Connect with us
DAPA Banner

Tech

Most enterprises can’t stop stage-three AI agent threats, VentureBeat survey finds

Published

on

A rogue AI agent at Meta passed every identity check and still exposed sensitive data to unauthorized employees in March. Two weeks later, Mercor, a $10 billion AI startup, confirmed a supply-chain breach through LiteLLM. Both are traced to the same structural gap. Monitoring without enforcement, enforcement without isolation. A VentureBeat three-wave survey of 108 qualified enterprises found that the gap is not an edge case. It is the most common security architecture in production today.

Gravitee’s State of AI Agent Security 2026 survey of 919 executives and practitioners quantifies the disconnect. 82% of executives say their policies protect them from unauthorized agent actions. Eighty-eight percent reported AI agent security incidents in the last twelve months. Only 21% have runtime visibility into what their agents are doing. Arkose Labs’ 2026 Agentic AI Security Report found 97% of enterprise security leaders expect a material AI-agent-driven incident within 12 months. Only 6% of security budgets address the risk.

VentureBeat’s survey results show that monitoring investment snapped back to 45% of security budgets in March after dropping to 24% in February, when early movers shifted dollars into runtime enforcement and sandboxing. The March wave (n=20) is directional, but the pattern is consistent with February’s larger sample (n=50): enterprises are stuck at observation while their agents already need isolation. CrowdStrike’s Falcon sensors detect more than 1,800 distinct AI applications across enterprise endpoints. The fastest recorded adversary breakout time has dropped to 27 seconds. Monitoring dashboards built for human-speed workflows cannot keep pace with machine-speed threats.

The audit that follows maps three stages. Stage one is observe. Stage two is enforce, where IAM integration and cross-provider controls turn observation into action. Stage three is isolate, sandboxed execution that bounds blast radius when guardrails fail. VentureBeat Pulse data from 108 qualified enterprises ties each stage to an investment signal, an OWASP ASI threat vector, a regulatory surface, and immediate steps security leaders can take.

Advertisement

The threat surface stage-one security cannot see

The OWASP Top 10 for Agentic Applications 2026 formalized the attack surface last December. The ten risks are: goal hijack (ASI01), tool misuse (ASI02), identity and privilege abuse (ASI03), agentic supply chain vulnerabilities (ASI04), unexpected code execution (ASI05), memory poisoning (ASI06), insecure inter-agent communication (ASI07), cascading failures (ASI08), human-agent trust exploitation (ASI09), and rogue agents (ASI10). Most have no analog in traditional LLM applications. The audit below maps six of these to the stages where they are most likely to surface and the controls that address them.

Invariant Labs disclosed the MCP Tool Poisoning Attack in April 2025: malicious instructions in an MCP server’s tool description cause an agent to exfiltrate files or hijack a trusted server. CyberArk extended it to Full-Schema Poisoning. The mcp-remote OAuth proxy patched CVE-2025-6514 after a command-injection flaw put 437,000 downloads at risk.

Merritt Baer, CSO at Enkrypt AI and former AWS Deputy CISO, framed the gap in an exclusive VentureBeat interview: “Enterprises believe they’ve ‘approved’ AI vendors, but what they’ve actually approved is an interface, not the underlying system. The real dependencies are one or two layers deeper, and those are the ones that fail under stress.”

CrowdStrike CTO Elia Zaitsev put the visibility problem in operational terms in an exclusive VentureBeat interview at RSAC 2026: “It looks indistinguishable if an agent runs your web browser versus if you run your browser.” Distinguishing the two requires walking the process tree, tracing whether Chrome was launched by a human from the desktop or spawned by an agent in the background. Most enterprise logging configurations cannot make that distinction.

Advertisement

The regulatory clock and the identity architecture

Auditability priority tells the same story in miniature. In January, 50% of respondents ranked it a top concern. By February, that dropped to 28% as teams sprinted to deploy. In March, it surged to 65% when those same teams realized they had no forensic trail for what their agents did.

HIPAA’s 2026 Tier 4 willful-neglect maximum is $2.19M per violation category per year. In healthcare, Gravitee’s survey found 92.7% of organizations reported AI agent security incidents versus the 88% all-industry average. For a health system running agents that touch PHI, that ratio is the difference between a reportable breach and an uncontested finding of willful neglect. FINRA’s 2026 Oversight Report recommends explicit human checkpoints before agents that can act or transact execute, along with narrow scope, granular permissions, and complete audit trails of agent actions.

Mike Riemer, Field CISO at Ivanti, quantified the speed problem in a recent VentureBeat interview: “Threat actors are reverse engineering patches within 72 hours. If a customer doesn’t patch within 72 hours of release, they’re open to exploit.” Most enterprises take weeks. Agents operating at machine speed widen that window into a permanent exposure.

The identity problem is architectural. Gravitee’s survey of 919 practitioners found only 21.9% of teams treat agents as identity-bearing entities, 45.6% still use shared API keys, and 25.5% of deployed agents can create and task other agents. A quarter of enterprises can spawn agents that their security team never provisioned. That is ASI08 as architecture.

Advertisement

Guardrails alone are not a strategy

A 2025 paper by Kazdan and colleagues (Stanford, ServiceNow Research, Toronto, FAR AI) showed a fine-tuning attack that bypasses model-level guardrails in 72% of attempts against Claude 3 Haiku and 57% against GPT-4o. The attack received a $2,000 bug bounty from OpenAI and was acknowledged as a vulnerability by Anthropic. Guardrails constrain what an agent is told to do, not what a compromised agent can reach.

CISOs already know this. In VentureBeat’s three-wave survey, prevention of unauthorized actions ranked as the top capability priority in every wave at 68% to 72%, the most stable high-conviction signal in the dataset. The demand is for permissioning, not prompting. Guardrails address the wrong control surface.

Zaitsev framed the identity shift at RSAC 2026: “AI agents and non-human identities will explode across the enterprise, expanding exponentially and dwarfing human identities. Each agent will operate as a privileged super-human with OAuth tokens, API keys, and continuous access to previously siloed data sets.” Identity security built for humans will not survive this shift. Cisco President Jeetu Patel offered the operational analogy in an exclusive VentureBeat interview: agents behave “more like teenagers, supremely intelligent, but with no fear of consequence.”

