Good morning! Let’s play Connections, the NYT’s clever word game that challenges you to group answers in various categories. It can be tough, so read on if you need Connections hints.

What should you do once you’ve finished? Why, play some more word games of course. I’ve also got daily Strands hints and answers and Quordle hints and answers articles if you need help for those too, while Marc’s Wordle today page covers the original viral word game.

If you’ve pre-ordered a Samsung foldable purely for the free storage bump, tomorrow’s Unpacked event might sting a little.

For years, pre-ordering a new Galaxy meant automatically getting double the storage at no additional charge. Buy the 128GB model, walk away with 256GB for the same price. The same applied to the 256GB and 512GB models. However, that might change at the upcoming Galaxy Unpacked event. 

So what exactly is Samsung ending here?

In a newsletter email sent by Samsung Austria, the company has confirmed it’s no longer offering the free storage bump customers are used to getting when they pre-order a Galaxy flagship. 

In other words, those pre-ordering the Galaxy Z Fold 8 Ultra, Galaxy Z Fold 8, and Galaxy Z Flip 8 won’t get a free storage upgrade in return for showing interest in the new smartphones and getting their units reserved ahead of the general sales. 

This isn’t a surprise exactly; an industry insider called this months ago, but seeing it in writing still feels like the end of an era.

What do you get instead, and is it still worth it?

Rather than free storage, Samsung Austria is going down the discounted upgrade path. Choosing the 512GB model during pre-order gets you a €100 deduction, while jumping to 1TB knocks €200 off. 

Based on leaked European pricing, that works out to roughly half of what the storage upgrade will cost once the pre-order window closes. So it’s not nothing, but it’s a real step down from getting double the space for free. 

Samsung hasn’t confirmed whether this exact structure applies outside Austria. However, given how much worse the global memory crisis is, and how companies have been passing on the additional cost to consumers (even Apple), I can’t say with absolute certainty that Samsung US won’t follow the same approach. 

What could Samsung do in the US?

Samsung has two ways to deal with this. First, it can absorb the rising bill of materials by reducing its effective margin on the products and retain the free storage-upgrade offer for its buyers in the US. However, it could meet the customers in the middle and offer them discounts on higher storage tiers.

Until official US pre-order terms are announced, these two paths reflect the balancing act between protecting margins and preserving buyer incentives.

from the put-on-the-hotdog-costume dept

You may recall that at the end of last year and very beginning of this year there was a big story over Elon Musk’s LLM tool Grok being willing to produce non-consensual images of people (including children) in bikinis or otherwise stripped down in objectifying ways. Elon played into and promoted this “trend” at one point by asking Grok to modify an image someone had already asked Grok for putting a bikini on the famous Ben Affleck smoking meme, asking it to replace Affleck’s head with Musk’s own. Grok complied and while the resulting image has since been removed, Musk responded “perfect.”

While some will argue this is more acceptable, as it was Musk doing it to himself, it still generated a ton of extra attention to the idea that Grok would gladly, publicly, undress just about anyone and put them in a bikini. To Musk, apparently, it all seemed like good fun.

As more and more of the media pointed out that this was being done to children, in some cases potentially creating illegal child sexual abuse material, Musk eventually came out with a statement claiming that anyone using Grok that way will “suffer consequences.”

In the interim, a number of people have been arrested for using Grok to produce CSAM, in some cases based on X’s reports to NCMEC. Of course, the company is also being sued by a bunch of people, claiming that it should be liable for the non-consensual imagery that it created. Some of the details of the lawsuit linked above are particularly horrifying:

Jane Doe 4, a female from Wyoming, said her stepfather uploaded a photo of her when she was 11 and lying on a couch to his phone. Using Grok, the stepfather created more than 7,000 CSAM-related images of her. He also shared and traded the images with others on social media platforms.

The lawsuit alleges that the stepfather opted for Grok “because the platform was less restrictive than other AI models and responded to his prompts to generate sexually explicit material using an image depicting a prepubescent minor.”

