There’s no confirmation of Joy-Con 2 mouse control support just yet.

security

A critical Langflow flaw allowing RCE on default deployments is being exploited, says the CISA

A critical vulnerability in IBM-owned, low-code AI builder Langflow lets unauthenticated attackers execute code remotely on vulnerable default deployments, potentially putting organizations running those instances at immediate risk.

The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog after identifying evidence of active exploitation and urged organizations to apply the vendor’s mitigation guidance as soon as possible. IBM says the flaw affects Langflow OSS versions 1.0.0 through 1.10.0 and recommends upgrading to version 1.10.1 or later; at the time of writing, the most recent version is 1.11.2.

Langflow, for those unfamiliar, is one of the more accessible AI agent builders on the market, as our hands-on look at the tool earlier this year demonstrated. It’s available on Linux, Windows, and macOS, and is basically an end-to-end, drag-and-drop GUI where users can construct agent workflows without having to know much, if anything, about the underlying code.

IBM owns the platform now, but Langflow was originally developed by Logspace, which was acquired by DataStax in 2024 before IBM scooped up DataStax, and Langflow with it, in 2025. 

The acquisition of DataStax and its tools like Langflow by IBM paved the way for Langflow to be integrated into watsonx.ai, IBM’s AI development studio, as a piece of middleware extending watsonx.ai’s capabilities.  

The ownership changes, however, didn’t stop the critical flaw from making it into production releases before it was finally fixed.

According to IBM, the vulnerability affects default Langflow deployments and combines two issues that, when chained, allow an unauthenticated attacker to execute code remotely.

First, there’s the matter of an auto-login endpoint in default deployments that’s willing to mint superuser tokens to any network caller. Combine those easily obtained superuser rights with the second issue, a code validation endpoint that’ll run any old Python code thrown at it, and you’ve got a recipe for someone taking over your entire Langflow server, or worse.

The CVE itself was published on July 17, meaning that it hasn’t taken long for bad actors to realize what they could do with RCE on any system hosting a default Langflow deployment with auto login enabled and that code validation endpoint left accessible on a network. 

Langflow itself isn’t a vibe-coding platform, instead serving as an interface for building agentic and RAG workflows, so don’t blame vibe coding or no-code security failures for this one. Instead, what we appear to have is a standard case of how default configuration deployments can easily be a disaster.

It’s unknown how extensively exploited this vulnerability is; we’ve reached out to IBM to learn more. ®

Soft X-rays from a galaxy about 500 million light-years away triggered an urgent worldwide search in March 2026. The Einstein Probe satellite, built by the Chinese Academy of Sciences with the European Space Agency, recorded a brief pulse of these X-rays and labeled the event EP260321a. Ground telescopes responded within an hour and quickly found a supernova growing brighter by the minute. Researchers later named the explosion SN 2026gzf.

Two astronomy teams were diving into the same region, utilizing a range of NSF NOIRLab resources. One, led by Brendan O’Connor of Carnegie Mellon University, and the other by Jillian Rastinejad of the University of Maryland, reached the same conclusion after evaluating the data. Their early observations suggested that the explosion began with a shock breakout. A shock breakout occurs when an immensely powerful shockwave from a collapsing core smashes through the star’s surface, allowing the supernova to shine. This isn’t uncommon in supernovae, but they’re difficult to detect because they only endure a few seconds to a few hours. To put it in context, there has only been one validated x-ray shock in the last 20 years, and scientists were certain this was the real deal. EP260321a is a once-in-a-lifetime scientific discovery.

LEGO Icons NASA Artemis Space Launch System – DIY Rocket Model Building Set for Adults, Ages 18+ – Gifts…

• NASA rocket model kit – Launch into a creative project with the LEGO Icons NASA Artemis Space Launch System model building project for adult space…
• What’s in the box? – This creative building set includes everything you need to craft a multistage rocket with 2 solid-fuel boosters, an Orion…
• Features and Functions – This NASA-themed rocket model features retractable launch tower umbilicals, rocket support and crew bridge, detachable…

People looking over the data discovered that SN 2026gzf is a broad-lined Type Ic supernova. These explosions are typically extremely intense, resulting in streams of material that travel at the speed of light. They are frequently accompanied by a gamma ray burst, which is one of the most tremendous energy outputs ever observed. Unfortunately, in this case, the teams were unable to identify a gamma ray burst, its high-speed jet, or even the afterglow. O’Connor hypothesized that the jet was likely muted by the star’s surface or surrounding material before breaking loose. Even though the explosion was quite intense, the resulting x-ray flare was exceptionally mild for something linked with a broad-lined Type Ic supernova.