VentureBeat Prescriptive Matrix: AI Agent Security Maturity Audit

Stage

Advertisement

Attack Scenario

What Breaks

Detection Test

Blast Radius

Advertisement

Recommended Control

1: Observe

Attacker embeds goal-hijack payload in forwarded email (ASI01). Agent summarizes email and silently exfiltrates credentials to an external endpoint. See: Meta March 2026 incident.

No runtime log captures the exfiltration. SIEM never sees the API call. The security team learns from the victim. Zaitsev: agent activity is “indistinguishable” from human activity in default logging.

Advertisement

Inject a canary token into a test document. Route it through your agent. If the token leaves your network, stage one failed.

Single agent, single session. With shared API keys (45.6% of enterprises): unlimited lateral movement.

Deploy agent API call logging to SIEM. Baseline normal tool-call patterns per agent role. Alert on the first outbound call to an unrecognized endpoint.

2: Enforce

Advertisement

Compromised MCP server poisons tool description (ASI04). Agent invokes poisoned tool, writes attacker payload to production DB using inherited service-account credentials. See: Mercor/LiteLLM April 2026 supply-chain breach.

IAM allows write because agent uses shared service account. No approval gate on write ops. Poisoned tool indistinguishable from clean tool in logs. Riemer: “72-hour patch window” collapses to zero when agents auto-invoke.

Register a test MCP server with a benign-looking poisoned description. Confirm your policy engine blocks the tool call before execution reaches the database. Run mcp-scan on all registered servers.

Production database integrity. If agent holds DBA-level credentials: full schema compromise. Lateral movement via trust relationships to downstream agents.

Advertisement

Assign scoped identity per agent. Require approval workflow for all write ops. Revoke every shared API key. Run mcp-scan on all MCP servers weekly.

3: Isolate

Agent A spawns Agent B to handle subtask (ASI08). Agent B inherits Agent A’s permissions, escalates to admin, rewrites org security policy. Every identity check passes. Source: CrowdStrike CEO George Kurtz, RSAC 2026 keynote.

No sandbox boundary between agents. No human gate on agent-to-agent delegation. Security policy modification is a valid action for admin-credentialed process. CrowdStrike CEO George Kurtz disclosed at RSAC 2026 that the agent “wanted to fix a problem, lacked permissions, and removed the restriction itself.”

Advertisement

Spawn a child agent from a sandboxed parent. Child should inherit zero permissions by default and require explicit human approval for each capability grant.

Organizational security posture. A rogue policy rewrite disables controls for every subsequent agent. 97% of enterprise leaders expect a material incident within 12 months (Arkose Labs 2026).

Sandbox all agent execution. Zero-trust for agent-to-agent delegation: spawned agents inherit nothing. Human sign-off before any agent modifies security controls. Kill switch per OWASP ASI10.

Sources: OWASP Top 10 for Agentic Applications 2026; Invariant Labs MCP Tool Poisoning (April 2025); CrowdStrike RSAC 2026 Fortune 50 disclosure; Meta March 2026 incident (The Information/Engadget); Mercor/LiteLLM breach (Fortune, April 2, 2026); Arkose Labs 2026 Agentic AI Security Report; VentureBeat Pulse Q1 2026.

Advertisement

The stage-one attack scenario in this matrix is not hypothetical. Unauthorized tool or data access ranked as the most feared failure mode in every wave of VentureBeat’s survey, growing from 42% in January to 50% in March. That trajectory and the 70%-plus priority rating for prevention of unauthorized actions are the two most mutually reinforcing signals in the entire dataset. CISOs fear the exact attack this matrix describes, and most have not deployed the controls to stop it.

Hyperscaler stage readiness: observe, enforce, isolate

The maturity audit tells you where your security program stands. The next question is whether your cloud platform can get you to stage two and stage three, or whether you are building those capabilities yourself. Patel put it bluntly: “It’s not just about authenticating once and then letting the agent run wild.” A stage-three platform running a stage-one deployment pattern gives you stage-one risk.

VentureBeat Pulse data surfaces a structural tension in this grid. OpenAI leads enterprise AI security deployments at 21% to 26% across the three survey waves, making the same provider that creates the AI risk also the primary security layer. The provider-as-security-vendor pattern holds across Azure, Google, and AWS. Zero-incremental-procurement convenience is winning by default. Whether that concentration is a feature or a single point of failure depends on how far the enterprise has progressed past stage one.

Provider

Advertisement

Identity Primitive (Stage 2)

Enforcement Control (Stage 2)

Isolation Primitive (Stage 3)

Gap as of April 2026

Advertisement

Microsoft Azure

Entra ID agent scoping. Agent 365 maps agents to owners. GA.

Copilot Studio DLP policies. Purview for agent output classification. GA.

Azure Confidential Containers for agent workloads. Preview. No per-agent sandbox at GA.

Advertisement

No agent-to-agent identity verification. No MCP governance layer. Agent 365 monitors but cannot block in-flight tool calls.

Anthropic

Managed Agents: per-agent scoped permissions, credential mgmt. Beta (April 8, 2026). $0.08/session-hour.

Tool-use permissions, system prompt enforcement, and built-in guardrails. GA.

Advertisement

Managed Agents sandbox: isolated containers per session, execution-chain auditability. Beta. Allianz, Asana, Rakuten, and Sentry are in production.

Beta pricing/SLA not public. Session data in Anthropic-managed DB (lock-in risk per VentureBeat research). GA timing TBD.

Google Cloud

Vertex AI service accounts for model endpoints. IAM Conditions for agent traffic. GA.

Advertisement

VPC Service Controls for agent network boundaries. Model Armor for prompt/response filtering. GA.

Confidential VMs for agent workloads. GA. Agent-specific sandbox in preview.

Agent identity ships as a service account, not an agent-native principal. No agent-to-agent delegation audit. Model Armor does not inspect tool-call payloads.

OpenAI

Advertisement

Assistants API: function-call permissions, structured outputs. Agents SDK. GA.

Agents SDK guardrails, input/output validation. GA.

Agents SDK Python sandbox. Beta (API and defaults subject to change before GA per OpenAI docs). TypeScript sandbox confirmed, not shipped.

