Connect with us

Tech

Visa used Mythos to hunt for bugs in its own payment network, then open-sourced the harness that made it possible

Published

on

Visa aimed Anthropic’s Claude Mythos at the infrastructure behind billions of daily transactions, a network that spans more than 200 countries and territories, moves money in roughly 160 currencies, and connects nearly 5 billion payment credentials to more than 175 million merchant locations.

The model stitched minor weaknesses deep in the stack into working exploit chains that would traditionally have surfaced only late in penetration testing. Rajat Taneja, Visa’s president of technology, walked the VB Transform 2026 audience through what came next, including why Visa released the harness that governed the entire hunt as open source and why the company abandoned traditional remediation metrics for a measurement its team invented.

Taneja has run technology strategy, product engineering, and global infrastructure at Visa since 2019, after joining the company in 2013 from Electronic Arts, where he served as CTO following 15 years at Microsoft. He co-authored, with Visa chief information security officer Subra Kumaraswamy, the June 10 blog post announcing the release of the Visa Vulnerability Agentic Harness on GitHub as a reference implementation that any security team can inspect, adapt, and extend. Visa also published a technical white paper detailing the architecture, lessons learned, and 12 non-negotiable architectural practices for critical infrastructure.

Advertisement

Trust built on pessimism and paranoia

Taneja led with the arithmetic that makes Visa a target worth defending obsessively. Trust at the scale of global payments gets engineered through what he called pessimism and paranoia, by assuming failure and designing around it before failure arrives. The network has been hardened over many years through zero-trust architecture, layered defenses, and highly automated security operations built for the scale and reliability global payments demand.

So when Anthropic invited the organizations behind critical software to test Mythos under Project Glasswing, Visa said yes. Glasswing participants collectively identified more than 10,000 high- or critical-severity vulnerabilities in the first month of testing across software underpinning critical systems industry-wide, according to Anthropic. Anthropic’s own conclusion placed the bottleneck after discovery, in verification, disclosure, and patching speed. Visa joined to test decades of hardening at AI speed and learn where advanced models could push its defenses further.

What Mythos showed at Visa

Inside Visa’s environment, Mythos demonstrated system-wide, context-aware analysis, surfacing vulnerabilities buried deep in the stack and flagging issues that grow more serious when chained together, with findings clean enough that engineering teams could act on them without wading through noise. Some findings carried critical severity ratings, and Visa credits its zero-trust controls, network segmentation, and layered safeguards with breaking the chain before any external actor could have acted.

That confirmation mattered, Taneja said, but the epiphany that followed mattered more. “In a world of agentic attacks, defense also has to be agentic,” he said. Even at a company that has invested decades in defense-in-depth, the model revealed assumptions the team had been operating under that needed rethinking. Traditional SAST tools keep their place as a first pass against known vulnerability patterns, Visa’s white paper notes, but pattern matching alone cannot follow an adversary who reasons through logic, data flow, and the exploit chains that live between the signatures.

Advertisement

A harness, not a scanner

Visa’s response was not another monolithic scanner. The team built the Visa Vulnerability Agentic Harness, now in its fifth generation, as a governed pipeline that directs frontier AI models through structured security tasks while enforcing deterministic controls, policy gates, and human oversight at every stage. Taneja walked through the design philosophy. The harness operates across four phases and eleven stages, from code ingestion and threat modeling through deep-dive verification, exploit chain synthesis, and finally remediation and fix validation.

Visa pointed Mythos at its own payment network and open-sourced the harness behind the hunt, its tech chief tells VB Transform 2026

The open-source Visa Vulnerability Agentic Harness pipeline. Standardized inputs flow through four phases and eleven stages, combining deterministic controls with frontier-AI-informed reasoning to produce structured reports, SARIF artifacts, and validated candidate fixes. Source: Visa Project Glasswing white paper, June 2026.

Three design choices drive finding quality, per the project’s own documentation. Threat modeling runs before analysis to focus on the attack surface rather than scanning everything blindly, multi-agent deterministic voting requires convergence across independent reasoning chains before a finding advances, and structured triage artifacts compress the lifecycle from discovery to a result developers can actually ship. The payoff is a pipeline that runs hot by default. A plain scan in the shipped profile runs all eleven stages and edits source files in the target repository in fix mode, applying candidate patches unless the operator stops it at detection.

The harness is multi-model by design. An LLM abstraction layer lets Visa swap or combine providers without changing the control plane, and the open-source version works with Anthropic Claude, OpenAI-compatible models, or a mix. The repo’s documentation is candid about the exception. Applying a fix requires the file-editing tools that only the Anthropic backends expose, so the remediation and validation stages currently require Anthropic models for full functionality, and an OpenAI-compatible model in those roles is limited to report-only output. VentureBeat’s Q2 2026 Pulse research, presented earlier at the conference, reinforces why that provider flexibility matters. Among the enterprises surveyed, 82% rely on provider-native controls as their primary security layer, and 59% plan to adopt or switch agent security tooling within the year. The controls enterprises adopted last year are already becoming the controls they plan to replace.

Advertisement

Mean Time to Adapt replaces legacy metrics

Finding vulnerabilities is no longer the hard part, Taneja argued. The real challenge is how quickly a team can confirm an issue is truly exploitable, fix it, and prove the attack path is closed rather than just showing a patch was applied. Visa calls this Mean Time to Adapt, and the white paper tracks it along three dimensions. Inventory freshness measures how current and complete the organization’s view is of code, configuration, and runtime deployment. Exploitable paths per release counts how many end-to-end attack chains remain possible after each release, not just how many findings were closed. Validation cycle time tracks how long it takes to produce repeatable, evidence-backed proof that a fix works and stays working in production.