Over a decade earlier, the Dark Energy Camera on the Víctor M Blanco 4-meter Telescope captured images of a blue source in the same position. That was intriguing since it implied that the star was already fairly active before collapsing. DECam later captured several further photographs, revealing that the supernova was becoming increasingly strong. Meanwhile, the NSF-DOE Vera C. Rubin Observatory produced multiband observations of the event in its COSMOS Deep Meiling field, revealing information on the star’s behavior before to the explosion. The DESI on the Nicholas U. Mayall 4-meter Telescope captured a succession of spectra that helped determine the type of supernova and tracked the light as it spread.

Rastinejad’s team employed both Gemini telescopes, as well as the Gemini Multi-Object Spectrographs and the Goodman spectrograph on the SOAR 4.1-meter Telescope, to gain a comprehensive look at the event at all wavelengths. They examined the data and concluded that the star that went supernova was a Wolf-Rayet star. Born with nearly twenty times the mass of the sun, it had already depleted all of its hydrogen and blown off all of its helium in a series of frenzied explosions. The residual core was largely carbon and oxygen, and the mass loss episodes left behind a variety of material shells: a small tight one near to the star that provided the soft X-ray signal, and a larger one further away that created the supernova’s visible brightness.
[Source]

Reddit on Wednesday announced a series of changes to its infrastructure and tools, designed to make it easier for people to participate on its site, protect against scraping and spam, and aid in the moderation of its online communities. In addition to providing a new suite of moderation tools, the company said it’s working on more advanced abuse prevention systems that could eventually help communities move away from using things like account age and “karma” to determine who’s allowed to post.

Karma, Reddit’s digital reputation system, allows users to raise their score by posting and commenting helpful, friendly, or funny responses that lead to upvotes. Originally designed to weed out spam, bots, and trolls, many communities came to rely on karma and other account-age restrictions that make it difficult for legitimate newcomers to participate in their communities. Reddit says it now wants to shift to stronger, built-in abuse prevention systems to do more of the moderation work, so communities can be more open to new users.

Reddit didn’t say karma would go away entirely with these coming changes, but it did suggest that its importance could dwindle in the future.

“This will make it easier for genuine new users to participate and easier for mods to welcome them with confidence,” Reddit’s announcement stated.

Related to this, the company said it’s expanding the test of its new suite of AI-powered moderation tools, the Rules Hub, which helps moderators by choosing when to automatically enforce certain community rules and what action should be taken when doing so. Initially used by 700-plus communities, Reddit says that all new communities can now test the tool. Later this year, the tool will be widely available to all communities, both new and existing.

With Rules Hub, Reddit uses large language models (LLMs) to determine whether a post or comment matches the intent of a rule, which the company says allows it to “better handle nuance,” natural language, and edge cases.

Reddit also expanded the capabilities of other tools, including one that helps moderators inform users about their community’s rules when posting and commenting, and another that helps members set their flair — a custom tag users append to their name that only appears in the community they’re posting in.

“Today, new users can encounter invisible barriers like account age and karma thresholds, unclear removals, and poor community discovery,” Reddit explained. “We want new users around the world to be able to easily find relevant communities, understand their rules and norms, and make useful contributions.”

The company also said it would make changes to its legacy desktop site, Old Reddit, by shifting its moderator workflows to its new stack and migrating other critical bots.

On Reddit’s second-quarter earnings calls with investors last week, company executives stressed that one of Reddit’s near-term goals was to convert its half-billion weekly active users to daily users through product updates. The company had crushed earnings with revenue of $805 million and earnings per share of $1.25, above estimates, but still saw its stock sink because of what Reddit CEO Steve Huffman described as “choppy” search referral traffic.

Hark, the secretive AI startup founded earlier this year by serial entrepreneur and roboticist Brett Adcock, today announced Handoff, a “computer use agent” (CUA) that it says is among the top-performing in the world at navigating the open web on a user’s behalf — ordering dinner on DoorDash, booking flights on United and Delta, or messaging job candidates on LinkedIn — all autonomously, end-to-end.

Sign-ups open to the public today at hark.com, with availability planned for later this month as part of the initial release of Hark’s software platform.

