The viral fervor we saw earlier this year around OpenClaw, the open source AI harness that turns powerful language models into autonomous workers the user can message via their favorite channels (Telegram, iMessage, WhatsApp, Discord etc), has cooled off substantially from its peak in March 2026.

But over the weekend, OpenClaw’s creator Peter Steinberger and current team of co-developers gave the world — especially enterprises — a reason to look at it again, announcing OpenClaw 2.0, billed as the most significant update to the harness and surrounding platform yet.

OpenClaw 2.0 seeks to transform what began largely as a personal agent harness into something increasingly designed for teams, shared infrastructure and enterprise workflows.

OpenClaw 2.0 introduces a rebuilt browser interface that brings conversations, files, approvals, configuration and live agent activity into a common workspace. It adds shared cloud sessions and multi-user collaboration. And it expands the security model with stronger sandboxing, role-based permissions, approval controls, secrets handling and auditing.

Together, those additions move OpenClaw closer to being infrastructure that an organization could deploy for employees rather than simply a powerful agent an individual developer runs locally.

They also sharpen a competitive question surrounding the project: whether OpenClaw has addressed the security and isolation concerns that helped inspire newer alternatives such as NanoClaw.

The answer is increasingly yes at the capability level — but not necessarily by default.

OpenClaw wants to become the shared agent layer

Released under the official name of v2026.8.1, the update spans installation, messaging, memory, skills, models, automations, browser and native applications, plugins and security.

Steinberger described the development of OpenClaw 2.0 as an exercise in using the product to build itself.

“Two months ago, we started the mission to ‘build OpenClaw with OpenClaw,’” Steinberger wrote on X early on August 31.

Over that period, he said, OpenClaw gradually moved its team away from individual local coding harnesses and toward team.openclaw.ai, a shared agent environment aware of what team members are working on.

“Multiplayer coding + infinite compute with nodes and cloud sessions has been a game changer for how we build,” Steinberger wrote, adding that local harnesses now “feel like relics of the past.”

That claim points toward one of the more important changes in OpenClaw’s enterprise proposition.

The dominant model for AI coding agents has generally been individual: a developer runs an agent in a terminal, IDE or desktop application, gives it access to a repository and lets it execute work within that environment.

OpenClaw 2.0 is pushing toward something different. Agent sessions can become persistent workspaces that outlive a single terminal or employee. They can be shared with colleagues, executed across other machines or cloud workers, and supervised through a browser.

For enterprises, that potentially turns the agent from an employee-level productivity application into a shared operational layer.

A new UI could broaden OpenClaw beyond developers

The redesigned Control UI is central to that strategy.

OpenClaw has shifted away from an Overview-first web application and made conversations the primary interface. Threads sit in a sidebar, while the active conversation occupies the main workspace. Files, approvals, settings and ongoing agent activity remain accessible around it.

The design deliberately brings OpenClaw closer to the interaction model employees already know from OpenAI’s ChatGPT, Anthropic’s Claude, Google’s Gemini and other conversational AI products.

That lowers an important barrier to enterprise adoption. Open-source agent frameworks are often powerful precisely because they expose low-level configuration, terminals, tools and runtime controls. Those same characteristics can make them difficult to deploy beyond engineering organizations.

OpenClaw 2.0 attempts to preserve the underlying control while putting a conversational interface on top of it. An employee can ask an agent to perform work without treating the terminal as the primary product interface. But OpenClaw does not hide what is happening underneath. The Control UI can surface session files, terminal activity, Git-backed changes, pull-request state, browser activity and interactive dashboards.

The release also places more emphasis on observability during agent execution. Tool calls and results are paired more clearly, file changes can appear as focused diffs, command activity is easier to inspect, and long-running background tasks can remain visible alongside the conversation. That combination matters for enterprise use.

Employees get a simpler interface for delegating work. Technical users retain access to the artifacts and execution state behind the conversation. Administrators gain a centralized place to configure and supervise the system.

The redesigned Settings workspace now encompasses agents, memory, plugins, MCP servers, devices, communication channels and device pairing. OpenClaw also consolidates model-provider administration, including credential status and, where providers expose it, model availability, quota, account balance, budget and spending information.

Limited-access browser users can request administrator privileges rather than automatically receiving them, with another administrator required to approve the escalation.

These are not especially flashy agent features. For companies deploying AI systems to dozens or hundreds of employees, they may be among the most important additions in the release.

Multiplayer sessions turn agent context into shared context

OpenClaw 2.0 also expands the agent from a personal workspace into a collaborative one.

Shared cloud sessions allow another employee to enter work already in progress without discarding the context accumulated by the agent.

Multi-user Gateways — the service that connects users and agents to tools, files, credentials and other resources — can track who created a conversation and which prompts were submitted by identified participants.

Owners and administrators can determine whether another user can read a session, suggest changes, work in draft mode or participate directly.

