Your ChatGPT usage limits are about to get loosened if you’re a free user. OpenAI said on Thursday that it is giving free users unlimited text chats, and the default model for paying users is getting upgraded.

Usage limits are one of the biggest annoyances of using AI chatbots and other products. If you don’t pony up for the $20 paid subscription — or if your workplace doesn’t pay for an enterprise plan — you probably run into messages on ChatGPT telling you that you’ve reached your limit for the day. Now, these limits for text-only chats will be removed for free users. Limits on image generation, file uploads and voice tools will still apply.

Free and paying users will have a new default model, GPT-5.6 Luna, the lightweight version in the company’s newest model family. Luna has performed better than the current default, GPT-5.5 Instant, with OpenAI reporting that factual errors were 62% less common with Luna. There’s also going to be a new “Think” button available for free users and subscribers on the $8 per month Go plan. This is supposed to help the AI answer harder questions by taking more time to process an answer.

Plus and Pro users ($20 and $200 per month subscribers, respectively) should also see some improvements when they use GPT-5.6 Sol, the heavyweight new model. OpenAI said it tweaked Sol to be better at everyday tasks, like web research, writing, planning and making decisions. It should give honed or focused answers — less unnecessary info and formatting. There will also be a slider tool where you can increase the amount of technical firepower you want in your prompt, like upgrading from GPT-5.6 high to extra high to pro.

Luna will be the new default model starting this week, while the unlimited chats, new Think button and slider should be released next week. Don’t panic if you don’t see them right away; rollouts can sometimes take a few days.

While unlimited chats might be nice if you use AI for school or work, it could be an issue for some vulnerable groups. We’ve seen more than a few cases (and subsequent lawsuits against AI companies) where people who use AI chatbots excessively develop and exacerbate some mental health issues. In one lawsuit, a mother alleges that OpenAI failed to enact necessary safeguards in order to keep her daughter engaged with ChatGPT. It’s a similar concern that is underpinning several lawsuits against social media companies, saying they had deliberately addictive designs that resulted in harm for young and vulnerable users.

OpenAI says it has added guardrails to the models so they “avoid romantic roleplay, age-restricted challenges and presenting itself as a substitute for real-world relationships” for users under 18.

(Disclosure: Ziff Davis, CNET’s parent company, in 2025 filed a lawsuit against OpenAI, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.)

Katelyn Chedraoui

Reporter 2

Katelyn is a reporter with CNET covering artificial intelligence, including chatbots, image and video generators. Her work explores how new AI technology is infiltrating our lives, shaping the content we consume on social media and affecting the people behind the screens. She graduated from the University of North Carolina at Chapel Hill with a degree in media and journalism. You can reach her at kchedraoui@cnet.com.

See full bio

AI and ML

Agent Plugins 1.0 defines a write-once-run-anywhere container for passing tools and skills across different agent platforms

The AI giants have joined forces to ask the world’s developers to all please write their agentic skills and tools into the same format. In return, coders will be able to move these superpowers easily from one platform to another (such as when they get laid off). It’s designed to be write once, run everywhere.

Vercel posted the initial draft of the Agent Plugins spec on Thursday, with input from Amazon, Cursor, Microsoft, and OpenAI, which all pledged fidelity (and engineers) to the project. It was quickly embraced by the Linux Foundation’s Agentic AI Foundation (AAIF), though it will operate as an independent entity.

Agent Plugins 1.0 packages an AI agent’s skills and tools in a single directory structure. It builds on the AAIF-stewarded MCP protocol and the open Agent Skills standard originally created by Anthropic in 2025.

Agent Skills holds the instructions for how the agent should perform a specific task. MCP provides the connectivity to outside databases, APIs, shell scripts, and other external resources. Together, the trio makes AI capabilities modular so that they are, in theory, write-once-run-anywhere. 

It is still up to the agent clients, or platforms, to provide a user interface, establish security boundaries and create marketplaces where the plugins can be shared. Thus far, VS Code, Cursor, GitHub Copilot, ChatGPT, Codex, and Kiro all support the standard.

File-system-as-configuration

Agent Plugins follows the Next.js practice of using the host computer’s directory format as the structure for defining components.

The spec prescribes creating a top-level directory for each plug-in, with a small manifest and schema. The manifest provides the name, version and schema of the plugin in JSON format. Skills are filed in the skills sub-directory, and the MCP server configuration is stored as an mcp.json file.  

Those are the essential elements, though the plugin authors can also use the namespace directory to store additional extensions. This format “keeps the shared format predictable without requiring it to absorb every client-specific experiment happening across agent products,” noted the AAIF in a blog post. 

Bundling the skills with the MCP configuration makes the package portable, allowing it to be copied and used across any supporting agent client.

The narrow way

Agent developers around the globe are adding all manner of experimental hooks, rules and extensions into their skills. Nonetheless, the keepers of the spec deliberately kept the scope “narrow” for this 1.0 release, in AAIF’s words. The best ones may be considered for future versions of the spec, though the team is not making any promises. Until then, developers can add all these extensions to the namespace and hope for the best, portability-wise.  

Going forward, Agent Plugins will be managed under an open governance model, with an independent technical oversight committee calling the shots, considering input from the public. Currently, engineers from Amazon, Cursor, Microsoft, OpenAI, and Vercel are on the core development team. The spec is licensed under the Creative Commons Attribution 4.0 International License (CC-BY-4.0).

There are other efforts underway to tame the wild frontier of agent development. Google folded its own Agent2Agent (A2A) agentic communications protocol effort into AAIF. Google is also building out a specification for finding tools on the web, called Agentic Resource Discovery.

AAIF has a similar “complementary” project to Agent Plugins, Skills Over MCP, which shares skills by bundling them into the MCP server itself. Essentially, this approach is akin to shipping “the manual with the product,” wrote AAIF Vice President Angie Jones. 

Should MCPs be festooned with skills? Or should each set of skills come with an attached MCP? Let the best approach win! ®

A single adapter could be all you need.

The model of GameCube is important

Igor Bonifacic for Engadget

How to connect a DOL-001 GameCube to an HDTV

Igor Bonifacic for Engadget

What about the DOL-101?

Bonus: Nintendo Switch Online

Nintendo

The company has secured a deal to provide Anthropic with computing capacity for six years, according to a Bloomberg report.

Volta Infra, a new AI infrastructure start-up, has emerged from stealth with a valuation of $2.4bn after completing a seed funding round and Series A round led by Azora, Andreessen Horowitz, Altimeter and Nvidia.

The rounds also saw participation from strategic investors including the family office of Michael Dell and Matter Venture Partners.

Volta, founded earlier this year by Ricard Boada and Sofia Gumuzio, aims to help top AI labs and start-ups access key infrastructure. The company develops, finances, builds and operates AI factories by integrating “institutional capital, powered land, data centres, compute, software and operations under a single platform”.

The months-old start-up raised $300m in venture funding, according to Bloomberg, and also announced a deal with asset company Azora to provide $5bn of financing for the “next generation of AI factories” developed by Volta.

“Compute has become a new infrastructure asset class, with AI models and applications as the verticals built on top,” said Boada. “Every technology revolution has run on a physical layer beneath it.

“We founded Volta because compute should be financed, developed, and commercialised with the principles and scale of infrastructure.”

The start-up also announced that it has secured a $10bn strategic partnership with an unnamed AI lab to develop an AI factory in Norway alongside Bitdeer, a Bitcoin miner that operates data centres.

The project – the first within Volta’s broader development pipeline – will comprise a 133MW deployment powered by Nvidia Vera Rubin systems.

As well as the site in Norway, Volta plans to build US sites in Texas and Wyoming, Boada told Bloomberg. The start-up aims to deploy multiple gigawatts of capacity by 2030.

Bloomberg reported that the unnamed AI lab involved in the $10bn Norway site deal is actually AI giant Anthropic, with the publication citing anonymous sources familiar with the matter. As part of the deal, Anthropic will reportedly have access to Volta’s computing capacity at the site for six years.

Anthropic has recently been making a series of deals to boost its access to vital AI infrastructure and compute.

Just a couple of weeks ago, the company announced a partnership with AMD for 2GW of its latest-generation chips in a bid to boost AI capacity and meet growing demands. The Wall Street Journal reported that the deal between the companies is worth “tens of billions of dollars”.

Anthropic has also made similar deals with Broadcom and Amazon.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

In brief: Flock’s AI-powered license plate readers, which have drawn public scrutiny over surveillance and privacy concerns, are traditionally stationary. However, public records indicate that the company is exploring ways to make its cameras more mobile, including through partnerships with delivery and rideshare companies.

A presentation from Flock, obtained by 404 Media, describes abandoned plans to install the company’s automatic license plate readers on 350,000 vehicles operated by Uber, Lyft, and other delivery companies in Georgia. The plan could have significantly expanded the surveillance capabilities of the already controversial AI-powered cameras.

ALPRs from companies such as Flock and Axon are ostensibly designed to record the license plates of passing vehicles and store the data in a searchable cloud database. Authorities have used the cameras, which currently operate in about 6,000 communities across the US, to track the movements of vehicles suspected of being involved in serious crimes.

However, incidents involving misread plates and police officers using ALPRs to stalk people have contributed to a nationwide backlash. Many communities, including Los Angeles, have since deactivated the cameras. ALPRs are usually installed on traffic lights or roadside poles, but a recently uncovered document outlines a proposed partnership between Flock and dashcam provider Nexar.

The presentation highlights the hundreds of thousands of dashcams in Uber and Lyft rideshare vehicles in Georgia, as well as cameras operated by local businesses and homeowners associations, as potential ALPR platforms. While Flock and Nexar ultimately did not ink the deal, it would have allowed Flock to catalog every vehicle that passed those equipped with cameras. Whether the drivers would have been aware of the surveillance remains unclear.

Authorities have utilized mobile camera networks before. Last year, robotaxi company Waymo admitted that it complies with police warrants for footage from its 360-degree cameras, but only after carefully reviewing the requests. Axon and Motorola also provide ALPRs designed for installation on moving vehicles.

The Flock-Nexar presentation was originally obtained through a public records request by Jason Hunyar, a Georgia-based blogger who reports on Flock’s activities in the state. Previous requests have uncovered records indicating that the company erased its supposedly immutable usage records after an officer observed a girl’s gymnastics room and sold data collected by its cameras.

In one post, Hunyar outlines Flock’s plans to install its cameras on robot dogs that could send data back to their Hangzhou-based manufacturer through pre-installed backdoors. Previous reports also revealed that a major Flock investor supports a company capable of intercepting and altering surveillance footage.

Ford on Thursday unveiled both the name and starting price of its upcoming electric truck. The Ford Fathom will start at just under $30,000, making it one of the most affordable electric pickup trucks coming to the US market.

While the automaker didn’t show off what it will look like, the Fathom will have a standard-range battery, five seats and Ford’s BlueCruise driver assistance, as well as Apple Maps integration. BlueCruise is Ford’s version of AutoPilot, providing a hands-free driving experience in designated areas called “Blue Zones” on certain highways.

The Fathom’s announcement follows Ford’s $5 billion investment last summer in EV production and the development of Ford’s Universal Electric Vehicle platform. The Ford Fathom is the first electric vehicle built on UEV.

According to Ford, the name Fathom and the truck’s design come from “a deep understanding of the person who would drive it. Their day. Their challenges. Their goals. Even their wallet.”

Although EV sales have continued to increase worldwide, that growth has begun to slow in recent years, especially in the US. According to the International Energy Agency, electric car sales in the US increased by 40% in 2023, but slowed to 10% growth in 2024. Worldwide, EV sales increased by 35% in 2023 before slowing to 24% in 2024, followed by 20% growth in 2025.

As electric vehicle growth slows, affordability may be the strongest component for attracting new buyers. When announcing Ford’s 2025 investment in EV production, Ford CEO Jim Farley acknowledged there’s risk, but said the company planned to create a “vehicle that can sustain itself” and still make strong profits, CNET previously reported.

“The team were just ultra focused on providing customers value in terms of what they are looking for and content that they want rather than stripping out stuff that they don’t,” Ford Model e General Manager Kay Hart told CNET. “Blue Cruise-capable vehicles with hands-free driving, digital car key, large touchscreen … the versatility of an open bed, the true adaptability, the value of this vehicle is what I think is the core message.”

The Ford Fathom will be available for preorder in early 2027 with a starting MSRP of $28,350. That price is just above the upcoming Slate pickup truck, which starts at $24,950 and is currently the most affordable electric pickup available for preorder.

Corin Cesaric-Epple

Editor

Corin Cesaric-Epple is an Editor at CNET covering home and kitchen tech and meal kits, and reporting regularly on artificial intelligence. She earned her bachelor’s degree in journalism from the University of Missouri-Columbia. Before joining CNET, she covered crime at People Magazine and national and international news for NBC Local Television Stations.

See full bio

The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors.

The exploited vulnerabilities allowed the attacker to execute arbitrary code with the highest level of privileges and deploy the PhantomCore and PhantomGraph backdoors.

TrueConf is a video conferencing tool widely used in Russia, especially in the enterprise and government sectors, as a secure, on-premise alternative to Western tools such as Zoom and Microsoft Teams.

Researchers at cybersecurity company Kaspersky discovered the attack in July. They found that Head Mare hackers used TCP port 4307, which is open by default, to connect to the target TrueConf server without authentication.

They leveraged a vulnerability internally tracked by Kaspersky as KLCERT-26-057 to execute a malicious script within TrueConf’s isolated environment, and KLCERT-26-058 to escape the sandbox and run commands on the underlying operating system.

The attacker then increased their privileges to NT AUTHORITY\SYSTEM, and replaced the ‘\public\js\locale.php’ file with a web shell that gave them persistent remote access to the compromised server.

Kaspersky reports that Head Mare uses a web shell to collect sensitive information from the victim’s environment, access the TrueConf database, and replace the legitimate TrueConf Client installer hosted on the server with a malicious version that contains the PhantomCore backdoor.

When members of the organization connect to the local TrueConf server, they receive a trojanized, non-digitally signed client installer as an update.

“Even if your organization does not use the TrueConf server, employees of the organization can connect to compromised counterparty TrueConf servers to participate in online meetings and download infected installation packages,” Kaspersky warns.

Additionally, Head Mare deploys PhantomGraph, a separate backdoor consisting of two DLL files (SysExcSvc.dll and SysReadSvc.dll) that accept commands via a Microsoft OneDrive account, execute them, and return the results.

Observed attacker activity through PhantomGraph included dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to exfiltrate credentials.

The malware also runs commands for reconnaissance activity, such as hostname and whoami, and starts a reverse SSH tunnel.

Kaspersky says it is currently observing multiple active Head Mare campaigns targeting Russian organizations in various sectors: instrumentation, electronics, transportation, energy, IT, and software development.

According to the researchers, the threat actor is using several initial access methods that include phishing, exploiting public-facing web servers, and access via contractors.

TrueConf vulnerabilities

The two flaws Kaspersky saw leveraged in attacks affect TrueConf Server 5.3.x before 5.3.9, 5.4.x before 5.4.9, 5.5.x before 5.5.5, and older versions.

The vendor fixed them in versions 5.3.9, 5.4.9, and 5.5.5, released on June 18.

In April 2026, CheckPoint Research reported that hackers were targeting a zero-day arbitrary file execution flaw in TrueConf, tracked as CVE-2026-3502, compromising users via trojanized client updates.

CheckPoint named the campaign ‘Operation True Chaos,’ and tentatively attributed it to Chinese threat actors behind the Havoc implant, which was used in these attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

It can be hard to find TVs this big for less than $600, something that makes this deal even better.

The Hisense 65-inch U6 Pro Mini-LED 4K TV has crashed to just $598.99 from a $1,099.99 list price, slicing more than $500 off and handing you a barely believable 45% saving on a set this good.