• Date: Sunday 31 May
• Kick-Off: 10:30pm BST / 5:30pm ET / 7:30am AEST
• Stream Brazil vs Panama free on Globoplay
• Use NordVPN to unblock free Globoplay stream

Brazil vs Panama are both ramping up their World Cup preparations this weekend as they face off in a friendly at the Maracanã Stadium in Rio de Janeiro.

A Seleção is one of the favourites for the tournament, but with question marks over Neymar Jr’s fitness, attention is very much elsewhere.

After criticizing a startup called Artisan for misusing his work, artist KC Green — creator of the famous “This is fine” meme — said he’s reached an agreement with Artisan. 

The dispute arose after the startup appeared to use a version of Green’s art to promote its AI assistant Ava. In Artisan’s bus and subway ads, Green’s recognizable dog sat amid recognizable flames, but instead of saying “This is fine,” it declared, “My pipeline is on fire,” while the ad urged people to “Hire Ava the AI BDR.”

Earlier this month, Green posted on social media that his art had been “stolen like AI steals” and urged his followers to “vandalize” the ads if they saw them. He also told TechCrunch he was frustrated about having to “try my hand at the American court system” instead of putting that time into his comics.

Artisan, meanwhile, told us it has “a lot of respect for Green and his work.” Then, earlier this week, founder and CEO Jaspar Carmichael-Jack said the two sides had come to an agreement.

When TechCrunch reached out to Green, he confirmed that they’d “reached a settlement pretty quick,” with Artisan taking down the ads in New York and San Francisco that used his character, and Green taking down his initial post.

A top-level Communist Party publication has signaled a shift in how Beijing intends to govern its largest internet platforms. A draft commentary set to appear in the Qiushi journal on Monday says the focus will be on balancing support for growth with enhanced regulatory oversight. The message is directed at companies including Alibaba, Meituan, and PDD Holdings.

The guidance reiterates Beijing’s stance on curbing “involution-style” competition, a reference to the price wars and aggressive subsidies that have defined Chinese e-commerce in recent years. Platforms are told to compete on value, not on who can lose money the fastest. The commentary also calls for stronger oversight of algorithms, data use, and consumer protection.

The more significant signal is what the commentary encourages. Platform companies are told to increase investment in strategic technologies, specifically artificial intelligence and cloud computing. Beijing is pointing its tech giants toward higher-value growth areas and away from the subsidy-fuelled margin destruction that has characterised the sector.

“The healthy development of the sector depends on a sound governance system and effective regulatory measures,” the commentary says. “The irregularities seen in China’s platform economy are partly linked to the fact that regulatory and governance frameworks have yet to fully adapt to its characteristics.”

The policy follows years of sustained scrutiny. Alibaba was fined $2.8 billion in 2021. Didi was forced to delist from the New York Stock Exchange. Meituan faced antitrust investigations. PDD’s Temu has been under pressure over merchant fees and pricing practices. The regulatory crackdown wiped hundreds of billions of dollars from Chinese tech market capitalisations between 2021 and 2023.

The Qiushi commentary suggests Beijing is moving from crackdown to calibration. The regulatory backdrop is stabilising, but compliance costs are rising and operational constraints are tightening. Platforms get permission to grow again, with conditions.

Chinese AI companies are already competing aggressively on price. DeepSeek permanently cut its V4 Pro model pricing by 75% this week, undercutting every Western frontier model. The Qiushi commentary’s call for AI investment aligns with a broader national strategy to dominate the AI stack from models to chips to applications.

China’s technology exports are expanding simultaneously across multiple fronts. BYD, Chery, and Geely are entering Canada. Xiaomi shipped 600,000 EVs in under two years. CXMT’s DRAM is appearing inside Corsair kits. The platform regulation signal is one piece of a broader industrial policy that encourages Chinese companies to invest in strategic technologies at home while competing globally.

For investors, the message is cautiously positive. The crackdown era appears to be over. Alibaba’s stock has recovered significantly from its 2022 lows. But the new framework means higher compliance costs, tighter algorithm transparency requirements, and an end to the subsidy-driven growth models that built Pinduoduo and Temu. The companies that redirect spending from price wars to AI will be rewarded. Those that do not will face regulatory pressure.

The Qiushi journal is the Communist Party’s premier theoretical publication. Commentary published in it reflects official policy direction rather than speculative opinion. When it tells China’s platforms to stop fighting on price and start investing in AI, the platforms listen. The question is whether the investment produces innovation or compliance theatre. Beijing is betting on the former.