The interface adds session ownership, participant attribution, presence and even typing indicators. For coding teams, that introduces a workflow closer to collaborative software development than traditional AI chat.

A developer could initiate a task and allow an agent to work on it remotely. Another engineer could inspect the resulting changes. A senior engineer or administrator could approve an operation requiring additional privileges. The work does not have to remain attached to the laptop or terminal where it started.

Sessions can also move execution to paired devices or cloud workers while maintaining the broader workspace.

For enterprises experimenting with long-running agents, that is significant. Persistent agents need mechanisms for shift changes, escalation, supervision and ownership transfer. Otherwise, organizations simply create fleets of personal agents whose state disappears into individual user environments.

OpenClaw is attempting to turn that state into collaborative infrastructure. Already, some teams outside the developers of the open source project are adopting it.

Colin Johnson, CEO of marketing metrics software firm Solvely, described a similar shift in his own development workflow in a post on X.

His team had already been using OpenClaw agents through Discord, where developers could assign tasks, run commands and interact with their development environment. But he said that model still felt like “messaging a bot”: developers could share access to an agent without actually sharing the agent’s working context.

The new multiplayer WebUI changed that, he wrote, because two developers could open the same live session, see the same history and artifacts, and add information without first exporting or reconstructing what the agent had already done. “We were working inside the same context,” Colin wrote.

In one example, another developer was taking over a project he had been working on; instead of preparing a traditional handoff document, Colin joined the developer’s existing agent thread and added the missing project context directly. “The session itself became the handoff document,” he wrote.

For enterprise teams, that is a useful illustration of why persistent multiplayer sessions may matter beyond convenience: agent context can become a shared work artifact rather than information trapped inside one employee’s private conversation.

Colin’s deployment also illustrates both the enterprise potential and the remaining security boundary. His team runs its OpenClaw Gateway on a development server reachable through GitHub authentication, Cloudflare Access and a Cloudflare Tunnel, with the Gateway itself listening only on the server’s loopback interface rather than an exposed public port.

But he explicitly cautioned that this does not make the shared Gateway a multitenant environment. The developers already trust one another with the repositories, tools and agent capabilities behind it. As he put it, Cloudflare controls who can enter the workspace, while OpenClaw tracks who created, owns or contributed to the work; stronger separation still requires separate infrastructure.

Security becomes much more enterprise-oriented

That shift creates a corresponding security problem: a shared agent can potentially act with broader organizational authority than one running on a developer laptop.

OpenClaw 2.0 responds with considerably more granular controls.

Approvals can now be tied to a specific request, command, session and person. Command permissions can be constrained to specific arguments and working directories. For script-backed execution, OpenClaw can verify that the script being executed still matches what was originally reviewed.

Sessions can operate under different permission levels, including read-only, guarded, workspace and full-access modes, with the highest level restricted to administrators.

Organizations can also define operator roles that require sandboxed execution for sessions created by specific identities. OpenClaw says those requirements cannot be bypassed using elevated execution or host overrides; if the required sandbox cannot be provisioned, execution fails rather than silently falling back to the host.

Credentials receive additional protection.

OpenClaw’s team-scoped Secret Store distinguishes protected secrets from ordinary environment data available to the agent. For supported requests, a protected credential can be substituted into a Gateway-hosted HTTPS request without exposing that credential directly to the model.

OpenClaw can also reference external systems including 1Password and Vault.

Auditing has expanded around execution identity, approvals, session actions and outbound messages. Plugin installation can trigger capability reviews associated with the specific artifact being installed.

Those controls address questions enterprises inevitably face when deploying agents: Who initiated an action? Which agent performed it? What resources could it access? Who approved the operation? And what happens to those permissions when work moves between people or machines?

NanoClaw still takes a different approach to security

OpenClaw’s changes also make the comparison with open source, enterprise-friendly rival NanoClaw more nuanced.

NanoClaw is one of several subsequent projects to emerge around the idea that AI agents need stronger isolation and simpler security boundaries. Its architecture places operating-system-level containment at the center of the design.

NanoClaw runs agents inside Docker containers, limits those containers to explicitly mounted filesystems and runs their processes as an unprivileged user. Sessions and agent groups can remain isolated rather than automatically sharing files and conversation history.

Its credential architecture follows the same principle. Supported outbound requests can pass through OneCLI’s Agent Vault, allowing credentials to be injected by a gateway rather than placed inside the agent container itself. NanoClaw also provides an optional egress-lockdown mode that puts agents on an internal Docker network and routes supported external traffic through the gateway.

OpenClaw 2.0 can now reproduce many elements of that hardened model. It supports Docker and Podman sandboxes, per-agent and per-session sandbox scopes, configurable read-only or read-write workspace access, role-enforced sandboxing, remote execution nodes and disposable cloud workers.

