Connect with us
DAPA Banner

Tech

ConsentFix v3 attacks target Azure with automated OAuth abuse

Published

on

ConsentFix v3 attacks target Azure with automated OAuth abuse

A new attack type, dubbed ConsentFix v3, has been circulating on hacker forums as an improved technique that automates attacks against Microsoft Azure.

The first version of ConsentFix was presented by Push Security last December as a variation of ClickFix for OAuth phishing attacks, which tricks victims into completing a legitimate Microsoft login flow via the Azure CLI.

Using social engineering, the attacker fooled victims into pasting a localhost URL containing an OAuth authorization code that can be used to obtain tokens and hijack the account without passwords, despite multi-factor authentication (MFA).

ConsentFix v2 was developed by researcher John Hammond as a refined version of Push’s original, replacing manual copy/paste with drag-and-drop of the localhost URL, making the phishing flow smoother and more convincing.

Advertisement

ConsentFix v3 preserves the core idea of abusing the OAuth2 authorization code flow and targeting first-party Microsoft apps that are pre-trusted and pre-consented.

However, it brings an improvement by incorporating automation and scalability.

ConsentFix v3 attack flow

According to information retrieved from hacker forums where the new technique is promoted, the attack begins by verifying the presence of Azure in the target environment by checking for valid tenant IDs.

This is followed by gathering employee details such as names, roles, and email addresses to support impersonation.

Advertisement

Next, the attackers create multiple accounts across services such as Outlook, Tutanota, Cloudflare, DocSend, Hunter.io, and Pipedream to support phishing, hosting, data gathering, and exfiltration operations.

Push Security researchers explain that Pipedream, a free-to-use serverless integration platform, plays a central part in automating the attack, serving three critical roles:

  1. Is the webhook endpoint that receives the victim’s authorization code
  2. It is the automation engine that immediately exchanges that code for a refresh token via Microsoft’s API
  3. It is the central collector that makes captured tokens available to us in real time.
Creating the Pipedream model
Creating the Pipedream model
Source: Push Security

In the next phase, the attacker deploys a phishing page hosted on Cloudflare Pages that mimics a legitimate Microsoft/Azure interface and initiates a real OAuth flow through Microsoft’s login endpoint.

When the victim interacts with the page, they are redirected to a localhost URL containing an OAuth authorization code, which they are tricked into pasting or dragging back into the phishing page.

This enables the data exfiltration pipeline, in which the page sends the captured URL to a Pipedream webhook, and the backend automation immediately exchanges the authorization code for tokens.

Advertisement

The phishing emails can be highly personalized, generated from harvested data, and feature malicious links embedded inside a PDF hosted on DocSend to improve credibility and bypass spam filtering.

Generating personalized phishing emails
Generating personalized phishing emails
Source: Push Security

In the post-exploitation stage, the obtained tokens are imported into Specter Portal, allowing the attacker to interact with compromised Microsoft environments and access resources permitted by the token, such as email, files, and other services tied to the account.

Push Security noted that its testing of ConsentFix v3 relied on its personal Microsoft accounts; as a result, it is difficult to fully appreciate the impact, which depends on permissions, services, and tenant settings, among other factors.

In terms of mitigating ConsentFix risks, Push notes that the endeavor is complicated because trust in first-party apps is architectural, and that Family of Client IDs (FOCI), Microsoft applications that share permissions and refresh tokens, is useful otherwise.

However, there are still steps administrators can take, such as applying token binding to trusted devices, setting up behavioral detection rules, and applying app authentication restrictions.

Advertisement

While ConsentFix attacks are used in actual campaigns, it is unclear if the v3 variant has gained any traction among cybercriminals yet.

 


article image

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Mark Zuckerberg backs $500 million push to build AI models of human cells as part of long-term effort to cure disease

Published

on


  • Global effort seeks massive biological datasets to power advanced cellular AI models
  • Predictive cell simulations could accelerate disease research and future medical treatments
  • Questions remain about data ownership as biological datasets expand worldwide

Meta billionaire Mark Zuckerberg is backing a sweeping $500 million push to build massive biological datasets that could power AI models capable of simulating human cells.

The effort, called the Virtual Biology Initiative, comes from Biohub, the nonprofit led by Zuckerberg and Priscilla Chan, M.D., and focuses on creating what scientists describe as predictive models of life at the cellular level.

Source link

Continue Reading

Tech

Space data centers sound like a pipe dream. What if we put them on lamp posts?

Published

on

SpaceX has its own ambitious plans for AI data centers in space, while Microsoft has explored the idea by sinking them underwater. However, building AI data centers is expensive and power-intensive. This is why a UK firm wants to build one using street lamp posts in Nigeria, and it has already signed a deal to do it.

