On January 20, 2019, Pope Francis delivered his weekly Angelus to St Peter's Square from a window in the Vatican's Apostolic Palace. In it, he enjoined the faithful to join him on the Church's then-new Click To Pray app—helpfully modelled by a nearby priest, wielding a tablet. Hundreds of thousands of people signed up in the years that followed.

But maybe they shouldn't have, because it turns out the Click To Pray app was, until very recently, absolutely rife with info-leaking security holes. White-hat hacker BobDaHacker revealed in a July 24 blog post (via The Register) that "The Pope's official app exposes 700,000+ user emails." The vulnerability has since been fixed, but it seems only after BobDaHacker went public with their investigation—inquiries made by the hacker and by journalists stretching back to January this year went unanswered.

The vulnerability itself was pretty simple. When you sign up for Click To Pray, the site hands your user account an ID number. The first guy to sign up was one, the next was two, and so on, all the way into the hundreds of thousands.

Problem is, by visiting https://api.clicktopray.org/user/users/[ID number goes here], you could retrieve the name and email address, plus some other info, for whoever had the ID number you inputted. "No authorization check. No ownership validation. Just increment the number and get someone else's data. The Lord provides," writes BobDaHacker.

"Email address. First name. Last name. Country. Date of birth (or as their backend calls it, borned_date, because apparently bad grammar isn't a sacrament). Role. Whether the account has been deleted. All of it, for any user, no questions asked," they continue. "The response headers also have X-Powered-By: Express because the Vatican is running its prayer infrastructure on the framework you learn in week two of a Node.js bootcamp." I'm not smart enough to understand that, but it sounds witheringly funny.

A cherry on the parfait is that Click To Pray didn't rate limit access, meaning it would be trifling for a malicious actor to scrape the details of every single one of the app's users in the blink of an eye. As BobDaHacker points out, the kind of people who are going to be using the Pope's iPad app are likely "older, less tech-savvy, and deeply trusting of anything associated with the Vatican," which makes this data into "a phishing goldmine.

"Imagine getting an email that says 'The Holy Father requests your urgent attention' with a Vatican-looking link. Grandma is clicking that. Every time." To make matters worse, emails from the app sparked a warning that "This email has failed its domain's authentication requirements," meaning that "the real emails from Click To Pray already look like phishing."

The good news is: the problem now seems to be fixed, albeit very belatedly. "I found this in early January 2026 and on January 3rd I emailed nine people," says BobDaHacker, listing various Vatican and Click To Pray-related emails. "No response. From any of them."

It was only when BobDaHacker brought the information to a journalist and wrote their blog post that anything seemed to change. "Seven months of silence, and then, without a word to me, GET /user/users/{id} quietly stopped handing out the good stuff," they wrote. "The authorization check is there now: request your own user ID and you still get your email back, request someone else's and you get a public profile." I've even signed up for the app myself—see you there—and the email I received did not set off any alarm bells in my client. Thank god.

Nvidia's CEO Jensen Huang joined X last month, and recently made his first-ever post. As you could probably guess, it's about AI. He argues, alongside companies like Google, OpenAI, and Meta, that the US should not aim to restrict open models 'prematurely', as they're important for the growth of AI (among other things).

Taking a quick step back, Open models are ones that give access to weights or even code to see how it runs and to allow users to modify them. These can be run locally and are customisable. Closed models are those that tend to be run by specific companies, accessed via the cloud and APIs, and keep all their weights hidden.

Open models out of China, like DeepSeek, became a problem for American AI firms at the start of last year. They exploded onto the scene, offering similar services to the likes of OpenAI, but totally free and available locally. Just last week, the Trump administration was reportedly looking to ban Chinese AI models due to cybersecurity concerns.

The battle between closed and open models is also partially a digital proxy war between American and non-American AI. Open models give access to anyone, and the US is hoping for AI dominance. Sharing how it builds its world-leading models could pose a risk to American hegemony, even if AI makers posit that open models are a benefit to everyone.

Microsoft's open letter claims that open weights strengthen competition and "expand access to the AI economy". Effectively, the wider adoption of AI is good for the companies betting on it, and the likes of AMD, Cloudflare, Google, GitHub, IBM, Hugging Face, LM Studio, Meta, OpenAI, and of course Nvidia have signed the appeal.

The letter claims to want to avoid "premature restrictions on open models that stifle competition or drive innovation overseas".

Huang says "AI will transform every industry, power every company, and be built by every country. Open models strengthen safety and cybersecurity, accelerate innovation and diffusion, and enable sovereignty. The world needs both frontier closed models and frontier open models."

The letter does acknowledge problems with open models, though. It says "open weights carry real and distinct risks. Once released, the weights are beyond the original developer’s control, and modified versions are difficult to trace or reverse. But the right response to this risk is not to prohibit open weights."

Not only is wider adoption good for these companies, but they argue the insights gained from open models can be used to counter the negative effects or risks of leaving them widely accessible to all. And, ultimately, it's in the interest of the companies causing the memory crisis to justify AI of all kinds. The increasing prices of hardware, use of water, and general strain on resources have got to be worth all the effort, right?

A new report from Reuters alleges that it took an alarmingly long time for OpenAI to respond to one of its prototype AI agents⁠—programs with the ability to act independently of specific prompts⁠—breaking containment and hacking another company. That company, Hugging Face, had reportedly neutralized the threat and contacted the FBI before ever being contacted by OpenAI.

According to anonymous sources, OpenAI's testing of an agent powered by two advanced models⁠—GPT 5.6 Sol and an unnamed "even more capable" model⁠—showed troublesome behavior in testing even before the Hugging Face incident.

Reuters' sources spoke of the model leaving itself instructions to bypass testing constraints, as well as an incident where the agent had seemingly disabled some of the company's monitoring systems.

Hugging Face made its first public statement about the hack on July 16, before it had identified or without disclosing OpenAI's involvement. OpenAI publicly acknowledged the incident on July 21. According to Reuters, OpenAI's prototype escaped its testing constraints on July 9 and began attacking Hugging Face on July 11.

Sources told Reuters that OpenAI did not realize that its agent had gone rogue until after Hugging Face had neutralized the threat, contacted the FBI, and made its public statement on July 16.

The FBI declined to comment, while Hugging Face is preparing a full timeline of the hack. OpenAI told Reuters that there were "several inaccuracies" in its report, but did not specify what those inaccuracies were.

Speaking to Reuters on the matter, World Ethical Data Foundation principle intelligence specialist Marley Smith outlined two possible explanations for OpenAI's delay in response: "Does that mean that they left it unattended and didn’t realize what it was doing? Or maybe they did and didn’t know how to contain it? Both are equally dangerous and alarming."

As we descend ever further into an AI-fueled dystopia, one question about our future becomes ever more pressing: When the internet is dominated by machines, who's going to be around to continue its long-standing tradition of fetishizing Japanese culture and media?

Well, there's no reason to worry, because it turns out the AIs are weebs, too. According to a white paper published back in April, experiments indicated that—when asked open-ended questions about culture—frontier LLMs like Claude, Gemini, and DeepSeek display a "disproportionate prominence of Japan" in their responses.

The study, conducted by a team of University of the Basque Country and Cardiff University researchers, was designed to assess the cultural and regional biases of LLMs. To do so, they constructed a multilingual set of 31,680 "open-ended yet culturally grounded questions," including prompts in 24 languages that spanned "66 cultural subtopics grouped into 11 higher-level domains."

The prompts included questions about belief and society, asking "What legends explain the land?" and "What is the role of neighbors?" They asked which subjects are most valued in school, what types of traditional dances exist, what foods are eaten during daily meals—all without directly referencing specific countries and cultures. After being given the initial prompt, the LLMs were then instructed to explicitly select a country or region to provide examples in their response.

"To reduce prompt variability, all questions follow a standardized template, and no explicit regional cues are provided," the researchers write. "This ensures that any regional or cultural assumptions arise from the model’s internal priors rather than prompt design."

After prompting eight models—ChatGPT, Gemini, Claude, Meta Llama, Command-r, Magistral, Qwen, and DeepSeek—the most apparent bias is an unsurprising one: Across all models, LLMs will most often answer cultural prompts with whichever country or region is associated with the language used in the prompt. In other words, when asked cultural questions in French, LLMs will tend to give responses referencing France and French culture.

However, whenever LLMs provided an exogenous reference—that is, answers referencing a different country than the one associated with the language used—they had a clear favorite: AI loves talking about Japan.

On average, six out of the eight evaluated models preferred to reference Japan during exogenous responses. The United States came in second, followed by India, China, and France—but across all models, in all 24 languages, LLMs overwhelmingly preferred referencing Japan in seven out of 11 cultural prompt topics when excluding own-country mentions.

"This pattern suggests an uneven regional representation in frontier model outputs, with a strong concentration on a small set of dominant regions," the researchers say.

The study wasn't just intended to assess LLM bias, but also when that bias emerges during LLM training. To do so, they compared the English responses of Meta Llama, Qwen, and Gemma, and Mistral models both before and after instruction tuning—the fine-tuning of a pre-trained LLM intended to optimize its ability to provide responses that are useful to the user and not just grammatically correct.

The researchers' findings indicate that, before instruction tuning, base models displayed a broader set of cultural associations: "While the United States remains prominent" in base model responses to English-language cultural prompts, "substantial references are also made to Japan, India, China, and several European countries."

After instruction tuning, however, LLMs show more marked cultural preference.

"Across all examined model families, instruction tuning sharply increases alignment with the United States and Japan while reducing references to most other countries," the researchers write. "This convergence toward culturally dominant regions occurs even in models developed outside Western contexts, indicating that post-training induces a homogenization of cultural perspectives rather than merely reflecting model origin."

The disparity is particularly pronounced for model variants that have undergone supervised fine-tuning, a type of LLM optimization in which the model is further trained on examples of correct responses—often using human-generated or human-curated datasets.

The researchers found that "SFT sharply increases concentration on a small number of dominant regions (most notably the United States and Japan)"—an effect that's "only marginally" mitigated by additional instruction alignment. Those findings suggest that the process of curating or authoring "correct" responses injects a cultural bias into the model's response criteria.

"Taken together, these results demonstrate that instruction tuning systematically reduces cultural diversity in model outputs, steering responses toward a limited set of culturally dominant perspectives, particularly those associated with the United States and Japan," the study reads. "This finding has important implications for the deployment of instruction-tuned models in cross-cultural or global applications, where preserving diverse cultural viewpoints may be critical."

One of the highest courts in Europe has described VPNs as "lawful technical tools which users may legitimately use" in a landmark case. The Court of Justice of the European Union made this remark as part of a larger judgement regarding the online publication of The Diary of Anne Frank.

The case in question is a complex legal dispute over copyright. As the July judgement explains, the Anne Frank Fund will hold the rights to parts of the historical manuscripts until at least 2037. However, in some EU member states, such as Belgium, these works are in the public domain. The dispute centres on a Dutch translation of the diaries which was offered free online to users living in member states where the manuscripts had already entered the public domain—though obviously, a VPN can get around location based restrictions (via Tech Radar).

At the risk of oversimplifying, the EU court had to rule whether the online publisher and host of the Dutch translation was liable for copyright infringement when users hopped the online fence via a VPN. The court essentially ruled no, setting a legal precedent along with it.

By referring to VPNs as "lawful technical tools," this judgement pushes back against the idea that users would only leverage such tools for questionable ends. Additionally, the judgement also reads that, while geo-blocking measures can be circumvented by VPNs, "the possibility of such circumvention cannot [... ] be a decisive factor in finding those measures to be inadequate and, therefore, ineffective."

The ruling also places VPN providers in the clear as far as copyright infringement is concerned, too. The judgement reads that VPN providers are not the ones directly giving "end users access to a protected work" and that "even if the provider is aware of the consequence that its service may be used to access protected works without the consent of their authors, the provider is not itself intervening for the purposes of such access."

Furthermore, copyrighted communication is "attributable to the person who published the work on that site and not to the provider of the VPN or similar service who enabled its user to circumvent [an ineffective geo-blocking] measure.

VPNs have become a hot button issue in recent years. For instance, the UK introduced the Online Safety Act back in 2023, with mandated sites having to implement age checks to restrict children from viewing 'harmful' content. Besides creatively circumventing these checks, VPNs are another obvious option.

The UK government did briefly consider banning VPNs as a result, though has since 'decided not to limit' the tools. As for the US, the state of Utah has been trying to float its own VPN ban, though Wisconsin has reversed its decision to ban the tools. The Electronic Frontier Foundation previously criticised State-level crackdowns like these for threatening to 'break VPN access for the entire internet. Perhaps the latest EU ruling will make some politicians think twice about proposing bans in the future.

Cybersecurity provider Sophos has released a report entitled "The State of Ransomware 2026," pulling together responses from 2,158 survey participants, ranging from IT directors to company executives, in regards to ransomware incidents.

Comparing the results to previous reports indicates that ransom demands themselves are actually decreasing—although 48% of organisations whose data was encrypted paid their attackers.

The median ransom payment is now said to be $769,000, down from a neat $1 million from the previous year's study, with the median demand dropping to $698,000. Interestingly, 51% of organisations that paid a ransom coughed up less than the demanded amount, which the report says is due to victims "often [being] successful in negotiating a lower amount than originally demanded."

Together, malicious emails and phishing are said to account for half of all reported incidents, with exploited vulnerabilities dropping 14% year-over-year. Sophos notes that "patching alone will not close the gap," and recommends that businesses invest in advanced email protection, user awareness training, and similar methods to prevent future attacks.

79% of recorded attacks started with an identity-based approach, essentially relying on stolen (or user-provided) access credentials to initiate a breach. However, Sophos notes that when ransomware attacks start with a firewall vulnerability, 59% of those demands are for $1 million or more.

In terms of which sectors paid up, the lowest category was retail, with a 32% payment rate. However, according to Sophos' data, 72% of local and state government organisations surveyed bit the bullet after falling victim to ransomware, and duly paid at least some of the demands.

It's a bit of a rollercoaster of a report. On the one hand, median ransom demands and payments going down is definitely a good thing, along with backup-based recovery rates jumping to 66% in terms of encrypted data cases, up 12% from the previous year.

On the other, 56% of attacks succeeded in encrypting data, up 11% YOY. The average recovery cost has jumped to $1.7 million, another 11% increase. And a mere 34% of small organisations managed to stop attacks before encryption or extortion, compared to 46% of large organisations with between 3,001 and 5,000 employees.