The key difference is the starting posture. OpenClaw’s documentation explicitly says sandboxing and execution approvals are off by default. Its baseline configuration assumes a trusted single operator and permits host execution unless administrators configure stronger restrictions. NanoClaw makes isolation more fundamental to how agent execution is structured.

So does OpenClaw 2.0 have security parity with NanoClaw?

In terms of available controls, it is much closer than before. In terms of defaults and architectural philosophy, no. An enterprise can configure OpenClaw into a substantially hardened environment, but it has to make that decision deliberately.

One Gateway is still one trust domain

Another limitation is particularly important for larger organizations. OpenClaw says a Gateway should be treated as a single trust domain.

Its new multi-user permissions are designed to govern collaboration among trusted users. They should not be treated as hard isolation between mutually untrusted tenants.

For organizations requiring stronger separation — between business units, customers or other security domains, for example — OpenClaw recommends separate Gateway instances, described as “cells,” with separate state, credentials and workspaces.

Fleet tooling for managing those cells remains experimental.

That distinction could matter significantly for enterprises considering OpenClaw as a centrally operated service.

Role-based access inside one Gateway may be sufficient for a trusted engineering department or internal team. It is a different proposition from a multi-tenant platform intended to isolate customers or users who should be assumed hostile to one another.

NanoClaw has its own configuration requirements and limitations, and even its stronger outbound-network lockdown remains optional. But its smaller architecture and container-centric execution model may appeal to organizations that want a narrower security boundary that is easier to reason about.

OpenClaw is optimizing for a broader problem.

OpenClaw’s biggest advantage may be the control plane

The tradeoff is product breadth.

NanoClaw emphasizes a relatively small codebase, container isolation and customization through code and skills. Its second-generation architecture supports owner, administrator and member roles, and a separate monitoring dashboard can provide visibility into deployments.

OpenClaw 2.0 is trying to build a much broader operational environment.

Its Control UI combines employee interaction, live execution, files, approvals, terminals, code review, model-provider configuration, devices and shared sessions.

That gives OpenClaw a potential advantage for enterprises that need not only secure agent execution but a usable control plane around it.

Security teams care about isolation. Platform teams also need deployment, authentication, model configuration, auditing and policy enforcement. Employees need an interface they can actually use. Managers need a way to understand what is running. Developers need access to the underlying files and tools when something goes wrong.

OpenClaw 2.0 increasingly tries to serve all of those constituencies through one system.

What is OpenAI’s role?

OpenClaw says 933 contributors, including 569 first-time contributors, participated in the release, which includes more than 16,000 pull requests — roughly half of all pull requests ever merged into the project.

Interestingly, the release was not shared by Steinberger’s employer, OpenAI. Recall that the Austrian developer announced on Feb. 14, 2026 that he was joining OpenAI to work on bringing agents to a broader audience, a move OpenAI CEO Sam Altman publicly confirmed the following day.

But OpenClaw was not folded into OpenAI. Steinberger said at the time that OpenClaw would move to a foundation and “stay open and independent,” while OpenAI would support the project. OpenClaw now says it is stewarded by the OpenClaw Foundation, an independent 501(c)(3), with OpenAI listed alongside Microsoft, GitHub, NVIDIA, Atlassian, Tencent and other organizations as partners.

Based on the available public information, OpenClaw 2.0 should therefore be understood as an OpenClaw Foundation release, not an OpenAI product or OpenAI software release, despite Steinberger’s employment at OpenAI and OpenAI’s financial and organizational support for the project.

Enterprise readiness now depends on configuration

OpenClaw 2.0 does not eliminate the security risks associated with autonomous agents, and its own documentation identifies limitations.

Secret Store values, for example, are not themselves encrypted at rest and rely on filesystem protections. Protected credential substitution does not cover every possible execution path, including some raw sockets, containers, remote nodes and provider-native harnessesIts multi-user permissions are collaboration controls, not hostile-tenant isolation.

Those caveats should prevent enterprises from interpreting OpenClaw 2.0 as secure-by-default agent infrastructure.But they also illustrate how much the conversation around the project has changed. The relevant comparison is increasingly not simply OpenClaw versus NanoClaw. It is a container-first, constrained system such as NanoClaw versus a deliberately hardened OpenClaw deployment that provides a substantially broader employee and administrator experience.

NanoClaw retains a strong proposition for organizations prioritizing a small attack surface, container-first execution and architectural simplicity.

OpenClaw is making another bet: that enterprises ultimately need an agent platform to function as both runtime and workplace.

OpenClaw 2.0 provides many of the primitives needed to build that environment — sandboxing, permissions, protected credentials, approvals, identity, auditing and isolated deployments — alongside a browser interface designed to make the system accessible to employees who will never configure an agent from a terminal.

The remaining caveat is important: enterprises have to turn those primitives into policy. OpenClaw 2.0 doesn’t automatically make OpenClaw enterprise-ready, but it does make an enterprise-grade OpenClaw deployment far easier out-of-the-box.

