Connect with us
DAPA Banner
DAPA Coin
DAPA
COIN PAYMENT ASSET
PRIVACY · BLOCKDAG · HOMOMORPHIC ENCRYPTION · RUST
ElGamal Encrypted MINE DAPA
🚫 GENESIS SOLD OUT
DAPAPAY COMING

Tech

Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren’t covering

Published

on

Four supply-chain incidents hit OpenAI, Anthropic and Meta in 50 days: three adversary-driven attacks and one self-inflicted packaging failure. None targeted the model, and all four exposed the same gap: release pipelines, dependency hooks, CI runners, and packaging gates that no system card, AISI evaluation, or Gray Swan red-team exercise has ever scoped.

On May 11, 2026, a self-propagating worm called Mini Shai-Hulud published 84 malicious package versions across 42 @tanstack/* npm packages in six minutes flat. The worm rode in on release.yml, chaining a pull_request_target misconfiguration, GitHub Actions cache poisoning, and OIDC token extraction from runner memory to hijack TanStack’s own trusted release pipeline. The packages carried valid SLSA Build Level 3 provenance because they were published from the correct repository, by the correct workflow, using a legitimately minted OIDC token. No maintainer password was phished. No 2FA prompt was intercepted.

The trust model worked exactly as designed and still produced 84 malicious artifacts.

Two days later, OpenAI confirmed that two employee devices were compromised and credential material was exfiltrated from internal code repositories. OpenAI is now revoking its macOS security certificates and forcing all desktop users to update by June 12, 2026. OpenAI noted that it had already been hardening its CI/CD pipeline after an earlier supply-chain incident, but the two affected devices had not yet received the updated configurations. That is the response profile of a build-pipeline breach, not a model-safety incident.

Advertisement

Four incidents, one finding

Model red teams do not cover release pipelines. The four incidents below are evidence for a single architectural finding that belongs in every AI vendor questionnaire.

OpenAI Codex command injection (disclosed March 30, 2026). BeyondTrust Phantom Labs researcher Tyler Jespersen found that OpenAI Codex passed GitHub branch names directly into shell commands with zero sanitization. An attacker could inject a semicolon and a backtick subshell into a branch name, and the Codex container would execute it, returning the victim’s GitHub OAuth token in cleartext. The flaw affected the ChatGPT website, Codex CLI, Codex SDK, and the IDE Extension. OpenAI classified it Critical Priority 1 and completed remediation by February 2026. The Phantom Labs team used Unicode characters to make a malicious branch name visually identical to “main” in the Codex UI. One branch name. That is where the attack started.

LiteLLM supply-chain poisoning and Mercor breach (March 24–27, 2026). The threat group TeamPCP used credentials stolen in a prior compromise of Aqua Security’s Trivy vulnerability scanner to publish two poisoned versions of the LiteLLM Python package to PyPI. LiteLLM is a widely adopted open-source LLM proxy gateway used across major AI infrastructure teams. The malicious versions were live for roughly 40 minutes and received nearly 47,000 downloads before PyPI quarantined them.

That was enough.

Advertisement

The attack cascaded downstream into Mercor, the $10 billion AI data startup that supplies training data to Meta, OpenAI, and Anthropic. Four terabytes exfiltrated, including proprietary training methodology references from Meta. Meta froze the partnership indefinitely. A class action followed within five days. One compromised open-source dependency sitting 40 minutes on PyPI created a cross-industry blast radius that no single vendor’s model red team would have caught.

Anthropic Claude Code source map leak (March 31, 2026). This incident was not adversary-driven. Anthropic shipped Claude Code version 2.1.88 to the npm registry with a 59.8 MB source map file that should never have been included. The map file pointed to a zip archive on Anthropic’s own Cloudflare R2 bucket containing 513,000 lines of unobfuscated TypeScript across 1,906 files. Agent orchestration logic. 44 feature flags. System prompts. Multi-agent coordination architecture. All public. All downloadable. No authentication required. Security researcher Chaofan Shou flagged the exposure within hours, and Anthropic pulled the package. Anthropic confirmed it was a “release packaging issue caused by human error.” This was the second such leak in 13 months. The root cause was a missing line in .npmignore. No attacker was involved, but the release-surface gap is identical. No human review gate existed between the build artifact and the registry publish step.