Warwickshire-based Conflow Power Group has agreed with Nigeria’s Katsina State Government to deploy 50,000 solar-powered smart lamp posts called iLamps across the state (via BBC). Each unit runs on a cylindrical solar panel and battery, powering a low-energy Nvidia chip that draws just 15 watts.

Networked together, CPG says the units would deliver 13.75 petaOPS of combined computing power without pulling a single watt from the grid. For comparison, a traditional data center typically needs 300 megawatts of grid power, millions of liters of cooling water, and years to build.

What else can these lamp posts actually do?

Each iLamp can support cameras for traffic enforcement, spotting speeding vehicles, parking violations, and seatbelt non-compliance. Facial recognition for identifying wanted or missing persons is also on the roadmap, though no such deployment exists yet.

The units can also offer public WiFi and Bluetooth connectivity. Katsina will earn revenue from traffic fines captured by the cameras, with CPG taking a 20% share after three years. Income from renting out computing power to AI companies is funneled into a green bond that funds installation and maintenance.

Advertisement

Can lamp posts really replace data centers?

Experts say the iLamps won’t replace conventional data centers for heavy AI workloads since the distance between posts makes communication too slow for demanding tasks. But they could serve as useful access points for lighter AI tasks, functioning similarly to mobile phone masts.

If all ongoing negotiations across seven Nigerian states, universities, and institutions are finalized, the total network could exceed 300,000 iLamp units, forming the largest distributed AI compute network on the continent.

All of this comes as AI infrastructure continues to strain global resources, with experts warning it could significantly worsen the e-waste crisis already choking the planet.

Source link

Advertisement
Continue Reading

Tech

How this systems analyst navigates personal and professional change

Published

on

Bárbara Oliveira Medeiros discusses how change, while intimidating, often leads to significant career growth.

Amgen’s Bárbara Oliveira Medeiros, a specialist IS business system analyst, was always drawn to maths, numbers and chemistry, so engineering was, for her, a “natural fit”.

She told SiliconRepublic.com, “I studied chemical engineering in Brazil and originally planned to focus my career around industrial operations. That all changed after I graduated and I was introduced to data historian systems during an internship.”

When she saw how specialised databases could capture and organise process information from the plant floor, her eyes were opened to the value of applying data in operational settings.

Advertisement

“Over the course of a few years, I developed expertise in data and technology. Travelling down that path led me to Ireland and Amgen, which has given me the opportunity to combine my background in engineering with data analytics and business systems.”

You have worked across a range of industries – how do you develop skills to match expectations?

Working across industries has taught me that while each one has its own language, priorities and pace, many core skills are the same. Irrespective of the industry, the key is to stay curious and learn quickly when technical contexts change. In my experience, one constant is using data to understand operations, identify opportunities and support colleagues to work more effectively.

I listen carefully, understand what matters most to each team and then connect that to the technical tools available. The technical side matters but so does understanding the business problem behind the request. When you can do both, it becomes much easier to add value.

You relocated for your career, so have you any advice for how to manage professional change?

Relocating from Brazil to Ireland was a big change. It was also one of my best life decisions. My advice is to be open to new opportunities, even if they aren’t part of your original career plan. And while a big change in your professional life can be uncomfortable, it is also where the biggest growth takes place. A new role, country and culture all take a lot of adjustment, so leave yourself time to settle in.

Advertisement

When I relocated, I was fortunate for two reasons. First, Brazilians and Irish people have a lot in common – they are warm, friendly and have big hearts. It meant I settled in faster than expected, despite the change in weather. My other big advantage was working for Amgen. I joined in February 2025 and from day one, I was welcomed and supported.

What is your typical day-to-day like, if there is such a thing?

A typical day doesn’t exist and that’s one of the things I enjoy most about my job. The one constant is a focus on problem-solving across departments and functions. Colleagues come to my team with challenges related to data, reporting or process efficiency. Our job is to find solutions that make their work easier and more productive. That might mean automating part of a process, improving access to information or helping teams use data more effectively in decision-making.

Some days are carefully planned, while others can change quickly if an urgent matter arises. It means that I often switch between technical discussions, business priorities and project conversations. I find the variety keeps things interesting and it makes my job really rewarding.

What skills do you utilise in your role and are any unexpected?

Technical expertise is crucial and when I entered this field, I expected it would focus primarily on systems and data analysis. However, over time, I came to realise that communication is just as important. A large part of my role is understanding the challenges that my colleagues face and how I can apply my knowledge to deliver solutions that support them. It means I need to listen attentively, ask the right questions and explain technical concepts clearly.

