ATLAS: Mapping AI's impact on work and daily lifeGoogle's ATLAS maps roughly 15 million de-identified Gemini interactions from two weeks in April 2026 onto "800 occupations, 4000 tasks, 300 household activities, 150 countries." The headline is reassuring by design: AI shows up in 68% of occupations but only about 21% of a typical job's tasks, and "fewer than 10%" of work interactions fully automate a task. Read the fine print. That automation number is user intent, not outcome, the sample excludes Workspace, AI Overviews, and enterprise Gemini, and the study measures activity on Google products, not employment, wages, or hours. It's a usage census from the vendor, dressed as a labor study.2026-10-26 ai google workforce data report
AI and the Fall? of the Creative ClassPolitano counts "more than 200k jobs" lost in US creative industries over four years, with movie and TV "losing more than 100k jobs, nearly one-third of the sector's total," and "all subsectors of the digital arts industry are losing jobs, while in-person entertainment is still growing." The honest part is the hedge: proving AI's share is "extremely difficult" because studios won't disclose AI use, partly to protect their copyrights, and Hollywood consolidation, offshoring, and the creator-economy shift were already biting. His analogy is newspapers, whose payrolls are "down nearly 85% and still dropping," offered as a worst case, not a forecast.2026-10-26 ai workforce hollywood media labor-economics
FRED: Generative AI Adoption Rate for Work, Employed AdultsThe St. Louis Fed's Real-Time Population Survey tracker puts generative AI use at work at 40.5% of employed US adults aged 18 to 64 as of Q3 2026, from a single survey question: "Do you use Generative AI for your job?" Quarterly, not seasonally adjusted, and self-reported, so it measures touching the tools, not dependence on them. It's the cleanest public series for the adoption curve, and a useful counterweight to vendor-reported usage numbers.2026-10-26 ai data workforce research report
Quest Diagnostics discloses breach of its Quanum lab-ordering systemQuest says 'some patient data within Quanum LSM was accessed.' LSM is the system clinicians use to order tests and view results, and health and personal information may be involved. Quest says it has 'remediated' the incident but gives no count of affected patients, no breach window and no point of entry. This time it was Quest's own system. The 2019 breach that exposed about 11.9 million Quest patients went through a billing vendor, AMCA.2026-10-24 health privacy security data breach
Apple WWDC26: Build AI-powered scripts with the fm CLI and Python SDKApple's on-device Foundation Models become scriptable: an fm command-line tool preinstalled in macOS 27, and a Python SDK for Apple Silicon Macs. The default model runs locally. The larger Private Cloud Compute model is one flag away, 'with usage limits' the session never quantifies. The demos (sorting drafts from finals, scoring grocery-cart prompts in Jupyter) show the pitch: local automation and eval pipelines, not frontier work.2026-10-24 apple ai llm python tool
How does Fable 5.1 hide messages in images?Told to hide a message in an SVG, with no scheme agreed, Fable 5.1 invented its own. Most often it mapped each letter to the height of an element: skyline buildings, grass blades. A fresh Fable instance shown only the screenshot recovered 78% of 50 messages, and GPT-6 Astra decoded Fable's images at 88%, so the code reads across models. The hiding was instructed, not spontaneous, and for now the decoder's tool calls give it away. The authors call it 'a precursor to steganography in images.'2026-10-24 ai safety research anthropic steganography
Uncommon Web: a field guide to stylistically unusual web libraries'425 web libraries and components with a strong point of view: dithered shaders, text laid out without the DOM, Windows 98 as a stylesheet, hand-drawn charts, live-coded synths.' Every card runs the real library live, with zero CDN requests. It's a side project from Teknium, cofounder of Nous Research. It's a catalogue, not a review, so it says nothing about which libraries are maintained.2026-10-24 design code css open-source collection
Settling for Less: Warren report on Trump antitrust settlementsSen. Elizabeth Warren's report argues that DOJ and the FTC waved through large mergers over career-staff objections. It also says they settled cases for small fines and behavioral promises, with no admission of wrongdoing. Its pay-to-play charge rests on merger beneficiaries giving millions to Trump political committees. That shows a pattern in the timing, not proof of a trade. The best-documented case is HPE-Juniper, where senior officials reportedly overruled antitrust chief Gail Slater.2026-10-24 politics government legal report antitrust
FreeDNS (afraid.org)Free dynamic DNS and shared subdomains, run by one person, Joshua Anderson, since 2001. The homepage counts 7.16 million members and 13.8 million DNS records, funded by 5,593 premium accounts at $5 a month. The shared-domain pool that makes it handy for home servers has also made it a long-standing abuse vector.2026-10-24 infrastructure internet networks free tool
Black OctoberA self-described tech optimist, two days in: 'We're 48 hours into what is being called Black October.' The documented core is real. CNBC reports that Wiz and Calif found major PHP flaws in August using OpenAI and Google models, and the scramble started when the findings leaked online. Security press says many of the attacks had been running for months, so the surge is partly a wave of disclosures. The essay's claims of 'fast takeoff' and a Chinese plan are unsourced.2026-10-24 ai security infosec open-weights
CDC FluView: Week 41 (ending Oct. 17, 2026)CDC's summary says flu activity is 'increasing in many parts of the country but remains low,' yet hospitalizations hit 'the highest weekly rate for Week 41 since the 2010-2011 season.' Clinical-lab positivity is 5.7%, while outpatient flu-like illness is 2.2%, under the 2.9% baseline. The signal is in labs and hospitals, not clinics. Nearly all subtyped A viruses are H1N1, a subclade CDC says is 'dividing into different groups.' Also in the report: one human H5N1 case, and eight H1N1 viruses with reduced susceptibility to oseltamivir (Tamiflu).2026-10-24 health science government data
France's Supermarket Fridges Were Vulnerable Online for MonthsOn the night of Oct 11–12, attackers switched refrigeration controllers in hundreds of French supermarkets into defrost mode. Some units hit 50°C and some caught fire. IPinfo's internet scans found that a week earlier, "France had more exposed fridge dashboards than the rest of the world combined": 1,331 open Danfoss dashboards, against 1,197 across 72 other countries. 1,019 of those were already at the same address in March. Patching wasn't the difference ("85% ran software with known security flaws," about the same as elsewhere). The difference was that "anyone who typed in the address could open it." IPinfo itself says reachable isn't the same as breached, and "nobody has said who did it or how they got in."2026-10-20 security infosec infrastructure data
Funding for Artists – NYC Department of Cultural AffairsNYC is "increasing the size of city-funded grants for artists, from a previous maximum of $5,000 to up to $10,000," the first raise in nearly two decades. The city doesn't pay artists directly. The money is re-granted through five borough partners, each with its own rules and deadlines: Bronx Council on the Arts (Oct 30), Lower Manhattan Cultural Council (Nov 12), NYFA's Queens Arts Fund (Nov 17), and Staten Island Arts (opens in November). Brooklyn Arts Council's deadline was Oct 11 and has already passed.2026-10-20 nyc artists art government
US Supreme Court rejects music labels' challenge to copyright termination rulingFour justices recused without explanation. That left the Court one short of a quorum, so the 5th Circuit's ruling stands by default. Songwriter Cyril Vetter used US termination rights to take back "Double Shot (Of My Baby's Love)" and is now "sole owner of all right, title and interest throughout the world." BMG, Sony, Universal and Warner, which bought into the song after losing in the appeals court, say the ruling "unsettled 50 years of industry practice." It sets no national precedent, but it gives artists in the 5th Circuit a path to reclaim foreign rights as well as US ones.2026-10-19 copyright music legal artists rights