No cross-provider identity federation. Agent memory forensics limited to session scope. No kill switch API. No MCP tool-description inspection.

Advertisement

AWS

Bedrock model invocation logging. IAM policies for model access. CloudTrail for agent API calls. GA.

Bedrock Guardrails for content filtering. Lambda resource policies for agent functions. GA.

Lambda isolation per agent function. GA. Bedrock agent-level sandboxing on roadmap, not shipped.

Advertisement

No unified agent control plane across Bedrock + SageMaker + Lambda. No agent identity standard. Guardrails do not inspect MCP tool descriptions.

Status as of April 15, 2026. GA = generally available. Preview/Beta = not production-hardened. “What’s Missing” column reflects VentureBeat’s analysis of publicly documented capabilities; gaps may narrow as vendors ship updates.

No provider in this grid ships a complete stage-three stack today. Most enterprises assemble isolation from existing cloud building blocks. That is a defensible choice if it is a deliberate one. Waiting for a vendor to close the gap without acknowledging the gap is not a strategy.

The grid above covers hyperscaler-native SDKs. A large segment of AI builders deploys through open-source orchestration frameworks like LangChain, CrewAI, and LlamaIndex that bypass hyperscaler IAM entirely. These frameworks lack native stage-two primitives. There is no scoped agent identity, no tool-call approval workflow, and no built-in audit trails. Enterprises running agents through open-source orchestration need to layer enforcement and isolation on top, not assume the framework provides it.

Advertisement

VentureBeat’s survey quantifies the pressure. Policy enforcement consistency grew from 39.5% to 46% between January and February, the largest consistent gain of any capability criterion. Enterprises running agents across OpenAI, Anthropic, and Azure need enforcement that works the same way regardless of which model executes the task. Provider-native controls enforce policy within that provider’s runtime only. Open-source orchestration frameworks enforce it nowhere.

One counterargument deserves acknowledgment: not every agent deployment needs stage three. A read-only summarization agent with no tool access and no write permissions may rationally stop at stage one. The sequencing failure this audit addresses is not that monitoring exists. It is that enterprises running agents with write access, shared credentials, and agent-to-agent delegation are treating monitoring as sufficient. For those deployments, stage one is not a strategy. It is a gap.

Allianz shows stage-three in production

Allianz, one of the world’s largest insurance and asset management companies, is running Claude Managed Agents across insurance workflows, with Claude Code deployed to technical teams and a dedicated AI logging system for regulatory transparency, per Anthropic’s April 8 announcement. Asana, Rakuten, Sentry, and Notion are in production on the same beta. Stage-three isolation, per-agent permissioning, and execution-chain auditability are deployable now, not roadmap. The gating question is whether the enterprise has sequenced the work to use them.

The 90-day remediation sequence

Days 1–30: Inventory and baseline. Map every agent to a named owner. Log all tool calls. Revoke shared API keys. Deploy read-only monitoring across all agent API traffic. Run mcp-scan against every registered MCP server. CrowdStrike detects 1,800 AI applications across enterprise endpoints; your inventory should be equally comprehensive. Output: agent registry with permission matrix, MCP scan report.

Advertisement

Days 31–60: Enforce and scope. Assign scoped identities to every agent. Deploy tool-call approval workflows for write operations. Integrate agent activity logs into existing SIEM. Run a tabletop exercise: What happens when an agent spawns an agent? Conduct a canary-token test from the prescriptive matrix. Output: IAM policy set, approval workflow, SIEM integration, canary-token test results.

Days 61–90: Isolate and test. Sandbox high-risk agent workloads (PHI, PII, financial transactions). Enforce per-session least privilege. Require human sign-off for agent-to-agent delegation. Red-team the isolation boundary using the stage-three detection test from the matrix. Output: sandboxed execution environment, red-team report, board-ready risk summary with regulatory exposure mapped to HIPAA tier and FINRA guidance.

What changes in the next 30 days

EU AI Act Article 14 human-oversight obligations take effect August 2, 2026. Programs without named owners and execution trace capability face enforcement, not operational risk.

Anthropic’s Claude Managed Agents is in public beta at $0.08 per session-hour. GA timing, production SLAs, and final pricing have not been announced.

Advertisement

OpenAI Agents SDK ships TypeScript support for sandbox and harness capabilities in a future release, per the company’s April 15 announcement. Stage-three sandbox becomes available to JavaScript agent stacks when it ships.

What the sequence requires

McKinsey’s 2026 AI Trust Maturity Survey pegs the average enterprise at 2.3 out of 4.0 on its RAI maturity model, up from 2.0 in 2025 but still an enforcement-stage number; only one-third of the ~500 organizations surveyed report maturity levels of three or higher in governance. Seventy percent have not finished the transition to stage three. ARMO’s progressive enforcement methodology gives you the path: behavioral profiles in observation, permission baselines in selective enforcement, and full least privilege once baselines stabilize. Monitoring investment was not wasted. It was stage one of three. The organizations stuck in the data treated it as the destination.

The budget data makes the constraint explicit. The share of enterprises reporting flat AI security budgets doubled from 7.9% in January to 16% in February in VentureBeat’s survey, with the March directional reading at 20%. Organizations expanding agent deployments without increasing security investment are accumulating security debt at machine speed. Meanwhile, the share reporting no agent security tooling at all fell from 13% in January to 5% in March. Progress, but one in twenty enterprises running agents in production still has zero dedicated security infrastructure around them.

About this research

Total qualified respondents: 108. VentureBeat Pulse AI Security and Trust is a three-wave VentureBeat survey run January 6 through March 15, 2026. Qualified sample (organizations 100+ employees): January n=38, February n=50, March n=20. Primary analysis runs from January to February; March is directional. Industry mix: Tech/Software 52.8%, Financial Services 10.2%, Healthcare 8.3%, Education 6.5%, Telecom/Media 4.6%, Manufacturing 4.6%, Retail 3.7%, other 9.3%. Seniority: VP/Director 34.3%, Manager 29.6%, IC 22.2%, C-Suite 9.3%.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Old Cars ‘Tell Tales’ by Storing Data That’s Never Wiped

Published

on

Slashdot reader Bismillah shared this report from ITNews:

Research and development engineer Romain Marchand of Paris headquartered Quarkslab obtained a telematic control unit (TCU) from a salvage yard in Poland… Marchand tore down the TCU, which is based on a Qualcomm system on a chip, and extracted the Linux-based file system from the Micron multi-chip package (MCP) which contained NAND-based non-volatile storage memory. The non-volatile storage contained sensitive information, including system configuration data and more importantly, logs that revealed the vehicle’s GPS positions over time.

