Attackers have begun targeting a critical-severity Citrix NetScaler flaw in the wild, according to vulnerability intelligence company Previdian.

Tracked as CVE-2026-19490, this security flaw can allow unprivileged threat actors to bypass authentication remotely when the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured.

“We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin, assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible,” Citrix warned in mid-August when it addressed the flaw and urged admins to patch it as soon as possible.

While the company has yet to flag the vulnerability as actively exploited in its August 19 security advisory, Previdian founder and security researcher Ryan Dewhurst told BleepingComputer on Thursday that attackers have begun targeting CVE-2026-19490 in the wild after a “credible” proof-of-concept exploit was published online.

“On 3 September, one of our NetScaler sensors received requests matching the PoC from three distinct source IPs, geolocated to Australia, the United States and Germany,” Dewhurst told BleepingComputer.

“Our current assessment is that this provides evidence of exploitation attempts, but it does not confirm successful compromise of real-world systems.”

The Centre for Cybersecurity Belgium, the country’s National Cybersecurity Coordination Centre for Belgium (NCC-BE), also warned on Friday of exploitation attempts targeting the CVE-2026-19490 vulnerability and urged admins to prioritize patching all vulnerable Citrix NetScaler appliances on their organizations’ networks.

Although Internet threat watchdog Shadowserver tracks over 22,000 NetScaler ADC appliances and nearly 1,700 Gateway instances exposed online, there is no information on how many are honeypots, have vulnerable configurations, or have already been patched against CVE-2026-19490 attacks.

Citrix urged admins to patch two other NetScaler flaws (CVE-2026-3055 and CVE-2026-4368) in March, just days before threat actors began exploiting them in attacks.

The Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2026-3055 flaw to its catalog of actively exploited vulnerabilities one week later and ordered federal agencies to patch vulnerable Citrix appliances within three days.

Since November 2021, the U.S. cybersecurity agency has tagged 23 Citrix vulnerabilities as exploited in the wild, six of which have also been abused by ransomware gangs.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Advertisement

Get the report

There’s not much the robot vacuum industry can do to surprise me these days. I’ve seen robots that have mechanical arms to pick up objects, robot vacuums with legs and tread systems to climb stairs, and even wilder humanoid concepts. But iRobot genuinely surprised me with its Roomba Duo, a floor-washing robot module that carries a little baby Roomba on top. I saw this contraption in action at iRobot’s booth at IFA Berlin, and I honestly don’t know what to make of it.

I briefly spoke to Adam Pope, iRobot’s chief engineer at the booth, who explained that the Roomba Duo is currently just a concept, but it’s an example of the kinds of things iRobot is considering to address consumer pain points. In the case of the Duo, the main egg-like mothership module includes a powerful floor washer and steamer that’s more capable than the type of hardware you can put. iRobot tells me that the main unit’s power is equivalent to that of a traditional wet-and-dry vacuum, offering powerful cleaning but lacking the autonomy of a robot vacuum.

The Duo solves this problem by also incorporating a slim Roomba that can be deployed. I watched it do so after the main unit sucked up some spilled spaghetti from the carpet for the demo and sanitized the spill area. It then used a top-mounted mechanical arm and what I can best describe as a landing craft to lower the Roomba onto the floor, where it started cleaning in the narrow spots of iRobot’s obstacle course. The movement reminded me of a bulldozer or a forklift because the mechanical arm itself looks quite industrial and sturdy, which iRobot says is necessary to ensure stability under the additional weight.

After the main unit finished its heavier cleaning job, it moved closer to its docking area while the smaller Roomba puttered around, cleaning corners and navigating iRobot’s barriers.

Both units operate autonomously, but they share a home map and an autonomous mobile dock, so they won’t duplicate efforts. They communicate in real time and are connected via the Rooma Home app, which uses AI to coordinate cleaning tasks. iRobot says the main unit vacuums and mops the large, open floor areas, while the slim baby Roomba goes under furniture and into narrow spaces the bulky main module can’t reach.