And as Steinberger’s description of OpenClaw’s own development process suggests, the long-term ambition may be larger still. Rather than giving every employee another AI assistant, OpenClaw is positioning the agent itself as shared infrastructure — a persistent layer where people, models and compute collaborate on the same work.

When Donkey Kong 64 debuted on the Nintendo 64 in 1999, Rare sent five Kongs on a quest to reclaim a thousand Golden Bananas, recover stolen riches, and deliver one very long rap. Rainchus, Ballaam, Killklli, Umed, and collaborators released DK64 Rekongpiled, also known as DK64 Recompiled, and the campaign now runs as a regular Windows, Linux, or macOS. You still need to point the software at a legally dumped US cartridge image. No assets are included with the download. After selecting one file, the original game code is executed on your computer rather than within an emulator.

Static recompilation is the way to go, as Wiseguy’s N64 Recompiled project works by reading ancient machine code, converting it to C code, and then compiling that C code for newer CPUs. RT64 handles frame drawing, allowing for higher resolution, refresh rate, and screen form than the original N64; it is no longer stuck in the 1990s. Gameplay speed stays the same even when the picture updates far faster than 30 frames a second. Objects, terrain, scrolling textures, screen effects, and the HUD all follow the higher rate. Default output matches the monitor’s refresh. An in-game slider handles the cap, because outside limiters can introduce stutter.

LEGO Super Mario Donkey Kong Arcade 72051

• BUILDABLE ARCADE CABINET – Relive the fun of playing an iconic arcade game with the LEGO Donkey Kong Arcade (72051) building set for adults ages…
• AUTHENTIC ARCADE GAME DETAILS – Create a Donkey Kong arcade level featuring Jumpman, Donkey Kong and Lady, including iconic details like the…
• WORKING JUMP AND DODGE PLAY – Pull the lever on the left side of the base to release one barrel at a time, then move Jumpman with the joystick and…

Widescreen and ultrawide layouts operate with any aspect ratio, and the effects are adjusted so that everything fits properly on a wide panel. The HUD elements on an ultrawide display can still be restricted to a 16:9 block. Any graphical flourishments that only make sense in 4:3 are left alone to avoid looking janky. The draw distance is significantly greater than it was on the original console, which is especially handy in the jungle and factory levels, which were typically packed. Cut scenes have also been revamped to take over the entire screen rather than being contained within a box.

Finally, the controls feel current. The keyboard and mouse are cleanly mapped. Controllers perform as intended. Gyro aiming is, as expected, an option, with a 1.0.One patch solved an issue that caused the axs to flip at once. You may configure the stick deadzones and axis inversion in a simple menu that saves your preferences across sessions. Input delay is kept to a minimum, so bonus games no longer seem like they’re up against the hardware.

System requirements are fairly modest. You only need a GPU that supports Direct3D 12 Shader Model 6 or Vulkan 1.2, which is pretty much any GPU built in the past 15 years or so. This comprises a GeForce GT 630 from 2012, a Radeon HD 7750, and an Intel HD 510 class GPU. If you’re using an x86 system, you’ll also require AVX. Just make sure your drivers are up to date. The 1.0.1 patch, released on August 29th, 2026, fixed a crash on an AMD Radeon 9070 XT running Windows.
[Source]

“The open ADB port plays the central role,” Plume researcher Gergely Eberhardt wrote in an email. “Combined with root access, a single pm install command can silently install any APK. This bypasses every one of Android’s default protections at once: signature verification, the “unknown sources” restriction, the permission-review dialog, and Play Protect scanning.”

Intruders at gates

The open ADB, along with the default presence of apps that have built-in proxy functionality, creates a dangerous mix that makes SuperBox a potent threat.

“This combination results in further infections involving additional residential proxies or IoT botnets, and the attackers are often the very customers of the primary proxy network,” Plume wrote. “The device owners get multiple bots they never asked for and are not aware of, all competing for the same hardware, and an IP address whose reputation now reflects whatever those bots utilize it for.”

Some of the proxy networking services that make use of SuperBox take measures to prevent their customers from accessing the local networks of SuperBox users. The recently disrupted Popanet, for instance, blocks local IP address ranges from outside the local network. Even then, Popanet users can access local IPs by specifying the special wildcard address 0.0.0.0, which Android then routes to the SuperBox IP 127.0.0.1. From that vantage point, proxy users can access the rest of the local network.

Monday’s post also reported that even the Popanet network was facilitating live exploit attempts. Plume wrote:

The internal-network protection issue that we described in the previous part isn’t just a theoretical concern. To confirm whether anyone is actually exploiting it, we ran a controlled experiment. We joined the Popanet network as a residential exit node and instructed the host that any connection coming through the tunnel targeting either port 5555 or 5858 (these are the most common ADB ports) would be redirected to our local honeypot. From the operator’s perspective, our node looked like any other regular residential endpoint serving customer traffic; from the inside, every attempt aimed to reach an ADB port through our node was captured.