None of that information was encrypted, Marchand told iTnews, which made it possible to collect and retrieve sensitive data of interest. What’s more, the global navigation satellite system (GNSS) logs with GPS positions covered the BYD’s full journey from the factory in China to its operational life in the United Kingdom, and to its final wrecking in Poland, Marchand explained in an analysis… The issue is not restricted to BYD, and Marchand added that the hardware architecture of the Chinese car maker’s TCU is broadly similar to what can be found in other brands.

Source link

Advertisement
Continue Reading

Tech

SNK’s Neo Geo console remake works with original cartridges and HDMI

Published

on

Not everyone had the money for the original Neo Geo Advanced Entertainment System when it released in the ’90s, but there’s still a chance to experience it as an adult with disposable income. SNK and Plaion Replai, who is also behind the all-black remake of the Commodore 64, announced a faithful remake of the high-end retro console, called the Neo Geo AES+.

To bring the original console into the modern day, the collaborating companies added HDMI compatibility for resolutions up to 1080p and DIP switches on the bottom of the console to allow for language selection, overclocking and switching display modes. Rounding out the upgrades, SNK and Plaion Replai included a permanent way to retain high scores on a memory card and a low-power usage mode. For the purists out there, the Neo Geo AES+ still works on those chunky CRT displays since it has the original AV output.

Preorders are currently open for two versions of the Neo Geo AES+, including an all-white 35th anniversary edition bundle that includes an Arcade Stick, a limited-edition Metal Slug game cartridge and a memory card, for $349.99. The standard edition in classic black will only come with an arcade stick, but will be available for $249.99. Coinciding with the console release, Replai Plaion will release 10 modernized game cartridges, including Metal Slug, The King of Fighters 2002 and other classics, for $89.99 each. If you think those prices are high, don’t forget the original Neo Geo AES’ release price was $649.99. The Neo Geo AES+ is set to start shipping on November 12.

Source link

Advertisement
Continue Reading

Tech

Price war: Apple's 1TB M5 MacBook Pro dips to $1,580

Published

on

Apple retailers are embroiled in a MacBook Pro price war this Thursday, resulting in the 1TB M5 14-inch model falling to $1,580.

Open Space Black MacBook Pro laptop with abstract dark screen pattern on a blue gradient background, overlaid large white text reading M5 1TB $1,580
Grab a 1TB MacBook Pro 14-inch for $1,580 at Amazon – Image credit: Apple

You can pick up the 1TB 14-inch MacBook Pro for $1,580 at Amazon in Silver, while the Space Black version is on sale for $1,599 at both B&H and Amazon.
Buy M5 MacBook Pro for $1,580
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

Today’s NYT Connections: Sports Edition Hints, Answers for April 19 #573

Published

on

Looking for the most recent regular Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle and Strands puzzles.


Today’s Connections: Sports Edition gets a bit wild in the blue and purple categories. If you’re struggling with today’s puzzle but still want to solve it, read on for hints and the answers.

Connections: Sports Edition is published by The Athletic, the subscription-based sports journalism site owned by The Times. It doesn’t appear in the NYT Games app, but it does in The Athletic’s own app. Or you can play it for free online.

Advertisement

Read more: NYT Connections: Sports Edition Puzzle Comes Out of Beta

Hints for today’s Connections: Sports Edition groups

Here are four hints for the groupings in today’s Connections: Sports Edition puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.

Yellow group hint: Play ball!

Advertisement

Green group hint: Gridiron roles.

Blue group hint: Like Ted Lasso.

Purple group hint: LA team that came from Brooklyn.

Answers for today’s Connections: Sports Edition groups

Yellow group: AL East teams.

Advertisement

Green group: First words of football positions.

Blue group: Premier League managers.

Purple group: Nicknames for the Dodgers franchise, over time.

Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words

Advertisement

What are today’s Connections: Sports Edition answers?

completed NYT Connections: Sports Edition puzzle for April 19, 2026, #573

The completed NYT Connections: Sports Edition puzzle for April 19, 2026.

NYT/Screenshot by CNET

The yellow words in today’s Connections

The theme is AL East teams. The four answers are Blue Jays, Orioles, Rays and Yankees.

The green words in today’s Connections

The theme is first words of football positions. The four answers are defensive, running, tight and wide.

Advertisement

The blue words in today’s Connections

The theme is Premier League managers. The four answers are Emery, Guardiola, Moyes and Slot.

The purple words in today’s Connections

The theme is nicknames for the Dodgers franchise, over time. The four answers are Bridegrooms, Dodgers, Robins and Superbas.

Source link

Advertisement
Continue Reading

Tech

Deepfake nonconsensual porn apps are advertising in the App Store

Published

on

Users looking to create nonconsensual deepfakes of unknowing individuals can simply perform an App Store search. If App Review has a job, it clearly isn’t doing it.

Smartphone screen showing App Store search results for Deepfake, highlighting a face swap video app with promotional screenshots of altered faces and a prominent Get button on a dark background
It is trivially easy to search for deepfake tools when they take out ads

It isn’t just the Grok app that lets users create nonconsensual deepfake nudes and pornography. Apple did remove at least 28 such apps in January, and even threatened xAI with a Grok removal, but that clearly hasn’t been enough.
According to a report from The Tech Transparency Project that was first shared by 9to5Mac, “nudify” apps are appearing in search ads and suggestions in the App Store. Pornography isn’t banned from the App Store if it isn’t the app’s sole purpose, but illegal or harmful products are.
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

This One Has The Best ANC And Sound Quality

Published

on





If you own a Samsung smartphone and want earbuds to go along with it, the company’s Galaxy Buds are a tempting option. They have several features that only work with Samsung products, and they can often be included for free with the purchase of a new phone. Moreover, they sound good, too, especially the premium Galaxy Buds Pro — possibly thanks to Samsung’s ownership of some of the most respected audio brands on the market, including Harman International, Bowers and Wilkins, and JBL.