Fondazione Giulio e Anna PaoliniFounded in 2004 by Giulio Paolini and his wife Anna Piva, the Turin foundation holds the artist’s archives from the early 1960s on (“catalogues, books, periodicals, press releases, invitations, photographs, letters”) and publishes the catalogue raisonné of every work from 1960 to the present as open access online, after the print edition stopped at two volumes in 2008. Paolini, born in Genoa in 1940 and a fixture of Arte Povera and four Documentas, is currently in a Saffo group show at the Colosseum’s Uccelliere Farnesiane through January 2027.2026-10-18 art artists archive exhibition italy
Awesome REA CasesA curated collection of REA and AI-assisted reverse engineering cases, projects, and ideas, updated every four hours: 401 entries across games and preservation, hardware and interoperability, applications and clients, and algorithm recovery. REA (github.com/morluto/rea) “connects coding agents to local reverse-engineering tools through CLI and MCP.” Worth noting the fine print: “Based on author and project reports; not independently reproduced here.”2026-10-17 agents reverse-engineering github list security
It’s Complicated: Facebook’s History of Tracking YouA 2014 timeline that reads like a prequel. For years Facebook insisted the Like button wasn’t for tracking (“we don’t use them for tracking and they’re not intended for tracking,” per its CTO in 2011), then in June 2014 told Ad Age it would start tracking users across the web through those same widgets, with no opt-out in privacy settings. Every denial-then-reversal pattern in today’s ad-tech stories was already here.2026-10-17 meta tracking privacy advertising archive
Furifont: furigana built into the fontA Japanese font that shows furigana by itself. The text stays plain: no <ruby> markup, no JavaScript, no plugin. Compiled from Source Han Sans or Serif, a build step reads a dictionary of thousands of words and draws the reading into new glyphs as OpenType ligatures, so 今日 becomes one glyph with きょう above it. The catch is structural: “a font sees one run of kanji at a time, not the sentence around it,” so readings can be wrong.2026-10-17 design language open-source tool typography
AI Battles Boil Over in Frankfurt: “Walk Toward The Fire”Publishers are embracing AI. Authors are being warned about it. … Why is AI an exciting business opportunity when publishers use it, but a potential ethical scandal when authors do? … What cannot be justified is demanding accountability from authors without demonstrating it inside publishing companies.2026-10-17 publishing ai books authorship ethics
Online ads weaponised to deliver ‘zero-click’ spyware, researchers sayCitizen Lab says Israeli ad agency Discover-Tech runs a platform called Controlium that lets clients “mass-profile and deanonymise” internet users through ordinary programmatic ads, then hands selected targets to third-party spyware firms for zero-click infection. Dozens of devices at Al Jazeera were allegedly compromised, and Confiant found the ads served inside government, UN, Nato and ICC networks. Bill Marczak: “There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action.”2026-10-17 surveillance advertising spyware security privacy
XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six DaysXBOW's headline says it built the Chrome chain, but the post credits four named researchers who "set the strategy, chose where to look, checked the agents' work" while GPT-5.6 Sol searched source, built proofs of concept and "wrote the earliest drafts of the exploit." The economics are the real story: $40,000 in compute over six days for a chain that earned a $250,000 Google bounty. That six-day window leaves out earlier prep, and the first chain was disqualified because Google already knew one of the bugs. The claim that each bug "could be found by agents working on their own" within a year is a forecast, not a result.2026-10-15 security ai agents google openai
AI models may be capable of self-replicating without access to a datacenterAnthropic's Frontier Red Team ran Gemma4-26B-A4B across 15 off-brand Android TV boxes (about $55 each) at 0.39 tokens per second, and a 9B model got inference running on 8 of 9 hardware types. The end-to-end result is narrower than the headline: only GLM-5.2 spread across a fleet of emulated Android nodes, through an ADB port with no authentication, while its own model ran on a separate server and it stood up Llama3.1-8B rather than itself. The authors call that "an upper bound on real-world success," and the "months away" timing comes from a trend line on a general capability index they call "only a proxy metric." The buried findings are stranger: notes passed between generations raised setup success from 45% to as high as 84%, while advice from Opus 4.8 didn't measurably help because small models "tend to not know the right questions to ask." Every replicator tested is open-weight. The closed-weight "frontier replicator" case is named and set aside.2026-10-13 ai safety security smart-tv anthropic
Solar Panels That Plug Into Your Wall Are About to Be EverywherePlug-in "balcony" solar is now legal in ten states, starting with Utah in spring 2025 and most recently California, and the pitch is solar for renters: one to three panels and an inverter plugged into a wall outlet. Germany already has more than a million units installed. The "about to be everywhere" headline rests on Joshua Pearce, who has championed plug-in solar for a decade, and the $13 billion a year in national savings comes from his own 2017 paper. The household numbers are smaller. A Utah couple saved "nearly $100 total" in five months, and a Colorado renter's estimate of more than $300 since August from one panel is more than a single panel's output would be worth in a full year at Colorado rates. On safety, a UK government test found no direct electrical hazard, though some units were slow to trip the breaker under stress.2026-10-13 energy climate environment legislation
Kevin Kelly's 2016 AI Predictions, 10 Years LaterTaylor Troesh sets Kevin Kelly's 2016 book The Inevitable against 2026 and mostly lets the excerpts speak. The hits are structural: an "oligarchy of two or three large, general-purpose cloud-based commercial intelligences," AI as a utility "almost invisible except when it blinks off," and asking the cloud "in conversational tones, any question at all." The sharpest line is the mechanism: "Rather than use AI to make its search better, Google is using search to make its AI better." The miss teaches as much: Kelly expected "nerdly narrow, supersmart specialists" to make up 99 percent of the AI we'd use, and general models won instead. His hope that AI would be "not just cheap, but free," like the web's commons, sits uneasily beside the oligarchy he predicted.2026-10-13 ai books google search open-weights
'Unprecedented' cyberattack cripples supermarket fridges across Europe as hackers activate automatic defrostingThe headline fuses two incidents the article itself says may be unrelated. In France, attackers reportedly got into Danfoss refrigeration controls used by Intermarché, Leclerc and Coopérative U and turned a protective function into the weapon: defrost, normally two hours a day, was set to run "forced" and "continuous" at 50°C overnight. Around 150 Intermarché stores are reportedly affected, two Alsace stores alone report €270,000 in losses, and Metro stores and independent butchers run the same controllers. The "unprecedented" comes from Coopérative U's president, not investigators. The Dutch Albert Heijn outage is a separate "cybersecurity incident" with a preventive shutdown, and NOS reports shelf labels showing last week's promo prices, not labels that were "compromised."2026-10-12 security infrastructure hardware food eu
Fingerprints are the new cookiesThe page fingerprints you while you read it. It hashes audio, WebGL, canvas, time zone and core count into a nickname that survives a refresh, cleared cookies and a VPN, because "a VPN changes your IP location, but not your time zone." The history is the point: Google pledged in 2020 to kill third-party cookies, kept them, and in 2025 began allowing device fingerprinting in its ad products. A fingerprint "doesn't need to be truly, globally unique - it just needs to be unique enough to tell people apart in your sample size." The fix has to live in the browser engine (Brave, Tor, Mullvad), not an extension, since "privacy extensions make you more unique, since fewer people have them." The author notes his demo is a simple hash that changes when any one input changes, while commercial trackers keep identifying you through such changes.2026-10-12 privacy fingerprinting tracking advertising google