The company says Handoff recorded the top-ever score on Online-Mind2Web (OM2W), a third-party benchmark with a human-evaluated leaderboard for web agents, posting a 97.7 against 92.8 for OpenAI’s GPT 5.4, 84.1 for Anthropic’s Claude Opus 4.8, and 69 for Google’s Gemini 2.5 Pro.

Hark also says it can serve the model at less than one-tenth the token price of competing frontier models — $0.18 per million input tokens and $2.37 per million output tokens, versus $5 and $30 for GPT 5.5 — with per-turn model latency of 0.8 seconds.

For each request, Handoff spins up a dedicated virtual computer with its own browser, file system, and terminal, and users can connect existing accounts so the agent can log in and act with their saved addresses, payment methods, and history.

Hark’s research uncovered that despite people spending 75% of their screentime every day in a browser, fewer than 1 in 1000 websites have publicly accessible APIs, making it challenging for AI agents to take over the workload.

In a roughly four-minute produced announcement video posted on YouTube and social media, Adcock — seated in a bare warehouse space that doubles as a metaphor for the company’s build-out — speaks a request aloud to Hark (“let’s liven this place up a bit… let’s do some roses, maybe some cherry blossoms”) and Handoff is shown navigating a florist’s website to place the order, while Adcock narrates that unlike a typical chatbot, Handoff “is always working, it’s looping,” and says he now uses it for “all of my recruiting efforts end to end.” In Hark’s announcement blog post, more demos are shown in realtime and 5x speed.

But big some open questions about Handoff remain, especially for potential enterprise customers and users.

High-scoring benchmarks…but against last generation’s models

Notably, the benchmark comparisons Hark provided to VentureBeat for its Handoff AI agent are against GPT 5.5, GPT 5.4, Opus 4.8, and Gemini 2.5 Pro — the prior generation of frontier models.

The current leaders, OpenAI’s GPT-5.6 and Anthropic’s Opus 5, are absent, as are strong open-source computer-use contenders like DeepSeek V4, Kimi K3, and Qwen3.8-Max.

These newer models haven’t published Online-Mind2Web results, and no third party has posted them to the benchmark’s public leaderboard — meaning Hark’s “top-ever” claim cannot currently be checked against the strongest available systems.

The omission is notable because the newest frontier models have posted their largest gains precisely in computer use: on OSWorld 2.0, a related benchmark covering full computer control, Anthropic’s Opus 5 scores roughly 70.6% versus 55.7% for the Opus 4.8 model Hark chose as its comparison point.

The latency comparison comes with similar caveats: the 6.8-second and 6-second per-turn figures Hark cites for GPT 5.5 and Opus 4.8 were measured by Hark, in Hark’s own harness, with the competing models set to their highest — and slowest — reasoning level. No independent latency measurements exist for comparison.

Asked by VentureBeat whether Hark plans to publish comparisons against those newer models, the company did not specify.

Even within Hark’s own chosen comparisons, the “best” framing has an asterisk: on WebTailBench v2, one of the three benchmarks in Hark’s own results table, GPT 5.5 scores 72.3 to Handoff’s 68.6.

Two of the three benchmarks (WebTailBench and an unnamed internal evaluation) were also run inside Hark’s own harness, with pass rates computed by Hark’s internal LLM judge — conditions the company controls.

Hark’s pricing advantage is far clearer: Anthropic’s newer Opus 5 carries the same $5-per-million-input and $25-per-million-output list price as its predecessor, so Handoff’s roughly tenfold cost savings would hold up even against the current frontier — assuming its benchmark performance does too.

Training and file access

Hark’s research preview describes a sensible-sounding pipeline — supervised fine-tuning followed by asynchronous reinforcement learning using the GRPO algorithm, according to materials shared with VentureBeat prior to today’s announcement — but the company acknowledges it has only done post-training so far, with pre-training “planned for later this year.”

That means Handoff is built on top of a base model Hark did not train. Asked which base model it is, and what mix of proprietary and open data Handoff was trained on, Hark hasn’t yet specified.

Another big question mark for enterprise users: who can access the dedicated virtual computers and the files created on them?

A Hark spokesperson said “security and privacy is a primary focus, but this is a technical preview,” adding the company will share more when the product reaches market at the end of the summer.

Adcock’s history leading up to Hark

Hark is Adcock’s fourth company. He previously co-founded the talent marketplace Vettery (sold in 2018 for roughly $100 million), the air-taxi maker Archer Aviation, and the humanoid robotics unicorn Figure AI.