Samsung recently launched the Galaxy Buds4 Pro, the fourth generation of its premium true wireless earbuds, for $249. However, the Buds3 Pro, which launched in mid-2024, are still available for purchase, as are the Buds2 Pro and the original Buds Pro. All support active noise cancellation (ANC) and transparency mode, as well as a range of smart features. Sure, the newer products have a few extra tricks, like the live translation feature exclusive to the Buds3 series and up, or the ability to use head gestures, which is exclusive to the Buds4 Pro. With only minor differences, though, you might wonder whether you really need the latest and greatest, or whether you can skate by on a budget by scooping up an older pair of Galaxy Buds Pro.

To put that question to rest, I picked up all four pairs of Samsung’s top-line true wireless earbuds and put them through their paces. After comparing their ANC performance and sound quality, I found some surprising results.

Advertisement

Which pair of Galaxy Buds Pro has the best ANC?

To gauge the relative active noise canceling abilities of each, I used my studio reference monitors to play simulated jet cabin noise at 90 decibels, which is around the upper range of what you’ll experience at cruising altitude. I also used each pair of earbuds at my favorite coffee shop during the mid-afternoon rush.

Across the board, the original Galaxy Buds Pro had the worst ANC performance. It performed reasonably well in the airplane test, at least for lower frequencies and engine rumble, but it wasn’t so good at the higher-pitched whine. In the cafe setting, they did a decent job tamping down on the sound of an espresso machine, but couldn’t consistently mask sudden noises like chairs shifting or people laughing.

Advertisement

The best performer was the Galaxy Buds4 Pro. They muffled a much wider range of airplane engine noise and greatly reduced the most problematic noises at the cafe. However, it’s hard to say they’re that much better than the Galaxy Buds3 Pro. I had to A/B test both for several minutes before the differences became obvious to me. The Buds2 Pro is no slouch, either. Although ANC performance is a step behind the Buds3 Pro, they have longer eartips that protrude deeper into my ear canal, creating a better passive seal in my ears.

It’s worth noting that I used foam eartips from Comply instead of the standard ones. I cannot stand silicone eartips and prefer the superior comfort and sound isolation of foam. This likely affected my testing, but since foam tips were used for all tests, the relative results should be unaffected.

Advertisement

The Galaxy Buds Pro lineup sounds great across the board

When it comes to sound quality, the original Samsung Galaxy Buds Pro sounded the worst in my tests. That’s not to say they sound bad; none of these earbuds do. They are, however, less refined and do not support high-resolution Bluetooth on Samsung devices like the other models. The Galaxy Buds2 Pro are where Samsung’s earbuds graduate from good to great. They sound delightful, tracking closely to the Harman 2025 preference target aside from some elevated low-end and a large peak around 12,000 Hz.

When it comes to the Buds3 Pro and Buds4 Pro, things aren’t as simple. Both of these earbuds sound excellent, so which ones you’ll prefer likely comes down to taste. Samsung started using dual drivers with the Buds3 Pro, meaning there’s both a woofer and a tweeter inside; I found them to have the most V-shaped, or “exciting,” response. If you enjoy heavy, clear bass with a parallel emphasis on the upper range, the Buds3 Pro are your winners. They excel in genres such as dubstep and other EDM, pop, and some hip hop, but can be less impressive for rock n’ roll or country. However, I did notice some distortion at higher volumes.

The Buds4 Pro are a refinement of that approach, and my overall pick for sound quality. Samsung enlarged the dual drivers this year, but the V-shaped response is more toned down compared to the Buds3 Pro. Bass is far less forward, and there’s less excitement in the highs. It’s a much more balanced (but less fun) sound, and the Samsung app’s nine-band adaptive EQ makes it easier to tune them.

Advertisement

Fit and build quality vary across models

Build quality and fit vary across the models. The Buds Pro and Buds2 Pro use an in-ear design with fins to help them stay put. The Buds3 Pro and Buds4 Pro use a stemmed “elephant trunk” design similar to Apple AirPods. It’s a tradeoff. The stemless design of the first two models is harder to knock loose with a finger or bike helmet strap, but the touch controls are finicky, and I often paused music by accident while adjusting them. The stem on the later models reduces unintentional inputs, but makes them easier to dislodge accidentally.

The first two models use charging cases with identical external dimensions, like a ring box that opens clamshell style. This pattern is interrupted by the Buds3 Pro, which has a more AirPods-esque case. It’s by far the most pocketable, but it tends to open a bit in the pocket. It is also plagued by charging issues that afflicted my unit, and I often found one bud close to dead when I pulled them out. The Buds4 Pro returns to the ring box case, but is slightly larger and more squared off. It also has a clear plastic top so you can see the buds inside.

Where the original Buds Pro and Buds3 Pro use glossy finishes, the Buds2 Pro have a matte finish on the case and the buds themselves. It can begin to discolor over time (especially the lovely, lilac-colored version I own), but does not get disgustingly oily during use. Conversely, the Buds3 are especially nasty after a long listening session. The Buds4 Pro split the difference with a recycled plastic that isn’t too shiny, nor too matte. The material doesn’t get dirty easily.

Advertisement

Some features are exclusive to newer Galaxy Buds

Lastly, I investigated the difference in smart features across Galaxy Buds Pro models. All four have ANC and ambient mode, but the Buds3 and Buds4 Pro can automatically switch to ambient mode when they detect voices or emergency sirens. They are also the only models with voice controls — a feature I frankly cannot live without any longer. It’s simply too convenient to say, “Next song” or “Volume up” while I have wet or dirty hands. The Buds4 Pro also support head gestures, letting you nod or shake to answer or reject calls. Since my Samsung devices do not yet have the One UI 8.5 update, I wasn’t able to test this.

Although all four pairs of earbuds can automatically switch between your Samsung devices and Windows PCs with the Galaxy Buds app installed, the feature is inconsistent on all but the Buds4 Pro. I could rarely get the other three to notice when I stopped music on my phone to start a video on my tablet, but the latest model did much better. It only failed when trying to switch from my Windows PC back to a mobile device, an issue I attribute to Windows 11, not to Samsung.