In 2024, researchers from the University of Illinois found that GPT-4, when provided with a common vulnerabilities and exposures (CVE) description, could autonomously exploit 87% of a curated 15-vulnerability one-day dataset. Without the description, it could only exploit 7%. This provided a “margin of safety” for the industry because while AI could exploit known vulnerabilities, it could not discover them.

However, on April 7, Anthropic announced that Claude Mythos Preview had closed that margin, with the model autonomously discovering thousands of zero-day vulnerabilities across major operating systems and browsers. Separately, Mythos scored 83.1% on the CyberGym vulnerability reproduction benchmark. In one campaign targeting OpenBSD across 1,000 scaffold runs, the total compute cost was less than $20,000.

Exploitation timelines are collapsing. Langflow’s CVE-2026-33017 (CVSS 9.8) was exploited 20 hours after disclosure with no public proof-of-concept. Marimo’s CVE-2026-39987 (CVSS 9.3) was hit in 9 hours and 41 minutes.

The defensive infrastructure most organizations rely on wasn’t designed for this. Rapid7’s 2026 threat landscape report states that the median time from CVE publication to CISA’s known exploited vulnerabilities (KEV) listing is five days. Google’s M-Trends 2026 report found that exploitation is happening before a patch is even released. When the Langflow advisory was published, the first exploit arrived in 20 hours. When the Marimo advisory was published, it took under 10 hours.

The assumption that your patch window is safe because exploitation takes time is no longer true. Here are your building blocks.

Replace CVSS-only prioritization with a three-layer filter

Most vulnerability management programs still prioritize by CVSS score alone. CVSS quantifies a vulnerability’s “theoretical” severity without considering whether a vulnerability is being exploited in the wild or how quickly someone could weaponize it. A CVSS 8.8 vulnerability with a history of active exploitation (like Docker’s CVE-2026-34040) gets lower priority than a CVSS 9.8 vulnerability that may never be exploited in the wild.

A recent study validated against 28,377 real-world vulnerabilities offers a concrete replacement: A three-layer decision tree incorporating CISA KEV status, Exploit Prediction Scoring System (EPSS) scores, and CVSS, thus forming a singular prioritization filter.

Three-Layer Vulnerability Prioritization Filter

Validated result: 18x efficiency gain, 85.6% coverage of exploited vulnerabilities, ~95% reduction in urgent remediation workload. All three data sources are open and free.

The described integration is entirely automatable. It’s possible to build a script to query the CISA KEV API, the EPSS API from FIRST.org, and the NVD, and have that script run against your asset inventory for every published CVE. The human in this process should remain in the loop as an approver, but not as the trigger.

Close the agent authorization gap

Creating exploits quickly not only changes how patches are prioritized, but how controls are configured for all the agent-driven systems that now possess privileged credentials. Your authorization policies have not been assessed against the behavior of AI agents, and that is now a measurable risk. CVE-2026-34040 showed that Docker’s authorization plugin architecture silently bypasses every plugin when the request body exceeds 1MB. Common AuthZ plugins (OPA, Casbin, Prisma Cloud) are unaware of this type of bypass, which occurs in Docker’s middleware before the request reaches the plugin.

When Cyera demonstrated this vulnerability, they showed that an AI agent debugging infrastructure could infer the bypass path while completing a legitimate task, without any instruction to exploit anything.

The Internet Engineering Task Force (IETF) is working on authorization models for agents. The document draft-klrc-aiagent-auth-01, published in March by participants from AWS, Zscaler, Ping Identity, and OpenAI, proposes the use of the current Secure Production Identity Framework for Everyone (SPIFFE) and OAuth 2.0 for AI agents to obtain dynamically provisioned and short-lived credentials.

Separately, the IETF Agent Identity Protocol draft (draft-prakash-aip-00) reports that out of about 2,000 surveyed model context protocol (MCP) servers, none had authentication.

But these standards are months to years away from implementation. For now, security teams must proactively incorporate agent-level test scenarios for all authorization boundaries, such as oversized requests, burst frequency, and multi-step escalation of privileged requests.

Map your credential blast radius

In a survey conducted by CSA/Zenity and published on April 16, 53% of organizations said they had already seen cases where AI agents exceeded their intended permissions, and 47% experienced a security incident involving an agent.