Hark raised a $700 million Series A round in May 2026 at a $6 billion valuation — led by Parkway Venture Capital, with participation from Nvidia, AMD, Intel Capital, Qualcomm Ventures, Salesforce Ventures, and ARK Invest.

Adcock seeded the company with $100 million of his own money and remains founder and CEO of both Figure and Hark simultaneously, a spokesperson confirmed.

Asked how the two companies interact, the spokesperson said Hark models “are being trained on the Figure robots,” but that Adcock has no plans to combine them.

Adcock’s promotional style has drawn skeptics. In April 2025, Fortune correspondent Jason Del Rey reported that Figure’s much-touted BMW partnership was far more modest than Adcock’s public claims of a robot “fleet” performing “end-to-end operations”: BMW spokesperson Steve Wilson said a single Figure robot was practicing picking up parts during non-production hours.

But the partnership has advanced, and as of June 2026, BMW said the Figure 02 robot supported production of more than 30,000 BMW X3 vehicles during a 10 month-period, and that the next-generation Figure 03 robot was being deployed at the plant for a parts-sequencing role in logistics.

On the social network X, Adcock called the story “mischaracterizations and downright lies” and threatened a defamation suit. Two months later, TechCrunch reported that Adcock skipped a promised live demo at a tech conference and sidestepped questions about the BMW deal onstage.

None of that means Handoff’s numbers are wrong. The agent may well be excellent, and the pricing — if it holds — would undercut every major lab.

The applications are in. The TechCrunch Startup Battlefield team made their decisions. Eight Australian startups have earned their spot on the Startup Battlefield stage at Stripe Tour Sydney on August 19 — and they’re ready to pitch for $15,000 in Stripe fee credits, investor attention, and a spot in Startup Battlefield 200 at TechCrunch Disrupt in San Francisco.

They represent the future of Australian tech — from enterprise tech to health and wellness tech to entertainment and media. Here’s who they are.

The eight finalists

Aigentsphere

Independent AI management and governance platform Aigentsphere helps enterprises scale AI safely and well, giving leaders visibility, control, and accountability over their entire AI agent workforce.

Apate.ai

Apate help banks, telcos, and governments dismantle scam operations by engaging scammers in live conversation and turning it into real-time intelligence.

Callease Ai

Callease Ai is the operating system for physical security control rooms, starting with voice AI that automates welfare, escalation, patrol, and many more — the entire calling engine.

Choosey App

Choosey App helps businesses hire instantly and workers get paid instantly through agentic AI-powered matching, workforce management, and same-day pay.

Doomers AI

Doomers AI helps AI and tech companies make product launches trend on X by orchestrating a vetted creator network that reaches the buyers who block ads.

equ

Startup equ helps health and wellness businesses deliver personalized nutrition at scale by embedding equ’s AI engine, built on 10 years of data and 100,000+ users, into their product.

LeadStory

LeadStory is the video intelligence layer powering the next generation of screens, surfacing exact video moments from sports, news, and finance clips to answer natural language queries.

Preve

Preve helps physical therapy clinics improve patient retention and clinical outcomes by automating the treatment plan creation and adherence.

Three will win prizes. One will go to San Francisco. All eight will pitch in front of investors, press, and the Australian tech community. If you want to see the future of Australian startups unfold, register for Stripe Tour Sydney on August 19 →

The stage is set. The judges are ready. Let the pitching begin.

Hosted and MC’d by Isabelle Johannessen, Director of Startup Battlefield.

• The Samsung Galaxy Fit 4 just leaked in FCC regulatory filings
• The documents suggest it will have a screen, unlike the Fitbit Air
• But the leak reveals previous few other details

The Fitbit Air has proved that you don’t need to pay a high price tag to get a great wearable, and now it looks like Samsung is getting in on the act with an alternative of its own. And with more details leaking out, we’re getting a clearer picture of the upcoming device than ever — but plenty of unanswered questions remain.

New FCC regulatory documents (spotted by Gadgets & Wearables) have spilled the beans on the much-rumored Samsung Galaxy Fit 4. There, you’ll find various nuggets of info on what we can expect from the product, as well as a few things that it likely won’t do.

At a time when storage space commands a premium price, SanDisk’s Extreme Fit drive is worth a look.

What is SanDisk Extreme Fit?

SanDisk

How fast is the SanDisk Extreme Fit USB-C?

SanDisk

Is the SanDisk Extreme Fit USB-C compatible with iPhones?

DenPhotos/Shutterstock