We let the node run for over three weeks; over that period, the honeypot recorded 1,352 distinct attempts at reaching the ADB through the gap we identified earlier. All the attacks could be split into two families of loopback addresses targeting the local machine. The first is 0.0.0.0, supplied either as a raw address or embedded in a hostname via a wildcard DNS service such as nip.io. The second is 127.0.0.1, which the proxy blocked via isLoopbackAddress() as we explained earlier.

An email sent to info@mysuperboxtv.com seeking comment didn’t receive a response before this story’s publication.

from the tiny-little-coffins dept

When we just discussed the two recent deaths in Pennsylvania that came as a result of measles infections, we noted that there was very little information about the deceased. Some additional information has since been released, in particular the fact that one of those that died was a newborn child. This is the sort of fact that is heartbreaking to those of us with normal, functional brains.

Or, if you’re RFK Jr., it’s the kind of fact that causes you to drop the whole facade and go full on anti-vaxxer conspiracy clown.

On Tuesday, as news of the two deaths was breaking, Kennedy took to his personal X account to rail against the measles, mumps, and rubella (MMR) vaccine and posted a link to The HighWire, a hardline anti-vaccine and conspiracy site run by Del Bigtree, a prominent anti-vaccine propagandist and Kennedy ally.

Kennedy’s post also assailed Pennsylvania Governor Josh Shapiro, who has criticized Kennedy’s anti-vaccine rhetoric and activism. Kennedy went on to blame national declines in vaccination rates on the Biden administration.

On Wednesday, as news broke that one of the deaths in Pennsylvania was in a newborn, Kennedy turned to his official X account as US health secretary to allege that “the deaths may even have been altogether fabricated by one of the Governor’s hopeful staffers.” He cited a tweet from Josh Parsons, a Republican commissioner of Lancaster County, who claimed there had been “zero measles deaths” reported in the county. The claims appear to be another old play from the anti-vaccine handbook.

Advertisement

Okay, deep breath, folks. Let’s start that reacting to two bodies that haven’t even gone fully cold yet by spinning out on a conspiracy theory rant about the very damned thing that could have saved them is roughly as reprehensible a thing as I could think up in my head. It’s mean. It’s heartless. It’s evil. There are people suffering right now, including people that recently lost a newborn child, and there is no quarter given by Kennedy to express sympathy for any of them. Instead, it’s right back to the pet conspiracy theories that have been debunked over and over again. I don’t need to hear from anyone ever again that Kennedy is somehow not an anti-vaxxer, or that he actually promotes the use of the MMR vaccine.

But now let’s hone in on the claim that the reported deaths may have been “altogether fabricated.” Due to the coroner’s statement that they had measles deaths in the county, you may have read that as a claim that nobody actually died here and somehow state officials were just making the whole story up. That’s not the case. The game of confusion that Kennedy is playing is much more subtle and, ultimately, stupid.

If you recall back during COVID, there were plenty of misinformation acts out there on the internet claiming that COVID death counts were inflated. Much of that was based on what the cause of death listing was on death certificates. “No, this wasn’t a death from COVID,” the bad actor would claim. “This person is listed as having died from pneumonia.” The spoiler here is that COVID causes pneumonia that wouldn’t have occurred but not for COVID.

The same trick is at play here and it’s a trick Kennedy damned well knows is bullshit. The newborn in this case died from a ruptured spleen. That was the listed cause of death. But the cause of the ruptured spleen in a newborn that was also infected with measles is, well, measles.

Paul Offit, a vaccine and pediatric infectious disease expert at Children’s Hospital of Philadelphia, clarified that the measles virus can be passed on in the womb or shortly after birth. The virus can cause the spleen to enlarge and rupture at birth. Offit urged that if measles wasn’t the cause of the baby’s ruptured spleen, the coroner should provide an alternative explanation.

Unlike Diamantoni, Offit said he had been in touch with state officials regarding the deaths and, based on the information he had received, he concluded that “these patients would not have died were it not for measles.”

You can think of it this way. A death certificate or doctor’s report is going to list an acute cause of death, but that may not be originating and overall cause that led to the death. This is also how AIDS works. Nobody dies acutely from AIDS. They die from illnesses that wouldn’t normally have killed them if their immune systems weren’t severely compromised from AIDS.

Would it make sense to downplay the significance of AIDS? Of course not! AIDS is still the root cause of the death, even if it doesn’t make sense to list that on a death certificate.

Again, Kennedy knows all of this. He’s playing misinformation games on top of the graves of two Americans he helped into their caskets, including an infant. There’s a level of callousness at play here that is at best near-sociopathic.