Advertisement

As I start to focus on people management, I am developing leadership skills. Although I work in a technical field, it is still vital to build trust, support colleagues and help move projects forward through people.

Are there particular skills that stand out as the most important?

Problem-solving is a core skill because you cannot approach every challenge in the same way. Our work begins when someone brings us an issue and asks how data or technology can improve it. Adaptability is also essential because technology changes quickly and every department has different needs, priorities and pressures. Those skills build on the technical foundation needed for the job.

However, communication is also central because good ideas only make an impact when people understand them and can work together around them. You still need strong technical understanding, but what really makes the difference is being able to connect that expertise to real business needs. That is what turns a tool into something that genuinely improves how people work.

As someone who oversees teams and project work, how do you ensure a collaborative environment?

My team focuses on addressing challenges across the business, so it’s important to create an environment where my colleagues feel comfortable bringing ideas and solutions forward. Two-way communication is also key; rather than treating a business challenge purely as a technical issue, we listen closely, understand the real need and then work together on a solution. Amgen’s workplace culture makes this type of collaboration possible. It empowers us to work in an open and supportive manner across various departments and functions, with the shared goal of supporting patients.

Advertisement
What do you enjoy most about your role?

I’m fortunate to work with truly talented people. My colleagues have a real depth of expertise and they bring a variety of perspectives to make processes faster and more effective. Working in technology also means that my role keeps evolving. I’m constantly learning on the job and I find that very motivating.

What I enjoy most, though, is the feeling that my work makes a positive impact in the real world. I’m able to make a clear connection between data-led decision-making and delivering medicines to people who need them – that’s really rewarding.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Advertisement

Source link

Continue Reading

Tech

Disneyland Now Uses Face Recognition on Visitors

Published

on

A gunman attempted to enter the White House Correspondents’ Dinner in Washington, DC, last weekend, while President Donald Trump, Vice President JD Vance, and other administration officials were in attendance. Media reports and Trump himself quickly identified the suspected shooter as 31-year-old engineer and computer scientist Cole Tomas Allen. The California resident was arrested at the scene on Saturday and appeared Monday in the US District Court for the District of Columbia to face three federal charges: attempting to assassinate the president, transportation of a firearm in interstate commerce, and discharge of a firearm during a crime of violence.

The authentication standards body known as the FIDO Alliance announced working groups this week along with Google and Mastercard to develop technical guardrails for validating and protecting transactions initiated by an AI agent. Meanwhile, given the proliferation and increasing sensitivity of some work using AI, OpenAI rolled out an “advanced” security risk mode for ChatGPT and Codex accounts facing heightened risk of attack.

New research this week shed light on an incident in which 90,000 screenshots pulled from a European celebrity’s phone were exposed online—underscoring the risks of commercially available spyware both as an invasion of personal privacy and a threat for widespread data breaches and abuse. And WIRED looked at arrests in the United Arab Emirates resulting from people sharing screenshots and other online content.

And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Advertisement

The Happiest Place on Earth just got a bit creepier. The Walt Disney Company announced this week that visitors to its Disneyland Park and Disney California Adventure Park will have the option to “choose” to enter the park through a lane that’s equipped with face recognition technology. While the company says subjecting yourself to face recognition is “entirely optional,” it notes that “you may still have your image taken” if you enter the parks through lanes without face recognition systems. Disney’s face recognition, like many others, works by converting images of people’s faces into a numerical value, which can then be used to match faces in other images. The company says these numerical values will be deleted after 30 days, “except in cases where data must be maintained for legal or fraud-prevention purposes.”

Face recognition systems are widely used across the United States and the world. Law enforcement agencies frequently use the technology, but it has also proliferated into everyday aspects of life, from airports to MLB and NFL stadiums to Madison Square Garden.

Anthropic’s Mythos Preview AI model has been described as so adept at digging up hackable bugs in software that its use has so far been carefully restricted to prevent it from falling into the hands of malicious hackers. So perhaps it would be more of a surprise if the National Security Agency was not already trying it out.

Bloomberg News and Axios reported this week that the NSA was among the agencies and companies granted early access to Mythos, which has been limited to 40 organizations so far, according to Axios. The agency has used the tool to hunt for bugs in Microsoft’s software—naturally, given that it still runs on the majority of the world’s PCs—and has been impressed with its speed and effectiveness in finding exploitable vulnerabilities, according to sources who spoke anonymously to Bloomberg. The agency’s remit, after all, includes some elements of helping the US government discover and patch security vulnerabilities in the software it uses, as well as sometimes exploiting those vulnerabilities in the NSA’s own operations.