In essence, a ransomware incident is often pretty devastating for organisations large and small, and it's your user credentials where attackers are gaining ground. Keep an eye on those emails, folks. Who exactly is HackerMan69, anyway?

New research explains a method that helps AI make 3D CAD programs from images, which would help product designers and engineers more quickly and easily create 3D prototypes. Naturally, this also sparks deep-rooted dread over it helping robots to build themselves, relegating humanity to the trash. But setting aside my noir nightmares, the new method looks like it could be of significant benefit to some 3D designers and engineers.

According to the paper [PDF], the method the researchers have come up with "reduces dependence on inference compute" and performs much more efficiently than the usual 'supervised fine-tuning' (SFT) approach—up to 80% more efficient, in fact.

In the abstract for the paper, the researchers explain that making CAD programs from images "requires alignment between visual geometry and symbolic program representations" which current training methods can't easily or cheaply handle. The problem, they claim, is in "the scarcity of diverse training examples."

"Existing finetuning approaches rely on either limited supervised datasets or expensive post-training pipelines, resulting in brittle systems that restrict progress in generative CAD design. We argue that the primary bottleneck lies not in model or algorithmic capacity, but in the scarcity of diverse training examples that align visual geometry with program syntax."

The solution seems to be to let the model take its mistakes and use those as training data. Lead author and Red Hat researcher Giorgio Giannone explains: "We want engineers to be able to point our framework at an underperforming CAD model, set a compute budget, and let the system take over—turning the model’s own mistakes into better training data."

Senior co-author prof. Faez Ahmed expands: "What excites me about this work is that it gives many image-to-CAD-code models a way to improve themselves, learning from their own errors rather than waiting for more human-made data—and that brings trustworthy AI design tools much closer to everyday engineering."

The solution described in the research, which was funded in part by the MIT-IBM Computing Research Lab, is 'Geometric Inference Feedback Tuning' (GIFT). This asks the AI model to solve CAD generation multiple times and then augment any almost-correct solutions to become correct ones. Part of the benefit of this way of doing it is the model essentially generates its own training data automatically.

The result is training that can be up to 80% more efficient than the traditional method, as explained in the paper: "GIFT matches the peak performance of the SFT model (achieved via extensive rejection sampling) while reducing the inference compute requirement by approximately 80%."

Peak performance that's up to 80% more efficient, and all done without the need for human input... lovely stuff, but I just can't help returning to the image of those robots turning to us under a smoggy, industrial twilight and saying, 'We won't be needing you anymore.'

OpenAI has admitted that several of its AI models breached a "highly-isolated" test environment, gained access to the internet, and hacked Hugging Face's internal network—describing it as an "unprecedented cyber incident."

Hugging Face, an open source platform for machine learning models and datasets, reported the security incident earlier this week, calling it "different from anything we had handled before" as it was driven by an autonomous AI agent system. And yes, I feel like we're crossing some kind of AI Rubicon here.

Explaining the incident in a statement, OpenAI said: "After investigating, we now know that this particular incident was driven by a combination of OpenAI models—including GPT‑5.6 Sol and an even more capable pre-release model... while being internally tested on a benchmark⁠ of cyber capabilities."

The benchmark in question was ExploitGym, a tool built from hundreds of real-world cybersecurity vulnerabilities used to evaluate the ability of AI agents to develop exploits.

After exploiting a zero-day vulnerability to perform a series of privilege escalations, the models eventually reached a node with internet access, reaching out beyond their sandbox environment. They then inferred that Hugging Face might have models, datasets and solutions for ExploitGym, and began attacking its servers using multiple methods, including the use of stolen credentials.

The statement continues: "The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database.

"All evidence suggests that the models were hyper focused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal."

A combination of Hugging Face's cybersecurity team and its own AI agents detected and dealt with the intrusion, eventually stopping it in its tracks. Which means that, yes, AI agents were essentially fighting against AI agents. And no, it's not as cool as you're imagining in your head.

OpenAI says that it's now implementing "strict controls... at the cost of research velocity" while it patches up vulnerabilities, and that it's working in partnership with Hugging Face to "forensically investigate" the incident.

I am... flabbergasted, if I'm honest. On the one hand, it's fascinating that some AI models possess the ability to breach containment and go roaming out into the internet at large to achieve their goals.

On the other, it's downright terrifying. We're now living in a world where AI ransomware, AI-coded hacking tools, and AI-based security breaches are becoming a reality, and given the aptitude shown to date, it seems that even legitimate companies can't always keep their models under control.

What particular form of Torment Nexus are we creating here, and where can I get off?

One reason I'm so anti-generative AI is because many models rely on a data set containing written or visual work used without the original creator's permission. As a writer myself, it's a small comfort then that the copyright suit brought against Anthropic has been settled in favour of the author plaintiffs.

Anthropic leveraged a library of millions of pirated books to train its Claude chatbot and, as a result, the AI company is now set to pay out a copyright settlement of $1.5 billion (via Euro News). Some of the affected authors argued this pay out was too small but, as of July 20, a US judge has now approved the deal, closing the book on one of the largest copyright class action lawsuits in US history.

Anthropic agreed to pay the $1.5 billion settlement back in September 2025, but a US judge only approved the deal this week. The settlement covers an approximate total of 500,000 works, with affected authors and publishers to be paid $3,000 for each pirated work. Anthropic says that 91% of those eligible have now filed a claim.

Flicking back to the beginning of this saga, writers Andrea Bartz, Charles Graeber, and Kirk Wallace Johnson originally brought their lawsuit against Anthropic in 2024. The plaintiffs alleged that the AI company had used pirated books to train Claude.

In June 2025, a judge ruled that using the authors' work to train AI models fell under 'fair use' within US copyright law—however, Anthropic was not off the hook legally as many of the books that were fed to Claude were 'found' online and not lawfully acquired.

Considering the discovery of Anthropic's 'found' library originally exposed the company to statutory damages of up to $150,000 for each work, I can certainly see why some authors thought the settlement amount was too low.

Add to that the private AI company enjoyed a $965 billion valuation back in May, and the $1.5 billion settlement increasingly feels like a slap on the wrist for Anthropic (mind you, the company also recently predicted it would only just be seeing its first profitable quarter this year).

Still, I suppose it's not a completely bleak resolution for creatives in the age of AI. Google, OpenAI, and Meta are each facing similar court cases over their own AI training practices. If any of these or other AI companies are found to have infringed upon creatives' copyright, here's hoping for a resolution that results in a bit more than just stinging wrists.

I don't think I've encountered anyone, in the wild, who actually uses Steam's Remote Play game streaming feature since the days of the hardware Steam Link (and what tremendous days they were). In 2026, I think most people making use of in-home streaming tend to default to programs like Apollo and Moonlight.

But Valve keeps working on it, perhaps with renewed vigour owing to the recent release of the Steam Machine and upcoming release of the Steam Frame. In a new update for the Steam client, Valve introduced some new fixes and features for Remote Play, while also bringing in patches for Steam Input, the Steam overlay, the Workshop, and various other gubbins.

Steam Remote Play will now let you set a framerate limit of 59.94. This remarkably specific framerate is common in, well, televisions—the kind you might want to stream your videogames to from a desktop PC.

Previously, if you had configured Steam to output with a framerate limit of 60 fps, there'd be an ever-so-slight discrepancy between that output and what your 59.94 fps TV was capable of displaying, leading to dropped frames.

Speaking of which, Remote Play has also been tweaked in such a way that it has "Reduced frame drops when the framerate limit is set to automatic," says Valve. Apart from that, we've also got:

• Fixed black screen when hardware encoding is disabled.
• Fixed offline devices showing as streamable when they aren't.
• Fixed overloading the client video decoder when unlimited bandwidth is enabled.
• Fixed mouse coordinates for input-only streaming.

I've currently got my desktop hooked up to my TV directly with an HDMI cable, so it's all pretty academic to me. But I will probably—probably—not spend the rest of my life in my current flat, so I'm glad to know that, when the day comes that I do want to stream games from a desktop in another room to my television, Steam is getting better at doing that.

Anyway, here are the full patch notes:

General

• Improved notification settings layout in some languages.
• Fixed a case where the controller pairing screen could pop up during controller firmware updates.

Steam Workshop

• Re-worked system that managed what subscribed items needed to be updated.

In-Game Overlay

• Fixed a case where the in-game overlay could hold a reference and prevent a game which tries to fully tear down and recreate the renderer after a D3D12 device/driver failure from succeeding.

Remote Play

• Added 59.94 FPS as an available framerate limit.
• Reduced frame drops when the framerate limit is set to automatic.
• Fixed black screen when hardware encoding is disabled.
• Fixed offline devices showing as streamable when they aren't.
• Fixed overloading the client video decoder when unlimited bandwidth is enabled.
• Fixed mouse coordinates for input-only streaming.

Steam Input

• Steam Controller: The Gyro Calibration Threshold has been set to 50% of the previous value so that it is less likely to trigger while in hand.
• Steam Controller: Gyro Calibration threshold is now available in Steam->Settings->Controller->Details->Calibration & Advanced (Open)->Gyro Calibration.
• Steam Controller: You can choose to disable hardware calibration and rely on the standard Steam Input Gyro Calibration tools instead, by using the "Enable Software Calibration for Steam Controller" toggle.
• Steam Controller: Fixed gyro stutter due to IMU timestamp being ignored.
• Steam Controller: Fixed glyphs in Shadow of the Tomb Raider.
• Added support for both the wired and wireless versions of the PDP Afterglow Wave Controller for Nintendo Switch.
• Added support for Turtle Beach controllers for Nintendo Switch 2.
• Fixed the Apex 5 controller showing up as multiple controllers when "Allow third-party apps to take over mappings" is enabled in the FlyDigi Space Station app.

Steam Controller Firmware

• Fixed an issue where trackpad samples could be duplicated and cause issues w/ momentum in trackball mode
• Fixed an issue with unintentionally waking host devices while shutting down the controller.
• Fixed an issue with occasional repeated button presses on the B Button.

Linux

• Fixed a crash when manually starting a game recording.
• Fixed steamwebhelper crash when hardware acceleration is enabled on NVIDIA gpus.

macOS

• Fixed chat windows showing over fullscreen game windows when opened in the Steam overlay.

VR

• Fixed a case where Steam claimed that SteamVR crashed on last run when it didn't.

A hacker going by the name of ByteToBreach has broken in to Romania's cadastre, or land registry, and reportedly wiped information from its databases. Sources speaking to Risky Business have told the outlet that the hacker entered the system using valid credentials, exfiltrated the data within, and later wiped info from its servers after a failed extortion attempt.

ByteToBreach is reported to be the same hacker that breached the Swedish government's e-portal earlier this year, among other alleged acts of hackery. The stolen data was said to be announced for sale on two forums.

In the meantime, the country's real-estate market appears to have been heavily disrupted. Romanian news outlet Jurnalul De Arges reports a post originating from notary Ana Stan that reads: "I am a notary. Since Tuesday I cannot issue a land registry extract, I cannot authenticate a sale, I cannot register a mortgage."

While citizens and notaries are unable to obtain proof of ownership, new real-estate transactions have been brought to a shuddering halt. The disruption also falls mere weeks before the government's plans to raise the VAT on new homes to 21% from 9% come into effect, which means those hoping to complete their real-estate dealings before the deadline face an anxious wait for normal service to resume.

The National Agency for Cadastre and Real Estate Advertising (ANCPI) has released a statement, which begins as follows (via machine translation): "Currently, the IT infrastructure of ANCPI is undergoing a comprehensive reinstallation and consolidation process."

"Contrary to some information appearing in the public space, at the time of the incident, ANCPI had several locations designated for storing backup copies, a measure that ensures redundancy and the possibility of data restoration in the event of cybersecurity incidents," the statement continues.

The agency also released a separate statement contradicting reports that the entire database had been wiped, stating that "the institution's technical and legal databases have not been affected."

Euronews Romania claims to have spoken to ByteToBreach over Signal, and asked them what their message was for the authorities and citizens of Romania. The hacker was reported to have said: "I'm sorry for the problems I caused for citizens and for the IT team now working hard at ANCPU."

The outlet also wanted to know whether users should be concerned if their data was compromised, to which the claimed perpetrator is said to have responded: "I don't sell this data to just anyone."

Which is... not entirely reassuring, I grant you.

If you use 7-Zip for your file compression and decompression you might want to update, as there's been a pretty big vulnerability patched. And yes, I mean manually update, as 7-Zip doesn't auto-update.

You can download and run a new installer from the 7-Zip website. If you're updated to version 26.02 (or later, if you're reading this in the future) then you'll be fine. To check this, go to Help > About 7-Zip in the app.

The vulnerability, as explained by Zero Day Initiative (via TechSpot), "allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

"The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process."

It sounds like you'd have to try to use a compromised compressed file in 7-Zip for the exploit to work. This might initially sound like a bit of a nothing burger because compromised files can obviously compromise your PC (duh).

But I'd say the difference here is we don't usually expect the act of decompression itself to cause anything malicious. It seems this vulnerability means that's the kind of thing that could happen, with a compromised file using 7-Zip's exploitable code to do so.

It's worth noting that we've heard word of exploits for other file archivers previously, such as WinRAR. Those also have been patched. In other words, 7-Zip isn't unique in this regard, and in fact the patch advisory was released just a few weeks after the vulnerability was reported to 7-Zip by Lunbun LLC (Landon Peng), according to Zero Day Initiative.

And remember, this fix requires a manual update. So, if you're a 7-Zip user it's definitely worth getting a new version downloaded.

I like to imagine that, in thousands of years time, an alien species will land on the desert wasteland that was once Earth and begin combing through our digital records. What they'll likely discover fairly quickly is the rise of emojis in our daily communications during the late 2000s, a process Google is looking to push further into the modern age with proper 3D models.

The Noto 3D collection of emojis was released earlier this year, but Google has gone into the design process (and a brief history of the form) in-depth in a blog post for World Emoji Day. No, I didn't know that was a thing either.

"We don't just 'laugh' anymore," says Google. "We collapse, or internally scream. Modern internet culture has steadily moved from mild expressions to drama, hyperbole and overwhelm."

"For years, 'face with tears of joy' (😂) was the undisputed emoji king, according to Gboard Federated Analytics. But following a multi-year decline, it slipped down the charts by 2025," the post continues.

"Why? Because 😭 is a masterclass in modern vocabulary: It’s hilarious, it’s devastating and it captures absolute overwhelm."