From, mind you, the person that has the American people’s health as his charge.

Filed Under: anti-vaxxers, health & human services, infectious diseases, josh shapiro, measles, mmr vaccine, rfk jr.

The Marvel superhero Captain America’s story arc is about being frozen for decades and awakening in an unrecognizable world he must adapt to. Similarly, it’s been nearly two decades since an Onimusha game came out: The franchise went under the ice when action-arcade games reigned, and has emerged after parry-precise Soulslikes became the dominant subgenre.

Onimusha: Way of the Sword is a valiant attempt to split the difference, with a world of funky demons to kill using precision-timed swordplay that will please Elden Ring fans.

The result is more hit than miss, with largely satisfying swordfighting that allows for clumsy button-mashing in hectic moments, but rewards — and often requires — careful timing. The deeper into the game you go, the harder its repetition and some frustrating boss design grates on the experience.

It’s fun to stroll up to demonic enemies and expertly deflect their attacks until masterfully cutting them down; it gets old to run through the same fight a thousand times with the most basic of mooks while jogging from one similar task to the next. 

Amid the resurgence of games set in feudal Japan, from 2019’s Sekiro: Shadows Die Twice to last year’s Assassin’s Creed: Shadows and Ghost of Yotei, Onimusha: Way of the Sword distinguishes itself with a fantastical retelling of historical figures.

You take on the role of the legendary swordsman Miyamoto Musashi, though the game portrays him in his younger, uncouth years — skilled with the blade but rude with his manners, believing in strength above all. An untimely death at the hands of demons and rebirth, thanks to the Onimusha series’ iconic soul-gathering Oni gauntlet, draws Musashi into battle against the demon horde that threatens the human world.

It’s a fun premise, and several characters challenge the loner Musashi into smoothing out his rough edges, from Shizuka, the elegant Oni trapped in his gauntlet, to the imposing Takamura, wise warrior with his own spirit gauntlet, to Okuni, a nimble kabuki dancer avenging her troupe. The ghost of famed Japanese author Murasaki Shikibu sends Musashi out to solve the peasantry’s problems to harvest fodder for her tales (and save her fluffy story-ferrying spirit hounds), rounding out the game’s early retinue. 

Most of the game’s plot follows Musashi’s pursuit of the famous samurai general Minamoto no Yoshitsune, who has taken over Hell with his demon Genma army and sent them rampaging through Japan. It’s Yoshitsune who revives the young swordsman with his Oni gauntlet, though he does the same for Ganryu, a self-described rival to Musashi who grows unstably enamored with his gauntlet’s power.

He’s a dark mirror for Musashi in the quest for strength, but our hero is curbed by the nobler influence of his new companions; in one tense scene where Musashi is tempted down Ganryu’s darker path, Takamura reminds him of the Buddhist notion that life is full of suffering — but embracing the challenge is worth it. It’s a thesis for the game, though one that unconsciously applies to pummeling through a lot of similar fights to get to more climactic moments.

Capcom/Screenshot by David Lumb/CNET

I played about 15 hours of the game, and most of that was spent in a wide area of Eastern Kyoto, the imperial capital. I enjoyed stalking the city’s dirt streets, cleaning up Genma scum, though most reappear every time you save at a Spirit Mirror (this game’s version of a Dark Souls bonfire). I used those to teleport around many corners of the city, cleaning up this or that shrine, tackling this or that tough enemy. It’s a way to pad the time and make expansive use of the game’s area; more rarely, I teleported out to remote zones like a forested temple or a mountain fortress.

The more I played, and the more I was sent back around areas I’d already visited or to new ones that hardly looked different, the more I found Way of the Sword’s recycled gameplay wearying. There’s a sense that this game was made with a shrewd budget, and its emphasis is in the right place — making sure the combat is tight enough, and that every encounter ends in a cinematic slash of your sword. But the most novel highlights in the game felt too brief, and I wished they were the norm rather than the exception.

Where Onimusha’s resurrection feels incomplete — and bends to Soulslike tropes 

In fighting demons and fitting Japanese history into its storyline, Way of the Sword stays true to the Onimusha franchise. The older games had more freeform action, so updating swordplay to the careful precision-parry of other Soulslikes ably fits Musashi’s character as a legendary duellist. His rudeness is an enjoyable flaunting of the more delicate, honor-bound portrayals of samurai ideals in other games, flavoring the skilled efficiency with which he — and the player — carve through groups of enemies.

But there are other elements seemingly adapted from Soulslikes that I grated against. Does nearly every single boss need two health bars with a second phase? Does their stamina need to be whittled down with parries until I can make a climactic strike, a la Sekiro? Do enemies and bosses need to swiftly alternate between unblockable attacks that can only be parried and others that can only be dodged, sometimes with questionable telegraphing?

I was relieved that the game has multiple difficulties and doesn’t punish you for switching between them on the fly. I played on the tougher “action” difficulty until I hit a wall with a fight against Ganryu later in the game, switched to the easier “story” setting to get through it, and went right back to the former thereafter.

Amid the routine gameplay of purging Genma are a handful of sublime moments that I wish comprised more of Way of the Sword. Early on, Musashi enters a courtyard that’s suddenly more vibrantly colored, as if in a spirit realm, and filled with people who’ve been cheerfully mutilated. A powerful Genma had been preying on them with macabre solutions to their petty problems, taking fingers, limbs and eyes. When Musashi finally perceives the fiend, it’s got massive body-slicing shears and a face full of mismatched grinning mouths. The boss fight is fun, the theming great — but sadly, I didn’t find such a strong combination elsewhere in the first half of the game.

Capcom knows how strong this segment is; I’d already played it twice, at previews during Summer Game Fest and before the game’s release. Much of the rest of Way of the Sword is amenable but not as exciting, with themed areas that range from period-appropriate to slightly jarring. There’s an underground lab that felt like a blatant wink toward Resident Evil, with mechanical elevators so out of place that even Musashi comments on them. 

The rest of the bosses are mostly fine, deployed as difficulty spikes for players to slam their heads against while they learn specific attack patterns. That’s a repetitive pillar of the Soulslike experience I don’t find valuable or interesting, but for challengemongers, all bosses can be replayed, with a bonus costume awarded for rebeating them all.

While the bosses technically all have different attacks, most of them feel similar to each other, following similar combat flows in smaller square arenas. Ironically, I wish Way of the Sword had inherited the Soulslike tendency for bombastic set pieces in unique zones when creating boss encounters — early on, Musashi tackles a huge boss off a cliff and through floating rocks, feeling much like Gandalf’s midair duel with the Balrog in the Lord of the Rings films, but this was another luminous exception. (You can try this fight for yourselves in the recently expanded free Onimusha: Way of the Sword demo.)

There are parts of the player’s toolkit I never ended up using, like items to increase defense or attack that wear off so quickly that I only got a few sword slices out of them. There’s also an extremely cool-looking mechanic called Issen (attacking the moment before your opponent) that requires such precise timing that I only ever did it by accident. A whole section of the skill tree is devoted to it, which was kind of dead weight to me — and despite a range of special Oni weapons, I got through most of the combat just alternating between parrying and light attacks. It made me feel like Captain America emerging in a tech-laden future, still relying only on bashing enemies with his shield.

At the end of the day, Way of the Sword is a serviceable update to the Onimusha formula that offers something different to other Soulslike games, though it’s clear that Capcom hewed toward what many players now expect in their action experiences: higher-difficulty combat that rewards precise timing to earn your power fantasy. In reviving the franchise, they’re playing to today’s hits, even if Onimusha didn’t originate some of them.

I wish the game distinguished itself with more of its own brand — more about demon hierarchies and politics, more funky powers, more of Musashi as a self-interested asshole rather than a brute refining into a benevolent hero. There are worse lessons to take from Soulslikes, and Way of the Sword stands above most clones of the genre. I just wish it didn’t feel like it took the middle road of compromise at nearly every junction, rather than do something more radically its own.

David Lumb

Managing Editor, Mobile

David Lumb is a managing editor for the mobile team, covering mobile and gaming spaces. Before CNET, he covered tech, gaming, and culture for TechRadar, Engadget, Popular Mechanics, NBC Asian America, Increment, Fast Company and others. As a true Californian, he lives for coffee, beaches and burritos.

See full bio

Advertisement

A representative TU Darmstadt survey of more than 2,000 people in Germany found that about 43% of those with very strong AI knowledge expect AI could soon take over their work, a higher share than among those who understand it less. Only 15% of respondents have had any AI training, eighteen months after the AI Act’s literacy obligation began to apply.

The better people understand AI, the more they expect it to take their job. About 43% of those with very strong AI knowledge think so, TU Darmstadt found.

The survey covered more than 2,000 people in Germany, carried out with YouGov. It is representative, and the answers are measured against last year’s edition.

“Those who understand AI best are also the most aware of its disruptive potential,” said Peter Buxmann, who led the study. He called the pattern both remarkable and worrying.

Industry matters less than output. If your work produces text, analysis, reports, code or slides, you are more exposed, Digital Trends reported.

The worries themselves are unglamorous, which is the second surprise. Hallucinations and data protection top the list, well ahead of anything about machine superintelligence.

Only 40% think superintelligence is even likely. TNW has argued that what AI is doing to jobs in Europe looks different from the headline version.

Younger workers are more anxious than older ones, which inverts the usual expectation too. Concern about job security rose across every occupational group since last year.

One number should trouble employers more than the rest of it. Just 15% of respondents have had any AI training at all.

Europe has had a rule about that for eighteen months. Article 4 of the AI Act has applied since 2 February 2025.

