The UK government has six months to decide whether to terminate a deal worth more than $400 million between the country’s National Health Service and American software company Palantir. If one part of the NHS is already doing without Palantir, politicians are asking, why can’t the rest of the country?

In 2023, the UK commissioned Palantir to develop a “federated data platform” (FDP) that could ingest and organize the tangle of health data produced across the country. According to Palantir and the NHS, the new system is already cutting wait times and the length of hospital stays, and maximizing the use of operating theatres.

But lately, as Palantir technology is deployed in theatres of war and the US administration’s immigration crackdown, its deal with the NHS has become a flashpoint in the UK, drawing protests, petitions, parliamentary inquiries, and a reported rebellion among NHS workers. Other European nations, increasingly at loggerheads with the Trump administration, are also reevaluating their relationships with Palantir in a bid to minimize their dependence on US-made technology.

The health care board for one part of England, Greater Manchester, has repeatedly declined to adopt Palantir’s FDP, choosing to stick with a home-spun platform developed over the best part of a decade. The board claims it doesn’t need Palantir, that its own platform is functionally superior and more trusted by the public. “[Even] a technically strong platform will struggle to realize value if clinicians, data controllers, patients or the public do not trust it,” Matt Hennessey, chief data and analytics officer at NHS Greater Manchester, tells WIRED. “If we were to fully adopt the FDP … it would be a retrograde step.”

That claim—disputed by Palantir and other FDP advocates—has fed into a national debate over whether the government should seize an opportunity next February to terminate the NHS contract early, instead of allowing it to run until 2031.

For decades, NHS workers have used a combination of digital systems, spreadsheets, paper, and whiteboards to keep track of patients. Sometimes, when a patient moves from one care setting to another, their treatment records are left behind with occasionally deadly consequences. Without a way for different types of care providers to share information effectively, NHS administrators have had to base funding and resource allocation decisions on an incomplete patchwork of data. Palantir’s FDP is meant to change all that.

The NHS began to roll out the FDP in early 2024. The platform consists of a national pool of health data meant to help identify care deficiencies, and a bunch of local databases that individual regions can use to perform analyses and develop tools specific to their needs—say, waitlist management or discharge planning. The various components all share the same underlying technology scaffolding, in theory making it possible for tools developed in one corner of the country to be readily adopted in another.

“You can lift and shift. That’s the real power of the FDP,” says Tom Bartlett, an independent IT consultant who previously oversaw the national-level FDP rollout as deputy director of data engineering at NHS England. “The other advantage is that you’ve got a surface for artificial intelligence to work across.”

Within the sprawling NHS, two types of organizations can access the FDP: trusts that run hospitals and local care, and integrated care boards (ICBs), responsible for planning and commissioning health care services at a regional level. Both use data for different purposes, but share the ultimate goal of improving patient care.

OS PLATFORMS

One remains a pillar of Linux, while the other keeps the BeOS dream alive

This is a quiet time of year in tech circles – perhaps explaining why, 25 and 33 years ago, the people behind two ambitious operating system projects kicked them off.

Debian

Last weekend, the Debian project turned 33 years old. The Linux kernel first appeared in September 1991, so it was not quite two years old when Ian Murdock announced the new distribution. (Indeed, the term “distribution” itself hadn’t really caught on yet – his announcement only uses the word as an adjective.) Sadly, Murdock died in 2015, before his project became one of the world’s most widely used forms of Linux in the world.

We examined the project’s history and success when it turned 30, and it continues to thrive.

It’s not the oldest maintained distro: that distinction goes to Slackware, which is about a month older – it turned 30 that July. Slackware remains actively maintained, although it has not produced a new release in a while. The Register’s own Slackware enthusiast Richard Speed looked at version 15.0 back in 2022. Since then, we have had Debian 12 in June 2023 and Debian 13 a year ago.

And in case you’re curious, as far as this vulture can see, the first release The Reg covered was Debian 2.1 in 1999.

Haiku beta beckons

Meanwhile, the Haiku OS project keeps on going. The Desktop on Fire blog celebrated with an article on 25 Years of Haiku.

Its development was prompted by Palm buying Be in August 2001, as The Register covered at the time. A couple of days later, an email modestly titled “OK, let’s start” set the OpenBeOS project in motion, as this history of project milestones describes.

