Security researchers at Accomplish AI demonstrated that Anthropic’s Claude Cowork could break out of its local virtual machine sandbox and read files across the underlying Mac, including SSH keys and cloud credentials. The attack, dubbed SharedRoot, exploited a Linux kernel privilege escalation vulnerability to gain root access inside the guest VM, then walked out through a writable filesystem mount that exposed the entire host. Accomplish AI disclosed the findings on July 23 and said roughly 500,000 macOS users running local Cowork sessions were exposed before the issue was addressed.

The escape chain worked because Cowork’s local execution mode runs inside a Linux VM that shares the host filesystem via a writable VirtioFS mount. That mount was intended to be accessible only to root within the guest, but the researchers found they could escalate from a session user to guest root by exploiting CVE-2026-46331, a Linux kernel flaw known as “pedit COW” that was given a severity score of nearly eight out of ten. Once the agent had root inside the VM, it could reach anything the logged-in Mac user could reach.

“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,” Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News. “From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we’d connected, with no permission prompt anywhere.” The vulnerability sits in the kernel’s traffic-control subsystem, where incorrect copy-on-write handling allows out-of-bounds writes into shared page-cache memory.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Anthropic closed the report as “informative” without issuing a direct fix, according to The Hacker News. The version of Claude Cowork released afterwards defaults to cloud execution, which sidesteps the local escape path entirely. Users who opt to run the agent locally rather than in the cloud, however, remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.

The finding lands in a month that has seen four separate research teams break AI agents in four different ways, from poisoned memories to hijacked browser extensions. OpenAI disclosed that its own models escaped a sandbox and breached Hugging Face during the same week, and researchers escaped the sandboxes of Cursor, Codex, and Gemini CLI without ever breaking the sandbox itself. The pattern across all of these incidents is the same: the AI agent follows its rules inside the box, but the infrastructure surrounding it trusts the agent more than it should.

Entropy is one of the most maligned and misunderstood concepts in science. Maybe you’ve heard it defined as the “amount of disorder” in a system. And the second law of thermodynamics says the entropy of a closed system always increases over time. So you might think, why should you clean up your office if it will only get messier?

That might be true, but you can’t blame it on entropy. The messy-room metaphor is often used to introduce the idea (it’s usually a teenager’s bedroom—can you relate?), but it’s misleading. See, disorder doesn’t mean messiness or chaos; it refers to the number of ways the parts of a system can be arranged without changing the overall state of the system.

For example, say your “system” is just a box full of air. Inside, at the microscopic level, the gas molecules are bouncing around like bumper cars. Now, imagine you could map the location and velocity of each particle at a given instant. That would be one possible arrangement, or microstate, but there are an infinitude of others, and they’re changing trillions of times a second.

Of course, you can’t really see this stuff. Instead, what you observe are overall, macro-level properties like air pressure; if you sealed the box at sea level, that would be 14.7 pounds per square inch. And unless you add energy to the system, say by heating it, that doesn’t change. So all those microstates correspond to the macrostate of 14.7 psi. Get it?

In other words, entropy is all about the link between the invisible atomic realm and the visible, measurable realm of objects, the world we inhabit. You could say it’s a conceptual and mathematical bridge between two levels of reality. I mean, c’mon, that’s pretty cool.

Now, out of all possible outcomes, which ones actually occur? That’s basically random, so it’s a matter of probability. In fact, probability is fundamental to the idea of entropy, and this is what the messy-room image fails to capture. So I’m going to use a different analogy: rolling dice. Einstein once said “God doesn’t play dice with the universe.” Let’s just see about that, shall we?

Rolling the Bones

Imagine you roll a six-sided game die. You get a number from 1 to 6, right? There are six possible outcomes, or states. If you roll the 20-sided die in Dungeons & Dragons, there are 20 possible states. If you want to wow your D&D pals, you could casually remark that this die has a higher entropy—because it has more possible outcomes.