TanStack worm and downstream propagation (May 11–14, 2026). Wiz Research attributed the Mini Shai-Hulud attack to TeamPCP with high confidence. StepSecurity detected the compromise within 20 minutes. The worm spread beyond TanStack to Mistral AI, UiPath, and 160-plus packages within hours. Mini Shai-Hulud even impersonated the Anthropic Claude GitHub App identity by authoring commits under the fabricated identity “claude ” to bypass code review.

Four incidents. Three frontier labs. One finding. The red-team scope stops at the model boundary, and the build pipeline sits on the other side of it.

Advertisement

The timing no system card can explain

On May 10, 2026, OpenAI launched Daybreak, a cybersecurity initiative built on GPT-5.5 and a new permissive model called GPT-5.5-Cyber designed for authorized red teaming, penetration testing, and vulnerability discovery. Daybreak pairs Codex Security with partners, including Cisco, CrowdStrike, Akamai, Cloudflare, and Zscaler. OpenAI positioned the launch as proof that frontier AI can tilt the balance toward defenders.

The next day, the TanStack worm compromised two OpenAI employee devices.

OpenAI’s own incident disclosure acknowledged the gap directly. The company had already been hardening its CI/CD pipeline after the earlier Axios supply-chain attack, but the two affected devices “did not have the updated configurations that would have prevented the download.” The controls existed. The deployment was in progress. The worm arrived first.

The security community saw the same gap: Security researcher @EnTr0pY_88 noted on X that the real signal was the certificate rotation, not the exfiltrated code. “The cert rotation…is what you do when the blast radius reached signing trust, not just source access.” @OpenMatter_ put the SLSA provenance failure in one sentence. “If an attacker controls your CI runner, they control your attestations. Policy-based security is failing at scale.” And @The_Calda compressed the disclosure’s internal contradiction into seven words. “‘Limited impact’ but the next sentence is ‘we’re rotating signing certs.’”

Advertisement

A company that launched a cyber defense platform on Sunday and disclosed a build-pipeline breach on Tuesday is not failing at model safety. OpenAI is demonstrating the exact gap this audit grid exists to close. The model red team and the release-pipeline red team are two different disciplines; four incidents in 50 days suggest only one of them is being funded consistently.

The VentureBeat Prescriptive Matrix

The matrix below maps the seven release-surface classes missing from AI vendor questionnaires, with vendor hit, failure mechanism, detection gap, technical mitigation, and priority tier a security team can execute before Q2 renewals close.

For teams that need to map these rows into existing GRC tooling, rows 2, 3, and 5 align with NIST SSDF PS.1.1 (protect all forms of code from unauthorized access and tampering). Row 4 maps to SSDF PS.2.1 (provide mechanisms for verifying software release integrity). Row 6 maps partially to SLSA Source Track requirements for verified contributor identity, though no published framework directly addresses upstream dependency maintainer credential provenance. Row 7 is not yet addressed by any published framework, which is itself the finding.

Release-surface class

Advertisement

Vendor hit

Failure mechanism

Detection gap

Technical mitigation

Advertisement

Priority

Model capability evals (jailbreak, misuse, exfiltration)

All three (ongoing)

Covered. System cards, AISI Expert suite, Gray Swan scope this today.

Advertisement

None. This row is the baseline.

Continue requiring the system card at every renewal.

Baseline

CI runner trust boundary (pull_request_target)

Advertisement

TanStack; OpenAI downstream (May 11–14, 2026)

TanStack pwn-request ran fork code in base-repo context. Poisoned pnpm cache. Extracted OIDC token from runner memory. Two OpenAI employee devices compromised.