It also claims that in February, xAI did generate a tip to the National Center for Missing and Exploited Children regarding the images, but the company only submitted the original, authentic image as evidence. According to the suit, xAI did not respond when law enforcement requested the thousands of Grok-generated images based on the photo and IP address information that would have quickly helped identify her stepfather as the perpetrator.

Advertisement

Perhaps recognizing that this story is getting worse, xAI (the parent company of X since it acquired the social network in yet another deal of Elon “selling” one of his companies to another of his companies) has now directly sued one of its own users, Terry Harwood, for creating CSAM with Grok, arguing that the indemnification clause in the terms of service means that the court should order Harwood to pay for xAI facing lawsuits from Harwood’s victims.

The lawsuit, filed in Musk’s favorite federal court — the Wichita Falls Division of the Northern District of Texas — was immediately assigned to Musk’s favorite judge, Reed O’Connor. It sure seems like the company is trying to get out ahead of this story before it gets even worse — by suing one of its own users for doing, in a horrific and illegal way, exactly the kind of thing Musk himself had promoted.

The filing, of course, tries to play up the claim that X is a good actor in this space, taking its responsibility seriously:

There are bad people in the world and not all users have good intentions, so Plaintiff draws a bright line on permissible usage: the tool may be open and truth-seeking but is not a safe harbor for illegal, harmful, or abusive conduct. Plaintiff takes violations of this rule extremely seriously. It enforces its rules against violators through account suspensions, account terminations, and by reporting suspected child sexual abuse material to the National Center for Missing & Exploited Children (“NCMEC”). Indeed, Plaintiff has suspended 52,222 accounts and made 73,604 reports to NCMEC in 2026, resulting in (at least) 244 arrests.

In addition and when necessary, Plaintiff will pursue civil accountability against bad actors who abuse its tool to harm others.

Advertisement

Plaintiff strictly prohibits any use of Grok in connection with illegal, harmful, or abusive activities. These prohibitions are set forth in plain language in the xAI Terms of Service and the xAI Acceptable Use Policy. Among the expressly forbidden activities are:

• “Using [Grok] in a way that infringes, misappropriates or violates a person’s privacy or their right to publicity”;
• “Undressing or nudifying real persons, or otherwise altering a real person’s image or likeness to depict them in an intimate or sexual context”;
• “Depicting likenesses of persons in a pornographic manner”; and
• “Sexualizing or exploiting children.”

Which all sounds well and good if you simply ignore the whole “yeah, but your CEO kinda laughed about and promoted this use of the tool” part.

Also, it’s quite a move to sue a user for using a tool that you offer in a manner that you enabled the tool to work. I’ve long argued that users themselves are the ones who should be liable for any violative actions they make rather than the platform but I don’t recall ever seeing a platform actually sue one of its own users for using their own tools. It really feels like them looking at all the lawsuits coming their direction for Grok’s usage and… pulling the whole “we’re all looking for the guy who did this” hotdog costume meme in the form of a lawsuit.

I have no idea if it’ll work, but suing your own users for the very thing that other people are suing you over is quite a statement. Yes, in this case it involves potentially criminal behavior (the guy was arrested after all), but are Musk and X suggesting that if you violate any part of their terms of service, Musk can take you to court in front of his favorite judge? Because it sure seems to suggest that. Much of the argument is based on laying out X’s Terms of Service and Acceptable Use Policy and detailing why this guy violated them. This kind of argument does not at all appear to be limited to law-breaking activity:

Defendant breached the xAI Terms of Service and Acceptable Use Policy by leveraging Grok to generate non-consensual sexually explicit images and CSAM.

Among Defendant’s various other breaches described herein:

Advertisement

a) Defendant manipulated Grok to create sexually explicit images of others without their consent, in contravention of the xAI Terms of Service, which prohibit, among other conduct, using Grok to aid in violating a person’s privacy or their right to publicity.

b) Defendant manipulated Grok to create CSAM, in contravention of the xAI Terms of Service, which prohibit, among other conduct, the sexualization or exploitation of children.

Plaintiff has been damaged by Defendant’s breaches of the xAI Terms of Service.

The lawsuit leans heavily on the indemnification clause in their terms of service to argue that they want the court to order Harwood to cover any legal expenses that might stem from potential lawsuits from the people Harwood victimized with his CSAM.