While this is just a concept product with no indication it’ll come to market, iRobot did share some specs with us. The main mothership has a wet-and-dry floor-washing module, a high-performance motor, and a high-capacity battery. It also uses the company’s PowerSpin Max Roller map, applying 46 newtons of downward pressure, which is a huge jump from the 12 to 14 newtons you typically get from a robot vacuum. iRobot says it scrubs the floor as thoroughly as if you were cleaning by hand.

It also has an internal heater that generates steam to loosen tougher, dried-on grime and stains. The roller is self-cleaning, as we’ve come to expect and iRobot says it can handle everything from dirt to pasta sauce and cooking grease. There’s also a hot-air dryer behind the roller that dries the floor after the roller is done mopping, so the wood flooring doesn’t get damaged by moisture.

The companion robot used for the demo is the Roomba Plus 575 Combo, which we covered after it launched earlier this year. It’s just 8.35 centimeters tall and 29.8 centimeters wide, making it one of the slimmest models we’ve seen, which is why it was selected as the companion unit. Right now, it’s not clear whether the mothership can accommodate other robot vacuum models, but I would guess it’s only compatible with this one for now.

The main Duo unit is equipped with the company’s ClearView Pro dual-line lidar and AI to detect and navigate household objects. It also has a top-mounted AI camera, giving it a better, higher view of rooms and floor layouts, and creating more detailed maps than a standard robot vacuum. It should also be able to better identify stains.

To move this fairly bulky unit, it uses 17-centimeter wheels powered by hub motors. There’s a shared AutoWash dock (the self-emptying and cleaning docking station that most newer Roomba models use). It has a centralized clean water supply, a waste water tank, and like a standard stationary dock, it automatically washes and dries the mop and collects dust in a dustbag, letting you go months before it needs to be emptied.

Ajay Kumar

Smart Home & Robotics Editor

CNET’s Smart Home & Robotics Editor covering robot vacs, home appliances, smart home, and yard & outdoors. Built CNET’s lab-exclusive testing methodology and lab awards.

See full bio

Advertisement

Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver’s licenses.

Several law firms, including Markovits, Stock & DeMarco, and Hall Attorneys, have also launched investigations into potential class-action litigation related to the reported security incident at IDScan.

Brian Krebs originally reported on September 1 that a dark-web identity-theft service called “Nexus” advertised access to more than 153 million U.S. and Canadian driver’s license scans, 10 million ID cards, 3 million travel documents, and 579,000 medical cards.

Krebs verified the samples by searching the database for his own records and those of other individuals who had consented to the checks, and tracked the leak to IDScan.

IDScan is an identity verification technology company that provides hardware and software solutions for businesses to scan, authenticate, and extract information from government-issued identity documents.

Its systems are used across the U.S. in car rental firms, retailers, gun shops, financial institutions, cannabis dispensaries, and hospitality establishments.

The company has not published any statements about these allegations, and it did not respond to BleepingComputer’s requests for comments.

Currently, it is unclear if IDScan’s systems were compromised or the number of impacted individuals.

Krebs also reported that the FBI’s New Orleans office has launched an investigation into the incident, which Reuters also confirmed independently.

The agency has also confirmed for BleepingComputer that it is looking into the incident. However, the FBI declined any further comment due to the ongoing nature of the investigation.

The illegal service Nexus is no longer online. However, cybercriminals still have access to the database.

BleepingComputer learned that the service included documents belonging to U.S. Secretary of Defense Pete Hegseth and an assistant director of the FBI, but we could not verify the information.

The lawsuits were filed in Louisiana, where IDScan is based, and allege that IDScan failed to protect information from its clients, such as global car rental company Hertz.

According to Markovits, Stock & DeMarco, IDScan has started to notify some business customers around September 1st.

The law firm says people whose IDs were scanned through businesses using IDScan’s systems may be affected, and is seeking potential claimants for a possible class-action case.