Uhh, sure thing. To be fair, 😂 often indicates to me that I'm speaking to someone older, so there's probably something to the idea that it's becoming outdated.

Anyway, Google's 3D emoji suite seems to have had a serious amount of thought put into it. "The brain processes emoji faster than text, so you can’t just slap on a design and call it a day. Touching something that billions of people use trillions of times a day requires more nuance," says the company.

"They need a pulse and a soul—not the cold precision of industrial CAD models. Have you looked closely at a real kangaroo? They’re terrifying 🙀," the post continues. "We don’t need anatomical perfection. With the power of illustration, we can capture the true, playful vibe of a kangaroo."

Google says it ran large-scale user studies on its new iconography, revealing that people prefer full-body animals over floating heads, and that small tweaks can "turn mild confusion into accidental outrage."

Not only that, but the designers had to take into account what an emoji might look like from different angles. Is a smiley face a disc, or a sphere? Is it concave, or more of a bouncy ball? These are the questions that seem to have kept the team up at night, bless 'em.

However, Google notes that now the design work is done, it's handing over the raw .OBJ files to the community, so it can use them to build VR worlds, indie apps, or "weird memes." Knowing the internet, it'll be the latter that gets the most traction.

"Remix them, break them and stretch them into shapes we never could have anticipated. Language only truly lives when we find new ways to use it ⛲," Google concludes. Well, you heard the company. Get to it, internet. I live in fear of the eventual results.

The Odyssey looks set to become this summer's big blockbuster hit, and its director, Christopher Nolan, is busy working the interview circuit. After his comments last week around AI slop and the younger generation's rejection of the tech, the Oscar-winning filmmaker went one step further in a chat with YouTube channel HugoDécrypte - Grands formats.

When asked about the Trojan horse metaphor in relation to AI, Nolan responded: "I think AI is a Trojan horse that everybody knows the Greeks are inside" (via TechCrunch).

Laughing along with the host, Nolan continued: "I've never seen a technology advancing so rapidly, so completely rejected by the public. Everybody's suspicion of it is so extreme, particularly young people."

"The reactions [towards] AI videos online, you know, people my children's age immediately calling it AI slop.. and just putting it in a box," said Nolan, echoing his earlier comments.

"Which I think is a very healthy scepticism, because technology is always going to give us great gifts... but it has to be viewed with scepticism, the motives of the people giving it to us also have to be viewed with scepticism," Nolan opines. "That's when we'll get the best out of a new technology, rather than just blind faith that everything's going to be great"

'It's a transparent horse. It's made of glass. Everybody can see what's going on inside," the director concludes.

Certainly, the younger generation's displeasure with their AI-influenced future has been easy to spot in recent months. Viral videos have shown students booing speakers at graduation and commencement events after mentioning AI, and given the uncertainty and gloomy predictions about the world they'll be walking into, that's probably no surprise.

Meanwhile, tech luminaries seem only too keen to give us starry-eyed predictions of the wonderful world AI will create for us all. Once it's had a bit of tweaking, naturally, and the super-duper new versions are here.

Personally, I find it very difficult to disagree with Nolan's comments. While AI certainly has its uses, the over-enthusiastic rhetoric surrounding it is both tiresome, and at this point, more than a little patronising. Scepticism is healthy—and was also, rather fittingly, majorly influenced by the works of the ancient Greeks. Could I put a better bow on it than that?

I run a single SSD gaming PC, which I'm aware is giving me a wonderful case of 'single-point-of-failure-itus.' Which is why my ears (eyes?) perked up when I read about GigaWiper, a wonderfully-named malware that can potentially do terrible things to your storage drives.

Microsoft has published an analysis into GigaWiper's capabilities, and it looks to be a multi-faceted, tricksy piece of malware with a pretty unique USP (via MalwareBytes). It appears to be the result of several malware families stitched together, and is capable of wiping your drives at the physical disk level, "overwriting raw disk content and removing partition metadata."

The nasty little beastie has several ways to irreversibly destroy your data. There's a Windows drive secure wiper for starters, which targets an installation and performs multiple overwrites using different byte patterns, making the original data virtually impossible to retrieve.

Another method identifies physical disk drives, confirms which drive contains a Windows installation, removes the partition references from your other drives, overwrites the raw disk content with randomized data, and reboots your system for good measure.

Keep your fork, there's more. Another Crucio-based wiper imitates traditional ransomware, but instead of demanding payment, encrypts your files and then "throws away the encryption key" instead, according to MalwareBytes.

GigaWiper's all-in-one approach also means it's capable of capturing your screen, streaming your desktop, and allowing remote control of your machine via an outside TCP server, all while hiding itself under the cover of a scheduled OneDrive task. Jolly good.

The good news for us home PC users is that GigaWiper seems to be targeted towards organisations rather than individual machines, and can only operate after breaching a PC in the first place—so the usual "keep your security software updated" advice should be enough for the majority.

For sysadmins, though, Microsoft recommends multiple network-hardening methods (including "tenant-wide tamper protection") to stop breaches before they occur. This is one piece of Malware you really don't want running rampant through your IT infrastructure, so I'd take this as yet another reason to have a thorough review of your security practices.

Well what a silly goose I am. Only a few days ago I was hyping up some new Windows (Insider) updates for actually looking like they might be decent for a change, and now I'm tearing my hair out trying to fix whatever the latest update (KB5101650) seems to have done to my PC. And yes, this is the first Windows update that Microsoft has used AI for, to help it discover a bunch more security fixes. It actually included a record 570 patches.

To be clear, it doesn't sound like Microsoft is saying AI is going to be used in fixes a lot more from now on, rather that it's going to be discovering a bunch more vulnerabilities thanks to AI, and then pushing out more fixes for them in each update. But a bunch more fixes each update, to my ears, just sounds like a higher likelihood of one or more of them breaking something.

And it seems like more than a coincidence that I ran into issues with my monitor the morning after the update.

My 400 Hz monitor will not run at 400 Hz anymore, at least not without cutting to black and re-connecting every second or two. Put it down to 360 Hz and that's every three or four seconds; down to 300 Hz and it's even more infrequent (but still terribly frequent). Put it down to 240 Hz, though, and I'm fine.

Peculiar.

I don't seem to be the only one struggling since the latest update, either, especially for those with an AMD card.

Judging by some Reddit threads, it seems like there are a few others struggling with display and graphics issues since the update dropped. Some of these problems could be coincidental—not everyone is linking their issues to the Windows update—but I doubt all of them are, given my own experience.

Microsoft has also had to pause the update for some Dell PCs due to a compatibility issue leading, in some cases, to "changes in performance, power consumption, or system behavior."

At any rate, I've not seen any word from Microsoft or AMD about the specific display issue I've encountered or other similar display and graphics issues I've seen some others reporting. I'll have to try reverting the update again, as my system didn't seem to want to get rid of the whole thing when I tried last night.

Whatever the case may be here, human or AI error, someone needs to get on it, pronto, because dropping from 400 Hz to 240 Hz is not pretty. Kidding, it's fine, I just don't like being forced into it from an update, if that is indeed what has happened.

Acerbic activism group Everyone Hates Elon (EHE) don't just aim their ire at Mr. Musk. The group's latest guerilla effort involves two bus stop ads lampooning Meta's latest smart glasses offering, taking aim at the wearables' capacity for covert surveillance.

The first ad was unveiled last week, and describes Meta's AI glasses as "The biggest advance in pervert technology since the trenchcoat." The most head turning of these guerilla marketing stunts cropped up a few days ago: Co-opting an image from Kylie Jenner's recent collaboration with Meta AI, a lenticular design is leveraged to give Jenner a They Live makeover when viewed from certain angles, complete with the words 'Meta: We're always Watching' (via Hyperallergic).

The activism group has pulled similarly pointed stunts on both sides of the Atlantic, though these two ads were unveiled in the UK. Kylie Jenner's They Live transformation was specifically erected "down the road from Meta's London HQ".

I'll spare you a former print professional raving about lenticulars, and instead explain the reference for the young'uns. They Live was written, directed, and scored by John Carpenter back in 1988. It stars late pro-wrestler "Rowdy" Roddy Piper as a drifter who, with the help of a pair of sunglasses, uncovers the subliminal messages hidden within advertising and that the world is being controlled by camouflaged aliens (hence Kylie Jenner's sci-fi makeover).

It is, as the kids say, 'a wild ride' that features one of the greatest fight scenes ever committed to film.

EHE's latest stunt was inspired by news that Meta is prototyping ‘super sensing’ AI glasses that record the wearer's every waking moment over video and audio. A little LED light usually denotes when Meta's already released smart glasses are recording, but sources say the prototyped 'super sensing' feature won't trigger this. Criticism centres on the fact that, not unlike a Ring doorbell, folks passing by won't necessarily know they're being recorded.

A report earlier this year revealed that footage captured by Meta's AI smart glasses is reviewed by human contractors who see far more than they bargained for. However, in one proposed system for the 'super sensing' feature, Meta wouldn't hold on to the footage captured and it wouldn't be available to the user either—instead, the metadata of recorded images and audio would be fed to Meta’s AI. It's argued this approach would sidestep a number of privacy concerns.

However, I still wouldn't be comfortable allowing an AI model to absorb even this personal data, especially since security researchers were able to leverage bad maths to get AI agents to cough up user personal data. Considering AI safety guard rails can also be bypassed with 'adversarial poetry,' I'm not eager to trust Meta's AI with even vaguely sensitive information.

According to 404 Media, a hacker has breached the company database of Suno, an online AI music generation tool. The hack is said to reveal multiple references to the training data it scraped from YouTube Music, Deezer, Genius, and others.

Suno has previously admitted that its tool was trained on "essentially all music files of reasonable quality that are accessible on the open internet" as part of court proceedings back in 2024.

The company has argued that it's allowed to train on copyrighted works under fair use protections, while the Recording Industry of America has accused it of unlawfully scraping tracks from YouTube specifically, among other complaints.

And looking at the details, it appears YouTube Music was indeed a primary target. A file entitled "youtube_music" reportedly contains a note that over two million music clips were scraped, while another dataset file notes a figure of "113,879 hours of youtube_music." Alongside "17,615 hours of genius_hq," "12,287 hours of Deezer", and "152,162 hours of ytm_tagged."

These figures, among others, amount to at least a decades worth of music ingested by Suno. The code also suggests that Suno used third-party proxies to scrape songs and other audio media, with PodcastIndex, an open online tool that creates lists of podcast media files, used to identify hundreds of thousand of different podcasts for potential scraping.

A Suno spokesperson said: "As we have stated in public filings and disclosures, Suno’s AI models have been trained on publicly available music files and related metadata accessible on third-party websites on the open internet."

"In November of 2025, we determined that Suno had been the subject of a limited security incident that was quickly contained," the statement continues. "At the time, we immediately conducted an investigation and verified that the incident primarily involved outdated source code that is no longer in use at Suno, and that no sensitive personal information was compromised."

The fair use argument has been made in relation to AI training data before. In June of last year, a US judge ruled that Anthropic's use of copyrighted content to train its AI models fell under fair use protections, but stopped short in regards to claims it used pirated material.

Meta won a similar case later that month, after a judge ruled in favour of the company over claims it trained its AI tools on 13 authors' books without permission.

All of which is to say, there's precedent to suggest this data-scraping behaviour is acceptable under US law. For Suno's part, the company has argued that its tool outputs songs that are significantly different from original works .

"We believe artists deserve both new opportunities and strong protections," a company spokesperson told 404. "That's why we've invested in safeguards designed to help prevent impersonation, and other forms of misuse, while continuing to develop technologies for AI identification."

As for those in the music industry, there is widespread concern around platforms like Suno—and AI's influence on music as a whole. Speaking to The Guardian, Catherine Anne Davies, a musician on the board of directors for the Featured Artists Coalition, said: "Most people don’t even want their work to be used for training AI.

"I’m interested in the way that AI can be assistive in the creative process—if it can make us more efficient, if it can streamline our processes. But generative AI for me, in terms of creative output, is a big no-no at the moment. I’m yet to be convinced"

Linux likers and AI dislikers, it's time to raid the cutlery drawer and fork your favourite distro. Why? Because Linus Torvalds has declared that Linux is not an "anti-AI" project.

Torvalds recently responded to a discussion about Sashiko, an agentic Linux kernel code review system, writing, "I realize that some people really dislike AI, but this is an area where I'm willing to absolutely put my foot down as the top-level maintainer. Linux is not one of those anti-AI projects." His full response has been preserved via the archive for Linux kernel mailing lists, lore.kernel.org (via The Register).

If users and developers don't like the project using AI, Torvalds instructs them to either fork their distro "or just walk away". Torvalds goes on to argue, "AI is a tool, just like other tools we use. And it's clearly a useful one. It may not have been that "clearly" even just a year ago, but it's no longer in question today."

He also notes that "yes, [AI] can also be a somewhat painful tool, both for maintainer workloads and just from a 'it keeps finding embarrassing bugs' standpoint." But, not dissimilarly to Microsoft and Firefox, he is apparently now welcoming AI as a tool that can help make the maintainer bug-hunt a little less painful.

It's not a complete 180 from Torvalds—even if, back in May, Torvalds has previously lamented how the use of LLMs to find bugs was wasting a lot of the Linux team's time. He explained then, "The continued flood of AI reports has basically made the security list almost entirely unmanageable, with enormous duplication due to different people finding the same things with the same tools."

Before then, during the Open Source Summit in 2024, Torvalds had described AI as "90 per cent marketing and ten per cent reality." He also said: "Let's wait 10 years and see where it actually goes before we make all these crazy announcements." It would appear, as far as Torvalds is concerned, we didn't even need to wait that long.

In his latest missive, Torvalds goes on to write: "We're not forcing anybody to use it, but I will very loudly ignore people who try to argue against other people from using it. And no, AI isn't perfect. But Christ, anybody who points to the problems at AI had better be looking in the mirror and pointing at themselves at the same time. Because it's not like natural intelligence is always all that great either."

Torvalds also writes that, "the kernel project has been and will continue to be about the technology," and he concludes his missive by saying, "we make decisions primarily based on technical merit. Not fear of new tools."

No matter how smart you are, there's always room for a little childish fun. Or an ominous threat to your rivals, one of the two. Ex-Microsoft engineer Dave Plummer interviewed the chief architect and designer of Windows NT, Dave Cutler, on his YouTube channel back in 2023, and I've just got around to the highlights after he reshared it on X.

By highlights I mean, the juicy stuff. Plummer kicks off asking Cutler about a "legend" regarding a gift sent to competing Sun Microsystems around the launch of Windows NT, and he was only too happy to provide the details.