That distinction matters because legacy measures such as mean time to detect and raw CVE closure counts can look better on paper while actual exposure keeps growing underneath them. An organization can close hundreds of findings a month and still leave viable exploit chains open if nobody tested whether the patches actually break the attack. MTTA forces teams to measure the outcome that matters, and the white paper leans on CISA Known Exploited Vulnerabilities data to make the prioritization case, noting that fewer than 1% of CVEs are ever actively exploited. Visa’s SSDLC policy now assumes every exploitable path will be exercised in production and requires it to be remediated before code is promoted.

Supply chain risk accelerates under AI

The conversation moved past Visa’s own perimeter when Taneja turned to suppliers. A well-defended enterprise stays exposed through weak vendors and weak open-source components, the white paper warns, so Visa is making AI-specific security posture a non-negotiable dimension of supplier due diligence, with expectations for continuous vulnerability validation, living software bills of materials, and MTTA baselines across its technology stack.

Visa has also joined Project Lightwell, the $5 billion IBM and Red Hat initiative to harden widely used open-source components through AI-driven validation and coordinated patching, alongside financial institutions including Bank of America, JPMorganChase, Goldman Sachs, and Mastercard. The commitment extends the same logic upstream, because the MTTA clock does not pause at any single company’s perimeter.

Advertisement

When agents start buying things

Securing agentic commerce is Visa’s next problem. Taneja described a future where AI agents transact on behalf of consumers and enterprises, and said Visa is building the trust framework, identity layer, and agent readiness scoring that merchants will need before agents can safely complete transactions. Behind that work sits the Visa Payment Threats Lab, a simulation environment where real fraud scenarios get replayed against the authorization rules, thresholds, and configurations Visa actually runs, to surface AI-enabled failure modes as targeted hardening recommendations.

The identity challenge is not theoretical. VentureBeat’s Pulse research found that 69% of enterprises already run credential sharing somewhere in their agent deployments, and companies with shared credentials report security incidents or near-misses at a 63.5% rate, against 40.9% where every agent has its own scoped identity. Visa’s white paper addresses that gap directly, listing “AI agents are identities” among its 12 non-negotiable practices and requiring scoped permissions, least privilege enforcement, full audit trails, and inclusion in IAM governance for every agent that calls an API, reads data, or modifies a system.

Three priorities for defenders

Visa is organizing its defensive strategy around three priorities, Taneja said. Shift security left until exploitable flaws are designed out before they reach production, and replace high-risk, under-supported components before they turn into material exposure. The third is the heaviest lift at Visa’s scale, refactoring defenses to run autonomously under human governance so detection, validation, and response keep pace as threat volume grows and the models behind attacks improve.

None of it requires a payment network’s budget to start. The harness sits on GitHub with 595 stars and 97 forks as of July 20, MTTA needs a dashboard rather than a procurement cycle, and the white paper’s 12 non-negotiable practices map onto architecture reviews security teams already run. Visa’s own conclusion reads like a deadline. The opening to get ahead of machine-speed attackers is still there, the paper argues, and it will not stay open.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Low-power AI could define the next era of global innovation

Published

on

Artificial intelligence (AI) is constantly reshaping everything we do. Across industries, it is changing the way we do work, but that rapid expansion can’t continue without bumping up against real tangible limitations.

Most notably, planning for hyper scaled data centers across the world and increasingly complex cloud computing infrastructures and AI systems are leading to difficult conversations around energy pricing, generation and availability.

Source link

Advertisement
Continue Reading

Tech

Netflix edges past the BBC as UK viewers’ first choice

Published

on

For the first time, a streaming service has overtaken the BBC as the place UK viewers say they turn to first. In Ofcom’s annual Media Nations report, published this week, Netflix was named first choice by 26% of viewers, just ahead of the BBC on 25% and ITV on 15%.

The measure is about instinct, not hours. Ofcom asked viewers which service they reach for first, and for decades the answer in Britain was overwhelmingly the BBC.

A single percentage point is not a rout, but it is a milestone. The corporation has anchored British viewing for generations, and being pipped by a Californian subscription service, however narrowly, marks a shift the BBC has long seen coming and long dreaded.

The wider numbers tell the same story more slowly. Around 70% of Britons watched traditional broadcasters for at least 15 minutes a week in 2025, down from 73% the year before and 78% in 2022, a gentle but unmistakable decline.

Advertisement

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The broadcasters are not standing still. Their own streaming apps, including iPlayer, ITVX, Channel 4 Streaming, and 5, grew 9% year on year, as viewers who left the schedule followed the same programmes onto on-demand.

Subscription streaming, meanwhile, looks close to saturated. Services such as Netflix, Disney+, and Amazon Prime Video now reach roughly 70% of British homes, a figure that has largely stopped climbing.

Advertisement

The plateau matters for what comes next. With most households that will pay for streaming already paying, growth now has to come from taking time off rivals rather than signing up newcomers.

The more striking mover is YouTube. Viewing of the Google-owned platform on actual television sets has doubled, to 19 minutes a day per person, up from nine minutes in 2022.