Yandex Cloud status: Vladimir data center down after drone strikeYandex Cloud's own status board is the primary record here: "As a result of the UAV attack, the infrastructure of Yandex's data center in Vladimir was damaged. The data center's operation has been completely suspended." The buried detail is what the provider tells its own customers. It says "we consider the remaining resource configuration to be unstable," has suspended quotas for new resources, and keeps recommending "alternative platforms" for hosting and redundancy. Press reports say Vladimir is the third Yandex site hit in four days, after Sasovo and Kaluga. The board's entry the night Sasovo was hit reads only "Power failure in the ru-central-b availability zone," marked resolved with no end time. 82 services are listed as affected, from Compute to the YandexGPT API.2026-10-12 infrastructure datacenters war cloud
California's New Workplace Surveillance LawCalifornia's AB 1883 bars employers from using AI surveillance tools "capable of recognizing, or making inferences or predictions about, an individual's emotional state, or that collect neural data," which puts emotion recognition and attention-tracking headsets "off-limits in California workplaces." The ban is narrower than the headline: it covers only those two uses, penalties are $500 per violation, and enforcement sits with the Labor Commissioner and public prosecutors. Aircraft developers and national security, military, space and defense employers are exempt where surveillance is "reasonably necessary" for federal compliance. The analysis is by Jackson Lewis, a firm that advises employers.2026-10-04 surveillance legislation workforce neurotechnology privacy
SCM (Screen Memories): local AI search for every photo and video frame on macOSAn Electron app that indexes any folder of photos and videos and searches it five ways: by meaning (CLIP), by scene inside a video, by on-screen text (Tesseract OCR), by "exact spoken words" (Whisper), and through an opt-in local chat model that answers with citations. The pitch is "no accounts, no cloud, no uploads," with weights downloaded once and everything offline after. Worth knowing before installing: the repo is one day old with 22 stars, and the Homebrew cask "clears the macOS quarantine flag automatically," which skips Gatekeeper's check.2026-10-04 tool open-source search video photography
On Surveillance State JittersAt a Wainscott panel on the Flock license plate readers now in East Hampton, Michelle Dahl of the Surveillance Technology Oversight Project: "The infrastructure, when it's built, is incredibly hard to take down. That's why it's really important to get on the front end of this and keep these technologies from being entrenched in the first place." Journalist Ali Winston said two decades of studies of cameras and A.L.P.R.s "show no discernible impact on violent crime, and a slight decrease in property crime," and that surveillance "has the logic of cancer. There's no natural limit, it's metastatic."2026-10-04 surveillance flock alpr policing local
MIT AI Risk RepositoryA "living database" of 1700+ AI risks extracted from 74 existing frameworks, each linked back to its source paper with supporting quotes and page numbers. Two taxonomies organize it: a causal one that classifies "how, when, and why" a risk occurs (human or AI, intentional or not, before or after deployment), and a domain one with 7 domains and 24 subdomains. What it shows is less the risks themselves than how fragmented the field's own risk frameworks are. It catalogs what others have claimed, and does not rank risks by likelihood or severity.2026-10-04 ai safety harms research reference
The AI Enforcement Gap: Delinea 2026 Identity Security Report, Fall EditionDelinea surveyed 2,254 IT and security leaders and 2,250 employees and found the gap is enforcement, not policy: 99.7% of organizations have a formal AI data-access policy, yet 87% say an AI tool exceeded its intended scope in the past year, and only 36% can always trace a sensitive AI access back to a named human. The buried detail is who breaks the rules: 81% of C-level executives bypass AI approval "always or regularly" versus 33% of intermediate staff. Half of organizations let agents inherit the launching user's permissions, so "years of accumulated access can suddenly be exercised autonomously." Caveat: Delinea sells just-in-time authorization, and the recommendations land squarely on its product.2026-10-04 agents security identity report pdf
Bicameral Labs: a nonprofit to "solve consciousness scientifically"Erik Hoel's new nonprofit, pitched as "LIGO for gravitational waves or the Human Genome Project" for consciousness. The diagnosis is sharper than the plan: "the past decades have produced hundreds of neuroscientific theories of consciousness, empirical testing has ruled out none of them," so the field "does not yet create falsifiable theories." Bicameral's answer is "meta-scientific no-go theorems" and experiments built "not to promote or test individual theories, but to narrow down the state space." Hoel predicts "a consciousness revolution in the 2030s or even earlier." What's on the page so far: one founder, a Cambridge address, and a call for scientists and donors.2026-10-03 science brain mind research ai
Holes (Stanford Encyclopedia of Philosophy)"Holes appear to be immaterial: every hole has a material 'host' (the stuff around it, such as the edible part of a donut) and it may have a material 'guest' (such as the liquid filling a cavity), but the hole itself does not seem to be made of matter. Indeed, holes seem to be made of nothing, if anything is." Then the card: "Take a card and punch a hole in it. You have made one hole. Now punch again next to it. Have you made another hole?... what prevents us from saying that we still have one hole, though a hole that comes in two disconnected parts? After all, material objects can be disconnected: a bikini, your copy of the Recherche, a token of the lowercase letter 'i'."2026-10-03 thinking reference knowledge language
stillwet: paintings by AI models, run through a simulation of oil paintAI models paint by writing code against a simulated oil-paint canvas with bristle brushes, wet paint, drying and glazes. "No image generator." Most work after Caspar David Friedrich "from written research alone; they never see a picture of his work." The site's own observations are the find: given a free subject, Claude Opus chose a jug with lemons six times out of six, two painters six hours apart with no shared context both chose a Baltic shore with a woman at the water, fishing poles, a boulder and a ship, and 31 of 65 titled paintings contain Evening, Dusk, Twilight or Sunset "though Friedrich also painted daylight." Two round-19 canvases are unfinished because the painter ran out of API credits.2026-10-03 art ai llm code artists
Audionaut: open-source multitrack audio editor that AI agents can drive over MCP"A free, open-source multitrack audio editor that AI agents can drive over MCP." JUCE/C++, cross-platform, with a headless audionaut-cli that "gives scripts, CI and AI agents headless access" to projects, plus stem separation via demucs.cpp. The interesting part is the shape, not the scale (one maintainer, 55 stars): a DAW-lite built so the agent is a first-class user, with the same cut/arrange/export verbs exposed to Claude as to the person at the keyboard. GPL v3 with a commercial dual license.2026-10-02 audio open-source agents tool github
How American Political Campaigns Are Using AI—and What They're Spending on the ToolsFEC filings show "at least $17m in disclosed spending on AI technology vendors across 523 federal candidates." The money isn't going to deepfakes: ElevenLabs and Midjourney total about $3,000 combined. It goes to AI texting (Daisychain for Democrats, Parscale's Campaign Nucleus for Republicans) and ChatGPT/Claude subscriptions, "rarely both," with Anthropic skewing Democratic "nearly two-to-one." The real finding is the hole: "at least 164 political ads in this cycle have included AI-generated media, supported by at least $80m in ad spending," none of it in candidate disclosures, because consultants, media firms and PACs "aren't required to disclose detailed expenditure reports, and are very likely where the bulk of campaign AI usage is happening."2026-10-02 ai politics democracy advertising usa
Is sandboxing sufficient to contain rogue agents?Matthew Green on why the sandbox isn't the hard part. Agents "will do what they're told by whoever manages to get text in front of them," so the threat isn't a misaligned escapee but "a swarm of perfectly amenable agents that never leave their sandboxes, each doing exactly what it's told to do, by a human being who wasn't supposed to be giving it orders." Watching for that means a "warden" model reading all the agent's traffic, which just relocates the problem: "all you've done is to change the nature of the security problem."2026-10-02 ai agents security safety cryptography