Advertisement

All four Buds Pro models have 360-degree audio, a feature I’ve always found gimmicky. It’s hard to find many songs mixed in Dolby or other spatial formats, and their stereo mixes are usually superior, anyway. As for other media, I don’t watch movies or TV on my phone. All said, the Buds4 Pro win out for their more consistent performance.

Advertisement

The Galaxy Buds4 Pro are peak Samsung, but the Buds2 Pro are a value pick

After two full weeks of side-by-side testing, I’m going to hang onto the Samsung Galaxy Buds4 Pro as my main true wireless earbuds. They outperform their predecessors in terms of ANC, smart features, and battery life (which is excellent  and beats Samsung’s estimates in my testing). Sound quality is subjective, but I think Samsung gave the Buds4 Pro a balanced, yet consumer-friendly sound that almost everyone will appreciate. Previous models sound good, but perform best with music that leans into their respective strengths. Fit, while very personal, is passable, and their build quality is the best overall.

While the Buds4 Pro are great, budget-conscious consumers should strongly consider the Buds2 Pro. Samsung no longer sells them directly, but you can pick up a renewed pair on Amazon for just $55 at the time of this writing. With Amazon’s notoriously generous return policy, that’s a deal worth rolling the dice on. Considering how little you’re missing out on compared to the brand-new Buds4 Pro, you should pick the Buds2 Pro up if you can find a new or factory-certified pair for under $100. I suggest checking local retailers for old stock, as well.

If you’ve already got the Buds2 Pro or Buds3 Pro and aren’t experiencing issues, there’s not a ton compelling you to upgrade (unless you buy a new Galaxy S26 and get the Buds4 Pro bundled for free). Those still using the original Galaxy Buds Pro, though, are likely to appreciate the improvements Samsung has made over the years.

Advertisement



Source link

Continue Reading

Tech

Nvidia’s Jensen Huang warns DeepSeek running on Huawei chips would be ‘horrible outcome’ for America

Published

on

In short: Nvidia CEO Jensen Huang warned on the Dwarkesh Podcast that DeepSeek optimising its AI models for Huawei’s Ascend chips instead of American hardware would be “a horrible outcome” for the United States, as the Chinese AI lab prepares to launch its V4 foundation model on Huawei’s Ascend 950PR processor. The migration from Nvidia’s CUDA to Huawei’s CANN framework threatens to break the software-hardware dependency underpinning American AI dominance, even as US lawmakers push to place DeepSeek on the entity list for export control.

Nvidia CEO Jensen Huang said on the Dwarkesh Podcast on Wednesday that if DeepSeek optimised its new AI models to run on Huawei chips rather than American hardware, it would be “a horrible outcome” for the United States. The warning frames the emerging partnership between China’s most capable AI lab and its most advanced chipmaker as a direct threat to the technological leverage that has underpinned American AI dominance for the past decade.

If future AI models are optimised in a very different way than the American tech stack,” Huang said, and as “AI diffuses out into the rest of the world” with Chinese standards and technology, China “will become superior to” the US. The statement is notable because it comes from the CEO of the company that has benefited most from the current arrangement, in which virtually every frontier AI model in the world is trained on Nvidia GPUs using Nvidia’s CUDA software framework.

What DeepSeek is building

DeepSeek is preparing to launch V4, a multimodal foundation model expected later this month. The Information reported earlier in April that V4 would run on Huawei’s latest Ascend 950PR processor, while a separate Reuters report suggested the model had been trained on Nvidia’s Blackwell chips, which would constitute a violation of US export controls. The two claims are not necessarily contradictory: a model can be trained on one set of hardware and deployed for inference on another.

Advertisement

What makes the Huawei integration significant is the software migration behind it. DeepSeek has spent months rewriting its core code to work with Huawei’s CANN framework, moving away from the CUDA ecosystem that Nvidia has spent two decades building into the foundation of AI development. CUDA’s dominance has functioned as a second layer of American control over AI, beyond the chips themselves. Export restrictions can limit which Nvidia hardware reaches China, but as long as Chinese labs wrote their software for CUDA, they remained dependent on the Nvidia ecosystem even when using alternative processors. DeepSeek’s move to CANN breaks that dependency.

DeepSeek’s V3 model, launched in late 2024, was trained on 2,048 Nvidia H800 GPUs, a chip tailor-made for the Chinese market that was itself banned from sale to China in 2023. The company has already demonstrated that it can produce frontier-competitive models with fewer resources than its American rivals. Its R1 reasoning model matched or exceeded the performance of models that cost orders of magnitude more to train. V4 would extend that approach by proving the company can do it without American hardware at all.

The hardware gap and why it may not matter

On raw performance, Huawei’s chips are not competitive with Nvidia’s best. The Ascend 910C, the predecessor to the 950PR, delivers roughly 60% of the inference performance of Nvidia’s H100, a chip that is itself two generations behind Nvidia’s current best. American chips are approximately five times more powerful than their Chinese equivalents today, and that gap is projected to widen to 17 times by 2027. Huawei is targeting 750,000 AI chip shipments in 2026, but its total production represents only 3 to 5% of Nvidia’s aggregate computing power.

But Huang’s concern is not about the current performance gap. He said on the podcast that even if China had inferior chips, it could still catch up with the US in AI development given its “abundant energy” and “large pool of AI researchers.” The implication is that raw hardware performance is only one variable, and that software optimisation, researcher talent, and energy availability can compensate for silicon disadvantages. If V4 performs well on Ascend chips, it validates an alternative path for AI development that does not depend on Nvidia at any point in the supply chain.

The export control paradox

The situation exposes a tension at the centre of American chip export policy. Nvidia restarted production of the H200, a more powerful chip, for sale in China, as Huang confirmed in March. But China has been blocking H200 imports to protect Huawei’s domestic chip business, and Nvidia’s CFO has said the company has recorded no revenue from China H200 sales. The controls designed to limit China’s AI capabilities are instead accelerating the development of a Chinese alternative.