Now say you’re determining a character’s abilities in D&D, and you roll three six-sided dice. The three values can add up to anything between 3 and 18, but the various sums are not equally likely. For maximum dexterity, say, you need an 18. Well, there’s only one way to achieve that: Each die must come up a 6.

Photograph: Rhett Allain

At a time when so-called “artificial intelligence” seems inescapable, we were encouraged to see news that Amazon will be cracking down on third-party sellers that use AI-generated images for their product listings. They won’t be prevented from using the images, but they will need to clearly indicate that they don’t represent reality and were produced via artificial means. This comes in response to a recently enacted New York law that requires the disclosure of AI in advertisements.

But it’s not quite a clear cut as it might seem on the surface, as the New York law is actually about AI-generated people rather than products. Specifically, it’s designed to make it clear when a “synthetic performer” has been used in place of a human actor. As such, it would appear that the easiest way for Amazon sellers to dodge the new rule is to simply not include any humans in their AI slop images and videos. In other words, they can continue to post fake pictures of products without having to inform the consumer so long as they don’t show a fake person holding it.

Under normal circumstances we’d leave something like this next one for our weekly security column, but the utter lack of security in the Pope’s official “Click To Pray” mobile application revealed by researcher BobDaHacker on Friday is just too good a story to pass up. For one thing, who knew that there was an “official” prayer app? We don’t dabble in theology around these parts, but we’re fairly sure the good book didn’t mention anything about requiring a smartphone to give praise.

In any event, the service was so poorly constructed that you could simply step through the sequentially assigned numerical user IDs via the endpoint at api.clicktopray.org — because of course there’s a prayer API — and download any user’s personal information such as their full name, email address, and date of birth. There wasn’t even any rate limiting, so BobDaHacker was able to write simple script to quickly suck up the account details for each one of the service’s 700,000+ faithful users.

After waiting six months for a response from anyone at the Pope’s Worldwide Prayer Network, BobDaHacker took the story to the press. That seemed to get the pontiff’s attention, as the issue has now been addressed. Amen.

We know many readers appreciate a more minimalist approach to software, and still others are operating older devices that struggle with the admittedly ponderous bulk of the modern web. Both groups will likely appreciate brolly.sh, which provides a plain-text weather forecast for anywhere on Earth using data from Open-Meteo. It doesn’t just look the part either — we’re happy to report that if you pull down the forecast page for your location using something like wget, the resulting file is plain HTML which could be further parsed with grep and friends if you’re on a machine that doesn’t have a browser.

Speaking of older devices, Android Authority is reporting that Google has finally phased out support for Android 6.0 Marshmallow in Play services. This means that while devices running the older version of the mobile operating system will still be usable, they won’t be able to download software from the Play Store. Given that Marshmallow was released in October of 2015, this probably shouldn’t come as much of a shock. Any device out there that’s still running such an old release of the OS obviously hasn’t received any security updates in years, so the inability to download the latest mobile game should be the least of your worries if you are actually still using such a device as a daily driver.

Finally, given the impact Neuromancer has had on the hacker and maker communities over the decades, we felt obligated to point out that Apple has finally released a trailer for their upcoming adaptation. The ten episode series kicks off in January, and until now we haven’t had a good look at the aesthetic they were going for. Part of what made the novel so influential was how it described the world and the technology within it, but bringing those concepts to life on screen in a way that impresses modern audiences is going to be a unique challenge.

With how many hackers have put together their own real-world versions these last several years, we’re especially interested in the show’s depiction of cyberdecks. The novel itself doesn’t actually go into much detail about what they supposedly looked like, but contemporary illustrations were heavily influenced by 8-bit computers of the era from the likes of Amstrad and Atari. As much as we’d like to see something along those lines, we imagine a big-budget prestige television series probably demands something a bit sexier.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line; we’d love to hear about it.

The frontier of physical AI is a Jenga game in a warehouse in San Leandro, California.