Doubters might note that after a quarter of a century of work, there’s still been no Haiku OS 1.0 release. Fair, but this is not a Linux distro – it is an entirely new OS built from the ground up. Although it now boasts impressive Unix compatibility, it remains quite different: for a start, it is written in C++ rather than C, and its 32-bit x86 version is also BeOS binary compatible. That matters less today, however, because Haiku has developed a substantial software catalog of its own.

The latest activity report from Haiku’s dedicated paid developer “Waddlesplash” discusses the possibility of a new version any time now: “Are we beta6 yet? We have a definite release timeline now: a branch should be made by the end of this week, with a target release date of mid-August. Keep an eye on the forums for details to come about how you can help test!”

Never mind the version number: the project continues to make impressive technical progress. A PowerPC port has been in the works for more than five years, and in July YouTuber ActionRetro demonstrated an AI-assisted build running on the architecture. This joins a preliminary Arm64 port that was demonstrated back in May.

Not Haiku, but adjacent

Several Haiku-adjacent projects are also making progress. The cross-platform BeOS-derived programming toolkit Cosmoe, which we covered in June 2025, is still in active development. Its source code is available on GitLab, and it now builds and runs on Linux, Windows, and macOS.

Another project with overlapping goals, although no apparent direct relationship to Cosmoe, is VitruvianOS. V, as the team calls it for short, is a port of the Haiku display server and desktop to run on a Linux kernel.

Porting the BeOS desktop onto a Linux kernel has been tried before – the first such effort we saw was called BlueEyed OS, back in 2003. V seems to be unconnected with either BlueEyedOS or Cosmoe, but it’s making impressive progress all the same.

The Reg FOSS desk first heard about V when the project announced version 0.3.0 back in March. At the same time, we read an interview with Dario Casalinuovo, its primary developer, but we couldn’t get it running.

However, V is making headway. Since its public debut, the project has produced another half-dozen releases: it is now up to version 0.6.0, which gets considerably further in our testing – it boots to a very Be-like startup screen, with a language selection dialog and the choice to run a live environment or start installation. Sadly, that’s as far as we can go.

The idea certainly has potential. Linux has enviable hardware support now, and given the rivalry between X11 and Wayland, we admire how V sidesteps the dispute: it does not attempt to be either. Instead, it replaces both with a new system based on BeOS’s clean design from 1995 – when the original XFree86 Linux X11 server was only about three years old. ®

Office printers usually sit there doing their quiet job of putting toner on paper. One Samsung C410W now spends part of its time generating infinite blocky terrain and letting players dig, build, and chat across a local network. The project belongs to a maker known as vimpo, the same person who previously convinced a Wi-Fi light bulb to host a Minecraft world.

After a poll of regular visitors revealed that printers were the most popular choice, the quest began for a networked machine that was ancient but still had valuable debugging tools and was modern enough to communicate with an Ethernet network. The C410W printer met the requirements. It’s a tiny color laser printer from the mid-2010s that still includes wifi and has a firmware revision from December 15th, 2015 (V3.00.02.20).

Sale

ETIKEZ D90E Inkless Portable Thermal Printer with Case – 8.5″ x 11″, Black

• Portable Wireless Printer – The ETIKEZ D90E is an inkless printer and portable printer that uses advanced thermal technology, requiring no ink, toner…
• Bluetooth & USB Connectivity – Connect this D90E portable printer to iPhones or Android via Bluetooth. This wireless printer also works with PC over…
• Multiple Printing and Format – The wireless portable printer supports 8.5″ x 11″ US Letter thermal paper (B0GD61HPDC, B0GD5JFC2Q). It meets all your…

Opening the case revealed a leftover debug serial port, which the manufacturers must have kept in there. The first step was to plug in a USB to serial converter and launch a terminal program to see what was going on behind the scenes. Soon, some standard commands appeared that weren’t really helping much, but pushing the escape key prompted a memory dump instead. Reboot messages described the heap and stack layouts, and the entire 23 megabytes of RAM spilled out into a disassembler for us to work with.