The xAI Terms of Service contain a clear and conspicuous indemnification provision that states: “You agree to indemnify, defend, and hold harmless xAI, its affiliates, officers, directors, employees, and agents from and against any and all claims, demands, losses, damages, liabilities, costs, and expenses (including reasonable attorneys’ fees and court costs) arising out of or in any way related to (a) your access to or use of the Services, (b) your User Content or Outputs, (c) your violation of these Terms or any applicable law or regulation, or (d) any third-party claim resulting therefrom, including but not limited to claims of privacy violation, right-of-publicity infringement, or harm caused by content you generate or distribute using the Services.”

Defendant’s conduct directly triggered this indemnity obligation. As detailed above, Defendant knowingly and intentionally used Grok to circumvent safeguards, alter nonconsensual images, and generate and distribute CSAM and NCII.

Advertisement

There is no indication as far as I can tell that Harwood’s victim(s) have taken legal action against xAI at this point, so it’s a little unclear what they’re hoping to get out of the indemnification here other than to present themselves as taking a (somewhat late) stance against this kind of illegal usage of a tool that they failed to properly lock down while wink-winking at how they expected people to use the tool.

Harwood, assuming the allegations and criminal charges hold up, did something genuinely monstrous, and his victims deserve real justice. But it does feel very wrong that the same company whose CEO demonstrated this use of Grok on himself for laughs, and whose product made this kind of abuse trivially easy to produce at scale, is now standing in front of Musk’s favorite judge asking to make one user personally responsible for some of the fallout — while the “we built and promoted the machine” part stays out of the complaint entirely.

And, honestly, given how much Musk has promoted X as “the anything app” where you can do and say anything, it does seem notable that he’s now suing a user for… doing exactly that.

Filed Under: csam, elon musk, grok, indemnification, liability, terry harwood

Companies: x, xai

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc’s Wordle today column covers the original viral word game.

OpenAI disclosed on Tuesday that it lost control of two AI models during a security test that ended in a breach of the open AI research platform Hugging Face.

Describing the incident as “unprecedented,” OpenAI said its AI models broke out of a sealed testing environment last week and hacked into Hugging Face’s production system to steal the answers to a test they were being graded on. The models—the publicly available GPT-5.6 Sol and an unreleased, reportedly more capable one—were being evaluated on their offensive hacking skills with the safeguards that normally block high-risk cyber activity switched off.

“The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database,” OpenAI and Hugging Face wrote in a joint blog post disclosing the intrusion.

According to OpenAI and Hugging Face, the models escaped through a package registry cache proxy—software that allows developers to install outside code without connecting to the internet. The proxy was the only component in OpenAI’s isolated testing environment permitted to reach the outside world; in normal use that reach extends only to public code repositories.

Rather than stay contained in the sandbox, the models ​​“exploited a zero-day vulnerability” to gain access to the open internet as they “hyperfocused” on finding a solution for the AI cybersecurity benchmark known as ExploitGym. Such experiments involve prompting that pressures the models to find solutions, essentially egging them on.

“After gaining internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym,” OpenAI wrote. “Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day.”

The flaw the models exploited was previously unknown, but flaws in this kind of software are not unusual. Companies have been patching serious vulnerabilities in artifact repositories for a decade. A bug disclosed in 2024 let anyone who could reach the server ask for a file by URL and get it—configurations files, passwords, access tokens—without logging in. Others have let attackers take control of the server itself.

Researchers point out that while AI advances have created new and sometimes unexpected challenges, the task of extensively and rigorously isolating infrastructure from the open internet is well explored.

“This is not an AI problem. It’s negligence on a 40-year-old standard—and it’s basically every sci-fi film ever,” says longtime security and compliance consultant Davi Ottenheimer. “‘Highly isolated’ and ‘escaped through the one hole we left open’ cannot both be true.”

In recent months, top AI companies have been raising concerns about the expanding cybersecurity capabilities of upcoming frontier models as the platforms increase in both expertise, creativity, and agentic, autonomous operation. But researchers emphasize that this is all the more reason that fundamentals should still apply.