Advertisement

The NSA’s testing or adoption of Anthropic’s AI tool appears to have proceeded in spite of the Department of Defense’s declared ban on Anthropic, which followed Defense secretary Pete Hegseth’s claim that the company represented a supply chain risk. Hegseth said in February, however, that the DOD will transition away from Anthropic’s tools over six months, and Anthropic has sued to prevent the ban from being enacted. Given that the NSA is part of the DOD, it’s not clear for now whether the NSA is merely using Mythos in the window before the ban goes into effect, or if the tool is powerful enough to persuade the NSA to rethink its ban—or make an exception.

The ransomware group known as Scattered Spider has been responsible for some of the most damaging extortion-focused hacking campaigns in recent memory, including the breaches of MGM Resorts, Caesars Entertainment, and retailers like M&S and Harrods. It’s also distinguished among ransomware gangs for its membership: Often very young, English-speaking hackers based in countries who are cooperative with US law enforcement—and, therefore, tend to get arrested.

The latest alleged member of the group to be identified and charged is 19-year-old Peter Stokes, who was arrested at an airport in Finland, where he intended to board a flight to Japan. According to the Chicago Tribune, Stokes’ alleged involvement in the targeting of four Scattered Spider victim companies is described in a criminal complaint that has since been placed under seal. Stokes is reportedly accused of helping to steal millions from those unidentified victim companies, which included an online communications platform and a luxury retailer. According to the complaint, he also led a jet-set life, traveling from Dubai to Thailand to New York and appearing in one photo wearing a diamond-studded necklace that read “HACK THE PLANET.”

A Medicare database left accessible on the open internet inadvertently revealed the Social Security numbers and other personal information for health care providers around the US, the Washington Post reports. The database was linked to an online director for the Centers for Medicare and Medicaid Services (CMS), which allowed Medicare patients to check which insurance plans health care providers accept. According to the Post, the exposed sensitive data was online for “at least several weeks.” Rollout of the directory is part of an effort by the Trump administration to “create a national database of health care providers,” the Post reports, which is being overseen by Amy Gleason, the acting head of the US DOGE Service who also serves as an official at CMS.

Advertisement

Source link

Continue Reading

Tech

15-year-old detained over French govt agency data breach

Published

on

15-year-old detained over French govt agency data breach

French authorities have detained a 15-year-old suspected of selling data stolen in a cyberattack on France Titres (ANTS), the country’s agency for issuing and managing administrative documents.

The government agency confirmed the breach and the authenticity of the data offered for sale on a cybercriminal forum by someone using the alias ‘breach3d’.

​On April 13, ANTS detected suspicious activity on its network and notified authorities a few days later, on April 16, the Paris Prosecutor’s Office said.

Following an investigation, the authorities believe that the suspected 15-year-old used the moniker ‘breach3d’ to offer for sale between 12 and 18 million records stolen in the ANTS data breach.

Advertisement

The minor faces charges for unauthorized access, persistence, and data exfiltration from a state-run automated personal data processing system, as well as for possession of software that enables the offenses.

The offenses carry a maximum sentence of seven years in prison and a fine of EUR 300,000, the Paris Prosecutor’s Office notes in a press release.

A judge is now overseeing the case. Based on the evidence found, prosecutors are seeking formal charges and have requested that the minor be placed under judicial supervision.

Personal information exposed

On April 20, ANTS disclosed that a threat actor breached its systems and accessed data from individual and professional accounts on the ants.gouv.fr portal.

Advertisement

​The government agency determined that among the affected data types were full names, email addresses, dates of birth, postal addresses, and phone numbers.

The announcement came after a threat actor claimed to have compromised ANTS and offered to sell up to 19 million records allegedly stolen in the attack.

In an update on the incident, the agency said that the number of impacted accounts was 11.7 million, but the stolen data could not be used for unauthorized access.

Pending the investigating judge’s decision, the 15-year-old minor has not been formally charged.

Advertisement

article image

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

Source link

Continue Reading

Tech

IR Device Control That Lives Off The Cloud

Published

on

There are lots of smart home systems that will let you blast your older dumb appliances with infrared to control them. However, many are tied to ugly cloud systems that can frustrate you on a regular basis. [Steelcuts] whipped up a cloudless solution to this problem instead.