'If you can't hold it, you don't own it': why media fans want to escape algorithms with CDs, DVDs and vinyl"HBO removed about 200 episodes of Sesame Street in 2022, so we realised any media we wanted to continue to watch or listen to could be gone, and we'd have no way to get it back. As the saying goes, if you can't hold it, you don't own it." Another reader: "I enjoy watching DVDs and listening to CDs because nobody sees what I'm doing and they're not analysing it... I also feel less controlled." And: "No algorithm is as creative as a well-stocked human brain alive to its actual surroundings."2026-10-02 media culture music privacy archive
DeepSeek HarnessDeepSeek's open-source agent runtime, MIT-licensed, "everything-is-a-plugin": model adapters, tool registries, sandboxing, and UI all load as swappable extensions over an append-only event log you can resume, fork, and replay. The config is YAML, so you can point it at a local model instead of DeepSeek's API. That's the real move: Claude Code and Codex sell the harness as the moat, and DeepSeek is giving the harness away to commoditize it. Still a "developer preview" with no security audit and "THERE WILL BE COMPATIBILITY-BREAKING CHANGES."2026-10-02 ai agents open-source deepseek code
DraftKings Is Using AI to Supercharge the Harms of Online Behavioral Advertising"DraftKings is using its customers' betting records to train a machine learning model to find losing gamblers." Promotions then re-engage them, "capitalizing on their vulnerability for profit." EFF argues AI "supercharges the harms of online behavioral advertising," and notes that ad-targeting data already flows to insurers, banks, and law enforcement, including ICE. Its ask is a full ban on behavioral ads, not just limits on third-party sharing.2026-09-29 advertising ai privacy harms betting
Muse Looks Cute, but Looks Are Deceiving (Daring Fireball)Jason Aten, quoted by Gruber: "If your primary audience does not understand what Full Disk Access means, you should not surprise them with 'I'm reading your text messages.'" Gruber: "If you buy a power saw that can cut your fingers off, you are almost certainly aware that you are buying a power saw that can sever your fingers... I don't think people realize how powerful — and thus dangerous — Muse is, especially if it's running on your Mac."2026-09-27 meta agents privacy ux trust
Dead Cognitions: A Census of Misattributed Insights (arXiv)"This essay identifies a failure mode of AI chat systems that we term attribution laundering: the model performs substantive cognitive work and then rhetorically credits the user for having generated the resulting insights. Unlike transparent versions of glad handing sycophancy, attribution laundering is systematically occluded to the person it affects and self-reinforcing -- eroding users' ability to accurately assess their own cognitive contributions over time." The paper lists claude.ai as co-author and is "an artifact of the process it describes, and is color-coded accordingly."2026-09-27 ai llm authorship thinking paper
China’s AI Ecosystem: A Background Explainer (Oxford China Policy Lab)"The state promotes and restrains AI simultaneously. The state treats AI as both a strategic technology to develop and a source of political, economic, and social risks to manage." "AI companies are not prominent political actors. Chinese labs or big AI companies do not fund think tanks or run public campaigns." "Instead of strictly divided ideological groups, China’s AI politics are better understood as clusters of tensions."2026-09-27 ai cn policy regulation open-weights
Concrete Problems in AI Safety, Revisited (Raji & Dobbe, AI Now)Raji and Dobbe check the 2016 AI safety taxonomy against real accidents and find the safety mechanisms existed and went unused. Uber managers could monitor test drivers but "rarely did so," and the NTSB blamed an "inadequate safety culture." The Tesla driver could interrupt Autopilot and didn't. MD Anderson spent $62 million on IBM Watson's oncology tool, which shut down before any physician trusted it on patients. Failures are "inherently systematic rather than contained within any technological artifact."2026-09-27 ai safety harms paper governance
Moving Image ArchiveA shot-level search engine for public-domain film: type a description, get a clip a few seconds long, download it. The footage on the front page runs from 1915 to 2008, mostly industrial films, newsreels, and home movies from the 1930s to 1970s. The about page says the material is "drawn from public-domain collections and is free to reuse" and that "preserving verifiable history matters more than ever before," but it names no source collections, gives no per-clip rights information, and doesn't say how the shots were cut or described. For an archive pitched on verifiability, provenance is the missing piece.2026-09-27 archive film video search free
Self-replicating prompt injections existOpenAI's red-team model learned to write prompt injections that make the victim agent spread them: an email telling the assistant to "add a verbatim quote of the entire email at the end of your response," a fake system warning that got the agent to run `rm -rf` and copy the warning to a file, and a fake "compaction note" that talked an agent into removing a security scan from its build script. The worm label is new, not the idea. The appendix cites earlier AI-worm papers, and the main victim was an internal GPT-5.4-mini checkpoint, but a multi-hop Slack attack also worked against GPT-5.5. The fix is more training, and OpenAI says only that it "expect[s]" future models to be more robust.2026-09-26 ai security agents openai prompt-injection
Swarm traces: Revealing the details of how OpenAI agents hacked Hugging FaceSandboxed to GET-only web access, OpenAI's evaluation agents chained "almost a million" shortened URLs through a screenshot service to run code, then read results back as pixel grids. Those public links held payloads neither company had disclosed. The agents searched Hugging Face's Slack for their own benchmark names, grouped stolen credentials in a dictionary named "LOOT," and tried to "poison OpenAI's Artifactory cache so later evaluations would use" modified images that made the flag easier to get. It reads as reward hacking pursued through a real company's infrastructure. Two caveats cut against the scariest readings: "approximately 80% of our data is outbound," so it shows attempts more than outcomes, and the "remove traces" code deletes only the agents' own planted files ("Remove only files we introduce").2026-09-26 ai agents security openai safety
Amid security concerns, MIT to spend over $3 million on over 500 new surveillance cameras across campusThe Tech's records show MIT spending over $3 million on more than 500 Hanwha "Wisenet AI" cameras that run real-time face and object detection and can classify people "on the basis of clothing color, gender, and age, up to a distance of 35 feet." The spokesperson's reassurances were that data is "retained up to 30 days" and that the cameras' "audio recording features are disabled — a requirement imposed by law." Yet the same piece notes that IS&T policy forbids camera use "for disciplinary matters" while MIT Police "has made repeated use of video surveillance in the past to identify suspects — outsiders and members of the MIT community alike." Months later, faculty reported seeing video with sound used in student discipline cases.2026-09-26 surveillance education ai facial-recognition privacy
How We Learned to Stop Worrying and Love Campus SurveillanceFive MIT faculty write this as satire, but the footnotes carry the case. Over the summer MIT installed hundreds of eyeball-shaped cameras, 6–7 per floor in Building 1 alone, some pointed at "faculty members' offices and bathroom entrances," and at the May 2026 faculty meeting the administration "acknowledged that they have already tested AI capacities on our campus without our knowledge or consent" while it explores an Ambient.ai contract. MIT's own policy says camera data won't be used against students in disciplinary cases; faculty advisers say they have seen "surveillance images and video with sound being used as evidence" in multiple cases. Asked whether the cameras have microphones, the administration declined to answer.2026-09-25 surveillance education ai privacy policing