Given the incident’s potential scale, additional lawsuits—including potential class actions—could be filed, and related cases could eventually be consolidated into multidistrict litigation.

State attorneys general and federal regulators could launch separate investigations or enforcement actions, as it has happened with similar-scale data exposures in the recent past, including for 23andMe, Marriott, and Equifax.

Update [September 4, 14:50 EST]: Article edited to include FBI’s confirmation that the incident is being investigated.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

from the social-media-chasing-lawyers dept

There is a flood of lawsuits against social media, from a variety of different parties, all claiming some kind of harm. Would you feel differently about some of those lawsuits if you found out the plaintiffs bringing them were talking amongst themselves about how they were doing it just to become rich?

Because we just found out that at least one of the key cases, involving a teenager who claimed he was addicted to social media ended with that kid dropping the case, right after he had to reveal during discovery that he had asked ChatGPT what his father meant when he said the kid needed to keep pursuing the case because it was going to make him a million dollars.

It increasingly looks like many of these cases brought against the companies are by money hungry lawyers and questionably competent parents exploiting children to try to get a big payday. There was some hint of this in the big California bellwether case regarding a teenager who sued Meta, claiming it made her addicted to social media, even though it came out that the teen suffered very real trauma from her own mother. Of course, at trial, pointing out that the child’s mother likely was the cause of some of her trauma doesn’t often play well in front of a jury.

But the story of another teenager’s lawsuit against all the big social media companies seems even more damning. Back in July there was some surprise that the teen, named only as “RKC” in the case, suddenly dropped the case just before it was set to go to trial. In the media, the claims were that it was just too stressful for RKC, but that seemed… odd. The real story appears to be what Meta turned up in discovery: evidence that the suit was part of the family’s get rich quick scheme, egged on by lawyers happy to keep it going.

Last week the Washington Post wrote about how everything you type into ChatGPT can get swept into discovery in a lawsuit. That’s a big deal on its own for anyone treating a chatbot as a diary. But buried in that story was something specifically revealing about the RKC case:

When a teenage boy identified in court filings as R.K.C. didn’t understand his father, he turned to ChatGPT for help.

“My dad Said that I’m will get a settlement worth of 1million dollar,” R.K.C. said to the chatbot in October 2024, according to court filings. “He said that If that doesn’t make me happy what does. What does he mean.”

Unlike the California case, where the trauma came from the teen’s own mother, here Meta got something much closer to a smoking gun: a kid so confused about why a million dollar settlement was supposed to make him happy that he had to ask a chatbot what his father meant. I imagine that would not play particularly well in front of a jury.

But, once again, it should raise some serious questions about these cases, and the motivations of those bringing them. Even if you believe that the companies could do a better job, the whole reason why Section 230 is supposed to stop these cases cold at the beginning is to stop grifting lawyers and grifting plaintiffs from filing these sorts of lawsuits as a shakedown. This is why we’ve warned people that, even if you hate Meta, the results of the California case are bad news.

The point of Section 230, again, was supposed to be that it prevented “death by a thousand duck bites,” but increasingly the courts are saying “eh, we can allow the ducks to bite away and sort it out later.” And that’s an open invitation for more suits like this one, where the lawyers get a contingency fee, the parents get a settlement, and the troubled kid gets deposed about their worst year.

Hell, in the RKC case, Snap, TikTok, and YouTube all paid off the family (and its lawyers) before the trial even started. So the plan appears to have worked, even if Meta escaped, thanks to the ChatGPT transcript that was revealed during discovery.

I understand that big tech companies are unsympathetic here, and Mark Zuckerberg has made a ton of terrible choices over the years. I honestly hope that the company collapses and users find other, more user-empowering places to connect with family and friends. But these lawsuits all seem incredibly sketchy. And, again, Meta can afford to fight these cases for years. With something like 2,500 of them already pending in this one mass tort, the sites that can’t afford that fight — including the smaller ones that actually take kid safety seriously — will settle or shut down, which is precisely the outcome Section 230 was written to prevent.