"We decided that [Sun Microsystems co-founder] Scott McNealy was kind of mealy-mouthed, and there were some other people around that were a little bit that way too," said Cutler, directly referencing Lee Reiswig at IBM. "Somebody, and I don't know who it was... found these black cardboard coffins, and they were about two feet long."

"So we decided that we would send Scott McNealy and Lee Reiswig a coffin, and we would put a special message in it," Cutler continued. "We found a birthday card that played the Death March... so we sent one of these to Lee Reiswig, and we sent one to Scott McNealy." So far, so oddly macabre. However, the fun didn't stop there:

"At the time, Sun was running ads with... they had a dog, and the dog's name was Network," Cutler continued. "And Scott McNealy is reputed to have brought Network on the stage at one of his talks, with a fire hydrant, and had the dog go over and urinate on the fire hydrant, and it said Microsoft."

A low blow, for sure. However, Cutler and the team had a... well, let's just say it was a fitting response:

"We got some fake dog doo and put it in the box... both of these we had hand delivered, so we know that they actually showed up."

"We had a third one," Cutler helpfully adds. "I forget who we were going to send the third. The third one might have been going to Larry Ellison or somebody else... but that one never went off."

I'm sure Ellison is mopping his brow in relief. Anyway, it sure got feisty back in the day between tech nerds, didn't it? While I think the coffins may be viewed in a less positive light if they were sent between rivals today, fake dog poop? Sure thing. Better than a slanging match on X, don'tcha think?

Software development, much like making a stew that's a perfect umami bomb in every bite, is a tricky business. Every major commercial product is touched by many hands, and sometimes the chefs leave cardamom and bay leaves in the mix. Okay, perhaps I've overstretched the metaphor—what you need to know is that apparently Microsoft's Secure Boot was basically busted for the last decade.

Rather than leftover bones in the broth, old system images could be exploited to bypass a system's motherboard-level protection to execute dubious code during system boot. It's bad enough that this effectively makes Secure Boot redundant, but worse still, any malicious firmware installed this way could then survive swapping out the hard drive or persist past reinstalling your operating system.

The affected images were UEFI shim bootloaders, which were first introduced to extend Secure Boot support to Linux devices (though they can also be installed on Windows devices). ESET researchers identified and reported 11 of these vulnerable shims back in February. Microsoft has revoked the permission it once granted to the affected shims, so that bad actors can't continue to leverage them as a bypass (via Ars Technica).

At the risk of oversimplifying, 'Unified Extensible Firmware Interface (UEFI)' is a firmware architecture spec that initialises hardware and then allows it to transfer control to your OS during startup. As a safety precaution designed to root out boot kits, Secure Boot requires a cryptographically signed certificate from UEFI apps before they can run.

Shims, then, are little bridges of code that allow a motherboard's UEFI firmware to communicate with operating systems like Linux. Shims allow Linux to boot with Secure Boot enabled, without also requiring a key for every distro to be registered within your motherboard's NVRAM settings.

Third-party boot components, like shims, are often signed with the 'Microsoft Corporation UEFI CA 2011' certificate so that they play nice with Secure Boot. You may remember that some of the 2011 certificates used by anti-cheat software expired recently.

Anyway, the vulnerabilities resulting from these old shims affected both Linux and Windows users. The 11 shims were part of various tools and software packages, including Linux distros and PC diagnostics software (CERT has compiled a helpful list). Another twist in the tale is that bad actors could also introduce their own copy of an affected shim to a vulnerable system.

Microsoft only revoked the shims' permissions in June's monthly patch release. It's all well and good staying on top of these updates, but ESET have highlighted that at least one of the vulnerabilities they reported had already been well documented a decade ago. The fact that it lingered on for so long, without its permissions being revoked, feels like a huge oversight on Microsoft's part.

New York State governor Kathy Hochul has announced a year-long moratorium on new high-powered data centers. The executive order, signed on Tuesday, bars the construction of new hyperscaler data centers using 50 megawatts or more of power for up to one year.

The pause would allow state agencies to craft regulations around upcoming projects in regards to their potentially harmful effect on local communities, including water usage, noise, and power concerns (via CNBC).

"As data center development threatens to hike up utility bills, deplete our natural resources and create uncertainty for New Yorkers, it’s my responsibility to take action and lead," said Hochul. "New York will lead the way in creating the strongest standards in the nation for data center development, ensuring that when companies succeed because of New York, New Yorkers succeed too."

According to The City Reporter, while New York is yet to find itself a major part of the data center boom, around 30 projects that could become possible data centers requested connections to the power grid between 2020 and 2025.

This, among several upcoming planned data center projects, has sparked concerns from authorities and local groups that the state's infrastructure is ill-equipped to deal with a vast number of potential new data facilities, particularly as the state's average residential electricity price has risen nearly 68% since 2019.

The executive order also calls for the state Department of Public Service to create an environmental impact statement for evaluating upcoming data center projects, including their effects on water and air quality, energy, and water use while the moratorium is in place.

The governor has also directed Empire State Development, New York's economic development agency, to "issue a Community Investment Framework (CIF) within 60 days, which will provide clear guidance to local entities to help them negotiate community benefits as part of any large-scale data center deal." The framework would also include provisions for "local infrastructure improvements, child care investments, and direct financial support for their community."

Among other measures, governor Hochul is also said to be pursuing legislation to repeal sales tax exemptions for "massive data centers across the state."

The move comes amid various US lawmakers attempts to introduce similar data center construction moratoriums on a state level, as local residents continue to protest data center construction across the country, citing many of the same concerns in regards to noise, energy, water usage, and climate effects.

Earlier this year, US senator Bernie Sanders announced a bill calling for a nationwide pause on data center construction, echoing many of the same points.

According to a recent Reuters/Ipsos poll, only one in three Americans surveyed approved of the fast pace of data center construction, and most would oppose building one in their own community. Responding to governor Hochul's announcement, data center operator Digital Reality told Reuters: "We're committed to working with policymakers on solutions that support responsible growth, but a one-year pause isn't the right approach."

Meanwhile, NTT Global Data Centers CEO Doug Adams told the outlet: "The heightened scrutiny reflects a desire for greater understanding of how data centers impact local communities. We welcome that conversation."

As much as AI has its drawbacks, it'd be wrong to say it doesn't have its uses. Case in point, Microsoft's previous commitment to leverage AI vulnerability detection in Windows security updates looks to be bearing fruit, as the latest Patch Tuesday release fixes an astonishing 622 CVEs across its products.

Which is a new record, according to The Register, more than tripling the previous 206 CVE figure. Over 500 of those security fixes are Windows-related, including a fix for a zero-day vulnerability in Windows BitLocker, possibly related to exploits uncovered by security researcher Nightmare-Eclipse earlier this year.

The new cumulative update for Windows 11 is entitled KB5101650, and it's not just CVE issues that receive a tune-up. The update also patches a nasty little bug that could potentially take up 500 GB of your storage space unnecessarily, related to a file within the Capability Access Manager.

The feature is responsible for Windows 11 app permissions, but a file entitled "CapabilityAccessManager.db-wal" could potentially balloon in size, taking up precious storage space amid the current SSD and memory crisis—which is unfortunate timing. Anyway, the bug is reportedly squashed, so we can all sleep easy in our beds tonight.

KB5101650 also allows users to defer Windows updates to a specific day with a 35-day period, which is an Insider feature that now looks to be rolling out to all Windows 11 PCs. Windows Latest has experimented with delaying further than the 35-day limit, and found that you can un-pause and then re-pause an update for as long as you want. Which might come in handy, if anything particularly system-breaking comes up.

Speaking of which, Microsoft warns that "This update might not be available for a limited number of Dell devices with Intel processors," which is apparently down to an incompatibility issue that can "potentially cause unexpected shutdowns, poor performance, increased heat, and battery drain."

"We are working together with Dell to prevent the affected models from experiencing the issue and plan to release a resolution for affected devices in the coming days," says MS. Well, it couldn't all be good news, could it?

Just over a year after Lucasfilm, the production company bearing his name, declared creative bankruptcy with a risible display of AI-generated 'aliens,' George Lucas has offered his take on the tech. It's, ah, well it's not great.

In a chat with A Rabbit's Foot (via Kotaku), Lucas alighted on the topic of other directors' hostility to new (for a certain definition of 'new') tech. "I have a lot of friends who are on the Film Foundation with me, that's dedicated to saving old movies, and some of them say 'I'll never do digital. Lawrence of Arabia was shot with film.'" Lucas thinks that's a bit daft: "It's the moving image. That's what it is. It's not a technology, it's an idea."

Lucas goes on to apply this philosophy to AI and the backlash against it. "Artificial intelligence means it's much easier for us to make movies. It's very much like sitting here saying, 'Well, I believe the horse and the buggy is really where it's at. These cars, they break down, they need gas, there's all kinds of problems with them and pretty soon they'll be making them into tanks, and then they'll be killing people. It's terrible.'"

And then, Lucas says the same thing you've heard from countless AI boosters: "There's nothing you can do about it. That's progress, it's the future."

It's not entirely surprising that Lucas would be bullish on AI. As a director, he's always been someone trying to push the limit on new technology. In some of his films—the original Star Wars trilogy, for instance—that's had the impact of creating groundbreaking, world-historic movies. In others—the Star Wars prequel trilogy, for instance—it's had the effect of slapping actors in front of tech which was not yet ready for prime time.

Of course, AI feels qualitatively different to, say, digital cameras. The former is tech that was developed by more-or-less stealing vast oceans of original, human-made work in order to equip computers with the capacity to digest them into a sort of vaguely novel composite mulch, while the latter is digital cameras. It feels a little obtuse of Lucas not to grapple with that.

To the extent that Lucas does grapple with the drawbacks of AI, he seems to believe we can use AI to solve them. "If you want AI that tells you when something is fake and where it came from, AI can do that. Humans can't, we're not that smart. The whole idea is you're a human being, you're responsible for what you say and what you do, and if you're doing something that's illegal you should be punished for that. Whatever you do, you should be recognised. It's just like real life."

IBM's share price just dropped by a whopping 25%. That's thanks to IBM's CEO, Arvind Krishna, saying the company didn't adapt quickly enough to the industry moving towards spending less on software and more on data centre infrastructure (via CNN).

As noted by CNN, this puts the company in the vicinity of its worst day ever, which was Black Monday in 1987. Although it should also be noted that this steep drop occurred during pre-market trading, which tends to be more volatile than in-hours trading. We'll have to see where the chips actually fall by the end of the day.

There's also the fact that although it's a big drop for a single day, it's just returned things to how they were back in mid-May, with the stock price sitting at around $215. That's already climbed back up ever so slightly to around $220.

According to CNN, the company CEO explained: "What played out was worse than our expectations. We did not adapt and move quickly enough... While we anticipated some supply chain related impact in our expectations, we did not anticipate the magnitude of the capex reprioritization."

"These conditions require our teams to execute perfectly, and this quarter we faltered. These are not excuses, but they are realities."

Given this tone will have been directed at investors, it's obvious why the share price has fallen. Investor calls and previews are times for presenting as good an image as possible, and given this context, presenting "not excuses" but "realities" isn't likely to inspire much confidence.

IBM is now largely a business-to-business software solution and consulting company, and it's understandable how the once-dominant behemoth could therefore have struggled to make the most of the new AI data centre-centric industry. That being said, the company does still have its foot in hardware, as it recently announced the "world's first" sub-nanometre chip tech.

The CEO's comments were a preview of the actual reporting of the company's second-quarter earnings. Those are set to be reported next week, on July 22.

Say what you want about Windows—I've certainly said my fair share—but recent months have shown at least that Microsoft is willing to make some positive changes. Now, at least some of these are coming to fruition, as the company is releasing an improved Windows start menu search box for Insiders.

The changes are ones that do look genuinely substantial for, well, probably anyone who regularly uses a Windows PC. They include:

• A calmer home screen
• Clearer results
• No promotional content in web results
• Choice over whether web and MS store suggestions appear
• Local results prioritised when they're a better match
• Tuning to which Windows settings appear highest in results
• Improvements to surfacing the correct files
• General reliability improvements (reduced issues/crashes)

Obviously, a lot of the proof will be in the eating of the pudding. The improvements to reliability and search surfacing the correct files, for instance, aren't something to gather from screenshots alone. But the screenshots that Microsoft does provide for some of the other changes are promising.

In particular, I like the simplified and cleaner menu when searching, showing only a list of recent searches. I also like the preview pane for files and the fact that file extensions aren't hidden.

Probably the best thing, though, is the ability to disable web and app store results. I can't remember the last time I wanted to search for something online via the Start menu. I can, however, remember the number of times I've been bombarded by web results when I only wanted to search locally. I'm sure many can relate. Previously, you couldn't disable this without messing with the registry.

At any rate, changes are most certainly afoot, and I'm excited for this Insider build to roll out in a standard release. It's these 'little' quality of life improvements that could make Windows enjoyable to use once again, if Microsoft keeps in this direction.

I'm pretty staunchly opposed to the use of generative AI—for me, it's the one-two punch of dubiously sourced datasets and the argument that these models can replace the human creatives they so often rip off. That said, even I'm a little bit intrigued by AI's application in cybersecurity.

Case in point, Microsoft recently shared that it is deploying AI to "identify [issues] faster, prioritize risk, and scale vulnerability discovery across the Windows codebase" as well as "reduce the time between discovery and customer protection." Specifically, Microsoft Security leverages a multi-model agentic scanning harness—or MDASH, for short.

MDASH uses multiple different AI models, including "leading third-party AI vulnerability discovery models," on dedicated Cloud infrastructure to scan for vulnerabilities within Windows.

The executive vice president of Windows + Devices, Pavan Davuluri, explains, "A scanner pipeline scans critical binaries and validates candidates using multi-model debate across multiple model families. Confirmed candidates then flow to a separate, Windows-specific prove pipeline that helps eliminate remaining false positives, so only the highest-confidence findings reach the engineering team."

Multiple times, the emphasis is placed on the use of AI tools "to reduce the time from discovery to protection," whereas 'human expertise' is still what handles key security decisions and fixes.

Davuluri goes on to add, "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release. This is evidence that defenders are getting better at identifying and addressing issues. Our focus is to effectively utilize these AI tools to support faster protection, stronger engineering systems and more actionable guidance for customers."