IR2MQTT does pretty much exactly what it says in the name. It allows integrating things like air conditioners and televisions into a Home Assistant setup with the use of an IR blaster and a neat, tidy web app. You use it with an ESP32 or ESP8266 running a firmware based on ESPHome to actually do the IR blasting. In turn, IR2MQTT is a back-end plus a web interface that lets you setup all your IR devices without having to manually capture IR codes and create YAML files to do everything. It’s also integrated with large databases of IR codes for common appliances so in many cases, you can just look up your gear and get it working the easy way.

Sometimes all you need to get the job done is an IR LED and the will to use it. If you’re cooking up your own infrared hacks, don’t hesitate to let us know on the tipsline.

Advertisement

Source link

Advertisement
Continue Reading

Tech

Chinese courts rule AI replacement is not legal grounds for firing workers as global tech layoffs hit 78,000

Published

on

TL;DR

Chinese courts in Hangzhou and Beijing have ruled in two separate cases that companies cannot fire workers simply to replace them with AI, establishing that AI adoption is a strategic business choice rather than an unforeseeable change in circumstances under China’s Labour Contract Law. The rulings arrive as 78,000 tech workers have been laid off globally in early 2026 with nearly half attributed to AI, and create a stark contrast with the US and EU, where no equivalent legal protection exists.

A quality assurance supervisor identified only as Zhou joined a technology company in Hangzhou in November 2022. His job was to work with AI large language models, optimising their outputs and filtering sensitive content. He earned 25,000 yuan per month, roughly $3,640. In 2024, the company decided that its AI systems had improved to the point where Zhou’s role could be automated.

Advertisement

It reassigned him to a lower-level position with a 40 per cent pay cut, reducing his salary to 15,000 yuan. Zhou refused. The company fired him. Zhou filed for arbitration. The arbitration panel ruled the dismissal unlawful. The company appealed. The Hangzhou Intermediate People’s Court upheld the ruling.

The court found that a company’s decision to adopt AI is a strategic business choice, not an unforeseeable change in objective circumstances, and therefore does not qualify as legal grounds for termination under China’s Labour Contract Law. The company was ordered to pay compensation. The ruling, published this week, is the second Chinese court decision in six months to establish the same principle: you cannot fire a worker in China simply because an AI can now do their job.

The precedent

The first case was decided in Beijing. An employee surnamed Liu had worked as a data collector at a technology company since 2009, responsible for traditional manual map data collection. In early 2024, the company shifted entirely from manual collection to AI-driven automated data collection, cancelled its navigation products department, and terminated Liu’s contract, citing a major change in objective circumstances that made the contract unperformable.

The Beijing Municipal Human Resources and Social Security Bureau published the case in December 2025 as one of its ten most significant labour arbitration decisions of the year. The arbitration panel ruled that the introduction of AI fell within the scope of the employer’s autonomous business decisions and represented technological innovation proactively implemented to adapt to market conditions.

Such decisions, the panel found, may require adjustments to job structures, but those adjustments fall within the risks an employer should reasonably foresee during normal business operations. The company sued to overturn the arbitration. Both the trial court and the appeals court upheld the ruling.

Advertisement

The legal reasoning in both cases turns on Article 40 of China’s Labour Contract Law, which permits termination when objective circumstances materially change and render a contract unperformable. The provision is typically applied to events genuinely beyond the employer’s control: force majeure, government-mandated relocations, production suspensions caused by regulatory changes.

Chinese courts have now determined, in two separate jurisdictions, that AI adoption does not meet this standard. The technology was not imposed on the companies. It was chosen by them. The courts drew a distinction between an external shock that makes a job impossible and an internal decision that makes a job redundant. The first is a legal basis for termination. The second is not.

The context

The rulings arrive at a moment when the global technology industry is cutting jobs at a pace not seen since the post-pandemic corrections of 2022 and 2023. More than 78,000 technology workers were laid off in the first four months of 2026, and nearly half of those cuts were directly attributed to AI replacing human roles. Meta cut approximately 8,000 positions in May alone, with every major restructuring announcement citing AI as the primary driver.

Oracle eliminated between 20,000 and 30,000 employees in March. Block’s chief executive stated that the company’s reduction from 10,000 to 6,000 employees was driven by growing AI capabilities. Meta’s restructuring is the clearest example of the pattern: traditional roles are eliminated, the savings are redirected to AI infrastructure, and the headcount that remains is reoriented around building and operating AI systems rather than performing the tasks those systems are replacing.

Advertisement

China is narrowing the gap with the United States on AI performance while spending a fraction of what American companies invest in compute. The country has no interest in slowing the adoption of AI in its economy. China launched a months-long enforcement campaign against AI misuse in 2026, targeting deepfakes, fraud, and disinformation, and has introduced mandatory labelling standards for AI-generated content and new regulations governing AI chatbots and virtual human services.