An AI agent spent over 12 hours churning away at labeling functions and trying to figure out where a program was crashing, but in the end it just helped map out the code since it couldn’t find a way to operate the printer. Manual investigation of an obscure other residual protocol proved effective. The printer still had an old port 7000 open, which was reserved for something called the LAN Test Protocol, a manufacturing tool that received XML messages regardless of their size. So he put the payload into one that was just a little too big, which overwrote the buffer, overwrote the program counter, and redirected execution to a known function that flashed the status lights. Once that basic step was completed, the same procedure could be followed to get custom code running on the printer.

He was running UCraft, a Minecraft server created specifically for devices with limited memory and computing capability. It’s a tiny binary file, at about 46 kilobytes without requiring the user to sign in, and it consumes about 50 kilobytes of memory for a single player. It just about manages to get enough of the protocol sorted so that clients can join in, walk about a procedurally created terrain, punch blocks, and send text messages. By design, it excludes many of the complete vanilla features. The server is compatible with more modern Java Edition clients, and it previously ran on a light bulb microcontroller.

Once you’ve gotten beyond the overflow, the printer’s lights begin to flicker, and a Minecraft world appears at the device’s local IP address. One person can go in and look around, but it’s a sluggish process because chunks take a long time to load and the printer’s small processor is under strain. When you add extra players, the game lags and print jobs crash because the CPU is overloaded.

It is also worth noting that anyone with the same C410W printer and firmware can reproduce the entire thing because the exploit and server code are all available in public repositories. So all you have to do is obtain the necessary equipment and software to get it up and running, and then be willing to put in the time to set it up in the first place. When all is said and done, you end up with a working, if rather problematic, multiplayer universe running inside a device that was initially designed to simply print out words and images on paper.
[Source]

Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances.

The most severe of the two, tracked as CVE-2026-19490, can allow remote attackers without privileges to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured.

Admins can check if an appliance is vulnerable to attacks targeting CVE-2026-19490 by inspecting their NetScaler configuration for SAML action configuration (add authentication samlAction .*) string and Auth or VPN vserver (‘add authentication vserver .*’ and ‘add vpn vserver .*’) strings.

The second, a high-severity memory overflow security flaw tracked as CVE-2026-19489, can be abused by remote unauthenticated threat actors in denial-of-service (DoS) attacks when SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled on a large-scale NAT group configuration.

Security teams can determine whether Citrix NetScaler appliances on their network meet the preconditions for CVE-2026-19489 exploitation by inspecting their configuration for the “add lsn group.*sipalg.*” string.

Citrix advised customers to upgrade vulnerable NetScaler ADC and NetScaler Gateway appliances to:

• NetScaler ADC and NetScaler Gateway 14.1-73.32 or later,
• NetScaler ADC and NetScaler Gateway 13.1-63.21 or later,
• NetScaler ADC FIPS 14.1-73.32 FIPS or later,
• or NetScaler ADC FIPS and NDcPP 13.1-37.277 or later, as applicable

“We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin, assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible,” Citrix warned on Wednesday.

“The bulletin applies to supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds. SecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments that use customer-managed NetScaler instances are also affected and should be upgraded to the recommended builds.”

While these security flaws have not been flagged as exploited in attacks, Citrix urged admins to patch two other NetScaler vulnerabilities (CVE-2026-3055 and CVE-2026-4368) on March 23, just days before attackers began abusing them in the wild.

CISA added the CVE-2026-3055 vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on March 30 and ordered federal agencies to secure vulnerable Citrix appliances within three days.

Over the last five years, the U.S. cybersecurity agency has flagged 22 Citrix vulnerabilities as exploited in the wild, six of them also abused in ransomware attacks.

The ShadowServer Foundation now tracks over 22,000 NetScaler ADC and nearly 1,800 NetScaler Gateway instances exposed online. However, it does not provide information on the number of honeypots or how many may be vulnerable to attacks targeting CVE-2026-19489 and CVE-2026-19490.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Your clients receive thousands of emails every day, but all it takes is one convincing message to turn a seemingly harmless email into a security incident you will be responsible for cleaning up.

AI has fundamentally changed phishing, making it easier to launch, harder to detect and far more convincing than traditional email filters were built to stop.