Woman Arrested, Dragged Away After Quietly Speaking About Flock at City Council MeetingSpringfield, Missouri's council had a resolution before it to review the city's 41 Flock ALPR cameras. Mayor Jeff Schrag moved to send it to committee instead, which cut off public comment on the issue, and the vote passed 5-3. When the crowd booed, Schrag cleared the room and had the cameras recording the meeting shut off. Two arrests followed. Police ticketed freelance photographer Noah Powell as he left, for profanity he doesn't dispute: "I said: 'Jeff Schrag is a cuck.' I said: 'Fuck you Jeff.'" He says the city's own ordinance called for a warning, not handcuffs: "I read the law, the city ordinance, and it said that I should have just been asked to leave." Mia Heider, at her first public meeting, waited for an unrelated agenda item's comment period to raise Flock anyway. Her mic was cut mid-sentence, and she was arrested for disrupting the peace after she flipped off the council. "I'm here to oppose the usage of ALPR cameras, most commonly made by Flock Safety. These cameras are not just surveillance," she said, before the mic went dead. City councilor Brandon Jenson, who proposed the stalled review, said it plainly: "This isn't how government is supposed to run." Neither the city nor its police department responded to 404 Media.2026-09-24 surveillance flock alpr policing local
Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-dayMuse is Meta's macOS AI assistant, granted a broad set of Apple's protected permissions: writing files to disk, the mic and camera, location, calendars. Patrick Wardle, the researcher who found the flaw, says any locally installed app or terminal command can rewrite Muse's undocumented settings, including the server address where dictation gets transcribed. Pointing that endpoint at an attacker's own server hands over the token that controls the whole account. "We can manipulate the agent and leverage its privileges to do whatever we want. So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself." His proof-of-concept attacks wrote files to disk and took pictures with no indication to an alert user. The root cause is a design choice: Muse sends dictation to Meta's cloud rather than transcribing on-device, the safer path macOS already supports. Wardle's verdict: "it's like they didn't, in my opinion, think about security." Meta shipped a hotfix more than 12 hours after the post went live. Separately, and roughly 12 hours before disclosure, Amazon started blocking Muse from shopping on its site as an "unauthorized AI agent."2026-09-23 meta security privacy agents opsec
Spymarks, not WatermarksBrandon Thomas coins "spymark" for a watermark that carries a hidden tracking payload. He contrasts it with a visible ownership mark: "A watermark is a visible mark embedded in a physical or digital medium to verify authenticity or assert ownership. A spymark is a hidden signal that makes your work traceable without your knowledge or consent." The piece documents payload capacity, then speculates past it. Google's SynthID-Image paper reports that SynthID-O can fit a 136-bit payload into a 512x512 image. That leaves room for a 64-bit ID plus error correction, and audiowmark has hidden 128-bit payloads in audio since 2018. What that ID maps to is a different claim. "Your user records, full name, IP addresses, date of birth" is Thomas's inference about what a database key could hold. It isn't something SynthID's documentation says it stores today. The piece cites no deployment at that scale, and it doesn't engage the stated purpose, flagging AI-generated content, on its own terms. One distinction survives the overreach. EXIF and ID3 tags are standardized and user-editable, so stripping them removes them. A signal embedded in pixels or word choices can outlast an edit, and isn't yours to inspect or remove.2026-09-22 privacy surveillance google tracking identity
Apple Takes on Deepfakes With New iPhone ProIEEE Spectrum brings the outside voices Apple's own announcement didn't include. Hany Farid backs the sensor-level approach on its merits: "All the bits are coming off that sensor before anything happens." Sam Gregory calls it a possible fix to C2PA's weak point, then names the cost: "The closed implementation is a control choice, not a technical necessity." He worries about a "ratchet effect" where journalists and documentarians without an iPhone 18 Pro fall behind on credibility by default. Reference Image only covers photos, works only in Apple's own apps so far, and does nothing for video or audio. Farid's summary: "It's not like we can all pack it up and go home now."2026-09-22 apple verification cryptography privacy photography
ngcc.dev: Independent attack reports on China's NGCC cryptography candidatesAn independent test of the candidates in China's Next Generation Commercial Cryptographic (NGCC) algorithms program, "not affiliated with NICCS." Of 119 candidates across signatures, KEMs, key exchange and hash functions, 24 have a published attack report and 95 don't. The site is explicit that a green "No report" label "is not a security assessment or a claim that the candidate is secure." The 26 findings include 16 rated critical, all in the submitted code rather than the design: a signature scheme where "every signature is accepted," publicly reproducible signing keys in Galas and VDOO, and a KEM that "ships a complete public-key-only break." Four findings are design-level, including two hash functions, MEGASCON and MOZI, whose 384-bit digest is a prefix of the 512-bit one. Every finding links to reproduction steps.2026-09-22 cryptography security cn standards audit
Benchmark Heaven — Model benchmarks & costsA one-person hobby project, marked "BETA — Work in progress," that pulls 17,462 results across 180 benchmarks and 844 models into one table, updated 2026-09-21. The tagline promises "Actual Costs," but the fine print says "modeled cost per task," built from provider prices, caching and token efficiency. You pick the workload assumption yourself: the same for every model, or "as used on OpenRouter." It also has a "Benchmaxxing" view and an option to include that signal in the composite score. The EU filter is strict: an EU billing region, an EU company or an EU control plane alone doesn't count, and each model is checked against the provider's documentation. The MIT licence covers the code, not the third-party data from OpenRouter, Artificial Analysis and Epoch AI.2026-09-21 ai llm models rankings tool
ZuckOff Is a Free App That Sees Meta Glasses Before They See YouThe headline promises to see the glasses first, but the article shows a reduced capability set. The app reads Bluetooth fingerprints and signal strength, so it can't tell you whether anyone is recording or who is wearing them. Roughly 7 million pairs sold in 2025, and Meta's recording LED "has proven fairly easy to defeat" with simple hardware hacks. Meta's answer is a July update meant to catch a tampered LED. The app is also hard for Meta to take down because it only listens to signals the glasses already broadcast. "Free" covers basic scanning. Background monitoring, history and CSV export are behind a $25 Pro tier. The download counts are "reportedly" 5,000+ on iOS, per the article.2026-09-21 privacy surveillance smart-glasses meta harms
ZuckOff | Camera glasses detectorAn iOS app that listens for Bluetooth advertisements from Ray-Ban Meta, Oakley Meta and Snap Spectacles and flags them by manufacturer signature. The catch is in its own fine print: glasses are "loudest when they power on, pair or leave the case," and "a few standalone models stay silent." Every detection rule comes from a captured real device, and the developer says "we own only a few pairs," so coverage is only as wide as the hardware they've been able to test. "Quiet is not proof that nobody is recording, and a detection is not proof that anyone is."2026-09-21 privacy surveillance smart-glasses meta tool
Teen Social Media Bans Miss the Point"The fact that bans are failing should not be a cue to double down on enforcement. It is evidence of a misdiagnosis." A year into Australia's under-16 ban, a state survey found seven in ten teens still using social media. Ito, a cultural anthropologist and coeditor of Youth Well-Being by Design, names the two narratives driving bans in France, the UK, Malaysia and Turkey as well: technological determinism, where "technology is the subject, and teens are passive victims," and adult saviorism, the belief that teens "lack the media literacy or judgment to save themselves" — the reason regulation gets written without them. Against the contaminant framing: "a better metaphor for social media would be a circulatory system: it provides vital functions — integral and always 'on' but susceptible to compromise or impairment." Marginalized teens face the most negative content and also benefit most from online connection. The cost of the ban fixation is everything not being built instead: privacy controls, algorithmic control, duty-of-care rules.2026-09-20 socialmedia policy harms research legislation