The government’s approach is not to restrict AI but to regulate its applications while ensuring that the economic benefits do not come at the expense of social stability. China’s urban youth unemployment rate reached 15.3 per cent in March, and the political sensitivity of mass layoffs in an economy that is already struggling with deflation, a property crisis, and weak consumer demand makes the court rulings as much about maintaining order as about interpreting contract law.

The comparison

The United States has no equivalent protection. American employment law operates on an at-will basis in every state except Montana, meaning employers can terminate workers for any reason that is not specifically prohibited by statute, and being replaced by AI is not a prohibited reason.

A Senate bill has been introduced that would require companies to file quarterly reports to the Department of Labor identifying how many employees were laid off because their functions were automated by AI, but the legislation has not passed and is not expected to in the current Congress. Illinois requires employers to notify workers if AI is used in hiring, discipline, or discharge decisions. Colorado’s AI Act, taking effect in mid-2026, mandates risk management policies and annual assessments of AI’s impact on employment decisions. Neither state has enacted anything resembling what Chinese courts have established: a legal principle that says AI replacement alone is not grounds for firing someone.

Advertisement

The European Union’s AI Act addresses AI in employment by classifying AI systems used for recruiting, screening, performance evaluation, and other workplace decisions as high-risk, subject to requirements for human oversight, worker notification, and logging. The high-risk obligations take full effect in August 2026. But the AI Act does not prohibit AI-driven layoffs. It regulates how AI is used in employment decisions, not whether a company can eliminate positions because of AI.

The European Trade Union Confederation has called for stronger protections, and legal scholars have proposed a European AI Social Compact that would combine employment support, training, and social protections to cushion displacement. None of these proposals have been enacted. The gap between China’s position and the West’s is not that Europe and America are unaware of the problem. It is that they have chosen, so far, not to solve it through the courts or through legislation.

The tension

The Chinese rulings create a legal framework that is coherent on its own terms but produces a genuine tension for companies operating in the country. If AI adoption is a strategic business choice rather than an unforeseeable change in circumstances, and if strategic business choices cannot justify termination, then companies that invest in AI systems that automate existing roles must either retrain the workers those systems replace, reassign them to equivalent positions at equivalent pay, or continue employing them in roles that the company has determined are no longer necessary.

The courts have said that the costs of technological transformation should not be borne solely by workers. The implication is that they should be borne by the companies that chose to transform.

Advertisement

What AI is actually doing to jobs is more complicated than the headlines suggest. Roughly 71 per cent of European firms are reconsidering job responsibilities because of AI, but reconsidering is not the same as eliminating. Klarna fired 700 customer service workers and replaced them with an AI chatbot in 2024, only to begin rehiring human agents in 2026 after repeat contacts jumped 25 per cent and customer satisfaction deteriorated on complex interactions. The CEO admitted publicly that the strategy had failed.

The pattern across the early adopters is that AI replaces tasks more effectively than it replaces jobs, and that the companies which cut deepest are often the first to discover that the remaining human work, the judgment, the escalation, the context that the model cannot hold, is more valuable than they estimated when they decided to automate.

China’s courts have not said that companies cannot use AI. They have said that companies cannot use AI as a pretext to fire people. The distinction matters because it forces a specific organisational behaviour: if you automate a role, you must find another role for the person who held it, at comparable terms. That is expensive. It is also, the courts have decided, the law.

Whether it makes Chinese companies less competitive or more resilient will depend on whether AI actually replaces the workers or merely changes what the workers do. The early evidence, from Klarna to the 78,000 layoffs to the courts in Hangzhou and Beijing, suggests that the answer is not yet clear, and that China has decided it would rather err on the side of the worker until it is.

Advertisement

Source link

Continue Reading

Tech

FDA’s approval of Otarmeni, the first gene therapy for hereditary deafness

Published

on

In a lab room, a toddler, deaf from birth, sits while a tone plays. There’s no reaction. His face does not change.

Six weeks later, after a single injection of an experimental gene therapy, the same toddler is back in the same room. The tone plays. The toddler’s head turns toward the sound. And somewhere just off screen, the child’s grandfather says his name. The boy turns and looks. He can hear.

“When the parents realized their child had a response to sound they cried,” says Dr. Yilai Shu of the Eye & ENT Hospital of Fudan University, who co-led the trial, in a video that showed the results. “The whole family cried.” The video cuts to another child, thirteen weeks post-treatment, dancing to music.