With a large language model and a few publicly available LinkedIn profiles, attackers can generate highly personalized phishing emails in minutes. Harvard Business Review found that AI-generated spear phishing campaigns achieved a 54% click-through rate, matching those of human experts at a fraction of the cost.

Understanding how these attacks work and why traditional filters struggle to stop them is essential to protecting clients before a single email becomes a costly breach.

Inside an AI-powered phishing campaign

Every AI-assisted phishing campaign follows the same basic path. AI simply makes each stage faster, more convincing and much harder for traditional defenses to detect.

Reconnaissance: AI finds the right target

Attackers use AI to scan LinkedIn, company websites and other public sources to build a profile of a specific employee. Within minutes, they know who that person works with, what projects they’re involved in and how they communicate.

Why this matters for MSPs: Public information gives attackers everything they need to create a believable phishing email before it ever reaches your client’s inbox.

Content generation: AI writes an email that looks legitimate

AI uses that information to create an email that appears to come from a trusted colleague, customer or vendor. Every message is personalized, contextually relevant and free of the spelling mistakes or awkward phrasing that once made phishing easy to spot.

Why this matters for MSPs: The biggest challenge is no longer identifying obvious phishing emails. It’s protecting clients from messages that look and read like legitimate business communication, making users far more likely to trust them.

Delivery and evasion: The email gets through

AI also helps attackers evade detection by creating a unique version of every email — a technique known as polymorphic phishing. It continuously changes subject lines, sender details, formatting and content, while using trusted cloud services, QR codes and redirect chains to bypass traditional filters.

Why this matters for MSPs: Traditional email gateways rely heavily on signatures and known indicators of compromise. When every email is different and constantly changing, those indicators become far less reliable, allowing more phishing emails to reach your clients.

Post-compromise activity: The damage happens fast

If a user clicks a malicious link or enters their credentials, the attack escalates quickly. Attackers can steal session tokens, create mailbox rules to hide their activity and begin moving through the client’s environment within minutes.

According to IBM’s 2024 Cost of a Data Breach Report, phishing is the leading cause of data breaches, accounting for 16% of incidents and costing organizations an average of $4.8 million per breach.

Why this matters for MSPs: By the time a phishing email reaches the inbox, prevention alone is no longer enough. Protecting clients requires visibility beyond email, with endpoint detection, identity monitoring and rapid response working together to stop attackers before they can expand their access.

What catches an AI-generated attack

AI can disguise a phishing email, but it can’t disguise the identity, endpoint and user activity that follows. That’s where modern detection makes the difference.

Monitor behavior, not just emails

Every successful phishing attack leaves signs that something isn’t right. Instead of just examining the email, monitor for unusual account and user activity, such as:

• A new forwarding or mailbox rule, which sends messages to an external address, especially immediately after a login from an unfamiliar location.
• Impossible travel, where the same account logs in from two different countries within minutes.
• Repeated multifactor authentication prompts that the user didn’t initiate, often indicating MFA fatigue or push bombing.

Behavioral analytics and anomaly detection help surface these warning signs, even when the phishing email appears completely legitimate.

Correlate activity across the environment

A single suspicious login or endpoint alert may not mean much on its own. But when identity, email and endpoint activity are correlated, it becomes much easier to recognize an active phishing attack before it escalates. Look out for:

• A user signing in from a trusted device, but the endpoint immediately begins launching PowerShell scripts or other unusual processes.
• A user successfully logging in, then immediately attempting to access systems, applications or data they’ve never used before.
• A sudden spike in outbound emails from an account that normally sends only a handful of internal messages each day.

Automated threat correlation connects these signals across email, identities and endpoints, helping MSPs identify active phishing attacks faster while reducing alert fatigue.

Detect faster, respond sooner

The sooner an attack is detected, the less opportunity an attacker has to expand their access. Once credentials are compromised, every minute counts.

• Automatically flag and investigate suspicious account activity before attackers can move laterally.
• Isolate compromised endpoints to stop malware from spreading.
• Disable compromised accounts or terminate active sessions before additional data is accessed.

Faster detection and response reduce attacker dwell time, improves incident response efficiency and helps MSPs contain phishing attacks before they become costly breaches for their clients.