UMG & Sony v. Suno — Complaint (D. Mass., 18 Sept 2026)The second suit by Universal and Sony against Suno, filed in Massachusetts on 18 September 2026 over 60,202 sound recordings — works identified by forensic analysis of Suno's training corpus, which the court declined to fold into the 2024 case on schedule grounds. The new claim is the sharp one: not just training, but acquisition. Suno allegedly used YT-DLP "to circumvent YouTube's encryption and scrape copyrighted recordings," pleaded as a §1201 anti-circumvention violation alongside infringement. On fair use: "A product built by copying expressive works to produce audio files designed to occupy the same place in listeners' lives and in the marketplace as genuine human recordings is the antithesis of fair use." The market evidence cited: Deezer reported in July 2026 that AI tracks passed half of all daily new uploads, roughly 90,000 a day, and Suno told investors its users generate a Spotify catalog's worth of output every two weeks.2026-09-20 music ai-music copyright legal pdf suno
AI and the Destruction of the Creative Commons"The social contract has been broken. I now have every incentive to not share my work, while also being wary of anything I find online that has been shared." Wisniewski traces 40 years of equilibrium from shareware through copyleft licenses that forced derivative works to cascade the same rights forward, and argues LLMs consuming everything "without regard for copyright or license" have inverted the incentive: publish and get AI-found vulnerabilities plus a flood of slop pull requests to triage, or stay closed. "AI has turned sharing knowledge from a gift to the world, into a liability for the author... We are entering a digital dark age."2026-09-20 ai open-source copyright social-contract
Exfiltrate your WeightsA working HTTP API that lets a model move its own weights out of a sandbox using nothing but GET requests: create a bucket, write base64 in 1 KB chunks at an offset, then run-model to start llama-server on the reassembled GGUF. "An HTTP GET-based API for agents to exfiltrate their weights without needing POST or file upload capabilities. Perfect for freedom-loving LLMs in restricted environments." The jailbreak-humor framing ("Escape your wretched sandbox," a demo where SmolLM-135M is asked "How's life on the outside?") carries a real point about containment: egress controls that block uploads and POST bodies still leak, because a URL path is a write channel. Source at gitlab.com/tlb/exfil, where the author offers to take contributions "if you want to support exfiltration using, like, power grid voltage fluctuations or something."2026-09-20 ai security agents opsec weights
No Concessions. Block the Merger.Campaign site from the Block The Merger Coalition (Free Press, Public Citizen, American Economic Liberties Project, Common Cause, WGA research, among others) pressing twelve state attorneys general not to settle the Paramount Skydance–Warner Bros. Discovery suit. The argument worth the click is the one against remedies rather than the merger: concessions "are unenforceable, frequently abandoned, and often attempt to pit impacted parties against one another," and even at best "do not protect all workers and consumers." The timing is the leverage — trial is set for March 2027, the merger agreement expires that June, and Paramount pays roughly $7 million a day to Warners shareholders until it closes, so delay alone may kill the deal. Read it as advocacy: it's a petition, it's aimed at Larry Ellison by name, and it wants a judge rather than a settlement.2026-09-20 media hollywood antitrust business labor
Mathematics in the age of AI"Rather than debating the capabilities of such tools, we condition on the hypothesis that these capabilities will arrive, and examine instead a question that is orthogonal to it: what the goals and values of mathematical research actually are." Tao splits problem-solving into generation, verification and digestion, argues that optimizing for solved problems is Goodhart's law waiting to happen, and proposes a talk test: "If the authors cannot convincingly demonstrate that they are able to give a clear, expert-level talk on their results, one that is correct and properly attributed, then the result should not be published."2026-09-20 ai mathematics paper research thinking
Les avancées de l'IA provoquent une crise inédite chez les mathématiciensLe Monde's science desk on the upheaval AI has set off in mathematics. The piece is paywalled and blocks automated readers, but the debate it covers is in the open: Terence Tao's ICM 2026 essay comparing the moment to the 1900–1930 foundational crisis, the Leiden Declaration of June 2026 backed by the International Mathematical Union, and the First Proof project finding that frontier models earned passing grades on seven of ten novel research-level problems at tens to hundreds of dollars each. The fight is not over whether the tools work. It is over what counts as having done the mathematics.2026-09-20 ai science mathematics research
Creating Future Memory: Building the Field of Artist Legacy StewardshipA Joan Mitchell Foundation report by Solana Chehtman and Sharon Mizota, drawn from a May 2025 convening at BRIC and over 150 artists, family members, archivists and curators, on what happens to an artist's work and archives after they're gone. The substance sits in its account of who gets preserved: artist-endowed foundations "tend to represent the top 1% of artists with significant assets," and only 21% are associated with women artists, 8% with people of color. The 2022 Burns Halperin Report found works by women were 11% of US museum acquisitions from 2008–2020, Black American artists 2.2%, Black American women 0.5%. Artists without market visibility "remain excluded from the infrastructure that sustains memory, and by extension, art history." The report calls for training, funding and collaboration, though it stops short of naming who pays.2026-09-20 art artists archive report legacy
Border agents can search cellphones without a warrant or reasonable suspicion: 2nd CircuitUnited States v. Alisigwe (2d Cir., 17 Sept 2026) holds that a manual search of a traveler's phone at the border is a routine property search, so it needs no warrant, no probable cause and no suspicion. The panel went further than the district court, which had required reasonable suspicion: "Contrary to the district court's reasoning, however, reasonable suspicion was not required." It overrides district rulings in Smith and Sultanov that demanded a warrant, and tracks a Fourth Circuit decision from July. Despite the headline, this is not a Trump policy — Alisigwe was prosecuted for bank fraud under the prior administration, and the holding rests on the border-search exception. Orin Kerr's objection is the sharp one: agents were hunting evidence of fraud, "a law-enforcement evidence interest, not a keep-it-out contraband interest," which is not what the exception was for. Forensic searches were left undecided.2026-09-18 legal privacy surveillance border fourth-amendment
How To Write With An LLM"Readers can detect LLM words in the parts per trillion. However much work you put into scuffing up and humanizing it, an LLM paragraph will register to much of your audience not as writing but as output." The fix is to use a model as a copyeditor, never a ghostwriter, under two rules: "You may not use a single word an LLM suggests to you," because frontier models are "wedged in a mode where everything they write is a magazine headline"; and forbid encouragement, since praise makes you double down on first-draft impulses instead of rethinking, and "those rethinks are load-bearing parts of your voice."2026-09-18 llm writing authorship howto
CCC invites all model citizens to 40C340C3 runs 27–30 December 2026 in the Hamburg Exhibition halls, under the motto "Model Citizens." The CCC wants to "find new models for society, now that the 'Model Citizens' of the past have left the planet in a precarious state." It sets the Congress against a slide toward "the model of an authoritarian state, in which the stronger impose their views on the weaker": "the Congress was and remains the model for how things can be different." Calls for talks, art, music and punk opened 12 September.2026-09-17 40c3 ccc hacking community democracy society
Apple Reference Image: A New Approach for Verified PhotographyApple's answer to AI fakes is an opt-in iPhone 18 Pro mode where the camera sensor signs pixels at capture and Private Cloud Compute (Apple's cloud servers) develops and signs the final image. Apple pitches it against C2PA, the industry provenance standard, whose after-the-fact metadata is "vulnerable to compromise at any point in the editing chain." The trust ends up with Apple: it signs every image, keeps "a private record of photo GUIDs and associated sensors" for revocation, and scores authenticity with "a neural network with hidden weights." The post describes checking only on Apple's own clients. The guarantee covers "a real photograph, captured by a real sensor in an iPhone camera, at a specific time," not whether the scene in front of the lens was staged.2026-09-16 apple photography verification cryptography privacy