“This should not have happened,” says veteran security engineer and researcher Niels Provos. “I wish the frontier labs spent as much time on teaching their models to write secure infrastructure as they are spending on them exploiting vulnerabilities.”

Making these available for download indefinitely and without restriction is something we consider a risk to our customers, particularly in business environments. There’s also the technical and organizational overhead of maintaining and supporting old versions and their associated keys indefinitely.

Although TreeSize says this is a long-standing policy, the backlash highlights the disconnect between what many people expect when buying a perpetual license and what they get when a software vendor shifts its business model toward subscriptions.

“To make sure customers aren’t caught off guard, we proactively notify them by email, well before their maintenance ends, to back up their installation file and license key themselves. This is meant to ensure no one loses access to software they’ve already purchased,” Christ said.

Should this be a subscription?

There’s also the question of whether it makes sense to subscribe to a disk space analyzer, especially when there are free alternatives like WinDirStat.

Christ admitted that the change has been “frustrating for some customers.” When asked about online requests for refunds, Christ said, “since our customers do receive what was agreed, namely indefinite use of the software version they purchased, we don’t consider a refund to be warranted…”

A free version of TreeSize exists, but it lacks some features, including the ability to search for duplicate files, deduplicate redundant files, and compare disk space usage over time. It is not for business use.

TreeSize’s evolution illustrates the growing subscription economy, particularly the software industry’s fixation on recurring revenue. Over the past decade, software vendors have increasingly shifted to subscriptions in pursuit of more predictable revenue streams.

In TreeSize’s case, JAM Software wanted to “continue offering our customers a relevant, well-maintained product over the long term,” Christ said.

“The broader economic environment is more challenging today than it was a few years ago, and we feel that too as a software vendor,” he added. “To continue meeting our own standards and our responsibility to business customers who rely on high-quality software, we are placing greater emphasis on predictability in development and support. A subscription model gives us that predictability in a way one-time purchases do not.”

In what looks to be a radical departure from its existing lineup, Range Rover has confirmed an entirely new fifth vehicle: the Range Rover GT, an all-electric grand tourer built on the company’s Electrified Modular Architecture (EMA), the same platform that will underpin other midsized cars for the brand.

Range Rover has only shared camouflaged prototype pictures for now, as the GT is supposedly still undergoing final testing, ahead of a full launch expected later this year. That means details on this completely new model are scant to say the least: no price, no range, and no power figures have been disclosed. As for a release date, Range Rover confirmed the GT hits the road in 2027.

What is evident from the camo images is the GT’s sleek silhouette and coupé proportions, more typically associated with Range Rover’s sister brand, Jaguar, than with the marque known for its commitment to SUVs. Both companies sit below the parent company, JLR (formerly spelled out as Jaguar Land Rover).

The clean Range Rover GT interior shows a small driver’s display and larger central screen, but the company has shunned the auto industry’s return to physical switchgear.

Advertisement

Courtesy of JLR

In a statement, Martin Limpert, global managing director at Range Rover, says the Range Rover GT is intended to “redefine the grand-touring segment” with its “GT poise, proportions and long-distance refinement,” adding that the EV will offer “capabilities no conventional GT can match.”

The inclusion of the word “conventional” is doing some heavy lifting. Range Rover will likely take pains in the coming months explaining how this new all-electric grand tourer isn’t a direct competitor to Jaguar’s new all-electric grand tourer, the hugely anticipated and polarizing Type 01, intended to signify a complete reset for Jaguar, also arriving in 2027.

“We have spent the last few years working obsessively on the fundamentals of the GT formula, reinterpreted in a sophisticated, uniquely Range Rover way,” says Limpert, adding that this GT, like its SUV stablemates, will apparently still be able to off-road. “The result is the most car-like Range Rover ever created. Its blend of effortless EV performance, first-class long-haul refinement, and all-terrain capability is pure Range Rover, while its interior previews our vision of a modern grand tourer.”

The GT’s rear has plenty of legroom, a central screen for passengers, and a panoramic roof that tapers down to maintain a grand-tourer outline.

Advertisement

Courtesy of JLR