That growth is no longer confined to the young. Among Britons aged 75 and over, YouTube’s weekly reach rose to 33% in 2025 from 28% in 2022, a sign the platform has crept well beyond its digital-native base.

The generational pattern is the report’s throughline. Younger viewers have rebuilt their watching around on-demand and video platforms, and each year a little more of the older audience follows them there.

Advertisement

ITV, on 15%, sits some way behind both. The contest at the top is really between one public broadcaster and one global streamer, rather than a broad field of rivals.

Being first choice is not the same as being most watched, either. Traditional broadcasters still fill more total viewing hours than any single streamer, even as the habit of reaching for them first quietly erodes.

For the BBC, the report arrives at an awkward moment. The corporation is defending the licence fee and preparing for charter renewal, and a headline saying Netflix has passed it will make neither conversation easier.

The funding question sits beneath the viewing one. The licence fee is levied on the assumption that the BBC is a near-universal habit, and a ranking that now places it second hands its critics a fresh line of attack.

Advertisement

The competitive pressure is not only about attention. Netflix faces its own frictions in Europe, including a consumer lawsuit in the Netherlands over subscription price rises, a reminder that scale brings scrutiny.

Britain’s public broadcasters have weathered the streaming era better than many feared. Public-service programming still draws large crowds for live events and news, and the collapse once predicted for traditional UK television has looked more like slow erosion than a cliff.

Still, the direction is not in doubt. Each edition of Media Nations records the same drift, younger viewers leading and older ones following, from the schedule to the app and from broadcast to the feed.

What the report cannot say is where the line settles. Netflix’s one-point lead could widen or reverse next year, but the more durable finding is that “first choice” is now a contest the BBC has to win rather than a title it holds by default.

Advertisement

Source link

Continue Reading

Tech

Universal Gravitational Constant Gets a 10-Year Recheck

Published

on

Physicists have been trying to measure the fundamental gravitational constant for well over two centuries. The current accepted value of big G, as it’s known, is 6.67430 × 10-11 cubic meters per kilogram per square second. It also has an uncertainty of ±0.00015 × 10-11 m3/(kg s2). As far as constants of the universe go, that’s very uncertain.

Stephan Schlamminger

Schlamminger is a physicist at the U.S. National Institute of Standards and Technology.

Stephan Schlamminger recently completed a 10-year effort at the U.S. National Institute of Standards and Technology to replicate an earlier measurement of big G from the International Bureau of Weights and Measures, or BIPM (located near Paris) that’s notably higher than most measurements. He spoke with IEEE Spectrum about why it took so long to get a number—6.67387 x 10-11 m3/(kg s2)—and why it’s notably lower than the BIPM result, to the tune of 0.0235 percent.

Advertisement

Why is it so difficult to measure big G?

Stephan Schlamminger: Gravity is very weak. When you were a kid, you probably played with fridge magnets, and it was a force you could feel. But if you have two coffee cups, you can try all you want—you can’t feel the force between them. It is there, but it’s so, so weak.

How did you attempt to measure big G?

Animated schematic of a rotating lab instrument with laser scanning cylindrical samples NIST used a torsion balance with a fourfold geometry. This animation shows an exaggerated version of how the outer green masses gravitationally attract the inner blue masses.S. Kelley/NIST

Schlamminger: We used what’s called a torsion balance. The key idea in the torsion balance is that it decouples vertical gravity that you have from Earth from horizontal gravity, and that makes it sensitive to masses that are around the torsion balance but not the Earth below.

Advertisement

Ours had a fourfold geometry. It has a very thin torsion strip, then four cylinders in a “plus sign” arrangement. All of this is inside a vacuum. Outside, we have four larger cylinders that gravitationally attract the four smaller masses to them. If I move the outer masses just a tiny little bit, the plus sign will rotate, and we measure that angle that it moves. That angle is proportional to the gravitational torque.

Why try to replicate the BIPM value?

Schlamminger: We could move the field forward. The measurements have been plagued with inconsistencies, so by redoing an experiment, we hoped to shed light on the inconsistencies.

We did not find a smoking gun, so there’s no single reason why it’s different—our value versus their value. It’s still a big question mark.

Advertisement

What was it like spending 10 years on this?

Schlamminger: It’s a bit like herding cats. I’ve measured other fundamental constants, like Planck’s constant, and for most experiments, they have some sort of self-calibration built in. But with the gravitational constant, you have to keep track of every single mass that moves—where they are, how big they are, and weigh them.

How does your result compare to the rest?

Schlamminger: Our result is a little bit below the standard accepted literature value. I was disappointed because it doesn’t agree with the BIPM value, nor with the literature value. If there’s something wrong with the BIPM experiment, then the literature value—which includes that result—probably ought to come down a bit. But that is not for me to say. I think somebody else, independent, should figure out what the new mean value ought to be.

Advertisement

From Your Site Articles

Related Articles Around the Web

Source link

Advertisement
Continue Reading

Tech

The robot NASA hired to lift a orbital telescope tumbled out of control

Published

on

A Katalyst Space robot that was launched to grab on to a space telescope and raise it to a higher orbit tumbled out of control after a series of failures, NASA and the company said today.

The company is trying to stabilize the spacecraft using back-up systems, before NASA will decide if the mission can continue.

This is the first time the space agency has hired a private company to lift one of its space telescopes to a higher orbit, allowing the observatory to continue operations beyond its expected lifespan.