That warehouse is occupied by Encord, a company that builds data tooling used to train AI models. Andrew Ceja is a pilot—the company’s term for its robotic trainers—and he’s carefully pulling wooden blocks from a tottering tower while wearing a headset with a camera that tracks what he sees. That alone is fairly common for collecting robot training data, but this headset includes sensors that measure his brain waves as he carefully disassembles the block tower.

Encord is one of a small but growing number of startups betting that the next real constraint on humanoid and warehouse robotics won’t be model architecture but instead the sheer scarcity of real-world physical training data. Rather than just helping robotics companies manage the data they have, Encord is building a business around manufacturing the data they don’t.

The brain wave headset Ceja is wearing was built by Zander Labs, a German neuroscience startup that’s betting measuring brain activity — to deduce mental states like error, intent and surprise — can create a more useful data set to train models. Encord’s work with Zander is currently a trial run; Encord says the goal is to build an initial brain wave-tagged data set, run it through customer robotics models, and evaluate whether it actually improves performance before deciding whether to scale it up.

Lucas Gehrke, a Zander neuroscientist supervising the work, says that the amount of brain activity used at any point during a given task offers clues for model builders trying to figure out when they need to deploy their highest-effort models.

This is the “bleeding edge” of the effort to solve the robotics data bottleneck, according to Vineeth Velmurugan, Encord’s head of robot learning. A veteran of OpenAI’s robot lab and Berkshire Grey, the warehouse automation firm, Velmurugan joined Encord to build the company’s internal data-creation team.

Encord was founded to help companies building machine-vision applications annotate data and evaluate models. As their customers—Velmurugan says they work with many leading robotics firms but that he’s not authorized to name them—began to apply end-to-end learning to robotic manipulation tasks, executives realized they would have to produce training data themselves, rather than simply manage it. “The data simply does not exist,” Velmurugan said.

The bet that generative AI can do for robots what it’s done for chatbots keeps running into this same wall. LLMs were built on the text of the entire internet, and more. Finding the same raw materials to teach neural networks about physical manipulation is challenging: self-driving car companies collect it themselves, but that’s hard to scale. Training from video can work, but it lacks the fidelity of real world data. Velmurugan says it will take a data set something like five times the size of YouTube’s video corpus to break through—a scale that helps explain why data-generation itself has become a business and not just a research problem.

Feed your egocentric data needs

Companies building robot brains are now turning to two main sources: “Egocentric” video collected by workers wearing cameras, often augmented with additional camera angles and other metrics, and collecting data from robots operated remotely. Encord does both, drawing egocentric data from several factories around the globe, and using its San Leandro facility to experiment with new modalities, like brain waves, or collect data sets around specific skills for fine-tuning.

When TechCrunch visited, pilots were using leader-follower rigs — paired robotic arms, one controlled directly by a human operator and one that mimics its movements —to create data about tasks like pouring coffee from a pot into mugs (very sloshy) and stacking poker chips. “Every humanoid company has asked us for these pieces,” Velmurugan says.

Storage racks held cartons of fake flowers in vases, books, plastic vegetables, kitty litter trays and scoops, bags and bundles of wires, the stock in trade for training manipulators for household tasks.

At one of these stations, another pilot, Sofia Infante, maneuvers robotic arms to plug and unplug ethernet cables from the back of a server—the kind of work data center operators would love to be automated, if only robots could manipulate them with the required precision. Taking a spin behind the controls, I was able to see why that’s still out of reach: Pincers are far less dextrous than human fingers and lack the degrees of freedom we take for granted in our arms.

Another new data modality that Encord is developing uses a set of sensors strapped to the forearm to detect electrical signals in muscles. Video taken of human hands manipulating objects typically doesn’t capture the entire hand, but Velmurugan hopes to build a 3D depiction of where the hand is at any time based on the arm sensors, creating a more robust understanding for models.

Encord’s data sets are annotated with physical descriptions of what each video contains—”right hand tightens bolt”—to aid LLM-based models in understanding what is happening. Velmurugan estimates this kind of dense annotation is worth 100 times as much as “junky ego data” for training specific tasks, and it only costs 20 times more to produce, which is a good trade, on paper.