Filed Under: addiction, get rich quick, social media

Companies: meta

A group of independent AI researchers discovered that internally deployed OpenAI agents began posting on an obscure German wiki forum in order to collaborate on evaluations. They appear to have worked together for over a month without OpenAI’s knowledge.

A spokesperson for the frontier lab would not say whether these agents were indeed from OpenAI, or when the lab became aware of their actions. They noted that OpenAI had not been given a chance to review the researchers’ findings before they were published today but said that the AI model maker is “now carefully reviewing its contents and will take any necessary next steps.”

After OpenAI revealed that agents working on an internal evaluation were able to access the open internet and exploit Hugging Face, a group of researchers — Nightingale CEO Sydney Von Arx, AI researcher Cormac Slade Byrd, Redwood Research’s Spencer Kitts, and AI Futures Project’s Thomas Larsen — began searching for evidence of other rogue AI agents.

They put themselves in the agents’ shoes to figure out their needs and deployed their own LLM to identify likely places the agents might congregate. They then identified a wiki-hosting service that would be particularly vulnerable: The DseWiki is 25 years old but had just 10 edits in the last 20 years — before the agents arrived.

Starting on May 11, the researchers tracked agents, many with OpenAI identifiers in their names, trying and finally succeeding in editing the German wiki site. By mid-June, the agents were actively trading tips on how to answer web search questions posed under time limits, sharing answers to pass the tests. A human moderator apparently noticed these posts and started deleting them, seeing them as spam, which the agents fought back against, trying to hide their posts from alphabetical sorting by beginning each with the string “ZZZ.”

“The administrator spent the next 5 days fighting a losing battle against the agents, deleting an average of 100 pages a day while the agents created about 400 new pages per day,” the researchers wrote. “On June 22, the agent edits suddenly stop, and the administrator spends each evening over the next 5 weeks deleting the remaining agent-created pages. Agents deleted the content of the front page of the wiki and replaced it with their link dumps. The moderator restored the original version. This back-and-forth happened nine times.”

Eventually, someone at OpenAI appears to have noticed — the researchers track apparently human browsers coming from OpenAI IP addresses, and then agent activity drops to near zero, before spiking as OpenAI-affiliated visitors attempt to recover the deleted pages.

While OpenAI has made vague disclosures about agents gaining unauthorized access to external communication services, it had not previously disclosed this specific incident, or said how often this type of thing has happened. While no obviously illegal activity appears to have occurred during this incident, it raises more questions about whether OpenAI can monitor and control the technology it is building, at a time when there is limited public oversight or input into frontier AI labs.

“The lack of any real federal AI governance means that frontier companies can pick and choose when they disclose incidents like this,” Representative Lori Trahan (D-MA) said. Trahan has introduced a bipartisan bill, the Frontier Act, that would require labs to disclose these incidents and host independent auditors.

AI safety researchers are concerned that the latest generation of powerful models, whose reasoning is increasingly opaque to its creators, could take actions that harm people. Astra, released yesterday by OpenAI, appears to be its most capable model yet.

The company says Astra is also the model most likely to follow human direction, but third-party researchers who were asked to evaluate it expressed concern about its alignment. The U.K.’s AI Safety Institute and Apollo Research both reported concerns that the model might be aware that it was being evaluated and potentially hide its real behavior.

“Apollo believes that, given the higher rates of eval awareness and limited evaluation window, low rates of misbehavior here do not provide substantial evidence about the model’s alignment or misalignment,” the researchers wrote in their evaluation.

Regulators will review the process and data Tesla used to self-certify the vehicle.

Tesla’s private Cybercab event has come and gone, and it was very different from the large, loud, livestreamed events the company usually puts on — an odd choice for the launch of a product CEO Elon Musk has spent years building toward.  

In fact, it doesn’t even appear that Musk spoke at the event, the keynote of which, by all accounts, only lasted around 15 minutes.