The Neil Gehrels Swift Observatory was launched in 2004, with the ability to swiftly point at ephemeral space events like gamma ray bursts. The spacecraft has been pulled back toward Earth and needs to be pushed back up to a higher orbit to continue doing its job.

Advertisement

The LINK spacecraft was launched into space on July 3 on board a Northrop Grumman Pegasus rocket. Over the past several weeks, flight controllers have worked to commission the spacecraft, activating its various systems before it heads off to rendezvous with Swift.

However, the spacecraft suffered issues controlling itself and began spinning over the weekend. According to NASA, the spinning has resulted in “sporadic communications” with the satellite, likely because its antenna flips away from the planet. Two of the three reaction wheels that control the spacecraft’s alignment have failed, and there are problems with one of the spacecraft’s thruster systems.

Flight controllers are working to recover the spacecraft using another set of thrusters on the spacecraft to slow the spin, and they said in a statement that “we have already begun this series of burns and are seeing the intended effect.” Katalyst told TechCrunch that “this remains an active mission, and we continue to move forward with plans to rendezvous with Swift.”

Katalyst’s Kieran Wilson, the principal investigator for the mission, told reporters ahead of the mission that the spacecraft had been built incredibly quickly because of the urgent need to raise Swift in the next few months.

Advertisement

“All this is challenging and risky,” he said at the time. “There’re a lot of spacecraft that have had far longer development cycles with far more funding behind them that have failed for mundane reasons.”

Katalyst raised a $12 million round in June to help support this mission, backed by investors Fortitude Ventures and Geodesic Capital. The company has also won funding from the U.S. military, which is interested in a dynamic vehicle that can service satellites or surveil rival spacecraft.

This story has been updated to include comment from Katalyst.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Advertisement

Source link

Continue Reading

Tech

AI digs through 3,700 accounts of dreams and waking life, finds method in the madness

Published

on

OFFBEAT

Researchers uncover patterns in how sleeping minds recombine memories, people, and places

Your brain apparently spends the night remixing reality rather than simply replaying it, according to researchers armed with AI and more than 3,700 accounts of dreams and waking life.

Researchers at Italy’s IMT School for Advanced Studies Lucca used natural language processing (NLP) to analyze more than 3,700 reports of dreams and waking experiences from 287 adults and found dreams are neither random mental noise nor faithful replays of the day’s events. Instead, the sleeping brain appears to recycle memories, emotions, familiar places, and imagined possibilities into entirely new scenarios.

Advertisement

Published in Communications Psychology, the study combined two weeks of dream and daily experience diaries with data on participants’ personalities, sleep quality, cognitive abilities, and psychological traits. Researchers used NLP to compare the semantic structure of the waking and dream reports.

Everyday settings such as workplaces, hospitals, and classrooms were combined with unrelated places, shifting viewpoints, or unfamiliar surroundings, while different parts of a person’s life could merge into a single scene. The findings suggest dreams do not replay reality so much as rebuild it from familiar parts.

Dream reports also varied with participants’ traits and attitudes. Those prone to mind-wandering tended to report dreams that jumped quickly from one scene to another, while those who said dreams were personally meaningful generally described more vivid and immersive experiences.

The researchers also looked at dream reports collected during the COVID-19 lockdown by a separate team at Sapienza University of Rome. Compared with more recent reports, those dreams contained more references to confinement, barriers, restrictions, and heightened emotions, reflecting the reality people were living through at the time.

Advertisement

“Our findings show that dreams are not just a reflection of past experiences, but a dynamic process shaped by who we are and what we live through,” said lead author Valentina Elce. “By combining large-scale data with computational methods, we were able to uncover patterns in dream content that were previously difficult to detect.”

The work also hints at a new role for AI. Rather than asking researchers to read and categorize thousands of dream reports themselves, the team used NLP to spot patterns across the entire dataset. The software’s assessments closely matched those of independent human reviewers, suggesting it could make large-scale dream studies far less laborious.

Before you ask ChatGPT why your dentist turned into your boss, the research has some obvious limitations. It relies on people remembering and accurately describing their dreams, and it doesn’t explain why we dream in the first place. However, it does suggest dreams have more structure than random neural noise – even if your brain still insists on making you sit an exam you forgot to revise for. ®

Source link

Advertisement
Continue Reading

Tech

Runway couldn’t fix a bug in its AI video model, so it turned the bug into a feature

Published

on

Runway spent weeks trying to engineer its way out of a stubborn bug: AI-generated avatars would drift off-center during real-time video generation. The fix wasn’t a back-end patch — it was a new front-end feature that just worked around the problem. That’s the kind of lesson Ryan Phillips, head of enterprise product at Runway ML, walked through at VB Transform 2026, arguing that even companies not building foundation models themselves can learn from how Runway builds, evaluates, and ships them.

“I think even if you are not all building models yourselves, it’s helpful to learn how we do it because I think almost all of the lessons are applicable to what you all are doing day-to-day,” Phillips said.

Runway is an applied AI research company building general world models to power generative tools. During his presentation, Phillips showcased Runway Characters, a real-time video model that enables zero-latency, back-and-forth interactions with AI-generated avatars. Five years ago, creating a video with illegible text and low framerates took artists hundreds of hours of stitching individual frames together, he said. Today, Runway’s models generate interactive video on the fly.

“Studying how we build these real-time models can inspire how you build and deploy real-time experiences, whether agentic or not, in your companies today,” he said.