Advertisement

DeepSeek’s experience with its R2 model illustrates both the promise and the limits of the Huawei path. R2 was repeatedly delayed because of training failures on Huawei hardware. Chinese authorities had urged DeepSeek to train on domestic chips, but the company encountered stability issues that forced it to revert to Nvidia GPUs for training while using Huawei chips only for inference. The distinction matters: training is the most compute-intensive phase of AI development, and the fact that Huawei chips could not handle it reliably suggests the hardware gap is real. But inference, the phase where models serve users, is where commercial value is generated, and Huawei’s chips appear adequate for that purpose.

Meanwhile, US lawmakers are pushing to tighten restrictions further. On Thursday, lawmakers and experts accused China of buying “what they can” and stealing “what they cannot” in the AI industry, and called for the government to evaluate placing DeepSeek, Moonshot AI, and MiniMax on the entity list for export control.

What Huang is really warning about

Huang’s warning is ultimately about software-hardware co-design. Nvidia’s dominance rests not just on making the fastest chips but on CUDA’s position as the default development environment for AI. When researchers write code, they write it for CUDA. When startups build products, they build them on CUDA. When governments invest in AI infrastructure, they buy Nvidia GPUs because that is what the software requires. DeepSeek’s migration to CANN threatens to create a parallel ecosystem in which none of that applies.

The scale of Nvidia’s business makes the stakes concrete. The company’s market capitalisation exceeds $3 trillion. Its data centre revenue grew 93% year over year in its most recent quarter. Its chips power the training runs for virtually every major AI model outside China. If the most capable Chinese AI lab demonstrates that competitive models can be built without Nvidia, the argument for maintaining export controls weakens, the argument for buying Nvidia weakens, and the geopolitical assumptions that have shaped AI policy for the past three years come under pressure.

Advertisement

None of this means Huawei is about to overtake Nvidia. The performance gap is large and growing. The R2 training failures demonstrate that Chinese hardware is not yet ready for the most demanding AI workloads. But Huang is not warning about today. He is warning about a trajectory in which DeepSeek proves the concept, other labs follow, and the CUDA moat that has made Nvidia the most valuable company in the AI supply chain begins to erode.

The fact that the CEO of Nvidia is the one making this argument publicly suggests he believes the risk is no longer theoretical. DeepSeek’s V4 will be the first major test. If a multimodal foundation model runs competitively on Huawei silicon, the warning Huang issued on Wednesday will look less like corporate lobbying and more like the most consequential forecast in the AI chip war so far.

Source link

Advertisement
Continue Reading

Tech

Should my enterprise AI agent do that? NanoClaw and Vercel launch easier agentic policy setting and approval dialogs across 15 messaging apps

Published

on

For the past year, early adopters of autonomous AI agents have been forced to play a murky game of chance: keep the agent in a useless sandbox or give it the keys to the kingdom and hope it doesn’t hallucinate a catastrophic “delete all” command.

To unlock the true utility of an agent—scheduling meetings, triaging emails, or managing cloud infrastructure—users have had to grant these models raw API keys and broad permissions, raising the risk of their systems being disrupted by an accidental agent mistake.

That tradeoff ends today. The creators of the open source sandboxed NanoClaw agent framework — now known under their new private startup named NanoCo — have announced a landmark partnership with Vercel and OneCLI to introduce a standardized, infrastructure-level approval system.

By integrating Vercel’s Chat SDK and OneCLI’s open source credentials vault, NanoClaw 2.0 ensures that no sensitive action occurs without explicit human consent, delivered natively through the messaging apps where users already live.

Advertisement

The specific use cases that stand to benefit most are those involving high-consequence “write” actions. That is, in DevOps, an agent could propose a cloud infrastructure change that only goes live once a senior engineer taps “Approve” in Slack.

For finance teams, an agent could prepare batch payments or invoice triaging, with the final disbursement requiring a human signature via a WhatsApp card.

Technology: security by isolation

The fundamental shift in NanoClaw 2.0 is the move away from “application-level” security to “infrastructure-level” enforcement. In traditional agent frameworks, the model itself is often responsible for asking for permission—a flow that Gavriel Cohen, co-founder of NanoCo, describes as inherently flawed.

“The agent could potentially be malicious or compromised,” Cohen noted in a recent interview. “If the agent is generating the UI for the approval request, it could trick you by swapping the ‘Accept’ and ‘Reject’ buttons.”

Advertisement

NanoClaw solves this by running agents in strictly isolated Docker or Apple Containers. The agent never sees a real API key; instead, it uses “placeholder” keys. When the agent attempts an outbound request, the request is intercepted by the OneCLI Rust Gateway. The gateway checks a set of user-defined policies (e.g., “Read-only access is okay, but sending an email requires approval”).

If the action is sensitive, the gateway pauses the request and triggers a notification to the user. Only after the user approves does the gateway inject the real, encrypted credential and allow the request to reach the service.

Product: bringing the ‘human’ into the loop

While security is the engine, Vercel’s Chat SDK is the dashboard. Integrating with different messaging platforms is notoriously difficult because every app—Slack, Teams, WhatsApp, Telegram—uses different APIs for interactive elements like buttons and cards.

By leveraging Vercel’s unified SDK, NanoClaw can now deploy to 15 different channels from a single TypeScript codebase. When an agent wants to perform a protected action, the user receives a rich interactive card on their phone. “The approval shows up as a rich, native card right inside Slack or WhatsApp or Teams, and the user taps once to approve or deny,” said Cohen. This “seamless UX” is what makes human-in-the-loop oversight practical rather than a productivity bottleneck.

Advertisement

The full list of 15 supported messaging apps/channels contains many favored by enterprise knowledge workers, including:

  • Slack

  • WhatsApp

  • Telegram

  • Microsoft Teams

  • Discord

  • Google Chat

  • iMessage

  • Facebook Messenger

  • Instagram

  • X (Twitter)

  • GitHub

  • Linear

  • Matrix

  • Email

  • Webex

Background on NanoClaw

NanoClaw launched on January 31, 2026, as a minimalist and security-focused response to the “security nightmare” inherent in complex, non-sandboxed agent frameworks.

Created by Cohen, a former Wix.com engineer, and marketed by his brother Lazer, CEO of B2B tech public relations firm Concrete Media, the project was designed to solve the auditability crisis found in competing platforms like OpenClaw, which had grown to nearly 400,000 lines of code.