No system card covers CI runner isolation. No AISI eval tests fork-to-base trust boundaries.

Audit every repo for pull_request_target + fork SHA checkout. Block fork code from base-repo context. Pin cache keys to commit SHA.

Advertisement

Do this week

OIDC trusted-publisher + SLSA provenance

TanStack; OpenAI downstream (May 11, 2026)

TanStack minted valid SLSA Build Level 3 provenance for all 84 malicious packages. First known npm worm with valid cryptographic attestation.

Advertisement

SLSA attestation confirms build origin, not build intent. No vendor questionnaire distinguishes the two.

Pin trusted publisher to branch + workflow, not just repository. Add behavioral analysis at install time.

Do this week

Release packaging review (human gate before publish)

Advertisement

Anthropic (Mar 31, 2026)

Missing .npmignore shipped 59.8 MB source map in Claude Code npm package. 513K lines exposed including agent logic, 44 feature flags, system prompts. Second leak in 13 months. Self-inflicted, not adversary-driven.

No red-team exercise checks artifact contents before registry publish.

Human review between build artifact and registry publish. Enforce .npmignore in CI. Fail build on unexpected artifact size.

Advertisement

Before renewal

Dependency lifecycle hooks (prepare, postinstall)

TanStack; OpenAI + downstream (May 11, 2026)

router_init.js executes on import. tanstack_runner.js self-propagates via optionalDependencies prepare hook. Spread to Mistral AI, UiPath, 160+ packages in hours.

Advertisement

Lifecycle hooks execute before any scanner runs. Model evals never test package install behavior.

Disable lifecycle scripts in CI by default. Explicit allowlist for production. Flag new optionalDependencies in PR review. Set minimumReleaseAge.

Do this week

Vendor maintainer credential hygiene

Advertisement

Meta via Mercor (Mar 24–27, 2026)

TeamPCP stole LiteLLM maintainer credential via prior Trivy compromise. Two poisoned PyPI versions live 40 min. Mercor cache held Meta training methodology references. 4 TB exfiltrated. Meta froze the partnership.

Vendor questionnaires ask about encryption and access control, not maintainer credential provenance for upstream dependencies.

Require hardware-key auth from every maintainer before onboarding. Add package-manager cooldown. Audit transitive dependency tree quarterly.

Advertisement

Add to vendor contract

Agent container input sanitization

OpenAI Codex (disclosed Mar 30, 2026)

BeyondTrust Phantom Labs injected shell commands through GitHub branch-name parameter. Stole OAuth tokens from Codex container. Scalable across shared repos. Rated Critical P1, patched Feb 2026.

Advertisement

Agent red teams test prompt injection, not input-parameter injection at the container level.

Sanitize all external input before shell execution. Audit OAuth token scope and lifetime per agent session. Enforce least-privilege on every container.

Do this week

Security director action plan

The matrix tells your team what to fix. Three actions tell security directors how to move it forward.

Advertisement
  1. Add one question to every AI vendor questionnaire. “Does your organization red-team its release pipeline, including CI runner trust boundaries, OIDC token scoping, dependency lifecycle hooks, and registry publish gates? Provide the last assessment date and scope.” No date and no scope document is the finding.

  2. Run rows 2 through 7 against your own CI pipelines this week. StepSecurity and Snyk both published detection and remediation steps for the TanStack worm patterns. Dev teams pull OpenAI SDKs, Anthropic packages, and Llama weights through npm, PyPI, and HuggingFace every week. The same patterns that got exploited are in your CI right now.

  3. Brief the board on the provenance gap. The TanStack worm proved that valid cryptographic provenance can sit on top of a malicious package. Attestation tells the board where a package was built. Behavioral analysis tells the board what it does after install. Q2 renewal requires both. Snyk’s analysis recommends pinning trusted publisher configurations to specific branches and workflows, not just repositories. That is the language the board presentation needs.