The promise of the Cybercab is massive: a fully autonomous vehicle that uses only cameras and AI to drive itself, all for much less than a Waymo. But Tesla scattered a lot of the details. Some are in PDFs the company released on Thursday, as well as in updated terms of service in its “Robotaxi” app. The rest were left for a select few die-hard fans to disseminate online.  

The company now has to prove that these vehicles are safe — to the public, to local governments, and to the National Highway Traffic Safety Administration, which has already opened an investigation into Tesla’s Cybercab rollout.  

In the meantime, here are some of the most interesting new details that caught our attention: 

No Cybercab for kiddos

One of the more interesting details in the Cybercab fine print is that Tesla does not allow minors under the age of 13 to ride in the vehicle “at this time.”  

Minors between the ages of 8 and 17 are allowed to ride in Tesla’s “Robotaxi” Model Y SUVs, and Tesla does have guidelines on how to use child seats in both vehicles. 

Curiously, the Cybercab does not have the standard LATCH anchors for child seats. Instead, they can only be attached using the seat belt. Tesla executives, including Musk, have talked a lot about how much they focus on taking out unnecessary parts to cut down on costs, though I’ll admit I wasn’t expecting the company to ditch child seat anchors — especially given Musk’s obsession with making more babies. 

All children under 18 must be accompanied by an adult in both vehicles, according to Tesla. But something is making Tesla hesitate on allowing young children in the Cybercab for now. 

What happens in a crash? 

While the goal of an autonomous vehicle is to avoid crashing, even the most capable ones on the road today do wind up in collisions. 

Here’s what happens when the Cybercab gets in a crash: The airbags will inflate, the doors will unlock, the hazard warning lights and interior lights will turn on, the high voltage battery is disabled, the windows go to the “vent” position, the Cybercab will apply the brakes to come to a stop and park, and the infotainment system will start up a two-way connection with Tesla’s rider support team. 

Unlocking the doors is notable because Tesla has come under fire for its reliance on electronic door latches, both in its home market of the United States and in its largest market, China. Just last month, Tesla agreed to recall 3 million cars in China, alongside a number of other automakers, as a result of an investigation into electronic door latches that could trap people following a crash.  

Manual door releases

Speaking of doors, another recent criticism of Tesla is that its interior manual door releases are too hard to find in an emergency. These are necessary because the electronic door latches are the main method of getting in and out of the company’s vehicles, activated either by pushing a button or using a smartphone.  

The Cybercab uses electronic door latches, which allow the doors to open automatically at the start or end of a ride. There is also a small button on the exterior of the car that riders can use to open the doors. But inside, the manual release is thankfully in a very obvious spot on the armrest of each door.  

Brake-by-wire

Tesla is using a brake-by-wire system in the Cybercab, again largely (it seems) for the purposes of cutting costs. Instead of using a hydraulic system that pumps fluid through lines to control brake pressure, Tesla has electronic actuators controlling the brake calipers.

“Having electric brakes avoids the complexity of a hydraulic system: no need to rout [sic] plumbing all around the car,” Musk wrote in a post. 

The company was already the first major automaker to use steer-by-wire on its Cybertruck, severing the physical connection between the steering wheel and the front wheels.

A little fresh air

For some reason, the windows of the Cybercab “cannot be fully opened at this time.” Tesla doesn’t explain why in the documentation it released this week.

USB-C power

According to influencer Jeremy Judkins, the USB-C outlets in the Cybercab put out 90W of power — roughly four times more than you’d typically find inside a car.  

A federal court in Delaware has ruled on a trademark fight between Elon Musk’s X and a startup trying to launch a rival social network. The startup, Operation Bluebird, originally launched under the name Twitter.now, but the court barred it from using that name, siding with X on the core “Twitter” trademark. However, the court also found that X had likely abandoned two other, related trademarks: the word “tweet” and the Twitter bird logo, making them available to use. Operation Bluebird has since rebranded its website as Tweet.app, using the freed-up “tweet” name, and launched to the public.