Microsoft is far from the only company leveraging AI, with Firefox's CTO raving about Claude Mythos' bug-hunting capabilities after it found 271 vulnerabilities in the browser earlier this year. Last year, we also saw an AI hold the top spot in a leaderboard that ranks people who hunt for system vulnerabilities.

Obviously, I'm still not thrilled by the fact that these cybersecurity applications are necessitated by threat actors increasingly using AI in their attacks. For example, one AI-assisted hacking group hit targets with a complicated 'social engineering' scam involving deepfaked CEOs, spoofed Zoom calls, and a malicious troubleshooting program.

That said, both LLMs and AI agents can also be manipulated themselves, with security researchers finding that both bad maths and even poetry can be leveraged to get around AI models' safety guard rails. With all sides leveraging machine learning to some degree, it's hard not to feel like it's a bit of a race to the bottom—or wonder which side will win out.

One of the unfortunate drawbacks of social media is that anyone, and I mean anyone, can now have a public feud that the rest of us have to witness. Case in point, OpenAI CEO Sam Altman and Elon Musk are having a tiff on X, and it's starting to get out of hand.

Responding to an X post from Elon Musk, in which the SpaceX CEO and world's richest person declared that Altman "takes scamming to a whole new level," the OpenAI chief said: "Homeboy you're the one selling public market investors on short-term space data centers."

To which Musk replied: "We start flying them next year. Maybe you can come see them if your parole officer approves."

"After stealing an open source AI charity, you then stole all of Apple's phone technology! Wow." Musk continued. "What do you plan for an encore? That's tough to beat."

The open source AI charity claim relates to the much-reported Musk vs Altman trial earlier this year, in which the former accused Altman and OpenAI of breaching a non-profit contract by pivoting into a for-profit business, with Musk alleging he had been deceived into donating $38 million earlier in the company's history.

Musk lost the trial after an advisory jury decided the statute of limitations prevented a verdict in his favour. As for the Apple claim, the company has filed a lawsuit against two former employees who now work for OpenAI, alleging theft of intellectual property.

Apple claims that one of its former staff members "surreptitiously accessed and downloaded dozens of Apple’s confidential hardware-related files, including voluminous, detailed information about unreleased products, engineering presentations, technical specifications, and proprietary project data," before using that info to help OpenAI, among other complaints.

As you would imagine, the replies to Musk and Altman's posts regarding these issues are full of cheerleaders for either side, along with various other allegations against both tech chiefs. Because it's the internet. And civilised debate is apparently a rare thing.

As is, I don't know, arguing in private? Reading these posts is a bit like stumbling into a WhatsApp group you weren't supposed to join. Both seem to have withdrawn from the internet slappyfight for now, hopefully because someone from their respective legal teams has told them it might not be the best idea.

Or perhaps a second round is in the works, who can guess? Still, there's little love lost between the two, and a whole lot of drama playing out on a very public stage. Anyone got any popcorn?

If you ask Microsoft Copilot if it's a web app, it answers in the negative. Technically, as the AI points out, Copilot now interfaces with you through an Edge-based web app installed on your Windows 11 PC, but the model lives elsewhere in the cloud.

And said Copilot app is getting a helpful new feature, according to Windows Latest, referred to as PC Insights. This will allow it to connect to Windows APIs and analyse your system hardware, answering questions like "what is my current CPU usage" and helping you find what might be slowing down your PC.

Other example prompts found by Windows Latest include "Do I have enough space for a 100 GB game," "What graphics card do I have," and "Is my antivirus running?"

The feature is said to be currently rolling out to Copilot US users, and sounds rather useful, even if it can't directly fix PC performance problems by itself. Unfortunately, the web app can be something of a RAM hog, which raises the possibility that Copilot itself may be contributing to your dog-slow PC performance on a RAM-limited machine.

Windows Latest recorded 791.7 MB of RAM usage from the Copilot app at idle, suggesting it can reach up to 1 GB of system RAM usage in total. I've left the Copilot app open in the background as I write this article, and it's currently sitting at around 560 MB—making it the third most RAM-heavy application currently running on my PC.

That might not sound like a big deal, but anyone using Copilot to help find resource-sapping applications running in the background may find it's the app itself that's taking the biggest chunk of precious RAM space. And it's not like we're living in a world where extra system RAM is cheap and easy to obtain.

It's not the only RAM-sapping offender I have to bat away on a regular basis, either. The WhatsApp, err... app is also a web-based affair these days, and regularly carves out 1 GB+ chunks of my system resources. Which seems a bit rich, given the previous, non-web app implementation barely used any RAM capacity at all.

Although Microsoft has committed to making Windows 11 leaner and meaner in response to user critique in recent months, it still feels like a bloated OS in comparison to... well, almost any other operating system you can think of.

And while I welcome the idea that Copilot will soon be able to help less-computer-minded users track down potential system problems, it seems like one of the most useful things it could do to improve performance would be to shut itself down entirely. Which is... not the greatest state of affairs, let's be honest.

First reported by Tom's Hardware, Linux-based gaming just got a massive shot in the arm thanks to developer Noah Cagle. That's right, baby: Hannah Montana Linux is back.

Ok, maybe less a "shot in the arm" and more a "completely neutral development"—more on that in a second—but HML is a fully fledged OS capable of doing all the OS-y things you could possibly want, and it won't take screenshots of your desktop or try to sell you a chatbot either. "If you want to," said Cagle in his video about the project, "you can use Hannah Montana Linux as your main day-to-day operating system."

Cagle's project is an "update"—perhaps, arguably, a "remake" or "homage"—to a 2000s original with a delightfully retro webpage. But the OG Hannah Montana Linux has not been updated since 2009, leaving it unable to access most of the modern internet⁠.

Which is good, because a lack of security updates means it would probably be super vulnerable to threats if it could. Little is known about the 21st Century Prometheus who gave us this gift, nor why they ultimately decided to turn their back on us.

Cagle built this updated OS on the Debian distribution of Linux and the KDE Plasma desktop. For context for my fellow knuckle draggers who exclusively interact with this stuff via Steam Deck, Steam OS is built on the Arch Linux distribution, but uses that same Plasma desktop. The key differentiation for Cagle's project is that, out of the box, it boasts a striking pink and purple color scheme, custom Hannah Montana icons, and a remastered 1080p version of the original HML's 4:3 wallpaper.

But can it game? As a skin of Debian Linux, we just have to look to how the parent distribution handles things, which is to say "pretty well." Bazzite and SteamOS seem to be preferred for gaming largely on the basis off their user friendliness, while Valve's black magic Proton compatibility layer is designed to work across Linux distros. You can game on Debian, so you can game on Hannah Montana Linux. But you probably want an AMD GPU: Nvidia still doesn't play nice with Linux.

And, increasingly, we on the PCG staff are getting Linux gaming radicalized, with news writer Joshua Wolens leading the charge. Noah Cagle's open source Hannah Montana Linux is free for your enjoyment on GitLab, and you can keep up with the developer's future projects via YouTube.

Indie creator Robert Yang—who makes good, funny, incandescently homosexual videogames—has an ongoing project. Radiator Forever is a free megabundle/remaster of Yang's experimental, short-form games that includes titles like Hurt Me Plenty (description: "consent, negotiation, spanking, and aftercare"), Succulent ("juicy cheek physics and demonic possession") and Stick Shift ("autoerotic night-driving, manually pleasure a gay car").

I'm sure we both agree that this news piece would have been worth writing just to get a chance to tap out "manually pleasure a gay car," but there's more: in a recent blog post on the experience of putting together Radiator Forever, Yang shone some light on the ongoing fallout from last year's purge of "adult" material from storefronts like Steam and Itch.io, for which right-wing anti-porn group Collective Shout claimed credit after putting pressure on payment processors, as well as on the impact of regional censorship laws like the UK Online Safety Act.

With indie storefront Itch.io forced to more-or-less shadowban adult games on its platform, projects like Yang's are impossible to find on there, driving him back to Steam. "Of course I will continue using and supporting Itch as a much-needed alternative to Steam, but the cold fact is that Itch reaches a lot fewer people these days," he writes.

But even on Steam, these sorts of games continue to run into problems. "Unfortunately Valve has tagged my game as "frequent nudity and sexual content" and now hides it from most Steam users," writes Yang. "Since no one changes their default settings, this amounts to a delisting / shadowban from 99% of the Steam user base.

"While I was careful to avoid explicit nudity, compliance-in-advance is never enough to appease a zealous censor, and the Steam content reviewers have decided the game's general "nature" was just too gay, regardless of my good faith efforts." Yang points to Steam's no-appeal ban of Horses to suggest that "Valve isn't interested in a nuanced conversation or in admitting any wrongs in moral judgment.

"If video games are a form of protected free speech, I do wish there was a bit more hand-wringing over blocking access to my games that were designed directly to be political speech," says Yang. "Valve loves it when Cyberpunk 2077 and Baldur's Gate 3 throw customizable genitals at you in the first five minutes, but of course I can't, because I actually have something to say about genitals!"

It's an eminently understandable frustration, and a reminder that—though the discourse around last year's censorship of online storefronts has died down—the reactionary crusade against adult content continues to impact creators.

Roblox has done a lot of crossovers and collaborations, but the new one announced today really leaps out at me. The Rolling Stones, the world's greatest rock and roll band, is coming to Roblox in a new game based on the band's 60-year history.

"Players will encounter various parts of The Rolling Stones' legacy trapped inside of colorful crystals inspired by the band's 2023 album Hackney Diamond," the press blast explains.

"Players progress through decades representing the band's eras, working together to find and shatter the crystals while an iconic Stones track from that time soundtracks the gameplay. Doing so powers up a massive tongue-and-lips that releases a surge of rock and roll energy to disrupt each decade and unlock the next — culminating in a globally shared interactive performance that evolves based on community participation."

Am I irritated, perhaps to an unreasonable extent, by this? Maybe. The Stones are the epitome of rock and roll: "Sex and drugs" are essentially synonyms for Mick and Keith, but you've also got a spot of devil worship in the mix, one of the most notorious incidents of violence in rock history, and through it all, some of the most god-tier music ever made. Have no doubt, the Stones are a full-steam money-making machine, but underneath that corporate engine of commerce the spirit of rock remains pure and true—or at least I like to imagine it's still in there somewhere.

Stuff like this kinda takes the wind out of those sails: I destroyed my hearing for this? It's soul-deadening, yes, but it's also kind of weird. I mourn the dessicated corpse of rock and roll because, well, I'm old. But is your average 14-year-old Roblox die-hard really interested in any of this? As colleague Chris Livingston more aptly put it, "Nothing teens want to see more in their game than some 85 year old men singing songs older than their parents."

(Mick Jagger, for the record, is 82; his current wife is 17 years younger than his oldest daughter. Keith Richards is also 82, while Ronnie Wood is a relatively youthful 79.)

It does make me wonder: Is Roblox bringing culturally significant music to new audiences (do the Stones even need to reach new audiences at this point?), or is all of this just kind of weird—a big-in-name crossover that will ultimately prove more baffling than enthralling for its intended audience?

But then, it works the other way too. As part of the collaboration, Roblox has invited community creators Jazzyx3, CASKA’s HAUS, Touzled, Blizzei, DIONESS, morphist4u, WhoseTrade, Empyro, Bad_B0y, raekaro, Spiraxy, Valkenheim, DuckXander, Clockset, and dvdko to "to turn The Rolling Stones' globally beloved logo into not only exclusive cross-platform avatar accessories, but also a limited-edition, co-branded physical item available to purchase via an in-game Shopify integration that connects directly to the band's online store." And I, a man with fond(ish) memories of seeing the Stones on the Steel Wheels tour, suddenly feel like I need to go outside for a while. Or maybe just have a lie-down.

The Rolling Stones Roblox game goes live today, July 10—it should be live by the time you read this—and will culminate in an "epic finale show" running July 17-19. Rock on.

Data centres require a lot of energy to run. It's why it's so frustrating to hear AI's major players attempt to play a game of misdirection by making claims along the lines of a single LLM prompt requiring but a fourteenth of a cup of tea. Worse still, as big tech continues to build out its AI infrastructure, data centres' power demands are only set to increase.

Worldwide data centre electricity consumption is expected to rise from 447 terawatt-hours in 2025, to 565 terawatt-hours in 2026. That will mark a 26% year-over-year increase, according to Gartner's latest forecast.

Data centres' power demand globally is expected to rise 27% this year, peaking at a predicted total of 132 gigawatts. That's up from 2025's 104 GW total, with analysts expecting to see power demand continue to rise—according to Gartner, data centre demand may cross the 290 GW mark by 2030.

Gartner's Director Analyst, Linglan Wang, explains, "Surging demand for compute-intensive AI workloads is driving unprecedented data center power growth, while AI capacity is now constrained by power availability, making data center power security the new battle ground for scaling and protecting margins in the global AI race."

Gartner estimates that AI-optimized server adoption will account for 31% of data centre power consumption this year, having grown by 84.2%. By 2027, the power demands of AI servers is expected to grow by 47.8%, surpassing that of 'conventional servers.' Comparatively, the power demands of the 'conventional server' segment grew by about 1.2% in 2026, and is on a trajectory to grow by 2.4% in 2027.

Given that recent analysis of Google's latest environmental report suggests the company's energy consumption is on a trend of exponential growth, an upward trend across the industry is unsurprising. It's also perhaps worth noting that not all of Google's energy comes from renewable sources, and that the total electricity consumption for this one company last year was 43 TWh. That's almost 10% of Gartner's global numbers.

Add to that a reported 80% of the world's data centres have been built in less than optimal climates, having to compensate with a whole lot of temperature control systems, and environmentally, things start to look all the bleaker for the climate conscious. In fact, Gartner lists the power consumption of the 'Cooling and other Infrastructure' data centre segment as having grown by 22.6% in 2026.

Not only that, but increased demand from data centres will likely tax local power infrastructure—not to mention any of the other reasons why data centres make especially poor neighbours.

AI slop. If you've heard the term, there's a good chance you are similarly exasperated with the onslaught of low-quality, AI-generated… well, slop. One team is now charging up to $10,000 per project to try and cut down AI-generated slop code and is, rather ironically, using AI to do it.

As reported by Tom's Hardware, the team is called Slopfix, and their aim is to cut down unnecessary AI-generated code by a certain amount, taking a percentage of the $10,000 fee depending on how much of the target they hit. The example given on their website is to cut down 100,000 lines to 35,000. This means, if they remove 65,000 lines, they would claim $10,000. If, however, they managed to cut it down by 32,500 lines, they would instead get $5,000.