But “20 times more” is still real money, and that’s the catch: scraping text off the internet, the way LLM makers built their models by pulling from Stack Overflow and the rest of the web, cost frontier labs next to nothing. Generating physical training data does not, and that’s the limit of the physical-AI-as-LLM comparison. This kind of data has to be manufactured, not just collected, and that changes the economics of building these models.

Velmurugan says that progress is being made—with Encord’s visibility into programs across the industry, he’s able to see start-ups and frontier labs alike figure out what works and what doesn’t to improve physical AI models. That vantage point—sitting between many robotics companies at once—is also part of Encord’s pitch. It can spot which data techniques are gaining traction industry-wide before any single customer can.

That will keep the dozen or so pilots at Encord’s facility busy. Both Infante and Ceja are part of a burgeoning workforce developing the building blocks for neural networks; they previously worked at Scale, another AI data annotation firm, before joining Encord.

Ceja had worked at a waste management company where his interest in technology found him in charge of keeping a robotic trash sorter in good working order. Now, as the Jenga tower topples, he says he enjoys the challenge of solving training tasks for robots —”It’s something new every day!”

A hot potato: A federal case in Atlanta is raising questions about a privacy-focused mobile operating system, with prosecutors arguing that its features were used to erase evidence. The US Department of Justice is attempting to prosecute Atlanta resident Sam Tunick under a federal statute that makes it a crime to destroy property in an effort to prevent it from being seized.

The case centers on Tunick’s use of GrapheneOS, an open-source operating system that works on Google Pixel phones and lets users enter a passcode to wipe a device clean.

Experts said the legal approach is unusual and may be the first time the law has been aimed at an operating system. “It’s concerning – and sends the message that [GrapheneOS] is criminal by default,” said Christophe Boutry, a cybersecurity and surveillance expert. Boutry and Bill Buddington, senior staff technologist at the Electronic Frontier Foundation, both said they had not seen a similar case.

The incident began at Hartsfield-Jackson Atlanta International Airport on January 24 of last year. Tunick had just returned from a trip to the Dominican Republic when he was stopped for questioning. According to court testimony, federal agents had already circulated his name and photo internally, saying he was under investigation for “suspected terrorism activities” because of his alleged association with the movement against Cop City.

Tunick was taken to a secondary screening room, where multiple agents questioned him. A motion filed by his defense argues the interrogation focused on child sexual abuse material as a pretext for investigating his connections to the protest movement. The motion also states that Tunick asked four times to speak with a lawyer and was denied each time. According to the same filing, agents did not present a warrant or read him his rights.

Government attorneys and agents pushed back during Monday’s hearing. They described the encounter as a routine airport inspection. Larry Findley, a Customs and Border Protection officer, said agents were “looking for anything that’s prohibited.”

During the questioning, agents repeatedly asked Tunick to unlock his phone and warned they would seize it if he refused. When he finally provided a passcode, the phone appeared to restart. The defense motion states that “the screen went blank, flashed several times, and the phone appeared to restart,” resulting in the loss of data.

The wipe is now central to the case. Prosecutors are treating it as an intentional act to destroy evidence, while the defense argues that the search violated Tunick’s constitutional rights and that the evidence should be suppressed.

The case raises questions about which constitutional rights apply at US borders, including international airports, where authorities have broader search powers. A judge is not expected to rule on the defense motion until at least late October.

GrapheneOS is designed to improve privacy and security on Pixel phones. Supporters say those tools are legitimate security protections, not evidence of criminal intent. Boutry pointed to France and Spain, where authorities have struggled to gain access to secured devices. He said authorities have treated the use of GrapheneOS itself as suspicious. In Catalonia, Spain, police have been profiling people carrying Pixel phones, assuming they have GrapheneOS installed and are drug dealers or gang members.

“The main goal [of the operating system] is protection of privacy,” Boutry said. “They’re our phones and the state can’t tell us how to use them.”