The worm already knows where your AI credentials live

Mini Shai-Hulud does not stop at CI secrets. Datadog Security Labs documented that the payload reads ~/.claude.json and exfiltrates it. It scans for 1Password and Bitwarden vaults, Kubernetes service accounts, cloud provider tokens, and shell history files where developers paste API keys. StepSecurity’s deobfuscation confirmed that Mini Shai-Hulud harvests Claude and Kiro MCP server configurations, which store API keys and auth tokens for external services. For developers using AI coding agents, the worm already knows where their credentials live.

OpenAI, Anthropic, and Meta will keep publishing system cards. They will keep funding red-team competitions. They will keep passing model evaluations. None of that stops the next worm from riding in on release.yml.

The TanStack postmortem team said it directly. Modern supply-chain defenses are important but not sufficient on their own. Teams must proactively identify and close workflow gaps rather than relying solely on the security features of their tools.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Why People Might Ditch Their Smartwatches For Something Simpler

Published

on

Tech has taken over our lives. We have smartphones, smartwatches and smart TVs. There are even smart fridges, smart toilets and smart sex dolls. (Or, uh, so I hear.) And with the rise of AI, Big Tech is now jumping on the smartglasses bandwagon… again.

An analog rebellion is brewing. I recently went to a Barnes & Noble for the first time in well over a decade. I was surprised at how many young, hip people were there, scouring the print books and vinyl records. Then there’s the resurgence of digital camerasfilm cameras and cassette tapes.

When smartwatches started popping up in the mid-2010s, they promised quick info at a glance without having to grab your phone. In theory, that meant freeing you up to engage with the world around you. But in practice? Well, over a decade later, not everyone finds that to be the case.

To be clear, nobody’s arguing that people are ditching smartwatches left and right. In fact, the market is steadily growing, not shrinking. But not everyone wants to keep marching in that direction.

“My smartwatch kept me attached to b******t I wanted it to get me away from,” born-again analog watch user RadioAdam posted. But not everyone needs to go back to the days of Casio and Timex. Minimal wearable tech products can track your fitness, just without feeling like you have a second phone on your wrist.

Advertisement

Notification overload

The persistent nag of the online world can feel even more intrusive when it’s on your wrist. It’s one thing to hear your phone chirp in a pocket or bag. It’s another to have a wearable device poking you every time something comes in.

“I don’t want my wrist to communicate with me at all” u/NeoMoose wrote in the Whoop subreddit. “My phone is already too much distraction.” Of course, you can silence notifications. But at that point, you (like these smartwatch expats) might question how much you need one in the first place.

Advertisement

Big Tech sold us the always-online lifestyle as a utopia. But the reality has too often resembled a dopamine-addiction hellscape. And if you’re looking to cut down on devices, smartwatches are an obvious candidate for the first item on your list.

Feature (and tracking) fatigue

Smartwatches can suffer from feature creep. While an Apple Watch has potentially lifesaving ones like fall detection and the ability to call emergency services from your wrist, it (and its competitors) also have… lots of other stuff.

For instance, Redditor u/Adventurous_Rice_731 briefly switched from a minimal Whoop to a Garmin smartwatch and quickly regretted the decision. “Went to my first [workout] and realized how many times I was actively checking the screen, looking to see if all my reps were recording,” they posted. “Overall, I just found myself glued to it even during TV time.” Simpler devices could keep you focused on not just the task or activity at hand, but also help you stay present in moments.

Advertisement

For some, health tracking can (ironically) increase stress. On top of that, when smartwatches and other fitness trackers measure things like sleep, stress and recovery, they’re merely estimates. Those things can’t be measured directly with a wrist-worn device, only approximated via advanced algorithms. Some people don’t see much point in using data that’s little more than an informed guess, as opposed to paying closer attention to their body.

In this economy?

Smartwatches, at least the most useful ones, can be expensive. For example, the Apple Watch Series 11 starts at $399. Samsung’s and Google’s alternatives are in the same ballpark. And while the Apple Watch SE is a more affordable $249 and up, it lacks several key health features (ECG, blood oxygen and hypertension monitoring).