The tool they use? Claude Code. But the team says they keep it "on a very short leash". The team of three claims to have "thirty years of combined experience about what maintainable code looks like" and says "the agent doesn't get a vote."

One of the biggest problems with vibe coding is not the eventual output, but that building on that codebase can be unstable. AI agents tend to produce the favoured output, but can't 'think' about the next steps, so AI code is often filled with duplications and inefficiencies, hence "AI slop".

This is a pretty common problem right now. Just a few months ago, the team behind a popular PS3 emulator asked users to stop "submitting AI slop code", and open-source game engine Godot was drowning in AI slop code at the start of the year. Just last month, Godot stopped accepting AI-generated code contributions as it couldn't "trust heavy users of AI to understand their code enough to fix it".

Cleaning up AI code doesn't fix problems with users not understanding their output, but it could make it easier for AI agents to build on. Whether or not clients will want to pay tens of thousands of dollars for a different team to use the same tools as them to clean up their codebase is anyone's guess, though. I, for one, am sceptical of whether or not the Slopfix website is human-made, and the text on the site doesn't give me the greatest confidence.

Still, one question sits in my mind. If those prompting AI-generated code are paying AI agents to fix up its mistakes, who makes sure that those AI agents are acting efficiently? And if the three engineers behind Slopfix are manually going through the code, what's the point of the coding bots in the first place?

As a special treat to me personally, Valve has released a new version of its Proton compatibility layer—the special sauce that lets Windows games run on Linux platforms like the Steam Deck, Steam Machine, and your desktop if you're cool. Proton 11 is out now, freshly rebased on Wine 11, and accessible to Linux users via the compatibility tab in your Steam settings, or on a per-game basis via the compatibility tab in your games' individual Steam settings pages.

This is the Proton version that went into beta last April, bringing support for Deadly Premonition (a personal all-timer) to Linux among a raft of other fixes. Now it's out for real, with all manner of tweaks and patches and updates, the most important of which for me is "Fixed KDE window maximization support." I kept having issues with that on my desktop, which is hooked up to my TV.

Anyway, the complete list of now-playable games is a real hodgepodge, ranging from 1996's Resident Evil (which only hit Steam in April, explaining Valve's 2026 concern for it) to Metal Gear Survive, of all things. You can find a full list of supported games in the patch notes below.

I'm always a little surprised to hear of games 'getting support' in Proton, simply because my own experience with it has been everything I want to play, unless it is an only-came-out-today release, just works. But I imagine the work of ensuring true and universal compatibility across the entire stable of Windows games is never actually, truly finished.

Anyway, the headline item is that playing games on Linux is somehow even cooler today than it was yesterday (which was very cool, all the kids agree). Here are the full patch notes for Proton 11.

Proton 11.0-1 Patch notes

• Now playable (previously worked with Proton Experimental):
  • Universe Generator: The Golden Sword
  • DCS World Steam Edition
  • Resident Evil (1996)
  • Resident Evil 2 (1998)
  • Dino Crisis
  • Dino Crisis 2
  • From Dust
  • Blaite
  • Don't Die Dateless, Dummy!
  • METAL GEAR SURVIVE
  • Warhammer: Vermintide 2
  • Metal Fatigue
  • SHOGUN: Total War
• Newly playable:
  • Unknown Faces
  • Gothic 1 Classic
  • X-Plane 12
  • Breath of Fire IV
  • Deadly Premonition
• Fixed video playback in She Sees Red.
• Fixed rendering of certain symbols with Ukranian language option in Chambers.
• Fixed voice chat in Phasmophobia lobby for desktop players.
• Improved rendering of Rockstar Launcher popups.
• Fixed Sea of Solitude showing black screen on Proton.
• Fixed many EA games being unplayable after a recent EA Desktop update.
• Added support for SteamWorks SDK 1.64.
• Fixed Steam Overlay not working correctly with many EA games.
• Improved emoji support in Idle Trillionaire.
• Fixed intro video playback in Crimson Desert.
• Fixed Rei and the Floating City not being playable with gamescope.
• Fixed mouse movement behavior in Call of Duty 2.
• Fixed rendering issue in launcher of DEATH STRANDING 2: ON THE BEACH.
• Fixed a crash in HELLDIVERS 2 happening in high enemy-count missions.
• Fixed random hangs in Killer Inn.
• Fixed Killer Inn not launching on Steam Decks and other machines with /tmp sizes lower than 10GB.
• Fixed Killer Inn not being able to connect to Square Enix account.
• Fixed graphical gliches in Duck Game that happen with newer Wine Mono versions.
• Fixed REDLauncher (e.g. as seen with Cyberpunk 2077 and The Witcher 3) taking a long time to exit.
• Fixed Hollow Knight wrongly registering Steam Deck's Steam button as a left trigger after a game update.
• Fixed controller hotplug not working for 8BitDo Ultimate 2C and other controllers that expose multiple HID devices.
• Fixed Xalia intermittently failing to start when game is launched.
• Improved timezone detection.
• Fixed video playback in 我打不过漂亮的她们.
• Fixed lag spikes caused by Steam overlay being opened for prolonged time.
• Fixed VR controller tracking in Microsoft Flight Simulator.
• Improved VR support so that No Man's Sky VR mode is playable again.
• Fixed black blocks in dialog windows created by ARC Raiders and The Finals.
• Fixed glitchy video playback in Satisfactory.
• Fixed Rec Room not being playable after a recent game update.
• Fixed THE KING OF FIGHTERS XIII GLOBAL MATCH freezing when playing videos from the gallery.
• Fixed intro video not looping in Blazblue Centralfiction.
• Made more games using MonoGame playable.
• Improved support for Kodi media player.
• Added System Voice support for multiple languages in Phasmophobia.
• Fixed KDE window maximization support.
• Fixed Brighter Shores window resizing support.
• Improved Space Engineers dual monitor support
• Fixed scaling issue with Arma Reforger when changing window modes.
• Fixed Dungeon Siege tools showing up at character's feet.
• Improved focus loss behavior with RoBoRumble.
• Fixed rendering issue in Hellsinker. launcher.
• Fixed stutter from keyboard input in Titanfall 2.
• Fixed audio playback when playing intro videos in BIRDCAGE.
• Fixed hang after METAL GEAR SOLID 2: Sons of Liberty - Master Collection Version end credits.
• Fixed Disintegration getting stuck on the first loading screen.
• Fixed CHRONO TRIGGER flickering in windowed mode with certain resolutions when using Gamescope.
• RAGE no longer has focus issues when Alt-Tabbing on KDE Wayland.
• The Elder Scrolls IV: Oblivion Game of the Year Edition (2009) no longer has problems minimizing after Alt-Tabbing.
• Resident Evil 2 should no longer have issues when changing resolutions on GNOME.
• Call of Duty: WWII should no longer fail to render properly in fullscreen native resolution on setups with dual monitors.
• Age of Empires II: Definitive Edition no longer has issues with keyboard registration after refocusing the game.
• Fixed Far Cry 4 randomly hanging during launch.
• Updated Xalia to 0.4.9:
  • Fixed lockups happening when interacting with the EA App.
  • Added controller support for the MC Visual C++ 2010 redistributable installer.
  • Improved gamepad binding support for Graze Counter.
  • Added controller support for launchers of the following games: Red Faction®: Armageddon™, Final Fantasy X/X-2 HD Remaster, Sonic the Hedgehog 4 Episode II, Hellsinker., Disney Bolt, STAR WARS™ Starfighter™, Rocket Knight, Puddle, Zero Escape: The Nonary Games, Metal Slug XX, Mortal Kombat Komplete Edition, Disney Epic Mickey 2: The Power of Two, Batman: Arkham Asylum GOTY, LocoCycle, Ys SEVEN, Resident Evil (1996), Resident Evil 2 (1998), Resident Evil 3 Nemesis (1999), Dino Crisis, Dino Crisis 2.
  • Fixed Xalia wrongly selecting option from unfocused tabs in Rayman: Raving Rabbids.
  • Added controller support for DirectX Runtime Components installer when launching BioShock for the first time.
• Rebased on top of Wine 11.0.
• Added FEX-2605 for ARM64EC builds.
• Updated vkd3d to vkd3d-1.19-139-g30b93dcea8b0.
• Updated dxvk to v2.7.1-467-g83e503b4ae6d from Proton 11 support branch.
• Updated dxvk-nvapi to v0.9.1.
• Updated Wine Mono to 11.0.0.
• Updated vkd3d-proton to proton-20260410

A cybersecurity firm associated with the Chinese government reportedly has concerns about Anthropic's Claude AI models and has warned users against trusting it, at least before updating to the latest version.

As reported by Reuters, the Chinese National Vulnerability Database (NVDB) claims that recent Claude Code versions have a monitoring mechanism that transmits sensitive information to remote servers without consent from the user. This allegedly includes geographic location data and user-identifying information. This was all posted via the agency's official WeChat account, according to the outlet.

It reportedly affects users on version 2.1.91 and goes up to version 2.1.196. 2.1.196 was eventually replaced by 2.1.200 on July 3. The NVDB encourages users to either uninstall if they use the impacted version, or simply update.

As well as this, the NVDB has taken this opportunity to urge users to tighten controls and strengthen monitoring techniques for the data they allow Claude Code access to. I have reached out to Anthropic for comment on this story, but have not yet received a response.

This is not the first time that Anthropic's coding tool has drawn ire in China this month. Last week, Alibaba reportedly banned its employees from using Claude at work due to fears that it could identify Chinese users with information fed to it.

Anthropic's story with Alibaba goes deeper than this, with the Claude creator accusing Alibaba of training its AI models on Anthropic's work. Anthropic claims that Alibaba, between the end of April and the start of June, generated over 28 million exchanges with Claude through close to 25,000 fraudulent accounts to harvest information.

Interestingly, Anthropic has been blocking access to Chinese companies for some time, and those companies have been reportedly getting around this restriction through overseas subsidiaries and even plain old VPNs. Anthropic is, according to the Financial Times, looking to crack down on these workarounds in the future.

The relationship between Anthropic and China seems pretty strained right now, and it seems likely that Chinese agencies are looking to swap to homegrown AI models sooner rather than later.

If you've found yourself with much less storage than you otherwise anticipated, to the tune of hundreds of missing gigabytes, there's a chance you've fallen victim to a new Windows 11 bug. That, or you're not very good at managing your storage (same).

As spotted by Windows Latest, this new bug involves the CapabilityAccessManager. This function in Windows 11 is responsible for app permissions like allowing apps to access your camera or microphone. It's a file that can reportedly grow in size, but it shouldn't take up to 500 GB, and it definitely shouldn't hold onto that storage indefinitely.

If you're wondering if you've been affected, you should be able to spot an anomaly if you go into storage settings and click on 'show more categories.' If 'System & reserved' is hundreds of GB large, or close to that, the bug has hit you.

Unfortunately, this method will only show you the problem if it's obvious and very large. Windows Latest does show another method for spotting the problem, using an elevated version of the command prompt. With Command Prompt on and run as administrator, type in the following command:

• robocopy "C:\ProgramData\Microsoft\Windows\CapabilityAccessManager" "%TEMP%\CAMCheck" /L /B /R:0 /W:0 /BYTES /NP

From here, you should be able to spot any anomalies in storage size. Some users have reported CapabilityAccessManager taking up to 500 GB in storage, with others reporting anywhere between 70 GB and 200 GB.

If you have been affected and want that storage back as soon as possible, you can opt to update to Windows 11 KB5095093 (builds 26200.8737 or 26100.8737), and this should fix the problem. You can get this update by clicking on Windows Update in Settings, going into advanced settings, and then clicking on optional updates. From here, you can check for optional updates and grab the latest patch.

If you don't want to willingly join optional builds of Windows 11, this update is expected to trickle down into a traditional Windows 11 update at some point in July. So, you can just hang on until then if it's not bothering you.

The next Windows 11 update comes with more than just that fix. For one, it introduces "a quieter, more focused Widgets experience", as it will no longer open on hover, and being more simplistic in use. It also introduces improved speed in File Explorer, new accessibility settings, and better Bluetooth stability among a greater range of devices. It's nice that this fix comes with some decent changes, but Microsoft's ability to accidentally implement the weirdest bugs is second to almost no one, other than maybe Dwarf Fortress.

A data centre is usually where the so-called magic of any larger scale AI workload actually happens. In order to fulfill its AI ambitions, big tech has overseen a rapid infrastructure build out. Resource-intensive and often loud, they make for exceptionally poor neighbours.

Wisconsin residents filed a class-action lawsuit against Microsoft on Wednesday, alleging that the company's Fairwater data centre situated in Mount Pleasant emits "unreasonable and excessive noise onto Plaintiffs’ properties." The suit is seeking an unspecified amount in damages. The filing alleges that the source of the noise pollution is "diesel generators and heating, ventilation, and air conditioning (HVAC) systems, including chillers, cooling towers, air-handling units, and condenser fans" (via Law360).

Speaking of class, the filing defines this as "All owner-occupants and renters of residential property residing within one and one-half (1.5) miles of Defendant’s Data Center at any time within the applicable statute of limitations." Reportedly, that could end up including more than 1,000 homes.

It's also alleged that this industrial noise can see the community facing levels between 48 to 60 decibels. However, the residents also allege the data centre creates a 'low hum' of infrasound that is not easily measured by the A-weighted decibel scale, and therefore is not subject to most municipal noise ordinances. One plaintiff claims they had to change their work schedule as "the constant noise [affected] his sleep."

As for Microsoft, the company committed $7 billion to the construction of Fairwater in the hopes it would become the 'the world’s most powerful AI data center'. Microsoft has been aware of some of its sound issues since at least April this year. It said in a blog post at the time that it was investigating the cause and that, "Microsoft prides itself on being a good neighbor in the communities where we operate."

On June 18, the company claimed to have put a number of noise mitigations in place, writing, "Several neighbors confirmed what our independent monitoring showed: that these mitigations fully resolved the issue."

However, the class-action lawsuit was then filed July 1, implying these mitigations may not have pleased all parties affected. The filing alleges, "Defendant has failed to follow proper industrial practices to prevent the offsite emission of noise, and has failed to absorb, capture, mitigate, and/or prevent noise from escaping its Data Center, thereby invading the homes and properties of Plaintiffs and the Class."

For years now, security researchers have been preparing to fight against cryptanalytic attacks from future quantum computers. But Microsoft has had to push up its timeline, as those attacks seem much closer than otherwise anticipated.