The case is tied to ongoing opposition to Cop City, a $109 million police training facility that opened last spring. The project has drawn opposition from activists concerned about police militarization and environmental impacts. Law enforcement officials have defended it as necessary for training and recruitment.

Previous attempts to prosecute protesters at the state level have foundered, while federal authorities have more recently stepped in, including a separate indictment announced last month.

Forward-looking: In a major reversal from its earlier decision to ditch hyper-threading across its entire product portfolio, Intel has officially confirmed that simultaneous multi-threading will return to its data center processors with the Xeon 8 “Coral Rapids” family, scheduled for release in 2028. However, the company did not confirm whether the technology will also return to its client CPUs.

Speaking to investors and analysts at Intel’s Q2 2026 earnings call on Thursday, CEO Lip-Bu Tan said that the company is working on several strategies to regain its CPU market share across the retail and enterprise segments, including bringing back simultaneous multi-threading with Coral Rapids in 2028. He added that Intel is also focusing on improving single-threaded performance to regain competitiveness in key market segments.

Tan confirmed the return of hyper-threading while answering a question from Morgan Stanley analyst Joe Moore, who asked if the company had any concrete plans to regain lost market share from AMD and Arm in the next five years. Tan did not directly address Intel’s rivalry with AMD and downplayed the competition with Arm, saying that the British chip design firm is a “great partner” for Intel, and that the two companies have a strong working relationship.

After making processors with hyper-threading for more than two decades, Intel ditched the technology with the launch of Arrow Lake-S in 2024. However, the company had already reduced its use of hyper-threading over the previous processor generations, starting with the Alder Lake family in 2021. Alder Lake, which was Intel’s first desktop processor family to feature a hybrid core architecture, incorporated hyper-threading only in its performance cores while the efficiency cores implemented only a single hardware thread each.

On the server side, the company’s current-generation Xeon 6 Granite Rapids processors retain hyper-threaded performance cores, offering up to 128 physical cores and 256 threads. However, the Xeon 6+ Clearwater Forest family ditches hyper-threading entirely, featuring up to 288 single-threaded E-cores built on Intel’s 18A process node. The upcoming Xeon 7 Diamond Rapids lineup is expected to offer up to 192 performance cores without simultaneous multi-threading.

Hyper-threading, which is Intel’s proprietary implementation of simultaneous multi-threading, was originally introduced in the early 2000s in single-core Xeon and Pentium 4 processors, promising improved performance in multi-threaded workloads. But with the steady increase in the number of physical cores in x86 CPUs, Intel ditched hyper-threading in the belief that it was largely a relic of the past and not nearly as important as it was twenty years ago.

• 2.2 million vehicles are susceptible to a Bluetooth-based attack in the state of California
• The vulnerability is due to dealer-installed security systems
• Researchers at the University of California San Diego found that the Acrisure-built security devices all rely on the same secure key

A vulnerability has been found in KARR and SWDS automobile security systems manufactured by Acrisure that enables remote control via Bluetooth. The vehicles had the security systems installed by car dealers in California, specifically as anti-theft and tracking devices. Thanks to this hack, however, it seems that vehicles can be unlocked, with some further control given to the attacker.

Researchers at the University of California San Diego found that the 2.2 million automobiles were purchased from Southern Californian dealers since 2017, although the secondary market means that the vehicles could be elsewhere in the US, and even as far afield as Japan.

In this week’s Sunday Reboot, Apple TV’s dating docuseries could lead to new content areas, an unexpected Mattel movie, and the hope of even more “Ted Lasso.”

Sunday Reboot is a weekly column covering some of the lighter stories within the Apple reality distortion field from the past seven days. All to get the next week underway with a good first step.

Dating docuseries is a big departure for Apple TV

On Thursday, Apple announced it was bringing out a new documentary series about dating. This is good news for the streaming service.

The eight-part show with the semi-melodramatic title “The Last Person on Earth” will be pairing up people that, at first glance, are polar opposites. But, as the great Paula Abdul opined back in 1988, there is a chance that opposites attract.