Advertisement

With inflation running rampant, it’s easy to cast a more critical eye on the value of a smartwatch. Sure, it’s nice not to have to whip out your phone to check messages or the forecast. But is it $400 nice? If all you want is health tracking, wearables like Google’s Fitbit Air and Nothing’s CMF Watch 3 Pro offer it for a small fraction of the price.

Road safety

Smartwatches may also make driving less safe. One study found that drivers were more distracted by smartwatch notifications than phone alerts. Glancing down at a watch seems more likely to take your eyes off the road than glancing at a phone, often mounted on a dashboard. (For the record, voice-based responses on either device were the least distracting.)

Advertisement

Arguably, this one is more about applying common sense and self-control than it is about the device itself. But it’s another factor to weigh when questioning whether you need a screen on your body.

Style and substance

Tech companies do their best to make smartwatches look good. I’m in the camp that doesn’t mind the aesthetic of the Apple Watch and some of its rivals. But if I were basing my decision on style alone, above all else? I’d go with a sleek analog watch without hesitation.

The advantage of screenless tracking bands is that they’re typically subtle enough to wear alongside more stylish watches. They could also be easier to dress up or wear to events where smartwatches are frowned upon. And if you’re looking for something that still tells the time and tracks your steps while looking like a classic timepiece, there are hybrid smartwatches from companies like Withings and Garmin that could meet those needs.

Advertisement

Opting for something simpler

If a smartwatch seems like a bit much, there are simpler and cheaper alternatives.

Screen-free fitness bands are having a moment with the recent launch of Google’s $100 Fitbit Air. The device, which impressed us in our review, is currently sold out everywhere. Whoop, the apparent inspiration for Google’s product, is another screenless contender with robust health tracking. However, it requires a subscription that ranges from $149 for the first year (then $199) to $359 annually, which can put some people off.

Then there are smart rings. Although they’re more expensive (the new Oura Ring 5 starts at $399), they excel at sleep tracking and recovery metrics. Of course, they also lack a screen and haptics, so it’s one less thing bugging you. There’s also the Samsung Galaxy Ring, a $400 competitor that’s often on sale for $300 at big-box retailers.

Advertisement

As a bonus, these free up space on your wrist for an analog watch. “I can wear a mechanical watch and be more in the moment,” u/Th3p4l4d1n posted. “The Whoop allows me to do that more since it has auto workout tracking.” Plus, you don’t need to worry about charging classic timepieces. And they won’t become obsolete in a few years.

There’s no shortage of variety (in style and price) in that space. For example, Casio has a plethora of options, starting at $30. Or, for that matter, head to any jewelry or department store and have at it. And while old-school timepieces don’t promise the moon, they also won’t lower your attention span or raise your blood pressure.

Advertisement

Source link

Continue Reading

Tech

Siri AI, Snap Spectacles, and iPhone rumors

Published

on

Siri AI is turning out to be absolutely brilliant, except when it isn’t, plus there are now Snap Spectacles, and rumors about the iPhone Fold, on the AppleInsider Podcast.

Of course you haven’t been so foolish and reckless as to install the developer betas of iOS 27 and the rest. These do seem to be remarkably stable, but your two hosts have both had problems, and totally different ones.

They’re not calamitous problems, but these are the same betas, on similar devices, being used in the same way, yet giving completely different difficulties. So, seriously, stay away for now.

Although when Siri AI is at its best, it is superb and you will want to use it. Just be reassured that Siri AI is far from always at its best, and both hosts are hoping for some marked improvements before this is all released publicly.

Advertisement

But speaking of releasing publicly, this week also saw the launch of another set of AR glasses. Snap has released its Snap Specs and from just the right angle, in just the right light, they still look poor.

Lastly, it wouldn’t be a week of Apple news without iPhone rumors, and there have been so many this time. From conflicting reports of delays with the iPhone Fold, to perhaps wishful thinking about an iPhone Air 2, we’ve got it all.