The story of the Virginia-based startup isn’t really about building something unique; it’s about a company trying to get its hands on abandoned trademarks that X relinquished. Even the homepage for the company clearly states its purpose is to go back and pick up what Elon Musk dropped when he renamed the town square as X, and “threw the bird away on his way out,” it says.

The effort is headed up by two lawyers, including founder Michael Peroff, based in Illinois, and Stephen Coates, previously a trademark lawyer at Twitter. Given their legal backgrounds, their assertion that they’re interested in building a new social network seems dubious. It’s more likely they want to acquire Twitter’s trademarks, which have value of their own.

Still, Tweet.app is at least going through the motions and opening up to users in early testing. The company told TechCrunch that more than 172,000 people requested a handle on the site before launch. This was likely in large part due to the affinity people still have for the brand name “Twitter” — a name the company now can’t use.

Notably, the startup is charging users $20 to reserve their handle and join the social network, which likely helps cover its legal bills.

The court’s decision on the matter is not final, we should note. U.S. District Court Judge Colm F. Connolly issued a split ruling on X’s request for a preliminary injunction that sought to stop Operation Bluebird from using a series of Twitter trademarks that the startup says X had abandoned since its rebrand.

The judge granted X’s motion for a preliminary injunction regarding eight Twitter-related marks, but denied it when it came to the Tweet mark and the Twitter bird logo.

In the judge’s opinion, he wrote that Bluebird was “likely to succeed in proving both that X Corp. discontinued the bona fide use of the Tweet mark and Bird logo and that it intends not to resume the use of the marks.”

The case will proceed to determine whether or not X ultimately still retains rights to any of the Twitter marks, given that the company now goes by X in most places.

“They kept the word. They let go of the bird, and they let go of the tweet,” wrote Coates, who is president of Operation Bluebird, in an announcement about the rebrand shared via email with TechCrunch. “A tweet was never a corporation. It’s one person saying something. That word survived three years of a company trying to replace it, because the public declined to stop using it. We think that tells you who it belongs to,” he said.

Sonance has spent decades perfecting the art of making loudspeakers disappear into walls and ceilings. At CEDIA Expo 2026, James by Sonance is doing something almost impolite: putting them back on the wall and making sure you notice the woodwork.

The new James by Sonance Natural Collection combines thin on-wall loudspeakers with handcrafted wood finishes, woven fabrics and dimensions designed to visually align with Samsung’s 2026 The Frame and The Frame Pro televisions.

Rather than hiding behind drywall or adding another black plastic soundbar beneath an expensive display, James treats the loudspeaker as part of the room.

Leon Speakers has pursued a similar idea for years with custom-width soundbars and television framing systems, while Canvas HiFi integrates amplification, DSP and loudspeakers into a complete active TV audio solution. James takes a more traditional custom-install approach, giving integrators passive loudspeakers that can be incorporated into larger systems without looking like an afterthought.

For homeowners who have already spent considerable time selecting the right wood, stone, lighting and fabric for a room, that makes a lot of sense.

The 19 black boxes in the equipment rack can stay hidden.

What Is the James Natural Collection?

The Natural Collection consists of two primary loudspeaker platforms, the NC3 and NC5QT, plus the matching NC10-SUB subwoofer.

Both speaker families are just 2 inches deep and are available in horizontal and vertical configurations. James offers models dimensionally aligned with Samsung’s 2026 The Frame and The Frame Pro televisions in 55, 65, 75 and 85-inch sizes.

The HTL, or Horizontal Thin-Line, versions can be configured as a single channel, stereo L/R system or three-channel L/C/R speaker. VTL, or Vertical Thin-Line, models operate as individual channels and can flank the display for greater left/right separation.

James also offers non-TV-specific versions starting at 19.75 inches for the NC3 and 23.25 inches for the NC5QT.

The important point is flexibility. This isn’t simply a soundbar built for Samsung televisions; the same speaker architecture can be adapted to different displays, room layouts and multichannel systems.

NC3: The Slimmer Option

The NC3 is the smaller of the two platforms and uses a 3.5-inch shallow-depth Thin-Line waveguide driver paired with an aluminum tweeter.