This is what gene therapy can do in 2026. The clip comes from the international clinical trial of an OTOF gene therapy run by Mass Eye and Ear and China’s Fudan University that provided the underlying science behind a drug the Food and Drug Administration (FDA) approved last week.

Advertisement

On April 23, the FDA granted accelerated approval to Otarmeni, a gene therapy from the pharma company Regeneron for severe-to-profound hearing loss caused by mutations in a gene called OTOF. In a pivotal trial, 80 percent of treated patients gained measurable hearing, and 42 percent reached the level needed to pick up whispers. Two and a half years after treatment, 90 percent of patients in the underlying multi-center trial were still hearing.

It’s a drug that certainly feels like a miracle to those in the trials, taking patients from silence to sound. But what can feel almost as miraculous is how far the broader field of gene therapies like Otarmeni — which deliver a working copy of a broken gene directly into a patient’s cells — have come.

In 1999, the nascent field of gene therapy all but collapsed when a teenager named Jesse Gelsinger died four days after being injected with an experimental gene therapy at the University of Pennsylvania, the first publicly identified death in a gene therapy clinical trial. In the years that followed, funding evaporated, careers ended, and “gene therapy” became a cautionary tale.

It took years and major changes in how gene therapies are delivered for the field to recover. And now, 27 years after Gelsinger’s tragic death, we have a gene therapy that can effectively reverse some kinds of congenital hearing loss. The next decade is no longer about whether gene therapy can deliver clinical results. It’s about whether it can deliver results to enough patients, at prices people can actually pay, for diseases that affect more than a few hundred kids a year.

Advertisement

Get those answers right, and what feels like a miracle to some in 2026 could become ordinary medicine.

After Gelsinger died, the FDA halted gene therapy trials in the US, the National Institutes of Health tightened oversight, and the principal investigator of the Penn study — James Wilson — was barred from clinical trials for five years and stripped of his administrative titles. In the lean years that followed, two things happened.

The first was a change in delivery. Gene therapies use engineered viruses to deliver restorative genes to a patient’s cells. The therapy used on Gelsinger was carried by an adenovirus, which are highly immunogenic, meaning the human immune system recognizes them and reacts violently. It was that immune reaction that killed Gelsinger.

In the aftermath, the field increasingly turned to adeno-associated viruses (AAV), which are smaller, more tolerable, and capable of slipping a payload into the right cells without setting off a five-alarm immune reaction. AAV vectors are now the workhorse of in vivo gene therapy, including in Otarmeni.

Advertisement

The second thing that happened was CRISPR. Adapted in 2012 by Jennifer Doudna and Emmanuelle Charpentier into a precision gene-editing tool, CRISPR could do something AAV could not: find a specific spot in the patient’s own DNA and rewrite the letters there, correcting the broken gene in place. CRISPR also earned gene therapy a cultural moment it hadn’t had since before Gelsinger. Money and talent flooded back into the field — including into the AAV programs that produced Otarmeni.

The clearest sign something has shifted in the field is the lengthening list of therapy approvals. In December 2017, the FDA cleared Luxturna for hereditary blindness from RPE65 mutations — the first gene therapy in the US for an inherited disease. Two years later, Zolgensma was approved for spinal muscular atrophy, a wasting disease that kills children before age two in its severe form. In 2022, Hemgenix made hemophilia B the first bleeding disorder with a one-shot fix. In 2023, Casgevy and Lyfgenia did the same for sickle cell, with Casegevy becoming the first FDA-approved CRISPR therapy.

The sickle cell approvals matter most because they are the first for a patient population that is large; 100,000 Americans suffer from it — mostly Black, and historically underserved. The gene therapies are also proof of concept that the underlying CRISPR mechanism can be redirected at multiple different targets. Verve Therapeutics is using base editing to permanently disable PCSK9, a gene that controls how much LDL cholesterol stays in the bloodstream, with the promise of one-time treatment instead of daily statins for patients at high cardiovascular risk. Early trial data showed a 53 percent average drop in LDL cholesterol. Trials are open for additional hereditary-blindness genes, Pompe disease, and a long list of single-gene conditions.

The science is working, but paying for it is another matter.

Advertisement

These are the list prices for the recent approvals: Luxturna at $850,000 per patient, Zolgensma at $2.13 million, Casgevy at $2.2 million, Lyfgenia at $3.1 million, Hemgenix at $3.5 million. Two-thirds of US sickle cell patients are on Medicaid, and only 16,000 are eligible for Casgevy under the current label. Regeneron has pledged to provide Otarmeni for free in the US, but that works only because the OTOF patient pool is small — an estimated 50 babies a year. That math won’t work for more common disorders.