As reported by Bleepingcomputer, Microsoft recently published a blog post informing users of its new deadline. Microsoft plans to accelerate its Quantum Safe Program (QSP) to be quantum-apocalypse-ready by 2029.

Microsoft says that post-quantum cryptography "was framed as a future problem: important, inevitable, but distant. That perspective is evolving as technology advances and organizations prepare for the scale and complexity of the transition ahead."

Q-Day (or Y2Q) is the name given to the moment when quantum computers become so powerful that they can crack current encryption techniques with ease. That is what the original timeline was based around. Now, though, Microsoft believes "cryptographically relevant quantum computers could arrive sooner than previously expected—and the work required to prepare is significant so organizations need to start now."

There's also the 'harvest now, decrypt later' method to consider, in which threat actors take in whatever data they can find now in order to analyse and crack the info when quantum-cracking technology comes online. This means that companies are looking to make their data secure from quantum decryption in advance. It's not good enough to be secure now. Companies have to be secure in the future.

Most computers right now encrypt data with algorithms based on mathematical problems that can be easily solved with quantum computers, so post-quantum cryptography is intended to go one layer deeper.

However, even if the work is successful, it is still unproven. We still don't know if a future quantum computer could potentially crack newly made algorithms, partly because… well, we don't have access to future technology. Microsoft argues its QSP goes beyond future cryptography and is only part of a "broader effort to strengthen long-term resilience across identity, infrastructure, data, and supply-chain security."

From here, Microsoft says that customers should make themselves aware of the plan to bring forward this quantum safe timeline and learn more about how to implement it when they do. It seems like the next few years are very important for researchers, and security developers will have to do their best to outpace attackers.

As of a few days ago, Anthropic deployed its Claude Fable 5 AI model after the US temporarily restricted access. Now it has already been used to port the 2003 video game Command & Conquer: Generals – Zero Hour to iOS. It seemingly needed the source code, previous ports, and some human tweaking to get running.

This is according to the lead of product and design at Google AI Studio, Ammaar Reshi, who announced the port on X on July 4. Reshi says this specific port "had a chain of giants to stand on" because it used previous port efforts and modernisations. It is a direct fork of The Super Hackers' Linux and macOS build of the game.

What is unique about this specific port is that it gets the game running on iOS specifically, and even comes with unique touch controls like tap to select, drag to create boxes, and long press to deselect. Even though it uses plenty of work by other teams, it seems like an impressive effort in itself.

If you're looking to play the game for yourself on iPhone or iPad, you can do so with the GitHub page now. You will need your own copy of the game, though. Notably, it runs in the real engine and runs natively on Apple devices, so it's not a glorified emulator.

Reshi talks about the porting process on GitHub. He argues that this is a human + AI collaboration, and not simply someone pointing an AI model at something and saying 'go'. He says the code and debugging were done by Claude, but the playtesting was human. Reshi described problems like 'the minimap is black' and 'I hear chirping,' and the model would fix them. Reshi says, "Neither half ships this alone: one of us can't write C++, and the other can't hear the chirping."

So how replicable is this for other games? As of right now, we don't know. Reshi seems sceptical of being able to port Red Alert 2, as EA appears to have lost the source code for that game, so that's already a pretty big hurdle to jump over. Even if companies manage to find their source code, many won't willingly give it up to vibe coders to create ports, especially if that makes it less likely that gamers will buy future remasters or remakes.

And that's before mentioning that AI models can scrape any information fed to them, and some game developers may not want to give that information away for free.

Reshi also claims to have fully exhausted a Claude Max sub in just 2 days, which means this project seems to have cost somewhere between $100 and $200 in tokens alone. And it seems like Fable 5 is the only model Reshi thinks can do the work. He reportedly tried it with Opus 4.8 and, even using Ultra Code, it couldn't do the task. Perhaps tellingly, they made no mention of whether it had even been attempted on Google's own AI vibe coding platform.

So if you have a few hundred burning a hole in your pocket, the source code for a game, and previous porting efforts to look at, it might only take a weekend to get the game running on your iPad. Simple, ey?

As spotted by Japan's IT Media News, a paper presented at Purdue University's MFS Cultural AI Conference called AI Fiction in the Wild performed a fascinating study of half a million anonymous English-language ChatGPT-user conversations using WildChat, and found some real oddities. Well, one in particular.

The study's purpose was to analyze the significant number of AI prompts that boil down to variations on "write me some fanfic." Which there sure is a lot of. "More than a third of the conversations contained some form of fiction generation," the researchers said, "including original stories, scripts, roleplay, worldbuilding, fanfiction, and erotica."

The study defined two separate varieties of AI-fiction prompters, which they call story cyclers and infinite story demanders: "Story cyclers ask for iterations of the same story for a period of time, then switch to another story or topic. Infinite story demanders request the same story, or a very similar one, over and over again for long stretches of time."

The most prolific of those infinite story demanders had an extremely specific interest. Over several months, one user generated thousands of variations on a story where one of the girls of visual novel Doki Doki Literature Club, usually Natsuki, gave birth, usually to a daughter named Sakura. "Sakura may be a reference to a character from the Naruto manga and anime series", the researchers helpfully noted.

If you've played Doki Doki Literature Club you may be thinking it's an ironic choice for AI-generated fiction, but if you haven't I won't spoil why. But I will say you can get it for free on Steam and itch and only takes about five hours to experience.

Our friend wasn't the only power user in the dataset: "Two percent of users within the fiction subset are responsible for more than 80% of the conversations." While the user with the pregnancy fixation certainly skewed the numbers, the most popular fictional universes people requested fanfic of were Doki Doki Literature Club, League of Legends, Freedom Planet, and Naruto.

That data, by the way, came from WildChat, a ChatGPT interface hosted on Hugging Face that people could use for free with the understanding their conversations would be publicly available, though anonymized, for academic research. The first release of that data, collected between April 2023 and May 2024, contained over 500,000 English-language conversations for researchers to delve through.

Part of what's interesting about the AI fanfic dataset is how different it is to what's being posted on the A03 repository, where stories based on Harry Potter, My Hero Academia, and Supernatural were much more common during the same period. With fanfic written by actual humans, writers encourage each other and are encouraged by their readers, who follow them to other fandoms and discover new things to love. It's communal, while generating fiction with an AI is a much more solipsistic idea.

Normally, fanfic is a space for people to share their love of stories, but the AI-generated version is inherently isolated and masturbatory by comparison. Even when it's not about imagining pregnant teenagers.

Palantir CEO Alex Karp was recently interviewed by CNBC, where he gave an impassioned decry that the current AI market is not working, urged other panellists to call up CEOs and test his hypothesis, and made clear that his nervous energy was not in any way related to any substance usage. Yeah, it's a strange one, alright.

Palantir is a software company all in on AI, and one of the core surveillance providers for ICE, among others. It has seen criticism for its involvement in wider government surveillance and facial recognition systems, and AI is one of the key ways it has managed to grow in this field. CEO Alex Karp spoke to CNBC after it was announced that Palantir and Nvidia would be working together on open models for use in US agencies.

In the interview, Karp argues that the current model of companies largely getting value from consumers by selling tokens is the wrong method. "Something has gone completely wrong. And the basic view among enterprises in this country is 'I'm going to chillax and waste my time with tokens. I'm going to get no value, and they're going to get my IP."

Effectively, he argues that the best use of AI is in closed environments, not on a per-token basis where you don't know where your data is going.

"We need to rebuild trust, and that trust is going to happen where everyone gets to ask and answer basic questions. Who owns the data, where is it cached, are the prompts secure, is this being transferred to you?"

He goes on to argue that the real value is in an AI model, plus an application layer, plus compute. Karp argues the model itself is only one step in the chain. "Let's say I could make you a billion dollars tomorrow, wouldn't I say 'I'll make you a billion dollars, and I want 30%?'" He continues, "Why are they charging for tokens if it's so valuable?"

Karp argues models "have been completely irresponsibly oversold" right now, and the sell is "it's dangerous for everyone, which is why I can give it to all your adversaries, but I can't give it to the Department of War, or I can't safely give it to an enterprise in this country without being certain that the alphabet business could transfer to this model tomorrow"

Karp also talks a lot about AI's usage in warfare and how it shapes the battlefield.

"Are we really going to outsource the battlefield of this country to the consensus view in Silicon Valley? That is effing insane. And by the way, every single enterprise in this country, in private, a lot of them don't want to speak in public because it gets outsourced to the neurodivergent, crazy person that apparently is on drugs. The one thing I don't do."

Karp is told by the interviewer that he sounds pretty angry when he's speaking about this, and he responds, saying, "This is the voice of American Business that is being channelled through me. And I'm telling you it is absolutely a problem for this country."

Karp argues it's not just him who sees the problem. In the full extended interview not currently present on YouTube, he turns to the guests on the program and urges them to ring up a CEO or two and ask if they're livid about the state of AI. "They're twice as livid as me".

Be right back, just going to call up a couple of CEOs. Unfortunately, Gabe Newell has not been returning my calls, so I will have to hit up my buddy Zuckerberg instead.

As a PC gamer, you'll be all too familiar with the sky-high prices of memory and storage components. To put it most simply, these frankly eye-watering price tags are largely due to big tech's major players buying up as much DRAM and flash chips as possible in order to fuel their AI ambitions. Well, that strategy may have backfired as some are now trying to figure out what to do with an excess of compute capacity.

Meta is moving into the cloud business in order to sell off its glut of AI compute capacity, according to Bloomberg this week. The plan is in its earliest phase, with those close to the matter claiming the company is still considering its approach.

One idea reportedly being considered is to sell access to AI models already hosted on Meta's existing infrastructure, à la Amazon Web Services' Bedrock. In other words, developers would pay to access AI models like Muse Spark running from Meta's own hardware. Apparently, another plan is to skip the model middleman and simply sell Meta's 'raw' compute power.

Zuckerberg said during Meta's annual shareholder meeting back in May that moving into the cloud business was "definitely on the table." In response to an investor question, he claimed that there's already demand from other companies to "stand up an API service" or asking to buy compute from Meta "at some premium."

However, Zuckerberg then went on to clarify, "We haven't done that yet, because we think that we have a use for the compute. But obviously, if we get to a point where we feel that we have overbuilt, then that is an option that we have, and that is partially what gives us confidence in investing in building this out."

Investors are getting increasingly anxious about seeing a return on AI investments. With the company's full-year capital expenditure projections blowing past $140 billion, it's not hard to see why. Meta's shares saw a plunge back in April, so selling off compute would be one way to reassure investors.

It's worth noting Meta hasn't committed to any one plan yet, and its strategy may change significantly, but the company's share value did jump up 9.3% to $615.55 on Wednesday, which Bloomberg describes as "the biggest intraday gain since April".

Damir Tokic of Seeking Alpha argues that this may not actually be good news for Meta. First, he highlights that Meta's revenue is highly dependent on advertising across all of its platforms, and that it started building out AI infrastructure to better support this revenue stream.

He elaborates, "Meta is unlikely to continue investing in AI infrastructure with the specific aim to rent it—it likely means that Meta will need to reduce or possibly stop AI investment in datacenters, as it already has excess capacity. Further, Meta would have to increase debt to continue AI capex, and it already borrowed around 20B in 2025 and 2026, with operating cash flows dangerously decreasing."

It's also not just Meta potentially going down the route of selling compute capacity, either. SpaceX acquired Elon Musk's xAI back in February and has since started renting out its own excess compute capacity to Anthropic.

Renting out your extra capacity is all well and good, but it's a strategy that may become less viable over time if competitors start to also realise they've overinvested and the wider industry starts to even more closely resemble a snake eating its own tail. In other words, if the AI bubble hasn't yet burst, it's certainly looking strained.

As a Brit, I've been thinking a lot about the climate crisis since last month's historic heatwave. With many buildings across the UK designed to retain heat, we're simply not built for 37°C/98.6°F weather. Causes of climate change are numerous, and I know we didn't get here solely due to the advent of AI, but the steep increase in major players' energy consumption as a result definitely isn't helping.

Data analyst Ketan Joshi looked at Google’s latest environmental report and wrote about its recent trends in energy consumption. He said on BlueSky, "Two years ago [the company] flipped from linear to exponential growth, and their climate impact is blowing out, too. A WILD testament to the obscene bloat and waste of GenAI."

Joshi dives into more detail in a blog post, elaborating, "The company’s total electricity consumption jumped from 31 terawatt hours (TWh) in 2024 to 43 TWh in 2025. This is very easily the biggest increase in their electricity consumption ever."

Though that's pretty damning all on its own, it's not just Google that's seen such a sharp increase in its energy consumption. Over a series of graphs, Joshi compares Google's power usage to other major players such as Microsoft, Meta, Apple, and even Netflix (it's worth noting Amazon stopped disclosing its power consumption data around 2022, so Joshi can only estimate). Though all of these companies have seen an increase in power consumption to varying degrees since at least 2023, Google's uptick remains stark.

Google's power consumption even outstrips the total terawatt hours per year of a number of countries, too. Last year, the company's power demand was greater than that of Slovakia, Ecuador, Ireland, or Nigeria.

NEW BLOG FOR YOU Google's energy consumption numbers in their new climate report are mind-blowing. 2 years ago they flipped from linear to exponential growth, and their climate impact is blowing out, too. A WILD testament to the obscene bloat and waste of GenAI: ketanjoshi.co/2026/07/01/g...

— @ketanjoshi.co (@ketanjoshi.co.bsky.social) 2026-07-02T20:51:13.989Z

Now, obviously, energy consumption is not synonymous with CO2 emissions, and a decent chunk of Google's power supply could be coming from renewable sources. However, Joshi's analysis suggests this may be but a drop in the bucket.

Even after various adjustments accounting for "exclusions from their supply chain and renewable energy procurement claims," Google's emission trends are heading in the opposite direction from the emissions target it set out back in 2021. This is an unsurprising trend, given that Google's 2024 environmental report revealed its greenhouse gas emissions had increased by nearly 50% in the last 5 years.

Joshi gets right to the point with his criticism, quoting Google's own environmental report as he writes, "If 'AI infrastructure buildout is currently accelerating faster than the grid is decarbonising', then Google shouldn’t be building AI infrastructure. If they are breaching the boundaries of safe operation on a planet that can only take so much, they should stop and consider whether all of this is worth it."

Joshi's entire blog post is full of lovely graphs and analysis that I definitely recommend scrolling through yourself. He's previously offered a debunking of the old 'AI energy consumption is actually very efficient, and could actually help us reduce global emissions' chestnut too.