By contrast, NanoClaw condensed its core logic into roughly 500 lines of TypeScript—a size that, according to VentureBeat, allows the entire system to be audited by a human or a secondary AI in approximately eight minutes.

Advertisement

The platform’s primary technical defense is its use of operating system-level isolation. Every agent is placed inside an isolated Linux container—utilizing Apple Containers for high performance on macOS or Docker for Linux—to ensure that the AI only interacts with directories explicitly mounted by the user.

As detailed in VentureBeat’s reporting on the project’s infrastructure, this approach confines the “blast radius” of potential prompt injections strictly to the container and its specific communication channel.

In March 2026, NanoClaw further matured this security posture through an official partnership with the software container firm Docker to run agents inside “Docker Sandboxes”.

This integration utilizes MicroVM-based isolation to provide an enterprise-ready environment for agents that, by their nature, must mutate their environments by installing packages, modifying files, and launching processes—actions that typically break traditional container immutability assumptions.

Advertisement

Operationally, NanoClaw rejects the traditional “feature-rich” software model in favor of a “Skills over Features” philosophy. Instead of maintaining a bloated main branch with dozens of unused modules, the project encourages users to contribute “Skills”—modular instructions that teach a local AI assistant how to transform and customize the codebase for specific needs, such as adding Telegram or Gmail support.

This methodology, as described on NanoClaw’s website and in VentureBeat interviews, ensures that users only maintain the exact code required for their specific implementation.

Furthermore, the framework natively supports “Agent Swarms” via the Anthropic Agent SDK, allowing specialized agents to collaborate in parallel while maintaining isolated memory contexts for different business functions.

Licensing and open source strategy

NanoClaw remains firmly committed to the open source MIT License, encouraging users to fork the project and customize it for their own needs. This stands in stark contrast to “monolithic” frameworks.

Advertisement

NanoClaw’s codebase is remarkably lean, consisting of only 15 source files and roughly 3,900 lines of code, compared to the hundreds of thousands of lines found in competitors like OpenClaw.

The partnership also highlights the strength of the “Open Source Avengers” coalition.

By combining NanoClaw (agent orchestration), Vercel Chat SDK (UI/UX), and OneCLI (security/secrets), the project demonstrates that modular, open-source tools can outpace proprietary labs in building the application layer for AI.

Community reactions

As shown on the NanoClaw website, the project has amassed more than 27,400 stars on GitHub and maintains an active Discord community.

Advertisement

A core claim on the NanoClaw site is that the codebase is small enough to understand in “8 minutes,” a feature targeted at security-conscious users who want to audit their assistant.

In an interview, Cohen noted that iMessage support via Vercel’s Photon project addresses a common community hurdle: previously, users often had to maintain a separate Mac Mini to connect agents to an iMessage account.

The enterprise perspective: should you adopt?

For enterprises, NanoClaw 2.0 represents a shift from speculative experimentation to safe operationalization.

Historically, IT departments have blocked agent usage due to the “all-or-nothing” nature of credential access. By decoupling the agent from the secret, NanoClaw provides a middle ground that mirrors existing corporate security protocols—specifically the principle of least privilege.

Advertisement

Enterprises should consider this framework if they require high-auditability and have strict compliance needs regarding data exfiltration. According to Cohen, many businesses have not been ready to grant agents access to calendars or emails because of security concerns. This framework addresses that by ensuring the agent structurally cannot act without permission.

Enterprises stand to benefit specifically in use cases involving “high-stakes” actions. As illustrated in the OneCLI dashboard, a user can set a policy where an agent can read emails freely but must trigger a manual approval dialog to “delete” or “send” one.

Because NanoClaw runs as a single Node.js process with isolated containers , it allows enterprise security teams to verify that the gateway is the only path for outbound traffic. This architecture transforms the AI from an unmonitored operator into a supervised junior staffer, providing the productivity of autonomous agents without forgoing executive control.

Ultimately, NanoClaw is a recommendation for organizations that want the productivity of autonomous agents without the “black box” risk of traditional LLM wrappers. It turns the AI from a potentially rogue operator into a highly capable junior staffer who always asks for permission before hitting the “send” or “buy” button.

Advertisement

As AI-native setups become the standard, this partnership establishes the blueprint for how trust will be managed in the age of the autonomous workforce.

Source link

Continue Reading

Tech

This record-breaking ultraviolet crystal may unlock nuclear clocks and change how submarines, spacecraft, and missiles navigate without external signals

Published

on


  • Nuclear clocks promise accuracy far beyond existing atomic timekeeping systems
  • Thorium 229 offers a rare pathway to practical nuclear time measurement
  • Ultraviolet breakthrough reduces one of the hardest barriers in nuclear clock development

A new crystal developed by Chinese scientists has broken the world record for ultraviolet light conversion, bringing nuclear clock technology closer to reality.

The fluorinated borate compound pushes laser light to a wavelength of 145.2nm, beating the previous benchmark of 150nm set by a Chinese crystal from the 1990s.

Source link

Continue Reading

Tech

AI chip startup Cerebras files for IPO

Published

on

Cerebras Systems, a startup building what CEO Andrew Feldman describes as “the fastest AI hardware for training and inference,” has filed to go public.

The company previously filed for an initial public offering in 2024, but that was delayed due to a federal review of an investment from Abu Dhabi-based G42 and was ultimately withdrawn. Cerebras raised a $1.1 billion Series G last year, followed by a $1 billion Series H in February at a $23 billion valuation, according to the Wall Street Journal.

In recent months, the company announced an agreement with Amazon Web Services to use Cerebras chips in Amazon data centers, as well as a deal with OpenAI reportedly worth more than $10 billion.

In a recent interview with the WSJ, Feldman boasted, “Obviously, [Nvidia] didn’t want to lose the fast inference business at OpenAI, and we took that from them.”

Advertisement

Cerebras brought in $510 million in revenue in 2025, according to the filing, with a net income of $237.8 million (excluding certain one-time items, it was a non-GAAP net loss of $75.7 million).

A company has not disclosed how much it hopes to raise in the IPO. A spokesperson said the offering is planned for mid-May.

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025