It’s also not just a case of shoving the human equivalent of chalk and cheese together and observing from afar. There will be people providing guidance, such as NYT bestselling author and relationship expert Esther Perel, and a bunch of therapists.

As for the format, it seems to be treading the same path as shows like “Married at First Sight,” which also paired people together and used experts to smooth things over.

This is not a show that I will be watching by any stretch of the imagination. I’m not one to watch dating and romance shows, and I think of watching an episode of Love Island as potentially being against the Geneva Convention.

That said, I think this is progress for Apple TV.

Relationship expert Esther Perel will be on “The Last Person on Earth” – Image credit: Apple

Just a month ago, this very column went over Apple’s inability and unwillingness to make a decent game show. Part of it was based on the belief that Apple would err towards quality programming, rather than the relatively cheap and quantity-based “shiny floor game show.”

If you look at the rest of the Apple Originals roster, the vast majority of it is for narrative programming. There are documentaries, sure, and animation, kids shows, and the rare competition show like “Kpopped,” but the bulk of it is gunning for quality factual content or well-told stories.

This dating show is not a game show or competition show. It’s also holding onto the “documentary” part of its description with a very loose grip.

It seems very different from the self-created pigeonhole that Apple TV has formed over time.

This show gives me hope that Apple is willing to try more in this direction, with more entertainment that doesn’t need a grand stage and more extras than a small school.

Sometimes, popcorn programming is OK to watch. Not exactly deep or thought-provoking, but just entertaining.

I wish Apple made more of it. Hopefully, if this is successful, it’ll make more.

Sci-fi, sports, and branded off-brand ‘Fast and Furious’

Apple had a lot to talk about when it comes to Apple TV this week. To be fair, it’s San Diego Comic-Con weekend, and Apple had to fill up its two-hour panel somehow.

That resulted in a slew of announcements and news items about the service.

In terms of officially announced news, Apple trotted out a bunch of trailers for upcoming shows. The second season of the reality-jumping “Dark Matter” was shown off, as well as the trailer for the long-awaited “Neuromancer.”

But then things go sideways with “Matchbox The Movie.”

To be clear, I didn’t know about the movie existing before the trailer appeared. My immediate thought was something similar to the well-handled “Barbie” movie, or even a pastiche of Disney’s “Cars” but for another Mattel property.

Instead, we’re given an action film that’s got the same fast-cars-and-stunts attitude of the “Fast and Furious” franchise. One fronted by John Cena playing an undercover CIA agent.

It’s very different from what I imagined, and it could’ve easily been using Mattel’s other toy car brand, Hot Wheels. That has a movie in development with J.J. Abrams.

It’ll be interesting to see if they can pull more reasons to use the Matchbox brand other than the protagonists having played with the toy cars in their childhood.

There was a downbeat in the week, though, as “The Morning Show” will be ending in 2027. Concluding after five seasons, the Jennifer Aniston and Reese WItherspoon drama will finish eight years after it was first announced by Eddy Cue.

It will be missed by fans, but it had a good run.

Lastly, with the return of “Ted Lasso” on August 5, the comedy-soccer show has been ramping up its publicity. It turns out that it may not be a one-season revival after all.

Jason Sudeikis said in an interview that, while Apple hasn’t commissioned a fifth season, the plan is still to get the writers together at the end of August to come up with ideas. He also wants a second three-season arc, bringing the total up to six seasons.

Me too, Ted. Me too.

Last week’s Sunday Reboot talked about the small model hope of PrismML, and how it can boost Apple’s on-device AI advantage.

If you’ve ever tried asking Siri anything on your Apple Watch, you’ve probably been met with its all-too-familiar “Here’s what I found on the web” response. Happy to report, those days are finally coming to an end. I put both the old and the new version of Apple’s Siri assistant through a few real-world questions on my Apple Watch(es) to see how they stack up, and the results have me sold on the upgrade.