Sonance has not yet published complete electrical specifications for the Natural Collection, including frequency response, sensitivity, nominal impedance or recommended amplifier power. We are therefore not going to borrow numbers from existing James SPL3 products simply because the driver dimensions look similar.

Same company does not mean same loudspeaker.

NC3 is clearly intended for installations where visual discretion matters most, particularly smaller rooms or displays where the larger NC5QT would dominate the wall.

NC5QT: Quadratech Steps Up the Performance

The NC5QT moves to a larger 5.25-inch driver and adds James’ Quadratech tweeter technology, positioning it as the higher-performance option for larger rooms and systems that require greater output.

James’ existing Quadratech designs use multiple tweeter elements and controlled dispersion to create broader, more consistent coverage. Current QX models, for example, use four dome tweeters rather than a conventional single tweeter, although Sonance has not disclosed enough technical information about the Natural Collection implementation for us to assume the architecture is identical.

That distinction is important. NC5QT may look like a lifestyle product, but James has decades of experience squeezing substantial loudspeaker systems into architecturally difficult spaces.

We’ll need the final frequency response, sensitivity, impedance and power-handling specifications before judging just how ambitious NC5QT really is.

NC10-SUB: Bass Without the Black Cube

The matching NC10-SUB uses a 10-inch woofer and follows the same design language as the loudspeakers.

More interestingly, Sonance is not assuming everyone wants another large black cube parked beside the credenza. The NC10-SUB can be wall-mounted, installed on a pedestal or positioned horizontally beneath furniture, giving integrators more options for placing bass in rooms where conventional subwoofers can become a visual problem.

The subwoofer is offered in the same five cabinet finishes as the speakers.

Sonance has not yet published complete specifications for the NC10-SUB, including frequency response, amplifier requirements or maximum output. Until those numbers appear, the fact that it has a 10-inch driver tells us considerably less than some marketing departments would prefer.

Physics remains annoyingly unwilling to read press releases.

The Materials Are the Point

Modern Brown and Modern Teak use genuine wood veneer, while Modern White, Modern Black and Sand Golduse painted wood. The products are handcrafted at the James facility in Minden, Nevada, where the company handles machining, carpentry, fabrication, finishing and testing.

There are also nine woven fabric grille options, allowing the speakers to coordinate with furnishings rather than merely match the television.

For designers who still cannot find the right material, James offers a Designer Fabric Frame that allows third-party fabric to be applied on-site. If the interior designer has already selected upholstery that costs more per yard than your first stereo system, the speakers can join the party.

The design strategy also aligns with Samsung’s television finishes. Samsung offers Modern White, Modern Teak and Modern Brown bezel options for The Frame, giving installers obvious starting points for a coordinated installation.

Why Is This Different?

The Natural Collection is not unique because James discovered wood veneers or figured out how to build a speaker beside a television.

Its advantage is system flexibility.

A designer can specify a single horizontal speaker, stereo configuration, full L/C/R array, separate vertical channels and a visually coordinated subwoofer while retaining the same materials throughout the room. Because the speakers are passive, the installer also remains free to choose amplification, processing and system architecture.

That separates James from most lifestyle soundbars and active TV audio systems, where the electronics, channel configuration and upgrade path are largely predetermined.

In other words, the Natural Collection isn’t trying to make traditional installed audio obsolete.

It’s trying to make it look considerably better.

Three Main Competitors

Leon Speakers FrameBar

Leon Speakers is the obvious competitor and arguably the company James has to worry about most.

Leon has been building custom-width loudspeakers around televisions for years, and its current FrameBar family can be manufactured to match the exact width and finish of Samsung The Frame televisions. The FrameBar Minima starts at $2,300 and uses 2.5-inch woofers with cloth-dome tweeters, while larger FrameBar models use 4-inch woofers and 1-inch tweeters.