When AI builder tools such as Flowise (CVE-2025-59528, CVSS 10.0), Langflow, or n8n become compromised, the blast radius extends far beyond the host. These tools contain API keys to frontier models, database credentials, vector store tokens, and OAuth tokens to business systems. A compromised AI builder host is not just a single-system breach. It is a credential harvest that unlocks authenticated access to every connected service.

Without credential dependency maps for each AI tool host, incident response for agent compromise is guesswork. For every instance, document each credential, the extent of its access, and the relevant credential rotation process. Also begin migrating static API keys to short-lived tokens where downstream services allow.

Five actions for this quarter

1. Deploy the three-layer KEV-EPSS-CVSS filter

Substitute CVSS-only prioritization according to the table above. Automate the collection of data from all three APIs as part of a scheduled script against your asset inventory. Desired outcome: 18 times more efficient, 85.6% coverage of exploited vulnerabilities, 95% reduction in urgent remediation workload.

2. Implement event-driven patching for Tier 0 services.

Determine which services fall under the critical exposure tier: Services exposed directly to internet users, AI builder hosts, and container orchestration control plane. Trigger event-driven patching on a CVE publication instead of waiting for the next maintenance window for this tier.

Goal: deploy patch to canary within four hours of a CVE being declared critical. Use the CISA KEV and EPSS feeds to trigger event-driven patching. In situations where it is impossible to meet the goal of four-hour patching because of legacy dependencies, change-freeze windows, or rollback risk, immediately apply compensating controls such as removing internet exposure to the vulnerable service, rotating credentials for the vulnerable service, disabling affected functionality of the service (if applicable), and identifying an exception owner for the exposure until a patch can be deployed.

It is not acceptable to allow unbounded exposures for extended periods while awaiting a maintenance window.

3. Test authorization boundaries at agent scale.

Create test cases for every API that AI agents may communicate with via AuthZ policies. Specifically, include test cases for requests exceeding 1MB, 5MB, and 10MB body sizes. This includes test cases for burst rate > 100 requests per second and test cases for unusual parameter combinations (privileged flags, host mounts, capability additions). Additionally, patch to Docker Engine 29.3.1 to fix CVE-2026-34040.

4. Credential blast radius mapping for all AI builder hosts.

Document each credential for each Langflow, Flowise, n8n, and custom AI pipeline instance. Classify each credential by its lifespan (static key vs. short-lived token). Identify what each credential can access. Set up alerts for anomalous IP or identity for any credential access.

5. Shadow AI discovery scan for this week.

According to CSA data, there is a greater than 50% chance that your agents have exceeded their expected boundaries. Check your Security Information and Event Management (SIEM) and network monitoring tools for communications to the default ports of the AI builder: Langflow 7860, Flowise 3000, and n8n 5678. Any unauthorized instances are an unmonitored attack surface.

The takeaway

AI agents are emerging, and the standards bodies are responding. The IETF has multiple drafts related to agent authentication and authorization. The Coalition for Secure AI has published its MCP Security taxonomy and Secure-by-Design principles.

But these standards move at standards-body speed, and the exploit window is now measured in hours. Organizations that implement the three-layer filter and event-driven patching this quarter will have a measurable reduction in exposure. Those who wait will be running calendar-based patch cycles against an adversary that operates in less than 20 hours. 

Nik Kale is a principal engineer specializing in enterprise AI platforms and security

Welcome to the VentureBeat community!

Our guest posting program is where technical experts share insights and provide neutral, non-vested deep dives on AI, data infrastructure, cybersecurity and other cutting-edge technologies shaping the future of enterprise.

Read more from our guest post program — and check out our guidelines if you’re interested in contributing an article of your own!

The Apple smart glasses with cameras and no heads-up display have been rumored for the end of 2026, but could now come at the end of 2027 instead. Though that’s not the whole story.

Rumors about Apple’s smart glasses effort have been increasing in frequency since 2024, but primarily from a single source. One other highly accurate source that has been in play since 2023 has offered a differing timeline, until now.

According to the Bloomberg newsletter “Power On,” Apple is pushing back its smart glasses release to late 2027 after hitting some development snags. While Mark Gurman didn’t offer his usual derogatory pile-on of Apple’s internal struggles, the timeline shift comes as a bit of a surprise.

His initial reports in 2024 around the latest codenamed N50 glasses suggested a 2027 launch window. He later suggested in January 2025 that Apple smart glasses development had hit “massive hurdles” that could take years to get past.

In May 2025, Gurman shared that Apple was aiming for a late 2026 launch window that has been repeated frequently by him since.