Advertisement

Demystifying evals

Building a robust AI product starts with a high-quality evaluation set. However, creating this set cannot be treated solely as an engineering task. It requires deep cross-functional alignment across product, design, research, and sales to define what “quality” actually looks like.

Phillips emphasized running internal workshops where team members review generated examples together. The goal is to align the entire organization on specific failure modes so everyone shares a unified definition of a successful generation.

“We spent a lot of time working with our team, running through examples… of what success and failure looks like, down to the very, very detailed and picky things,” Phillips said.

Advertisement

The resulting evaluation set must cover broad customer use cases alongside extreme edge cases. For instance, Phillips highlighted that to ensure the model behaves predictably when pushed beyond standard human facial structures, they used “Tooth,” a non-human character with no nose and very unusual teeth.

When grading these generations, the Runway team looks for subtle artifacts. In one example, a video where a character’s face remained intact but background elements, such as a net, began morphing was strictly graded as a failure.

Despite the cutting-edge nature of the product, the tool Runway uses to track these evaluations is simple: an Excel spreadsheet. The team logs tests daily, categorizing outputs as “minor” or “major” failures against a predetermined pass rate. 

“We set a bar before we get started on what percentage we need to pass, and when we hit that, we ship the model,” Phillips said. “So it’s not magical.”

Advertisement

For enterprise developers facing non-deterministic quality drift in their own real-time pipelines, manual evaluation at scale is a bottleneck. To solve this, Phillips noted that developers can rely on language models to automate the visual grading process. 

“LLMs are getting quite good at being a judge for a lot of this content, especially the types of morphing or changing that you would see in an evaluation set,” he said. Teams can also feed an LLM behind-the-scenes context (e.g., a hand-drawn sketch or an ad’s structural layout) to guide the generation and validation processes, ensuring quality without adding cognitive load to the end user.

Model training and turning bugs into features

Delivering real-time generative video requires a highly optimized technical stack. The process begins with pre-training a massive foundation model, which is resource-intensive and slow to generate outputs. To achieve real-time latency, Runway relies on distillation, where a smaller, faster “student” model is trained to mimic the large “teacher” model. According to Phillips, distillation helps Runway cut down “80 to 90% of the generation time.”

The team then applies adversarial post-training (APT) to the distilled model. This technique forces the model to continuously improve by testing it against a system designed to find its flaws, helping regain the visual sharpness lost during the distillation process.

Advertisement

However, altering the model architecture introduces new problems. The distillation and APT phases introduced a stubborn bug: characters would sway or drift from the center of the frame during real-time generation.

The team spent weeks attempting to fix the core model to eliminate the drift, he said. Ultimately, they discovered that if the user’s initial input image was perfectly centered, the generated video remained stable. Instead of spending more time on a backend engineering patch, Runway pivoted to a user experience solution.

“What we did was, when we noticed this in our evaluations, we then said, ‘What if we just offered that as a feature?’ If a user gives us a character that is turned to the left, we know the video is going to morph. Let’s just fix it for them,” Phillips said. 

They introduced a frontend feature called “Optimize for Image Quality,” which automatically re-centers the user’s image before generation begins. By wrapping a backend model limitation in a frontend tool, users perceived a helpful feature rather than an engineering flaw.

Advertisement

“Turn model limitations into product features so that you can actually expand how the model works,” Phillips advised. “It might feel like a limitation internally, but your customers will not see it that way if you’re kind of building this in as a product feature.”

The devil is in the infrastructure details

Delivering video globally at 24 frames per second requires optimizing every layer of the infrastructure stack. This ranges from caching and parallel decoding to making deep kernel changes in partnership with hardware providers like Nvidia.

Shortly after launching Runway Characters, he said the team noticed that 8% of API calls were dropping to 16 frames per second, causing the video to stutter for customers. 

Finding the root cause required deep observability. The team used an AI agent powered by Claude alongside monitoring tools like Datadog and Sentry to trace the anomaly. The debugging session isolated the problem to a single data center in the us-east-1 region.

Advertisement

“The solution actually wasn’t [to] go fix anything or change a config,” Phillips explained. “They actually went and physically replaced those GPUs in the data center to fix it, and that ultimately solved the problems.”

For enterprise teams deploying real-time applications, the takeaway is clear: hardware and infrastructure anomalies will directly impact model performance, requiring rigorous, full-stack debugging capabilities. 

“Don’t forget about all the small details, because there’s so many of them when you’re deploying these models,” Phillips said.

Surviving “failure hell” and the future of world-building

Developing AI systems is rarely a linear process. Teams often find themselves stuck for weeks on a single problem with no end in sight, a phase Phillips referred to as “failure hell.”

Advertisement

“We think you have to go through that pain and really struggle with the problem for a little bit before you can get the breakthrough,” he said. Consistent iteration eventually flattens the difficulty curve, triggering sudden, exponential improvements.

As the underlying models overcome these technical hurdles, the role of enterprise creatives is also fundamentally changing. Traditionally, marketing and design teams have focused on creating single assets, like a specific advertisement or illustration. In an era of real-time generation and agentic workflows, that paradigm is shifting toward defining parameters, aesthetics, and intellectual property.

“You might not be designing a single ad, but you might design a world that then the agent or a real-time video model can generate ads from,” Phillips said. 

Source link

Advertisement
Continue Reading

Tech

JFrog tries to spin OpenAI 0-day exploit of its app into a success story

Published

on

Last week’s unprecedented security event in which two OpenAI security hacking models trespassed into the network of fellow AI company Hugging Face was enabled by exploiting one or more zero-day vulnerabilities in Artifactory, JFrog, the product’s developer, said Monday.

In an incident mimicking a dystopian sci-fi novel, two OpenAI models broke out of the restricted environment meant to keep them from accessing the Internet during an internal test, the AI company revealed last week. The models went on to breach Hugging Face’s network and steal confidential information and credentials. OpenAI said its agent achieved the feat by exploiting a previously unknown vulnerability. The company called the event “unprecedented,” and outsiders largely agreed.

Not the triumph made out to be

OpenAI said the models exploited multiple attack vectors, including stolen credentials and zero-days, to gain remote code execution capabilities, but until now, the vulnerable software was unknown. JFrog’s Monday disclosure said the product was a self-managed instance Artifactory, a repository management system that secures and streamlines customers’ software development operations. JFrog says Artifactory is used by more than 7,500 developer Teams, 80 percent of which work for Fortune 100 companies.

“During an internal evaluation of frontier cyber capabilities, OpenAI’s models, running deliberately without production safeguards in an isolated research environment, autonomously discovered and employed chained vulnerabilities to escape its sandbox, reach the open internet, and extract evaluation answers from Hugging Face’s infrastructure,” JFrog CTO Yoav Landman wrote. The executive went on to say that the company learned of the zero-days from OpenAI.

Advertisement

The company said Monday that it fixed the exploited vulnerabilities, but it didn’t identify them or provide other important details, such as the conditions under which the vulnerabilities can be exploited. Such details are standard in many vulnerability disclosures because they’re necessary for customers to assess risks. In an email, a company representative declined to provide the details.

Release notes published Monday for version Artifactory 7.161.15 listed the CVE designations for nine patched vulnerabilities. The disclosure made no mention that any of them had been actively exploited in the wild. External sources, however, show that three of them—CVE-2026-65617, CVE-2026-65923, and CVE-2026-66018—were privately reported by OpenAI researcher Khai Tran. It’s likely that at least two of them were the zero-days OpenAI’s models exploited, but without confirmation, it’s impossible to say so definitively.

Source link

Advertisement
Continue Reading

Tech

Laboratoria Founder Is Increasing Women in Tech

Published

on

In shaping her career, Peru native Mariana Costa has asked herself a question: What can I do to make life better for women in Latin America?

The answer she landed on was training them for tech jobs.

Mariana Costa

Employer

Advertisement

Laboratoria

Title

Co-founder and president

Alma Maters

Advertisement

London School of Economics; Columbia

Such positions pay well and are in demand. And for too long, women across the region have been locked out of them, she says.

Costa is president of Laboratoria, a U.S.-registered nonprofit based in Miami that she helped found. Laboratoria has trained thousands of women in 11 Latin American countries for technology careers. She has built training centers in the countries and has placed graduates at major companies. Meanwhile, she has become one of the most recognized voices in the region on workforce equity and tech education for women.

IEEE recognized her work with its President’s Award this year for her “distinguished leadership and contributions to the betterment of society.” Recipients of the award are selected by the IEEE president with the consent of the IEEE Board of Directors.

Advertisement

Costa says the recognition came as a surprise because she is not an engineer by training and had never considered becoming affiliated with IEEE.

She was presented with the award at the IEEE Honors Ceremony on 24 April in New York City.

Peru: a country of contrasts

Costa grew up in Lima, Peru’s capital, in a household with no connection to engineering or technology. Her mother was an art historian and professor, and her father was a lawyer. The family was financially comfortable and traveled abroad regularly. Costa attended well-resourced schools.

That economic stability came with a reckoning, Costa says, in that she recognized early on that economic inequality had created separate societies inside Peru. Her parents, she says, made it “clear that my reality wasn’t the reality of most people in my country.”

Advertisement

Lima is a microcosm of the country, she says. The divide in the capital city is visible: A kilometers-long concrete wall topped with barbed wire separates wealthier neighborhoods from shantytowns, where residents lack running water.

Nationally, there are splits along ethnic and geographic lines. The highland and jungle regions remain home to mostly indigenous communities with limited educational access and a deep cultural distance from the Hispanic-dominated coast.

The questions that stirred in her as a child never left, she says.

“Why do I live in a country where so much depends on where you’re born?” she asked herself. “What does it mean to be Peruvian when individual realities are strikingly different?”

Advertisement

Those questions followed her to the London School of Economics, where she studied international relations, graduating with a bachelor’s degree in 2007. She held onto the questions when she moved to Washington, D.C., where she spent the next four years working for the Organization of American States, helping Latin American governments improve public services that fall under the heading of civil registration.

“I said, ‘How can it be? The tech space has so many rich opportunities. Why aren’t any women here?’”

The OAS Universal Civil Identity Program in the Americas provides technical support to national civil registry institutions, modernizing them to foster social inclusion and ensuring the right to civil identity for all people. Without civil identity, a person can’t access education, health care, legal employment, social services, or the right to vote. People without the classification don’t exist in the eyes of the government. They also can’t own property, get married officially, or pass citizenship rights to their children.

Doing that work deepened her concern about the socioeconomic disparities in her homeland, she says. In search of practical solutions to those problems, she went to New York City in 2011 to further her education. She earned a master’s degree in public administration and development from Columbia in 2013.