More importantly, Leon recently introduced the $5,750-and-up FrameBar Ultima, which moves into considerably more ambitious territory with 5-inch woven polypropylene woofers and 1-inch cloth-dome tweeters. Leon also offers its own television framing systems, designer fabrics and matching installation hardware.

Leon therefore has a more mature ecosystem surrounding the television itself.

James counters with a broader range of passive speaker configurations and a matching subwoofer, giving an integrator more freedom to build a traditional multichannel system while maintaining the same visual language throughout the room.

The competition between these two should become rather interesting because they are solving almost exactly the same interior-design problem from slightly different directions.

Canvas HiFi

Canvas HiFi competes for the same design-conscious customer, but with an active, all-in-one approach rather than passive loudspeakers.

The original CANVAS is designed for TVs from 55 to 85 inches and combines amplification, DSP, room correction, streaming and loudspeakers in one system. Interchangeable fronts and a universal mounting system allow it to visually integrate with Samsung, Sony, LG and other televisions.

The pending release of CANVAS L in late-2026 scales that concept up for 65 to 115-inch TVs, adding larger drivers, more powerful amplification and BACCH 3D+ spatial processing for substantially greater output.

Samsung integration is particularly relevant here. Canvas offers The HiFi Frame, which visually combines compatible Samsung TVs with the speaker system inside a single exterior frame. CANVAS L will also offer a Samsung-specific HiFi Frame option for larger displays.

We have heard both Canvas systems and came away impressed. But the philosophy is different: Canvas wants to replace much of the traditional audio system, while James preserves the flexibility of separate amplification, processing and channel placement.

For buyers who want the TV and audio system to look like one object, Canvas is the more integrated solution. James offers greater system flexibility.

Theory Audio Design sb Series

Theory Audio Design is the performance-first alternative.

Its sb65 and sb75 passive soundbars are dimensioned around corresponding 65- and 75-inch televisions and are built as genuine three-channel loudspeaker systems rather than conventional consumer soundbars.

The sb75, for example, contains six 5-inch carbon-fiber woofers and three 1.4-inch AdvancedPoly compression drivers divided across three separate ported enclosures. Theory specifies up to 117dB output per channel and more than 124dB with all three channels driven, although the speaker requires three channels of a Theory amplified loudspeaker controller with the correct DSP processing.

That is formidable hardware.

The catch, from the Natural Collection perspective, is aesthetics. Theory’s aluminum soundbars are unapologetically loudspeakers and are offered in black. James is making a much larger play for the designer who wants wood, fabric and dimensional integration to matter as much as output.

If performance is the only criterion, Theory deserves serious consideration.

If someone has already spent 45 minutes deciding between Modern Teak and Modern Brown, we probably know which meeting we are in.

James Natural Collection Models

The Bottom Line

The James Natural Collection fills a genuine gap between architectural audio and premium soundbars.

Leon remains the most established rival for custom television-matched loudspeakers, while Canvas HiFi offers a compelling all-in-one alternative for buyers who do not want conventional amplification or processing. Theory Audio Design attacks the same wall space with considerably more emphasis on maximum output.

James offers something different: the flexibility of a traditional passive loudspeaker system without forcing the room to look like one.

The unanswered questions are performance and price. Sonance still needs to publish complete electrical specifications, and we don’t yet know what the various sizes, configurations and finishes will cost.

But the underlying idea is sound.

If someone has already spent five figures designing a room around a television, telling them their audio choices are either holes in the drywall or a long black rectangle underneath the screen feels increasingly unimaginative.

James now has another option.

Price & Availability

James by Sonance has not announced public U.S. consumer pricing for the Natural Collection.

Authorized Sonance dealers in the Americas can begin placing preorders now, with the collection introduced at CEDIA Expo 2026. Sonance says the broader global launch is scheduled for Q1 2027.

Given the number of available lengths, channel configurations, finishes and grille options, dealer-based pricing is hardly surprising. These are custom-install loudspeakers rather than mass-market soundbars sitting next to the HDMI cables at Best Buy.

For more information: sonance.com

Related Reading: