Engineering physics students at the University of British Columbia finished a capstone project that produced something unusual in robotics. Their air hockey robot learned every move inside a computer simulation and then stepped onto real hardware ready to face human opponents with no further adjustments. The approach bypassed the usual slow and risky process of training directly on physical equipment.

Over the course of around two years, multiple student teams worked together to complete the project. Hudson Nock, Ian Hartley, and Mauro Ferraz led the last assault. They took over an early iteration of the hardware foundation, with the primary purpose of narrowing the gap between virtual training and real-world performance. The whole code and two pretty lengthy technical reports are now available on GitHub for anyone who want to read everything and understand every decision they made.

For any automated system, air hockey presents some significant issues. The table surface is never completely smooth, the puck travels at high speeds, bounces vary depending on where it hits the wooden rails, and motor efficiency degrades when the power supply voltage lowers under strain. Conventional physics models frequently fall short of adequately capturing these differences in order to transition from simulation to reality. Instead than relying just on a generic engine, the UBC team chose to meticulously measure the actual hardware and then mimic its unique characteristics within the code.

All the sensing is controlled by a single camera above. The puck is marked with retroreflective tape, while the opposing mallet is marked with a unique marker. Even when the camera uses very short exposures of only 100 microseconds to stop the movement, some bright LEDs close to the lens make both objects appear exceptionally clear and crisp. In order to keep the position error down to nearly precisely one millimeter over the entire surface, they also performed some calibration work using markers around the table edges. This is quite astounding given the little warping that would otherwise be an issue. A contour tracker can follow the puck all the way through even when the gantry obstructs the view. The human player’s mallet can be found by the same camera at a scorching 120 frames per second.

A Core XY gantry positioned high above one side of the table generates movement. The mallet is guided by two belt-driven motors and an STM32 Blue Pill microcontroller. During system testing, the team went to the trouble of determining how the mallet reacts to various voltage signals and recording it all as a third order transfer functions. They used a combination of feedforward controls and PID feedback to keep the mallet on track and virtually perfectly aimed. A sizable supercapacitor is also used to stabilize the voltage during rapid accelerations.

Custom code designed for speed and accuracy powers the simulation itself. The application employs analytical solutions to simulate both puck and mallet motion, reducing the need for time-consuming numerical integration stages. They use an adaptive collision timing technique to ensure that no impacts are missed. When the puck strikes the wooden rails, a small neural network with only 112 parameters kicks in, predicting both the departing velocity and angle, as well as a measure of uncertainty. The simulator then draws from that uncertainty distribution at random throughout each run, so the learning agent should expect slightly unfair and noisy bounces rather than flawless ones.

Vectorization allows a standard laptop to run thousands of game instances at the same time. On a normal Intel i5, the entire simulation runs approximately 230 times faster than real time, which is rather impressive. That kind of pace makes it absolutely practical to run extensive training sessions. To account for issues such as camera lag and control input latency, the agent is given a state that includes the most recent puck and mallet action over a variety of delays. It then outputs the voltage parameters for the motion profile together with the intended final mallet position.

The Soft Actor Critic reinforcement learning technique was used to train networks with about 200,000 parameters. The squad took action since self-play alone can result in one-dimensional strategies. After training, they just applied the policy to the actual controller without any further fine-tuning in the real world, resulting in some deviation. The round trip delays are all kept in sync while the entire system runs on a 60-Hz loop.
[Source]

Every year, the Verizon Data Breach Investigations Report serves as a ground-truth benchmark for the industry. Its value comes not just from the headline numbers but from the convergence signals: when multiple independent data sources point to the same structural shift in how attackers operate, that convergence is worth paying attention to.

This year, as a contributor to the Verizon 2026 DBIR, the Keep Aware team had early visibility into that convergence.

This post breaks down the specific areas where the 2026 DBIR data and Keep Aware’s own browser telemetry align — and where browser-layer data reveals what network and endpoint tools miss entirely.

Shadow AI Has Become a Mainstream Enterprise Risk

Shadow AI was identified in the Verizon DBIR as the third most common non-malicious insider action observed in Data Loss Prevention (DLP) datasets, representing a fourfold increase from the previous year.

Employees are not typically trying to exfiltrate data; rather, they are using the fastest available tool for a task, which increasingly means pasting internal documents or source code into a personal ChatGPT session before their organization has had time to approve and provision a governed alternative.

The scale of unauthorized AI usage in enterprise environments is one of the report’s most significant findings: 67% of users are accessing AI services on corporate devices through personal, non-corporate accounts, and 45% of employees are now considered regular AI users.

Keep Aware’s browser telemetry further provides insight into how these AI services are being used. Over half of AI prompt inputs are sent to personal accounts, and 23% of sensitive prompt uploads involve data transiting through personal or unverified accounts (i.e., outside the reach of any corporate DLP policy or logging infrastructure), conveying the real risks of AI usage.

Credential Abuse and the Browser’s Detection Gap

The 2026 DBIR found that 39% of breaches involved credential abuse. Keep Aware’s attack data from 2025 puts browser-based credential theft as the number one browser-based attack, accounting for approximately 41% of observed threat activity, implying that credential theft in the browser will later contribute to successful future breaches.

Compounding this attack vector is the fact that the vast majority of these attacks are invisible to traditional tooling, as our data illustrates.

In Keep Aware’s analysis, 63% of Microsoft-themed phishing sites were not flagged by any VirusTotal vendor at the time of employee exposure, showing a glaring detection gap in intelligence feeds and endpoint tools.

More pointedly, 100% of the credential theft attempts Keep Aware observed passed through existing non-browser security controls unblocked — network proxies, DNS filters, and endpoint agents alike.

None of them caught it. The only reliable detection point is inside the browser itself, where the page is rendered and the user interaction actually occurs.

Browser Extensions: Privileged, Ungoverned, and Expanding

Add-ons can read, modify, and interact with any page’s content, and exfiltrate data from within the browser context, enabling extensions to operate with a level of browser privilege that should dictate regular scrutiny—yet data tells a different story.

The 2026 DBIR flagged that the average enterprise had more than 15% of users with unauthorized AI extensions installed. However, the extension problem is broader than AI tooling alone.

Keep Aware’s extension telemetry additionally shows that 13% of unique browser extensions observed across our customer base were classified as high or critical risk.

The more operationally significant finding: 93% of poor-reputation extensions were labeled as “productivity” tools by browser marketplaces — the exact category most allowlisting policies treat as safe. For this threat class, that makes category-based allowlisting functionally useless.

ClickFix and Browser-Native Social Engineering

Both the 2026 DBIR and Keep Aware’s State of Browser Security Report call out ClickFix as an emerging technique worth tracking.

The Verizon DBIR found ClickFix accounted for 2.7% of browser-detected attacks—a small share that nonetheless signals an evolution in browser-based social engineering.

ClickFix is a deceptive social engineering tactic used to get a user to unknowingly execute malicious code from the browser and on the host machine.

This threat begins in the browser—often by encountering compromised websites and sometimes through LLM chat responses—but quickly continues on the endpoint, compromising the machine with info stealers and remote access to attackers.

The endpoint bears the impact, but the browser is the social engineering medium—and the first line of defense.

The Human Element Continues to be a (Browser) Problem

The 2026 DBIR found that 62% of breaches involved the human element, with phishing initiating 16% of incidents. Keep Aware’s browser-layer data shows phishing and social engineering accounted for 46% of browser attacks observed across 2025.

The human element finding is often framed as a training and awareness problem. But attackers are constantly evolving browser-based social engineering tactics—phishing links to benign intermediary sites, redirect chains, pages that render differently for automated scanners, hosting content on legitimate websites, and silent clipboard injections.

Browser-level visibility does not solve the human element problem, but it shifts the detection point to where the human interaction is actually occurring, rather than looking for downstream artifacts after the interaction has already been exploited.

What This Means for Security Teams.

Shadow AI, credential theft, malicious extensions, and browser-native social engineering techniques like ClickFix share a common characteristic: they all execute inside the browser, and they all produce artifacts that are most visible, if not only visible, at the browser layer.

Security programs that rely exclusively on network, endpoint, and identity telemetry will continue to have blind spots in exactly the places attackers have learned to operate.

The browser is no longer just an application. For most enterprise users, it is the work environment. Securing it is no longer optional.

If your security stack lacks visibility into what’s happening inside browser sessions, that gap is worth understanding before attackers exploit it. Request a demo of Keep Aware to see what your current tools are missing

Keep Aware contributed data to the Verizon 2026 Data Breach Investigations Report. Keep Aware’s 2026 State of Browser Security Report is available here.

Sponsored and written by Keep Aware.

EU trade commissioner Maroš Šefčovič has called for a new “diversification instrument“ to reduce Europe’s dependence on single suppliers of chips and rare earths. He made the proposal at the European Policy Center’s Brussels Economic Security Forum on Friday. The tool would force companies in sensitive sectors to source from at least three different suppliers.

“If it’s critical supplies, you have to have three different suppliers to make sure that you cannot be punished because of a political reason,” Šefčovič said. He cited the Energy Union as his model, an initiative he previously led to wean Europe off Russian energy after the 2014 annexation of Crimea.

The urgency is real. The EU relies on China for more than 90% of its rare earth supplies. Beijing imposed export controls on rare earth magnets last October during a tariff dispute with the United States, and halted chip shipments from Chinese-owned Nexperia after the Dutch government seized control of the company.

Those disruptions hit European carmakers and exposed the bloc’s vulnerability. “Recent industrial cases, in particular supplies of chips and rare earths, have reinforced my conviction that a step change is necessary,” Šefčovič said. “Every high-risk sector must be weaned off single-supplier dependence.”

The EU has since joined forces with Washington and other nations to find alternative sources. Sweden’s discovery of Europe’s largest rare earth deposit offered a long-term glimmer, but mining timelines stretch well beyond a decade. In the meantime, Europe remains exposed.

The proposal comes a day after Šefčovič urged Brussels and Beijing to address the EU’s “unsustainable” trade deficit with China. That deficit widened to €360 billion last year, up 18% from 2024. EU leaders are set to discuss China’s industrial overcapacity and subsidised exports at a summit on 18-19 June.

Šefčovič will also meet Chinese counterpart Wang Wentao in Brussels later this month. He told reporters the next step is a formal legal proposal. “We have to specify what to really do with the legal proposal,” he said.

The broader push to reduce chip dependency has already produced the EU Chips Act, which aims to double Europe’s share of global chip production to 20%. A Chips Act 2.0 was proposed by the Commission in June 2026 with new measures to cut strategic dependencies further.

JBL has taken the wraps off its most ambitious home speakers yet. The company is launching the next-generation Summit Everest and Summit K2 models as part of a new flagship Summit Series. This series was unveiled at High End Vienna 2026.

These aren’t just updates to existing speakers. They continue JBL’s long-running “Project” lineage — a designation reserved for the brand’s most technically advanced loudspeakers. In addition, they arrive as part of the company’s 80th anniversary celebrations.

The new range sits at the very top of JBL’s line-up, joining models like Makalu, Pumori, and Ama. However, the Everest and K2 are the clear headline acts. They are reference-level systems for listeners who want no-compromise performance at home.

The Summit Everest sits at the top of the stack, carrying forward the legacy of four previous Everest generations. It uses a redesigned mid and high-frequency system built around JBL compression drivers and a large-format HDI horn.

Advertisement

This is supported with dual 10-inch mid-bass drivers and dual 15-inch woofers, with the intent on delivering deep bass while maintaining precision across the full frequency range.

Advertisement

Slightly lower in the range, the Summit K2 follows a similar design philosophy but scales things back into a more “accessible” flagship format. Still, it uses JBL’s compression driver system and HDI horn design, paired with a 15-inch woofer and 10-inch mid-bass driver. This approach aims for the same sense of scale and clarity in a smaller footprint.

Both models share JBL’s updated internal architecture, including a redesigned crossover system intended to reduce signal loss and improve power handling. They have also reworked the cabinets, adding heavy internal bracing and damping to minimise unwanted resonance.

Furthermore, new isolation feet decouple the speakers from the floor, delivering cleaner bass response and sharper imaging.

Advertisement

Finish options lean fully high-end, with either high-gloss black with platinum accents or Macassar ebony veneer with gold detailing. Even the hardware has been treated as part of the design, using premium binding posts and high-grade internal wiring throughout.

Advertisement

Pricing underlines exactly where these sit in the market. The Summit Everest comes in at $159,990 per pair. Meanwhile, JBL prices the Summit K2 at $99,990 per pair, firmly placing both models in the ultra high-end territory when they arrive later in 2026.

Advertisement