He’s also been clear that Apple smart glasses don’t have an AR display, and those would arrive much later. Now, Gurman has been repeating “by the end of the decade,” which, given it is 2026, isn’t exactly that far away.

As recently as February and April 2026, Gurman has repeated that late 2026 release timeline. What is unusual is that there was never any hint of a potential delay or struggle to get the glasses to mass production.

iPhone Fold rumors continue to push for a fall release in spite of repeated production issues

Advertisement

Then comes today’s report shifting the release back an entire year. Also in this report is information about the potential design aspects of the smart glasses.

It seems Apple will try to stand out with unique design elements like “oval-shaped cameras, unique colors, and multiple frame styles.” Apple allegedly also believes future iterations could be seen as a health device that could include AR features that help people see.

Meanwhile, Apple has seemingly run into repeated problems getting iPhone Fold to mass production, which hasn’t started, yet it still reportedly isn’t being pushed back.

So, it seems odd that Apple’s timeline would suddenly shift around 8 months out from announcing the product. But then there’s the other leaker’s timeline.

Enter Ming-Chi Kuo

The other leaker I mentioned earlier is Ming-Chi Kuo, and he has been much more reserved in his leaking frequency on Apple smart glasses. While his history is hit and miss, the details he gets right are enough to have earned him quite the respect in the field.

Apple’s rumored AR glasses have been discussed for years

However, I will note that his accuracy and resources seemed to have dropped since he shifted to his social-media-based leaking patterns of today.

Apple’s AR and VR efforts have been seeing consistent leaks since as early as 2015, but the most recent iteration was discussed by Kuo in 2021. Then, his report was much more forward-looking and thus, wholly inaccurate.

I mean, the man called for Apple Vision Pro in 2022, full-AR Apple Glass in 2025, and AR contact lenses by 2030. It is a wild report in retrospect.

Jump forward to something a little less speculative, and his reporting has been consistent with the Apple smart glasses release window. In June 2025, Kuo reported that Apple was aiming to ship three to five million Meta Ray-Ban-like smart glasses in the second quarter of 2027.

Given Kuo’s strong suit is the supply chain and the fact that he had shipping estimates, it is easy to argue that he’s had the correct timeline all along. So, it is curious that Gurman has been saying late 2026 or early 2027 until today.

Game of leaks

Of course, all of these rumors are nebulous and will always shift and move as new information is obtained. Accuracy isn’t always easy to determine too since the age of a leak once it is released is rarely known.

Apple Vision Pro is the start of Apple’s work in the wearable AR/VR field

For example, Kuo might have heard from the supply chain that Apple’s supply-side management aimed for an initial order in 2027. Gurman might have heard from his internal source, likely on or near the Vision Product Group, that the internal team’s goals were the end of 2026.

Then, as deadlines were missed and supply chains shifted, the internal team finally realized that their stretch goal wasn’t possible. Which means shifting back to the supply-chain suggested goal of 2027, thus making them meet Kuo’s previously reported timeline.

In essence, both leakers could have accurately reported what they had heard, and both be correct in this instance. Then there’s also the chance they’re both wrong and Apple announces smart glasses at a completely different time.

However, Gurman has proven somewhat unreliable when it comes to reporting around the Vision Product Group. As Daring Fireball pointed out, Gurman completely missed the Apple Vision Pro update to M5 when he reported in January 2025 that “I don’t believe there will be a new headset from Apple this year.”

Then, later in April 2025, Gurman said a lighter Apple Vision product could ship by the end of 2025 or early 2026 and even suggested that the M5 refresh had been abandoned. The unchanged M5 model shipped in October 2025 instead.

There is no doubt that Gurman has some insider connections that give him unprecedented access into Apple’s inner workings. However, it is important to note that he is no foolproof and does make mistakes — often when trying to create a narrative around an otherwise innocuous leak.

visionOS 27 could hint at Apple’s future AR plans

Advertisement

WWDC is on June 8 and could provide a hint of what the rest of Apple’s year might look like. However, since the initial set of Apple Smart Glasses won’t have a display, there is unlikely to be any sign of them in visionOS 27.

Then there’s the fact that Apple has several glasses-related products in development beyond the N50. Several of which, we have no idea what they are or when they could release.

There’s always the chance that one set is coming at the end of 2026 and another in 2027. Apple’s supply chain is immense and these leakers may be describing different parts of different elephants.

Time will tell if the smart glasses will arrive in the next twelve months. In this case, I’d bet on Kuo’s initial report of a late 2027 launch until he says otherwise.