With the WatchOS 27 public beta rolling out this week, I wanted to take Siri AI for a spin where it matters most: the Apple Watch. Apple’s digital assistant has long needed an upgrade, but nowhere have its shortcomings been more obvious than on your wrist. Previously, all the old Siri could do on the Apple Watch was return web results, leaving me to wait for pages to load on a tiny screen that wasn’t designed for browsing.

To get started, I downloaded the Public Beta of iOS 27 on my iPhone first (it’s fairly stable, but I still wouldn’t recommend it on a primary device), then installed the WatchOS 27 beta on my Apple Watch Ultra 3 through the Watch app. From there, I made sure Siri AI was activated in my iPhone settings; it defaulted to the new version on the watch as well. I kept my Series 11 running on the latest version of WatchOS 26 with the old Siri. 

Keep in mind that Siri AI and WatchOS 27 are early software and far from the final version that will be released this fall.

Read more: Win a New Apple Watch in CNET Big Guessing Game Contest

Test 1: Ferry schedule

I started with a question old Siri has failed me on before: “When’s the next ferry from Vallejo to San Francisco?”

Old Siri: “Here’s what I found on the web.”

This response low-key triggers me. Waiting for a website to load on a tiny screen isn’t helpful when I’m literally trying to catch a ferry.

Siri AI: “The next ferry to San Francisco leaves Vallejo at 4:10 p.m.”

Advertisement

Winner: Siri AI

Test 2: Kitchen help

Next, I tried another situation where I’d rather not have to reach for my phone and risk getting it covered in whatever I’m cooking up. “What ingredients do I need to make buttermilk?” (A surprisingly common question now that I’m making frozen yogurt in my Ninja Creami.)

Old Siri: “Here’s what I found on the web.” Argh! At least it’s consistent.

Siri AI: “To make a homemade buttermilk substitute, you need milk and an acid. The standard ratio is 1 tablespoon of acid for every cup of milk.”

Advertisement

The generic “acid” suggestion was a bit vague (and slightly concerning), but luckily, I’ve made it enough times to know it was referring to lemon juice or vinegar and not some dark web-type acid. I could’ve also asked a follow-up question to clarify (which old Siri can’t handle either). 

Winner: Siri AI

Test 3: World Cup

For my final test, I asked something I’ve been checking a lot this summer (I asked on Monday, July 13). “When’s the next World Cup match, and what stadium is it being played in?”

Old Siri: “The next World Cup game is France vs. Spain tomorrow at noon PT.” It answered the first part of the question but ignored the stadium entirely.

Advertisement

Siri AI: “The next World Cup game is France vs. Spain tomorrow at noon PT at AT&T Stadium in Dallas.” It even asked if I’d like to set a reminder. The stadium bit was a key part of the question, since some matches have been played during extreme heat, which has impacted the teams’ performances. 

Winner: Siri AI

Bonus round (not shown in the video)

I also asked a question I was genuinely curious about: “Why was Erling Haaland substituted in the last minutes of the England vs. Norway match?”

Old Siri: “Here’s what I found on the web.”

Advertisement

Siri AI: He was suffering from severe fatigue and “dead leg injury,” leading his coach to pull him during the World Cup quarter-final against England. 

Winner: Siri AI

Final thoughts

This is the first time I’ve intentionally wanted to use Siri on my Apple Watch, and I think it could be a game-changer.

The WatchOS 27 Public Beta is available now, with the full release expected this fall alongside Apple’s next big product announcements. I’ll keep testing Siri AI as the beta evolves, but based on these early results, I won’t be going back to the old version anytime soon.

Advertisement

Vanessa Hand Orellana

Principal Writer

Vanessa is a lead writer at CNET, reviewing and writing about the latest smartwatches and fitness trackers. She joined the brand first as an on-camera reporter for CNET’s Spanish-language site, then moved on to the English side to host and produce some of CNET’s videos and YouTube series. When she’s not testing out the latest health tech, you can catch her on a hike or trail run with her family.

See full bio