Advertisement

Technology was not yet part of a solution. But Costa already had met someone who would change that.

Falling in love with a programmer

While working in Washington, Costa met Herman Marìn, a software engineer who used digital tools in support of social causes. Because he was doing work she had never associated with programmers before, her assumptions about the field dissolved quickly.

“I had a vision of [programmers doing] something not very social—strictly technical,” she says. “And my then-boyfriend, now husband, actually worked for different social movements that used technology to address social causes.”

That realization cracked something open, she says: “I said, ‘Oh! Technology can actually be a tool to address some of the more stubborn problems in our societies.’”

Advertisement

After earning her degree at Columbia, Costa returned to Lima with her husband. She had been abroad for nearly a decade and felt the pull of home.

“The thought of not moving back to my country was something that tormented me a bit,” she says. “I really felt I had to move back, at least to try it out and contribute somehow.”

What Latin America’s tech space lacked

When Costa, her husband, and a friend from graduate school moved to Lima, they had modest savings and big ambitions. They wanted to build something that combined technology with social impact.

They started with what they had: a small digital services agency, where they built websites for clients.

Advertisement

The business grew, and they hired more employees. Their team expanded to a dozen software engineers. And as it did, Costa noticed three things.

First, there weren’t enough trained developers to meet the demand. Second, many of their best hires did not have traditional computer science degrees. Some had never even finished college.

“There was no other space where you could actually build an amazing career and get a well-paying job without a good degree from a good school,” she says. “The tech world was different. It was open in ways other fields weren’t.”

Thirdly, she noticed that there were no women on the team. In the first six months, Costa says, they didn’t interview a single female developer.

Advertisement

Her colleagues shrugged. It’s just how it is, they told her.

Costa, the outsider, didn’t accept that.

“I said, ‘How can that be? The tech space has so many rich opportunities,’” she says. “‘Why aren’t there any women?’”

Building Laboratoria

In 2014 she decided to launch Laboratoria. The business model was simple: Find talented women who hadn’t yet broken into tech, train them quickly on practical skills, and connect them with employers who needed developers.

Advertisement

Laboratoria started offering a six-month immersive boot camp that covered Web development, UX design, data literacy, strategic use of artificial intelligence, and soft-skills coaching such as interview prep and projecting confidence.

Just as important for career success, Costa says, is a user-centered mindset. She says Laboratoria’s program emphasizes the discipline of keeping the client’s needs in mind when designing the work.

The teaching model has evolved beyond the boot-camp structure, but the organization still focuses on helping Latin American women develop tech skills and land quality jobs in the digital age. These days, the training, conducted via twice-weekly live Zoom sessions, lasts six weeks.

“We needed developers ourselves,” she says of the company’s original logic. “I said, ‘Why don’t we run a program to train women—women who are incredibly talented but haven’t been given a chance yet—and help them gain the skills they need to get a great job as quickly as possible?’”

Advertisement

Three smiling adults pose together on a green sofa in a bright living room. Mariana Costa [seated, right] poses with Laboratoria co-founder and CEO Gabriela Rocha and co-founder and chief product officer Rodulfo Prieto.Valeria Martens

It worked. Laboratoria expanded from Lima to Santiago, Chile; Mexico City; São Paulo, Brazil; and Bogotá, Colombia. The organization eventually incorporated as a nonprofit in the United States. Today its programs are held remotely in Latin America’s major job markets. So far, Laboratoria has opened the doors to tech careers for more than 3,500 women.

Costa says she believes the most important skills Laboratoria’s graduates need aren’t purely technical. Close behind the growth mindset is self-confidence, she says.

“Knowing who you are, valuing who you are, and learning to trust yourself and your capacities are indispensable traits,” she says.

Networking, she adds, is the third pillar, and often the hardest to build for women without access to elite schools or flexible work schedules.

Advertisement

“When you go out in the market,” she says, “you realize that having a network of people who trust you and know your work is such a valuable and critical asset.”

IEEE: a new connection

Costa’s introduction to IEEE came late—but it landed hard.

She is not an IEEE member, so when she was contacted this year about receiving the President’s Award, she did her homework on the organization. What she found, she says, was a public charity whose reach and values aligned with her mission.

“IEEE is about expanding access to opportunities in the world of technology,” she says. “And that’s also the core of what we do at Laboratoria.”

Advertisement

She says she also sees IEEE as a living example of something her company preaches every day: “I was talking about the value of professional networks, and I think IEEE is such an amazing reference in that space. It exemplifies this belief that human connection—not only doing your work but also sharing and learning with others—is at the core of building thriving technology careers.”

The engineering organization found her well after she launched her tech-related career. But it wasn’t too late. She says she intends to make the most of the connection.

From Your Site Articles

Related Articles Around the Web

Advertisement

Source link

Continue Reading

Tech

Microsoft explains what caused the Xbox outage and how it plans to prevent it from happening again

Published

on

Bleak Future: A few hours after recovering from the “great Xbox outage” of July 2026, Microsoft is now trying to assure customers that these kinds of systemic issues will not happen again in the future. Transparency is great, but people are questioning why Redmond isn’t removing online requirements for single-player, disc-based games.

Earlier this week, the Xbox network became unavailable to a majority of players. Users were unable to launch their purchased games, sign in, or complete new purchases, with even offline games and disc-based releases being affected by the outage. Most of the issues should now be resolved, although the Xbox team is still investigating the incident in preparation for a full post-incident review.