BONUS: Subscribe via Patreon or Apple Podcasts to hear AppleInsider+, the extended edition. This time, it’s about those different beta problems and just how it’s affecting our work.

More AppleInsider podcasts

Tune in to our Smart Home Insider podcast covering the latest news, products, apps, and everything HomeKit related. Subscribe in Apple Podcasts, Overcast, or just search for HomeKit Insider wherever you get your podcasts.

Advertisement

Podcast artwork from Basic Apple Guy. Download the free wallpaper pack here.

Those interested in sponsoring the show can reach out to us at: [email protected].

Subscribe to AppleInsider on:

Keep up with everything Apple in the weekly AppleInsider Podcast. Just say, “Hey, Siri,” to your HomePod mini and ask for these podcasts, and our latest HomeKit Insider episode too. If you want an ad-free main AppleInsider Podcast experience, you can support the AppleInsider podcast by subscribing for $5 per month through Apple’s Podcasts app, or via Patreon if you prefer any other podcast player.

Advertisement

Source link

Continue Reading

Tech

The CEO of Allbirds’ new AI biz has a plan, but no employees

Published

on

Call it a startup with a sole founder and a very large seed round, but what’s next is less clear.

Source link

Continue Reading

Tech

3,900 Waymo robotaxis recalled after new software issue

Published

on

Waymo had to recall a similar number last month after it discovered a bug that allowed AVs to drive onto flooded roads.

A new recall notice shows that Waymo is pulling nearly 3,900 robotaxis from US streets over a software issue that lets autonomous vehicles (AVs) enter and drive in closed freeway construction zones.

This comes just a month after the company had to recall a similar number of cars after it found a different bug that allowed its AVs to drive onto flooded roadways.

“Under certain circumstances”, Waymo’s fifth-generation automated driving system (ADS) software could allow AVs to enter and drive “at speed” in freeway construction zones, according to the safety recall report filed with the US National Highway Traffic Safety Administration (NHTSA) on 17 June.

Advertisement

The ADS in question is unable to recognise construction zones, or “inappropriately” prioritises avoiding other freeway hazards, the document noted. Waymo said it owns all of the 3,871 robotaxis it is recalling.

Mounting safety concerns alongside political roadblocks hindering its rollout plans in the US are bringing into question whether Waymo – or its competitors – might succeed in enabling wider robotaxi adoption.

Waymo said it began monitoring the latest issue after six separate incidents in April where its robotaxis failed to recognise, and drove past, ramp closure signs into pre-planned freeway construction zones in Arizona.

Seven similar incidents in mid-May saw Waymo AVs drive between traffic cones to enter freeway lanes with active construction in the San Francisco Bay Area. The company decided to recall the cars on 8 June.

Advertisement

“We identified an area of improvement regarding performance around freeway construction zones,” the company said in a statement to news publications. “We voluntarily restricted freeway operations last month while making improvements, proactively notified state and federal regulators, and decided to file a voluntary software recall with NHTSA.”

This is the sixth recall Waymo has had to issue for its robotaxis, TechCrunch reported. In December, the company issued a software recall after its AVs drove dangerously around school buses. Other recalls involved low-speed collisions with gates and telephone poles.

Waymo is currently being investigated by the US vehicle safety authority after one of its AVs struck a child near a school in California.

The company also faced major disruption to its services in late December when a massive power outage in San Francisco stalled its AVs, causing disrupted traffic and gridlock conditions.

Advertisement

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Source link

Advertisement
Continue Reading

Tech

Equinix pilots hydrogen power generators in Dublin data centre

Published

on

‘If this pilot delivers what we expect, it adds real momentum to Ireland’s decarbonisation story,’ said Equinix’s Irish head Peter Lantry.

Global data centre giant Equinix is testing its first hydrogen-powered back-up units in Ireland.

The 12-week pilot programme will test two hydrogen power generators developed by UK clean energy company GeoPura situated at Equinix’s DB3 data centre in Dublin’s Blanchardstown. The units are currently being used to support cooling systems within the facility.