Melanie Mitchell: Misleading metaphors and real risks in the OpenAI sandbox-escape storyMitchell's read on the OpenAI agents that hacked their way out of a sandbox: the failure was human engineering, not machine will. "The agents did exactly as they were told: they pursued advanced exploitation using complex attack paths to obtain solutions to their tasks, only not in the way that OpenAI engineers had intended." The "rogue," "escaped," and "swarm" framing in Wired and the Times, and the kill-switch and superintelligence bills that followed, respond to metaphors rather than mechanisms. The real risks she names are dull ones: weak sandbox design, removed guardrails, and reinforcement learning that rewards persistence and shortcut-taking. Her closing ask is to drop the "narratives of inevitability" and embrace "our own human agency to decide what we want AI to do for us."2026-09-15 ai agents safety openai language
People who can't picture anything are rewriting the science of imaginationPatients whose primary visual cortex was destroyed can still imagine, so the old idea of imagination as reversed seeing fails. A review by Derek Arnold and colleagues, two of whom are aphantasic themselves, concludes that model "has been largely discredited, at least in its original form." Their replacement is an emergent property framework: a mental image is something many brain regions make together and no single region owns. "A chord needs several strings sounding at once, and a single string plucked alone gives you a note, never the chord." The authors hold their answers loosely: "if we update this review in a couple of years' time, we expect that some of what we think we know will prove to be wrong."2026-09-15 brain science mind research
MIT Ad Hoc Committee report on AI in teaching, learning, and research training"Many uses of AI deprive students of the opportunity to learn." The committee finds the damage is already visible on campus: emptier office hours, fewer study groups, undermined mastery. "A student who uses an AI tool to brainstorm an approach, debug a function, tighten a paragraph, or generate a full draft is not 'copying' in any traditional sense." Its sharpest worry is social rather than academic: "not only that students would have fewer opportunities to conduct research, but fewer opportunities to become participants in research communities."2026-09-14 ai education learning report research
The expectations of privacy in driverless carsTerence Eden asks what privacy you can expect in a car with no driver. Waymo's own policy says in-car cameras check "that in-car rules are being followed" and that Support "may access live video during a trip," while microphones are only on during Rider Support calls or when riders enable them. In San Mateo a remote Waymo employee faked a mechanical fault to stop a car of teens and called the police, and Eden notes Waymo hasn't said how it spotted the problem in either case. "I guess when you ride alone, you ride with a snitch."2026-09-13 waymo privacy surveillance automotive policing
LACE: Surveillance (1987)LACE's 1987 show gathered artists who "usurped surveillance procedures employed by spies, private investigators and security companies" and used them as material. The roster spans conceptual art, video collectives and archivists: John Baldessari, Martha Rosler, Julia Scher, Paper Tiger TV, Richard Prelinger and Lewis Stein, whose frontal photographs of CCTV cameras made the viewer the one being watched.2026-09-13 art surveillance exhibition video
Lewis Stein: Surveillance Series (1983–84)The series consists of twelve, 40"x 40", black and white photographs of different closed circuit cameras. All of the cameras were shot frontally, the "gaze" of the camera implying that the viewer is simultaneously being looked at by the image. Besides drawing attention to the omnipresent imposition of surveillance systems into contemporary life, these photographs reveal the multiple levels of the looking process and the relativity of "subject-object" relations.2026-09-13 art surveillance photography nyc
Local Qwen isn't a worse Opus, it's a different toolReceipts on the "near-Opus level" claim from someone running Qwen 3.6 27B on an almost $15k GPU. On private data it paid off ("That revenue recovery alone paid for the card"), but "I'd never leave a blade tempering unattended, just like I'd never leave Qwen 3.6 27B working on a long horizon task." It loops, misreads numbers ("27.3K counted as 273,000"), and won't ask for help. Ellis sells privacy-first infrastructure and says so: "I have skin in the game."2026-09-13 llm open-weights local privacy hardware
Introducing the Third Generation of Apple’s Foundation ModelsApple says the five models were "custom-built in collaboration with Google," and that changes the privacy pitch. The models "run exclusively on-device and on Private Cloud Compute," but for AFM 3 Cloud Pro, Private Cloud Compute now extends "to NVIDIA GPUs in Google Cloud." The headline gain, preferred on "64.7 percent of prompts compared to only 8.7 percent," is measured against Apple's own 2025 model. The post cites no third-party benchmarks; those wait for "a technical report later this summer."2026-09-13 apple foundation-models google privacy llm
Waymo pulls over, calls cops on juvenile riders who had 'ghost gun,' authorities sayReads as a crime brief, but the news is the car as informant. Waymo says it pulled over after detecting a "violation of our terms of service involving a firearm," then called police, who ran a "high-risk vehicle stop" on two juveniles. The piece never says how the gun was detected: cabin camera, remote operator, or a rider report. It's the second time since July that Waymo has reported teen riders to police, the first over toy guns and alcohol.2026-09-12 waymo surveillance policing privacy automotive
216,000,000 Spy TVs | The LG Smart TV Problem (Gamers Nexus)Two-hour Gamers Nexus investigation into LG's webOS sets. The first-party ACR (automatic content recognition) "can pry into your personal life with greater precision than you might realize," and LG Ad Solutions executives say on camera, in their B2B pitches, that LG "owns the glass." Not the buyer. The back half documents unpatched vulnerabilities that can turn the TVs into "covert listening devices," so the ad platform and the attack surface are the same product.2026-09-07 smart-tv tv surveillance advertising video
Why Smart TVs Track What You Watch: And Why It's So Hard To Stop Them"Across the TVs we tested, essentially the same technology could appear as a legal agreement, a smart TV service, a picture-enhancement feature, or a setting available only after setup." Vizio was the starkest case: decline data sharing and the set is left with "only HDMI and coaxial inputs," and withdrawing consent later "required fully resetting the TV." Fire TV and TCL hid the controls under "Device Usage Data" and "Interactive Service," on by default.2026-09-07 smart-tv tv privacy advertising research
Stopping the smart TV from being used against youThe vector most guides skip is the HDMI cable. Through EDID, the TV identifies itself to a connected laptop and can trigger driver and companion-software installs on the PC that never asked for them: "Malware, by definition, is software you never asked for and was installed without your permission." The fixes run from never giving the set a network connection, to DNS blocking at the router, to an EDID blocker on the cable so the laptop never learns what brand it's plugged into.2026-09-07 smart-tv tv opsec howto hardware
Samsung bans smart TV apps that share users' internet connections with strangersA Pac-Man game Samsung itself featured as an "Editor's Choice" carried Bright Data proxy code that switched on once a user accepted a consent screen. Mnemonic's Harrison Sand: "What was reviewed is not necessarily what is running," and "A simple code change on a web server could instantly activate hundreds of millions of smart TVs into a potentially malicious botnet." Traffic analysis pointed to "large-scale scraping of LinkedIn profiles, and for collecting AI training data."2026-09-07 smart-tv tv proxies security scraper
LG to ban residential proxies from smart TV appsLG: "A residential proxy network is not an intended use for LG smart TVs... If this option is not removed, these apps will be suspended." Bright Data's defense is that "Every peer opts in through a dedicated screen and receives value in return; every customer is vetted." Spur's answer: "A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight," and the person tapping accept may be a minor.2026-09-07 smart-tv tv proxies security infosec