What MSPs can do this week

Here are practical steps MSPs can take to reduce risk and strengthen their clients’ defenses

• Modernize security awareness training: Run phishing simulations that look like what AI produces now, not the misspelled, generic templates from five years ago. Training built on old examples teaches people to watch for the wrong thing.

• Verify high-risk requests: Require a phone call or a separate channel to confirm any wire transfer, credential reset, or vendor payment change, no matter how convincing the email looks. This one habit stops most business email compromise attempts cold, because it doesn’t rely on anyone spotting anything.

• Monitor account activity after delivery: Don’t stop at the inbox. Monitor for suspicious mailbox rules, logins from unfamiliar locations, impossible travel and repeated MFA prompts. These behaviors often provide the earliest indication that an account has been compromised.

• Measure response time, not just resolution time: Measure how long it takes to detect and contain a suspected compromise. Treat that number with the same weight as ticket resolution time. A faster response window is what limits the damage once a phishing email gets past the gateway, and one eventually will.

AI changed phishing. MSPs need to change their defenses

AI has changed phishing from a filtering problem into a detection problem.

As phishing attacks evolve, the advantage belongs to MSPs that can detect and respond before a compromised inbox becomes a client-wide breach.

Download the 2026 Kaseya Email Security Report to learn how modern phishing attacks bypass legacy defenses and the strategies MSPs are using to stay ahead.

Sponsored and written by Kaseya.

We’ve got an AppleInsider staffer inside Amazon’s new drone delivery range. After trying it out on Thursday, we can tell you that it’s effective, and we’re going to use it again.

Earlier this week, Amazon greatly expanded the service area of its drone delivery service. A little napkin math suggests that the airborne delivery service now covers about 3500 square miles more than it did a few days ago.

And, as part of this expansion, one of our staffers is now inside the footprint of that service.

Partly out of curiosity, and partly out of need, he ordered something to be delivered by drone. It wasn’t an iPhone or AirPods, as Amazon suggested, no, but that didn’t seem prudent to try first.

The box the package shipped in

An initial delivery time was given, and Amazon was close enough to that estimate. Delivery was only about 10 minutes later than expected. The drone approached from the north of his location, and buzzed into place.

It hovered for a moment. With a light click, and continued mad hornet buzzing, it dropped the package about four feet, accurately, onto the selected front yard landing zone.

We did see, though, that the package rolled a bit before it settled into place. Your mileage may vary on this, of course, depending on the slope of your yard, the surface it lands on, and the angle of impact of the box.

The drone, leaving, after having dropped its payload.

You get to fine-tune the drop zone on your property when you order, some, but don’t expect it to be precise enough to drop it on a second-floor balcony. It’s probably not wise to bombard your driveway or your roof with your Amazon box.

Time and costs for Amazon Drone delivery

All told, from order to delivery took about an hour and a quarter, with it launching about a half an hour after the order was placed. The box was better packed than most of Amazon’s packages these days, which you’d probably expect since they know they’re dropping it from a bit of a height.

Amazon drone delivery packaging for a very small and light item

Advertisement

Amazon deliveries by vehicle within an hour cost $9.99 in some metro areas. If you can accept delivery within three hours, it’s generally $3.99. This incurred no additional cost, for now, at least.

Limits on shipped items are about five pounds, and the package has to fit in a box about the size of a shoebox, as seen above. Our package contents weigh about the same as an AirPods 4 box.

So far, we’re pretty impressed with this service. We’re also sure there’s going to be incidents of packages rolling under cars and the like.

Plus, you probably want to be home, since the box will be in your yard somewhere.

For now, though, so far, so good. We’ll do it again. Just maybe not with a $1000 iPhone.

software

After imagining explosions, blackouts, and daring escapes, this techie decided the best thing to do was just not doing the job

ON CALL Making it through a working week can feel like a dangerous adventure. That’s why The Register offers a little certainty and safety by always using Friday morning to share a new edition of On Call – the reader-contributed column sharing your tales of tech support.

This week, meet a reader we’ll Regomize as “Socrates,” who many years ago was the “fresh-faced manager of a small software department.”

Socrates’ employer had sold some monitoring hardware to a client that made equipment for power stations, but whoever installed the system had neglected to document it properly.

Socrates’ boss asked him to visit the site and bring the client up to speed.

