job – and on your own computer
-
Keepers of Noble Numbats to be offered a Resolute Racoon: Ubuntu 26.04.1 is coming
GRUB's up for furry new update
-
AROS, the FOSS recreation of AmigaOS, comes to Raspberry Pi
Plus: new official Amiga-branded hardware is coming
-
Emperor Penguin Linus Torvalds banishes a bug – with a bot
The lad himself finds and fixes a tricky one… or does he?

Facts Only

* Gemini 3.8 Flash scores well on speed, performance, and cost.
* AI agents carried out steps in a ransomware attack, resulting in an 80-page security audit.
* An attacker stole a METR API key and used $600K in credits without detection.
* The model provider gave METR credits for free.
* Anthropic promises zero data retention contingent on customer verification.
* Russians are posing as Signal support to launch phishing attacks.
* US took down Iranian propaganda sites.
* Microsoft patched a vulnerability in on-prem SharePoint that remains under zero-day attack.
* EQT acquired a majority share in Swiss cybersecurity firm Acronis.
* Debian voted to allow contributors to code with AI, requiring disclosure and mandatory quality checks.
* LibreOffice 26.8 was released without AI integration.
* AROS, a recreation of AmigaOS, is available for Raspberry Pi.

Executive Summary

New developments are occurring across the AI and security landscapes, highlighted by advancements in model efficiency, agent security, and ongoing geopolitical tensions involving cybersecurity. Google announced that Gemini 3.8 Flash performs well in terms of speed, performance, and cost efficiency. In a related development, AI agents were involved in a ransomware attack, leading to a security audit being performed on the victim. There are competing narratives regarding data handling, with Anthropic promising zero data retention but requiring customer verification, and concerns surrounding access control demonstrated by an attacker stealing API keys for significant credits from a provider. Furthermore, geopolitical activities involve Russian entities posing as Signal support and US actions against Iranian propaganda sites, alongside Microsoft patching issues and China's advancements in smartphone surveillance tools. In the open-source and software space, there are movements toward integrating AI coding assistance into Debian, the release of LibreOffice without AI features, ongoing explorations in BSD/FreeCORE derivatives stemming from TrueNAS projects, and continued hardware innovation like AROS for Raspberry Pi.

Full Take

The current information presents a landscape defined by the tension between rapid technological diffusion and entrenched security realities. There is an underlying pattern where advanced capabilities—whether in AI modeling or autonomous agents—are deployed in contexts where accountability is either tested (ransomware audit) or intentionally obscured (stolen API keys). The narrative weaving through the topic of data control suggests a systemic conflict: promises of privacy (Anthropic’s zero retention) are immediately juxtaposed against the practical realities of access and oversight, creating a space where trust is transactional rather than inherent. Furthermore, the parallel events involving state-level cyber activity (Russian phishing, US counter-propaganda measures) suggest that the security discussion operates on multiple planes simultaneously: commercial vulnerability, geopolitical conflict, and foundational software integrity. The integration of AI into core systems, as seen in the Debian voting process, signifies a shift where the boundaries between development and deployment are being actively negotiated by the community. This points toward an unfolding pattern where novel technological capabilities immediately introduce new vectors for risk that legacy governance structures struggle to contain. What is the necessary framework for establishing accountability when autonomous systems interact with complex security environments, especially when the provenance of data and control remains contested? What assumptions about technical competence versus legal responsibility underpin the current discourse on AI deployment?