It obliges providers and deployers of AI systems to take measures supporting AI literacy among the staff who operate them, weighed against their training and the context of use.

It sets no particular level and binds only organisations actually using such systems, so 15% is not a compliance rate. TNW has asked whether the Act can protect jobs at all.

It is a readiness figure instead. Eighteen months of a literacy duty, and most German workers have had nothing.

Which is Buxmann’s point. He wants training and honest answers rather than reassurance, because losing a job costs more than income.

Security

McKesson admits breach as ShinyHunters demands $55.2M

Two major healthcare businesses, Boston Scientific and McKesson, disclosed more details over the weekend about separate cyberattacks that disrupted global operations and resulted in stolen patient data, respectively.

Medical-device maker Boston Scientific, whose IT systems were hacked by unknown intruders last week, said the cyberattack remains ongoing. It also noted that pacemakers and other heart devices implanted after the August 25 breach cannot provide remote monitoring and data transmission as intended.

“New remote monitoring communicators cannot be activated, thus available device data will NOT be transmitted to remote patient management systems until the communicator can be activated,” the medtech firm said in a late Friday update. 

This applies to all new cardiac rhythm management implants other than insertable cardiac monitors (ICM). 

ICM devices must be activated using the Boston Scientific Clinic Assistant app to ensure the device correctly records patients’ heart rhythms, the company added. 

Because of the cyberattack, “new ICMs are unable to pair to the patient remote monitoring mobile phone, therefore available episode data recorded by the ICM will NOT be transmitted to the remote monitoring system until the ICM can be paired to the patient mobile app,” according to the update. 

The devices will still record any episodes, and patients can transmit these to the remote monitoring system by in-person transmission via the Clinic Assistant app. This is done by selecting the “interrogate” button, according to the company.

Once its IT systems are back up and running, and the heart devices can pair with home monitoring equipment, they will again transmit recorded data to the remote systems.

However, the company does not have a timeline for full restoration. “We are currently working on restoring affected functions and systems access,” Boston Scientific said on Saturday.

The digital intrusion also affected the firm’s manufacturing, shipping, and ordering, it noted. “We are expeditiously working towards partial restoration for the shipping of some products this week,” according to a Sunday update. “Once we can demonstrate the restoration is fully operable, we anticipate ordering and shipping will ramp up to full capacity.”

Boston Scientific has hired CrowdStrike to assist with the investigation and restoration efforts, and said the attack did not affect its cloud-based systems and apps – just “certain on-premise systems” – and added that it has seen no indication of unauthorized IT activity since August 25.

The firm has repeatedly declined to answer The Register’s questions about the compromise, including whether it was a ransomware infection and which criminal crew is responsible.

McKesson confirms breach as ShinyHunters claims responsibility

Meanwhile, in another cybersecurity incident that has been very publicly claimed by the criminal perpetrator: pharmaceutical and medical supply giant McKesson over the weekend confirmed an intrusion after ShinyHunters on Friday told The Register it broke into the company’s Snowflake and Salesforce instances and stole millions of patients’ data.

“Based on our investigation thus far, including assessments by leading cybersecurity industry experts supporting our response, we’ve confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units,” Francisco Fraga, McKesson executive VP, chief information officer and chief technology officer, said in a Saturday statement. 

The medical firm did not immediately respond to The Register’s questions, including how many patients were affected and what “certain data” was stolen. McKesson supports about 3,300 oncology providers in 29 states, according to its website. 

Fraga’s statement noted that distribution centers remain operational and McKesson continues to ship products. The firm has “reasonable assurance” that the digital intruders have been kicked out of the third-party environments and aren’t lurking around McKesson’s systems, he added.

A ShinyHunters spokesperson told us that the notorious extortion group compromised more than 284 million records of patient data, and demanded McKesson pay $55.2 million or else they would leak the stolen data.

However, as Have I Been Pwned boss Troy Hunt recently reminded everyone: Don’t confuse criminals’ claims with gospel truth, and “take headline numbers with a grain of salt unless you’re confident in the processes of those making the claims.” 

This was after Hunt’s HIBP service reported 12.9 million individuals affected by retailer Carhartt’s alleged breach. This number was around half of what ShinyHunters claimed when they leaked the company’s data earlier this month.

The McKesson records, according to the ShinyHunters spokesperson, include patients’ full names, home and email addresses, phone numbers, dates of birth, Social Security numbers, appointment dates and notes, and sensitive illness details including cancer locations on people’s bodies. The group also claims to have swiped emails containing private information from doctors to patients.

The spokesperson told us they accessed the company’s Snowflake and Salesforce instances by voice phishing “multiple employees.” This is a tried-and-true method popularized by the data-theft-and-extortion gang, which has victimized other medical providers in recent months. These include pacemaker manufacturer Medtronic in April, and cancer diagnostics business Exact Sciences in July. ®