While cost may not be a problem for the families that could qualify for Otarmeni, it’s not the only concern. Cochlear implants, the standard treatment for OTOF patients for decades, have been contested within Deaf culture since the 1980s, with many arguing that deafness should be seen as identity rather than deficit. Gene therapy applied to infants makes that question all the more fraught, since the children treated with gene therapy cannot consent to the change. And not everyone would make that choice.

Beyond economic and cultural questions, we lack gene therapy for Alzheimer’s, schizophrenia, or any of the polygenic — meaning, caused by multiple genes — conditions that cause massive amounts of suffering. The cochlear is a good gene-therapy target because it is small and accessible, and OTOF is a single-gene disorder. The brain and Alzheimer’s are neither of those things. The platform that is working in one child’s inner ear in 2026 is not about to deliver universal cures by 2030, or well beyond.

What gene therapies will do, however, is keep filling in the list. The next time a parent gets a rare-disease diagnosis for their child, the question will increasingly be not whether someone is working on a gene therapy, but how soon it will be ready.

Advertisement

A version of this story originally appeared in the Good News newsletter. Sign up here!

Source link

Advertisement
Continue Reading

Tech

Cork HQ for new onshore renewables company Perigus

Published

on

Perigus Energy, formerly part of Ørsted, has been established following Copenhagen Infrastructure Partners’ acquisition of Ørsted’s European onshore business.

A new onshore renewable energy company has launched in Europe following the completion of Copenhagen Infrastructure Partners (CIP)’s acquisition of Ørsted’s European onshore business, with Cork chosen as its European headquarters.

Perigus Energy already operates across Ireland, Germany, the UK and Spain, with a combined operational and under-construction capacity of 826MW and a multi-gigawatt development pipeline.

The company said Ireland is central to its new operations. Perigus has 373MW of operational onshore wind farms across the island, with a further 179MW currently under construction. Its people, assets and development pipeline here are unaffected by the acquisition.

Advertisement

Two Irish projects are set to reach key milestones in the near term, according to Perigus. The Garreenleen solar project in Carlow, the company’s first solar project in Ireland, is due to be energised this month and will generate 81MW of clean electricity, enough to power around 29,000 homes.

In Tipperary, the Farranrory wind farm is expected to be fully operational later this year, adding nine turbines and 43.2MW of capacity.

Perigus Energy has also secured planning permission for the Brittas wind farm in Tipperary, consent for the 170MW Cappakeel solar farm in Laois, and “provisional success” for the Lodgewood battery energy storage project in Wexford following the latest EirGrid and SONI capacity market auction.

TJ Hunter, Perigus managing director for Ireland and the UK, said the Cork headquarters decision reflects both the company’s heritage and long-term ambitions on the island.

Advertisement

“While our name is new, we are an experienced team with a proven track record of delivery in Ireland since the opening of Owenreagh wind farm in Co Tyrone in 1997,” he said.

CEO Kieran White described the launch as “a very exciting next chapter”, adding that CIP’s backing would enhance the company’s ability to deliver across its investment-ready pipeline spanning wind, solar and battery storage.

Perigus Energy employs more than 200 people across offices in Ireland, Germany, the UK and Spain.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Advertisement

Source link

Continue Reading

Tech

Elon takes the stand, Big Tech drops big numbers, and a Seattle VC gets in on a billion-dollar deal

Published

on

This week on the GeekWire Podcast: What it was like inside the Oakland federal courthouse where Elon Musk is suing OpenAI, Sam Altman, and Microsoft, with jury selection revealing just how hard it is to find anyone neutral about Musk these days.

Meanwhile, Microsoft and OpenAI restructured their partnership the same morning the trial began — and less than 24 hours later, OpenAI’s models landed on Amazon’s cloud.

Then, Microsoft and Amazon both dropped blockbuster earnings, with Azure up 40%, AWS posting its fastest growth in 15 quarters, and the two companies combining for nearly $400 billion in capital spending this year alone.

We also discuss a wild Semafor story about a serial entrepreneur who handed his entire life over to an AI agent that now emails people as him, sets up meetings without his knowledge, and even ordered him a computer.

Plus, the story of how Seattle’s Flying Fish Partners — a VC firm with less than $250 million under management — hustled its way into a $1.1 billion seed round alongside Sequoia, Google, and Nvidia. Then we tackle the quickly debunked rumor that Mark Zuckerberg and Tim Cook might buy the Seahawks. And finally, the return of the GeekWire Trivia Challenge.

Advertisement

Subscribe to GeekWire in Apple Podcasts, Spotify, or wherever you listen.

Audio editing by Curt Milton.

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025