While the investigation is ongoing, Xbox CTO Scott Van Vliet has shared a few crucial details about the outage. The source of the outage appears to have been a licensing service operating outside the main Xbox infrastructure. Microsoft uses this service to manage licenses and user access to several products, but the Xbox network was hit hard when the service began to fail.

The outage affected both end customers and Xbox partners, Vliet said. Players were unable to sign in in many scenarios requiring an “entitlement check” for purchased products, while Microsoft publishing partners relying on the same system were unable to manage their games. In Microsoft’s parlance, an entitlement check is simply a way to manage digital rights for content “purchased” by end customers.

Advertisement

In any case, the Xbox support team was quick to identify the “major incident” and isolate the failing part of the network’s infrastructure. They shifted network traffic to other, healthy parts of the network and were eventually able to restore almost full access to the entire Xbox experience. The service came back at different times across the global network, which is why some people regained access before others.

Vliet was adamant that having a single point of failure for a complex network such as Xbox is not an ideal solution going forward. Microsoft is apparently working on “hardening” the systems that sign-in and game-launch processes rely on while improving the team’s responsiveness to this type of platform-breaking problem.

Users welcomed Vliet’s “no bullshit” approach, but some were still frustrated by the fact that a network-related issue was capable of turning their disc-based games into useless plastic coasters.

Now that the industry is preparing for a future where physical games no longer exist, some enthusiasts fear that a failed “entitlement check” could turn thousands of dollars’ worth of purchased games into thin air.

Advertisement

Source link

Continue Reading

Tech

Jeff Bezos says this business is becoming Amazon’s next ‘pillar’

Published

on

Amazon’s next pillar could be built on a foundation of silicon.

In a new interview with Fortune, Amazon founder and Executive Chair Jeff Bezos says the company’s custom chip business is on track to become one of Amazon’s most durable businesses, placing it alongside Marketplace, Prime, and Amazon Web Services as a core pillar of the company.

“A few of our offerings have become durable pillars, things like Marketplace and Prime and AWS,” Bezos told Fortune. “What I see right now is that our chips business, our silicon business, is lining up to be our next pillar.”

The comments offer one of Bezos’ clearest public endorsements yet of Amazon’s push to design its own chips for artificial intelligence, an increasingly important strategy as demand for AI computing soars and companies look for alternatives to Nvidia’s dominant processors.

More than a decade of investment

Amazon has invested heavily in custom silicon through Annapurna Labs, the Israeli chip startup it acquired in 2015. The company now develops its own AI chips under the Trainium and Inferentia brands, designed to train and run large language models while reducing costs for customers using Amazon Web Services.

Advertisement

AWS has positioned the chips as a lower-cost alternative for AI developers. AWS has positioned the chips as a lower-cost alternative for AI developers. Anthropic trains and runs its Claude models on Trainium, and OpenAI has committed to consume about 2 gigawatts of Trainium capacity, ramping in 2027.

The company disclosed revenue for its in-house data center chips for the first time earlier this year, and since then its Trainium, Graviton, and Nitro chips have grown to a combined annual run rate of more than $20 billion. Amazon has been pouring billions of dollars into AI infrastructure, including new data centers and custom networking hardware.

Amazon CEO Andy Jassy has repeatedly argued that demand for AI computing will remain strong for years, making investments in chips, servers, networking equipment, and power generation essential to the company’s long-term growth.

In an earnings release earlier this year, Jassy signaled plans to pour a record $200 billion in capital expenditures across Amazon in 2026, citing “seminal opportunities like AI, chips, robotics, and low earth orbit satellites.”

Advertisement

The real potential for Amazon’s chips business could come in going beyond the walls of its own data centers. Jassy wrote in his annual letter to shareholders this year that it’s “quite possible” Amazon will sell racks of its internally developed chips to third parties in the future.

Amazon’s fourth pillar?

This discussion about Amazon’s “pillars” goes back to Bezos’ 2014 letter to shareholders, where he described four characteristics of what he called a “dreamy” business: “Customers love it, it can grow to very large size, it has strong returns on capital, and it’s durable in time — with the potential to endure for decades.”

AWS, Marketplace, and Prime are considered the first three pillars. The question of what could become Amazon’s “fourth pillar” has been debated for more than a decade, with areas including shipping and logistics and Alexa cited as contenders in the past.

Advertisement

@media (max-width: 600px) {
aside.callout { float:none !important; max-width:100% !important; margin-left:0 !important; margin-right:0 !important; }
aside.callout .callout-img { display:none !important; }
}

The company’s big bet on silicon also was emphasized by Jassy in the Fortune piece. He told the magazine that chips are often the key to computing. “The growth in AI has been so significant, but we have a chips business that we built over the last decade here that is growing very quickly,” he said.

The profile appeared alongside Fortune’s release of its 2026 Global 500 ranking, which placed Amazon at No. 1 for the first time, ending Walmart’s 12-year run as the world’s largest company by revenue after Amazon surpassed $700 billion in annual sales, as reported previously.

Walmart fell to No. 2, followed by State Grid of China, UnitedHealth Group, and Saudi Aramco. The magazine reports that Amazon is on pace to be the first trillion dollar company by revenue.

Amazon reports Q2 2026 earnings on Thursday afternoon. Check back with GeekWire for coverage.

Advertisement

Source link

Continue Reading

Trending

Copyright © 2025