The pilot is in conjunction with GeoPura and ESB – which owns one of the units. A similar joint project between ESB and Microsoft was launched in 2024.

Advertisement

The three partners believe that the project could provide solutions for Ireland’s grid constraints, which faces mounting pressure from data centres that consumed 22pc of the country’s total metred electricity in 2024. That figure is only set to rise as more companies situate these massive energy users in Ireland.

Equinix and ESB said they will gain valuable data insights into carbon reduction potential as a result of the project, which could be beneficial to policymakers and universities as they assess Ireland’s renewable needs.

Currently, Ireland has 72 data centre buildings that created more than 850,000 jobs and added more than €100bn in annual gross value to the economy, according to a March report from KPMG. The Government says data centres directly employ only 21,000.

Meanwhile, climate activists say that the rapid expansion of data centres cost the Irish economy €715m between 2015 and 2023. Climate group Friends of the Earth, in a recent report, said that households could face an additional €1.43bn in electricity costs linked to data centre growth between 2026 and 2034.

Advertisement

In January, the Government launched a new plan to attract more investments in highly energy-intensive sectors by offering companies the ability co-locate alongside indigenous renewable energy resources. The companies can still locate developments outside these locations.

“As data demand continues to grow, solutions like hydrogen power units offer a reliable, clean alternative to traditional backup generation,” said Paul Lennon, the head of asset development at ESB generation trading.

Peter Lantry, the managing director of Equinix Ireland said: “If this pilot delivers what we expect, it adds real momentum to Ireland’s decarbonisation story.”

The new hydrogen generators are a first for Equinix’s 280-plus data centre footprint worldwide. The two deployed generators have helped Equinix bring its power use effectiveness (PEU) – a metric used to measure the efficiency of power usage by data centres – to below 1.3, the company said.

Advertisement

A lower PEU means data centres are using a majority of the energy consumed for computing. An ideal PEU is 1, which would mean that all the energy consumed by the facility is used for IT, with no overhead for cooling, lighting or other support.

The units, housed in shipping containers, are powered by green hydrogen and use advanced fuel cell technology that allows the system to produce “clean, silent” energy, Equinix said.

They make “zero” direct onsite emissions, and only produce water and heat as byproducts at the point of use. The back-up generators can also respond in real-time to changes in grid capacity and turn on on its own when needed.

“As demand for digital infrastructure continues to grow, operators are facing increasing pressure to secure reliable power, reduce emissions and minimise the impact on local communities,” said GeoPura CEO Andrew Cunningham.

Advertisement

“This trial shows how hydrogen can help address those challenges today. By combining hydrogen fuel cell technology with battery systems and uninterruptible power capabilities, we’re delivering reliable zero direct onsite-emission power that can respond instantly when required.”

The partners also believe that hydrogen power in this context could offer a viable lower-carbon alternative for construction sites and other temporary power needs traditionally reliant on diesel generation. Hydrogen fuel units such as these are scalable up to 50 MW to support both backup and prime power applications.

According to the trio, the waste heat could also make potential uses for future district heating projects and the water can be recycled into the on-site cooling systems.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Advertisement

Source link

Continue Reading

Tech

Day-to-day cyber incidents driving loss for SMEs, finds report

Published

on

The Hidden Cost of Cyber Risk report, found that often the challenges being faced by companies are as a result of everyday cyber disruption, rather than large scale isolated issues.

The eir business Hidden Cost of Cyber Risk report, which is supported by Microsoft and the Kemmy Business School of the University of Limerick, has found that on average cyber attacks are costing Irish small and medium-sized enterprises (SMEs) up to €3.4bn annually. 

However, the greatest impact is not from large-scale, one-off breaches, but rather frequent, day-to-day cybersecurity-related disruptions, that are in turn, driving losses for many Irish companies. 

Reportedly, SMEs lose more than 7.2m working days every year due to cyber incidents, with affected businesses experiencing multiple incidents annually. For individual firms, this equates to nearly three working weeks lost annually. 