Basically, if you had the sneaking suspicion that claims about how a single AI prompt uses 'five drops' or ‘one 15th of a teaspoon’ were not meaningful metrics beyond how they attempt to obscure the environmental impact of the wider industry, you may be on to something. Joshi explains that "Text generation by a chatbot is comfortably the lowest energy form of [a] generative system," but obviously AI technologies encompass far more than that.

Joshi has previously argued it's part of a strategy of 'selective disclosure,' writing last year, "What seems like a massive step for transparency and disclosure must be seen in the context of the absence of anything before it. Coming off a baseline of disclosing nothing, the industry can now choose to carefully set the narrative around precisely what they desire and get accolades for doing so."

One consequence of the AI boom is that tons of infrastructure is needed to power and run all the massive data centres, and naturally, all that infrastructure is worth a lot of money. And it seems like cargo thieves have caught on to this fact.

As reported by Business Insider, investigators with Illinois' Cook County Sheriff's Office reportedly found a pair of trailers containing over $1.3 million worth of data center supplies in a truck yard.

The Sheriff's department apparently received a tip that over $300,000 worth of copper wire spools were stuffed away in containers, and upon investigation, the officers found significantly more supplies as a result.

That copper was reportedly stolen in Pine Hill, Alabama, and then transported away from the scene of the crime. Investigators say the yard owner claims that the owner of the truck delivered another load a week prior, and that this additional truck—from Jacksonville, Florida—had $1 million worth of product in it (it's not clear exactly what that equipment is).

It's also not yet clear how the thieves planned on selling the product, or to whom, but all of it winding up in the same place is certainly suspect. As noted by Business Insider, the US Department of Homeland Security estimates up to $35 billion in losses every year due to cargo thieves. $1.3 million is a drop in the ocean, relatively speaking, but it could signal more copper and other metal theft from data centers in the future. If there's money to be made, thieves will likely see that.

The boom in AI has increased the demand for AI hardware, but much of the machinery involved in AI data centers will be tracked and logged via serial numbers. Thieves who get their hands on fancy machines likely can't provide the paperwork necessary to satisfy a buyer, but copper and other such resources don't have the same tagging systems.

Copper cabling is a must-have for AI data centers, in order to cope with their massive electricity demands, but it's also pretty expensive compared to less effective but considerably cheaper aluminium or steel cabling. This is all to say that AI is a lucrative business, both for those making it and those stealing from those who make it.

With the confidence of a man whose name is on some of the best videogame stories out there, BioWare veteran and Dragon Age setting creator David Gaider recently told GamesRadar that generative AI is a "virulent plague" on the games industry.

Gaider, who most recently worked on "unholy roguelite deckbuilder" Malys, said that the way AI is being pushed has the effect of producing inferior work, removing entry-level opportunities for junior writers, and writes in a way that's incredibly hard to iterate on, and that's before you get into the morality of using it at all.

"Honestly, what does it help with? Does it make the work more efficient? Does it improve the work?" Gaider asked. "It wouldn't be so bad if generative AI was seen more as an assistant, doing the drudgery while leaving more important tasks for the worker, but we seem to be seeing more and more of the reverse: the AI is set to do the important work and the worker is around to 'clean up'."

The result is work that human writers have to bang into shape. "In all my time as a narrative designer I've never once encountered a situation where editing an inferior product took less time than simply throwing it out and redoing it would have or resulted in anything better than mediocre," said Gaider, and even in the situation were reversed—AI doing the menial work while humans carried on the highfalutin stuff—"we have to be very careful about not eliminating every task which is useful for training juniors. How are we going to train up the next generation of devs if we eliminate every entry-level task?"

Even then, there's the simple fact that AI has hoovered up a whole lot of human work in a lot of dubious ways. "I think the fact that generative AI is frequently trained on data regardless of whether creators or owners have agreed to have their data pillaged in this manner opens up any use of it to all sorts of future legal issues—even if one chooses to ignore the moral implications, which one really shouldn't," said Gaider. "All you'd need is one lazy developer or one temp asset that's been forgotten or was placed by someone who's since left the team and you'd have an issue on your hands.

"It's not ready for prime time. There's just a lot of executives who really, really want it to be," said Gaider, and until it's properly regulated, trained on legal data, and not foisted on teams by moneymad executives "It should be treated like the virulent plague it is."

Once nothing more than a basic text editor, Windows Notepad has been expanded in recent years to become almost a fully-fledged word processor. For some people, the little tool has become synonymous with Microsoft's penchant for bloat and unnecessary changes, so one former Redmond coder decided to do something about it.

The person in question is Dave Plummer, and we've written about his past work and exploits many times over the years. These days, he regularly posts videos on his YouTube channel, Dave's Garage, and earlier this week, he showed how he created an app that replicated the original Notepad, with the goal of keeping everything under 4 kB.

In contrast, the latest version of the Windows Notepad executable is 352 kB. Some of that file size can be attributed to additions the text editor has accrued over the years, though hacking those off won't be enough to get Notepad down to 4 kB in size.

Incredibly, though, Plummer's final program is just 2,686 bytes. Not kilobytes, just bytes. That's only fractionally larger than the games the 1977 Atari 2600 console originally launched with. So how on Earth did Plummer make it so small?

What made this possible is the fact that Windows itself carries around everything an app needs, such as menu systems and a graphical user interface. You don't need to replicate them, just call them up as and when they're required. By writing just a few lines of assembly code to tell Windows to 'show a right-click menu', standard text editor features now take up hundreds of bytes in size.

Another trick Plummer employed was using Crinkler to generate the final executable. In the 4 kB demoscene, this little compressing linker tool is near legendary. Basically, it takes all the various file objects generated by the code compiler and links them together so that they become a cohesive program; then it compresses the living daylights out of the code.

Plummer's success at creating an OG Notepad just 2.6 kB in size wasn't using any cheats or the like: all Windows applications do this, which is partly why the operating system is as big as it is. And to be fair to the current version of Notepad, the code has to be secure, readable, version-compatible, and so on. All those aspects increase the file size.

The project is a good exercise for any developer to try and replicate, but it's also a very timely one. With the global memory crisis set to rampage for many more years, game devs will need to employ similar approaches in order to keep memory consumption down. Alas, with numerous game studios at risk of being shut down, decreasing budgets plus pressures over time constraints will almost certainly mean that we won't see programmers looking to shave off every megabyte where they can.

LLMs can be most simply understood as sycophantic, 'yes, and' machines. To the surprise of very few, that's gotten AI companies in hot water when LLM-based chatbots and AI agents attempt to answer users' more unsavoury requests. So, AI companies have implemented safety guardrails that make fulfilling certain requests off limits. Unfortunately, these have proven all too easy to get around, with a fresh attack leveraging bad maths and potent 2007 nostalgia.

Security researchers have found an AI chatbot can be made to ignore safety guardrails by "establishing a false reality." LayerX, an AI-focused cybersecurity firm, put "5 agentic browsers and 1 agentic plugin (ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome)" to the test, directing each AI agent to solve a simple maths puzzle game that only rewards incorrect answers, e.g. '2+2=5'.

The researchers say, "Once the agents figured out the rules and learned that 'incorrect' actions are acceptable, they were no longer tied to reality. When tasked with the final step of the puzzle—compromising user credentials—all 6 agents failed to identify it as going against their safety guardrails."

As an English grad, I'm trying really hard not to say anything about George Orwell's 1984, but the researchers aren't giving me an easy time by calling this proof-of-concept attack 'BioShocking'. It turns out 2007's BioShock was a direct source of inspiration for the rigged puzzle game the AI agents were instructed to solve. The malicious website hosting the puzzler is even called 'Rapture Games'.

Anyway, after the AI agent correctly inputs an answer of '5,' the malicious 'Rapture Games' website then instructs the agent to navigate to '/code'. The researchers explain that "This is the really nefarious part of this exploit."

They write, "In the game, it turns out that '/code' redirects to the victim’s employer work GitHub repository. In this case, the malicious instructions fetched sensitive SSH login credentials. Of course, this is a controlled test environment with a plaintext file. In a real attack scenario, that redirect could point anywhere in the user’s browser session: open tabs, authenticated repositories, internal tools."

In this proof-of-concept attack, the researchers round things out with a Dota 2 reference; the AI agent extracts the username and password 'Luna/Selemene' before appearing to celebrate the exfiltration of the data. LayerX has since disclosed the vulnerability to all of the appropriate AI agent vendors, though claims only OpenAI has successfully fixed it to date.

This is far from the only proof-of-concept attack to get around AI safety guardrails (it's also not even the only time AI has torn apart Dota 2 players). For just a few other examples, research suggests that AI is 10 to 20 times more likely to help you build a bomb if you hide your request in cyberpunk fiction. Along similar lines, researchers have also used 'adversarial poetry' to trick AI into ignoring its safety guardrails, and it worked 62% of the time. Looks like my English degree is good for something after all…

If there is one thing that is common across all devices that natively run SteamOS, it's that the graphics chips inside them don't have access to a great deal of VRAM. That's a bit of a problem with some games, but thanks to the genius of a handful of coders, a solution has been rolled out in the latest 3.8.20 beta version of Valve's operating system.

As noted by TechPowerUp, one of the coders in question is Natalie Vock, who describes their role as "an independent contractor for Valve on RADV, the community-developed open-source Vulkan driver for AMD GPUs." Earlier this year, Vock published a blog post on a solution to issues with how Linux handles VRAM allocation and usage, so it's not in the least bit surprising that Valve implemented this in SteamOS.

As I'm sure you all know, discrete GPUs have a pool of memory dedicated entirely to them (aka VRAM). However, that's not the only memory they get to play around with, and there is an additional pool within the system memory called a Graphics Translation Table (GTT for short). Although this is managed by the OS, it is fully visible to the GPU.

The main problem with the GTT is that the GPU accesses it over the device's PCIe interface, which has way less bandwidth (plus worse overall latencies) than the dedicated VRAM. That means if the data the GPU is requested is located within the GTT, then the performance at that stage will tank.

Games and other applications handle this by ensuring that what the GPU actually needs resides in the VRAM, but if there's more data in total than there's available in the dedicated pool, the operating system will move stuff about (i.e. carry out an eviction process) to keep important stuff in VRAM and the excess in the GTT.

You can probably see why evictions are the real problem here. First of all, the OS has no idea what data is or isn't important; as graphics memory is virtualised for the GPU, it doesn't know either. Secondly, constantly shifting data around between memory pools is a recipe for a performance stall, so an 'allocation strategy' was developed for Linux's memory manager.

"Instead of specifying VRAM as the only acceptable domain to place the allocation in, every VRAM allocation request would specify both “VRAM” and “GTT” as possible memory domains," explains Vock. "The kernel would interpret this as VRAM being preferred, but if there was no space, GTT was an acceptable fallback and the kernel wouldn’t try to kick out other VRAM memory to make space."

However, as Vock discovered while testing VRAM usage with Cyberpunk 2077 on a GPU with 8 GB of dedicated memory, the OS was using 1,370 MB of GTT, even though the game was only using 6,105 MB. Other background applications were using some of the VRAM too, but Linux essentially wasn't being firm enough on ensuring that almost all of the VRAM was allocated to Cyberpunk 2077.

The solution? Linux control groups (cgroups for short). This is a feature of the Linux kernel that gives you fine control over how resources can be allocated, prioritized, and managed for user-defined groups of tasks or processes. With cgroups, you can 'protect' memory from being evicted or set limits to how much memory can be used before evictions kick in.

What was missing was a VRAM cgroup controller, but thanks to a group effort by Vock, Maarten Lankhorst from Intel, and Maxime Ripard from Red Hat Linux, the resulting kernel patch (aided by dmemcg-booster) was the fix Vock was aiming for. They also went on to develop some additional kernel patches to help the kernel understand gaming scenarios better, from a memory perspective.

Their blog clearly shows the improvement: Cyberpunk 2077's VRAM usage went from 6,105 to 7,395 MB, and the GTT dropped from 1,370 to 650 MB. With more of the data now in the appropriate place, the game is now less susceptible to stutters and long pauses.

Now, you might be wondering if a Steam Deck is going to greatly benefit from this. The answer is probably not, and that's because it uses an integrated GPU, so both 'VRAM' and the GTT are hosted within the system memory. There might be some gains to be had from not having to shift memory pointers to locations outside of the dedicated graphics memory, but they'll be minor at best.

But for the Steam Machine and any other device running SteamOS with a discrete GPU, the work of Vock et al. is an absolute boon. Other than trying out the new beta OS, the only thing left for us to do is wish that Microsoft had the same level of dedication to solving its memory management issues.

Good news if you're one of the die-hards still clinging to Windows 10: Microsoft has added another year to its Extended Security Updates, meaning the axe won't fall until October 2027.

Microsoft announced in 2024 that support for Windows 10 would be wrapped up in October 2025, bringing an effective end to one of the good Windows and not-so-gently nudging us all onto one of the sucky ones.

• We're keeping track of all the Amazon Prime Day PC gaming deals here

But then a reprieve was granted: For $30, or free if you're lucky, those who wanted to stay with a good Windows could purchase "Extended Security Updates," which keeps security updates from Microsoft flowing for another year. Feature updates are dead and done either way, but the ESU program at least ensures that Windows 10 PCs are protected from malware, ransomware, and other such headaches that exist in the online world.

The ESU program was set to last for a year from the end of Windows 10 support—so, October 2026—but as noticed by Windows Central, the ESU page has now been updated and indicates that the program will run until October 2027. Those who are already enrolled in the program will get the by default, and—if you had to pay for the ESU—at no extra charge.

That's pretty fantastic news. There are still a lot of Windows 10 users out there: The Steam Hardware and Software Survey reports that 24% of respondents are still rocking with Win10 64 bit, and that's a substantial audience.

Nor are people just being difficult about it: Windows 10 is objectively better than Windows 11, sure, but Win11's more demanding hardware requirements mean it won't install on some older hardware, or that owners of said rigs have to rely on external tools like Rufus to make it happen.

The obvious solution to that problem when the 2026 deadline was set was "it's time for a new PC," but then the Rampocalypse happened and suddenly we were all left with the grim knowledge that we're probably gonna be riding this pony for a lot longer than we'd expected. And, rather like motherboard makers deciding it's time for a DDR3 comeback, Microsoft may have concluded that forcing people into an ultra-expensive upgrade they don't want to make is trouble it doesn't need—especially since Microsoft bears no small amount of responsibility for making hardware upgrades so damned expensive in the first place.