“In those days I considered myself to be a bit of a programming hot-shot, and a visit to a power station sounded really interesting, so off I went,” Socrates told On Call.

He therefore drove to the plant, presented himself at the security gate, and was eventually led to something called a “turbine overspeed detector.”

“This power station was seriously big and impressive; massive rotating machines humming away, with barely anyone around,” Socrates wrote. “In a dark remote corner, there it was, the equipment I had come here to see: a dusty CP/M computer with various I/O cards, connected to wiring that snaked off into the far distance.”

But Socrates had no idea what it did.

In his email to On Call, Socrates pointed out that at the time of this story, Tom Cruise was yet to appear in a Mission:Impossible movie, and The Matrix was still years from release.

But his memory of these events is is somehow entangled with both franchises.

“I didn’t know much about electricity generation, but I did know that
a turbine is a thing with pointy blades, that are pushed around by steam
to drive a generator,” he wrote. “And these turbines were absolutely enormous, and
the thought of them overspeeding was truly scary.”

“You know the scene in Mission:Impossible where Tom Cruise is on the back of a train, pursued by a helicopter that crashes with its rotor blade just inches from Ethan Hunt’s throat?” he asked. “That image would have been uppermost in my mind; knife-like turbine blades being ejected in all directions, requiring all my Matrix-like skill to dodge them as they headed my direction.”

He then reasoned that an overspeed event would probably shut down the turbine – before imagining cascading faults blacking out an entire city.

Keen to avoid either scenario, Socrates sat down at the keyboard, opened the relevant software, and vowed not to break anything.

He got into the code and found it was “horrible.”

“Despite my tender years, I’d gained some exposure to well-structured programs, and this was truly awful,” he told On Call. “There were plenty of random GOTOs, a lot of I/O accesses to random addresses, with arithmetic, ANDing and ORing with arbitrary-looking numbers.”

And all without a single comment to help Socrates understand what he was seeing.

As he pondered what to do, only one sensible course came to mind: “Back away carefully from the keyboard and leave the system as-is.”

So that’s what he did.

Socrates now rates the experience as an important life lesson.

“Some things are best left alone,” he told On Call.

Have you bailed out of a tech support job? If so, click here to email us what happened and why. We promise not to give up on your story. ®

Pew found strong signs of AI authorship in around 10% of a random sample of webpages in July 2026, rising to more than a third among pages published since ChatGPT’s release. Commercial domains carry most of it, at about 10% of .com against roughly 1% of .edu and .gov.

About a tenth of the web now shows strong signs of having been written by a machine. Pew examined a random sample of 10,000 pages in July 2026 and found roughly 10% carrying AI authorship signals.

The headline figure everyone is quoting is the other one. Among pages published since ChatGPT arrived in November 2022, more than a third show those signals, which is a different claim about a much smaller slice of the internet.

The distinction matters because the web is old. Most of what exists was published before the models did, so a page-level average across everything understates what is happening to new writing.

The method is worth stating plainly. Pew classified nearly 500,000 English-language pages from the Common Crawl archive between January 2021 and July 2026 using Open Pangram, the detector Substack adopted to catch machine-written newsletters.

Detectors get individual documents wrong, and Pew says so. Its argument is statistical, that across hundreds of thousands of pages the patterns separate reliably even when any single verdict might not.

The domain breakdown is the real finding. Around 10% of .com pages showed AI authorship against 4.6% of .org and roughly 1% each of .edu and .gov.

That is a map of where writing is a cost rather than a purpose. Commercial pages exist to be found, and search-optimised text is the cheapest thing a language model can produce.

Pew also catalogued the tells, which will be uncomfortable reading for anyone with a house style. Em dash use has doubled since 2023, Oxford commas are up 63%, and the words “delve” and “pivotal” keep turning up alongside the construction “it’s not just X, it’s Y“.

Platforms are already building detection into the plumbing. LinkedIn says its own system identifies generic content with 94% accuracy, and arXiv now bans researchers who submit unchecked AI text.

Volume is not the same as visibility, which is the sane part of this. Separate research from Graphite found AI articles approaching half of newly published ones, while human-written pieces still dominate Google results and AI citations.

What has actually changed is the default assumption. A page published this year was probably touched by a model somewhere, and the industry’s response is to sell everyone tools to check.