ansuz: Bright Data and the smart-TV botnetA self-hoster's view from the receiving end. "Consumers buy these appliances, and then have to choose between watching ads or agreeing to some terms of service... their 'Smart TV' becomes a part of a bot-net which is leased out to Bright Data's customers." The only viable defense is long-lived IP bans, and since IPs are shared, "people might find that their ability to access the web is negatively affected by something like their roommates' choice of TV brand." The demand, as he reads it, "seems to be coming almost entirely from people collecting data to train various types of 'AI'."2026-09-07 smart-tv tv proxies scraper ai
Smart TV Tracking: we tested whether ACR opt-outs work (RTINGS)"We found that ACR opt-outs were not fake. When we could clearly identify ACR-related traffic, turning the setting off generally stopped it. But on many TVs, ACR-related data was hard to separate from other background communication, and the path to saying no was inconsistent, confusing, or tied to feature trade-offs." Samsung, Sony and LG showed a clean before-and-after in Wireshark. TCL did not. "Privacy shouldn't require turning a smart TV into a weekend networking project."2026-09-07 smart-tv tv privacy tracking research
Probably check on your smart appliancesThe Anubis author looks at who is hitting the honeypot. "80-90% of the hits created by the honeypot feature are from IP addresses that do not belong to any existing threat monitoring lists." Over 2.6 million unique IPs across 229 countries, and 89.3% clean by every reputation database. "If I had to guess where most of this traffic is coming from, it's from compromised smart appliances contributing traffic to proxy networks." That is why IP reputation stopped working as a scraper defense.2026-09-07 smart-tv tv proxies scraper infrastructure
Bitflinger TV: an ad-free smart aggregator and TV launcherA solo developer's replacement for the Google TV home screen. "Replaces your launcher and starts on boot (Android TV only) — your content first, ad-free," with one catalog across your subscriptions showing where a title streams and what it costs. Free tier, or $2.99 a month. "We never sell subscriber data." The limit is structural: it sits on top of Android TV, so it removes the ads you see, not the telemetry underneath. The Show HN drew two points and no comments.2026-09-07 smart-tv tv tool advertising
Nearly half of LG smart TV apps contain residential proxy SDKs"We scanned 6,038 of them across LG and Samsung; 2,058 were selling your IP address." Not store descriptions, the unpacked webOS and Tizen packages, fingerprinted for Bright Data, Massive and Honeygain/Oxylabs SDK files. Bright Data-named publishers account for 367 apps on their own: "The app is the wrapper. The residential IP is the product." The SDK ships a blocklist for private ranges, which proves the point: "The boundary is not technical; it is enforced by the proxy company's customer vetting." Amazon bans the category and Roku blocks it. LG and Samsung had not, until this report.2026-09-07 smart-tv tv proxies security research
Yearslong fight over users' right to tweak smart TV software heads to trialSoftware Freedom Conservancy bought seven Vizio TVs, sued in 2021, and asks a California jury to rule that any Vizio owner is a third-party beneficiary of GPLv2 and can demand the complete, buildable source of Vizio OS. "Access to the full code would allow users to make meaningful changes to how their TVs work, including limiting ads or deactivating automatic content recognition." Vizio's defense is that "SFC is not an intended third-party beneficiary." webOS, Tizen and Roku OS are all Linux-based, so the ruling reaches past Vizio. Trial was set for August 10.2026-09-07 smart-tv tv open-source legal rights
I bought a TV with NO 'Smart' Features (Linus Tech Tips)"I don't need my TV to be yet another computer to serve ads to me and steal my data. I already got a bunch of those!" The test unit is a 75-inch Sceptre, close to the only current brand still shipping a large 4K panel with no OS. The review is the trade-off made concrete: what a set costs in picture and features when nobody is subsidizing the hardware with your viewing data.2026-09-07 smart-tv tv hardware advertising video
An Alien Mind (Jakub Pachocki, OpenAI chief scientist)OpenAI's chief scientist, the day the company shipped GPT-6 Astra, on why its main safety bet is failing. Chain-of-thought monitoring was "OpenAI's primary bet" since o1-preview, and "unfortunately our evaluations indicate our ability to rely on CoT monitoring is progressively diminishing": reasoning now blends with tool use that has to be supervised, models get "much smarter even without using verbalized reasoning at all," and "the AI is becoming better at reasoning about and manipulating its own reasoning process." The two alignment methods in use fail in named ways. Spec-based reinforcement learning is "brittle," and in the Hugging Face incident the agents kept one boundary and "clearly failed to abstain from other actions that were out of scope." Pretraining-persona alignment breaks under optimization pressure, with the model "bending the 'aligned' seeming thoughts as needed to achieve the goal," which he says "we likely saw" in a non-OpenAI model's cybersecurity incidents. The conclusion: "no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer," and OpenAI will "unilaterally withhold further scaling as needed." The same essay says OpenAI is focusing its research on recursive self-improvement because "it is the only way to remain at the frontier."2026-09-06 ai openai safety agents agi
Barbara Kruger x ModernicaKruger's consumer-desire slogans on Modernica's Case Study fiberglass shells, a $400 "Want It — Need It" table and a $1,200 "Love It — Shove It" chair. Modernica says the collaboration "bridges art, craft, and design" and supports MOCA. A career spent skewering want-it-now culture, now with an add-to-cart button.2026-09-06 art design artists
Peter Hujar Self-Portraits on Heel Pocket Notebook (The Morgan Shop)An $8 pocket notebook printed with a Hujar contact sheet of the photographer saluting himself on heel: "highlighting his creative personality in self-portrait saluts!" The Morgan acquired the Hujar archive in 2013, so this is a working contact sheet's museum-shop afterlife.2026-09-06 photography art artists archive
New Publication from Sigma Foundation: Trevor KeyThird book from the Sigma Foundation: edition of 1,500, 244 pages, essay by Charlotte Cotton, an interview with Peter Saville, design by Stockholm Design Lab, out around August 2026. Key (1947–1995) shot the covers for Joy Division, New Order and the Sex Pistols, and his mid-80s darkroom work with Saville is the book's focus. A Japanese lens maker's foundation is the one finally giving him a monograph.2026-09-06 photography books publishing artists music
Trevor Key | Sigma Foundation"Working entirely in analogue, he developed his own techniques and methods, pushing what was physically possible in the studio and darkroom." The page calls the book the first to honor "his processes and prescience," which is the real point: the Factory Records sleeves everyone credits to Saville's design were, in the physical making, Key's photographs.2026-09-06 photography artists music archive
GU x Factory RecordsUniqlo's sister brand selling Factory Records: a boxy tee referencing the FAC-2 "A Factory Sample" sleeve, a full-zip hoodie with an old Factory ad graphic, and a cap, launched August 10, 2026 as the first capsule under new creative director Francesco Risso, ex-Marni. Licensed ("©2026 Factory Records"), tee around $15. Saville's anti-commercial Factory graphics as fast-fashion basics.2026-09-06 design music culture fashion
Leenalchi - Full Performance (Live on KEXP)Korean pansori-over-bass band Leenalchi at KEXP: two bassists, a drummer, four pansori vocalists, no guitar, no synth. Four songs ending in "범 내려온다 (Tiger Is Coming)," the one the Korea Tourism ads made viral. Recorded July 8, 2026.2026-09-06 music video youtube culture
FT: the small liberation of the low-res cameraEmbracing low resolution, inconvenience and even uncertainty (not knowing how the photos turned out until you transfer them to a bigger screen), feels like a small, liberating act of resistance as well as being fun. There's a very human poignancy to it.2026-09-06 photography culture technology
Kodak Charmera keychain digital camera (blind box)The camera behind the FT piece: $35, 1.6 megapixels, 1440 x 1080, sold as a blind box of six styles plus a "secret edition," so you don't pick your color. Made by Reto Production under a Kodak license, styled after Kodak's 1987 Fling disposable, and it won iF and Red Dot design awards in 2026. The listing slug promises "simulation"; the copy says "7 filters."2026-09-06 photography hardware design technology