Advertisement

Susan Brady, the managing director at eir business, said: “This report shows that cyber risk is not just about rare, large-scale attacks. 

“For most SMEs, it is the cumulative impact of everyday incidents, from phishing emails and ransomware attempts to service disruptions, that drives significant loss of time and productivity. These risks affect not just individual businesses, but supply chains, customers and the wider business ecosystem.

Challenges big and small

The report noted that, while single events can have significant financial implications, research suggests that the cumulative effect of repeated disruption, downtime, lost productivity and operational interruption creates the greatest economic cost per SME annually. The report also found that “much of this impact is avoidable”, for organisations exhibiting higher ‘cyber preparedness’.   

The report stated that the companies with more cyber preparedness tend to experience fewer incidents, lower overall losses and significantly less disruption. Moreover, the organisations with higher levels of preparedness can reduce annual downtime from more than 30 days to around five days, while structured data management significantly lowers the likelihood of experiencing an attack.

Advertisement

Commenting on the report, the Minister of State at the Department of Enterprise, Tourism and Employment Alan Dillon, TD said, “Small and medium-sized enterprises are central to the Irish economy and ensuring they are resilient in an increasingly digital environment is critical. 

“This research highlights the real and growing impact that cyber risk is having on businesses across the country, not just in financial terms, but in disrupted operations and lost productivity. However, with the right support, guidance and focus on practical measures, businesses can strengthen their resilience and reduce their exposure. “

Dr Mauricio Perez-Alaniz, an assistant prof in the Department of Economics, for the Kemmy Business School welcomed the attention to the issue. He said, “While SMEs are increasingly being reminded about the potential productivity and sustainability gains that can arise from the adoption of digital technologies, the issue of cyber risk, and the associated costs of cyberattacks, require more attention.

“This report seeks to do just that. It provides an intuitive approach to quantify the costs of cyber-attacks in terms of direct economic costs, and more importantly, potential costs associated with downtime. It is important to keep in mind that fully quantifying such costs is difficult. While the estimates presented by the report are necessarily high-level and resting on a set of assumptions, they offer important insights into the scale and nature of the issue.”

Advertisement

In early June, ESET published a similar report, the SMB Cyber Readiness Index 2026, which also indicated that some organisations are neglecting to pay attention to everyday threats, amid a sharper focus on large-scale, one-off cyber incidents. The report found that businesses are risking harm and loss of profits by allowing threats perceived to be smaller, to ‘pass through’.

Previously commenting on the report, Michal Jankech, the vice-president of enterprise, SMB and MSP at ESET, said: “While 78pc of SMBs recognise cybersecurity’s strategic importance, inconsistent understanding of key threats, technology and terminology, including MDR and security posture, suggests there is still room for improvement. Any improvement will have to start with a reality check. 

“We’ve found SMBs’ concerns are often shaped by headlines on emerging threats like AI-driven attacks, while more routine risks, phishing, unpatched vulnerabilities and lack of monitoring, are underestimated. This hints that many respondents misperceive their security posture and resilience.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Advertisement

Source link

Continue Reading

Tech

A cyber expert’s advice on the Mythos hype

Published

on

Integrity360’s Richard Ford discusses the unease caused by Anthropic’s advanced cybersecurity AI model, and how cyber teams can prepare for such technology.

In the time since Anthropic first revealed Claude Mythos in April, discourse around the cybersecurity AI model has been unceasing.

Anthropic’s claims that Mythos has seemingly advanced capabilities in finding and exploiting software security vulnerabilities caused a frenzy in public and private sectors around the world – including in Ireland.

“The issue is not that Anthropic has created this. The issue is that Anthropic has demonstrated that this is possible,” said Richard Browne, director of the National Cyber Security Centre, when speaking to the Oireachtas Joint Committee on Artificial Intelligence shortly after the Mythos reveal.

Advertisement

Mythos has not been released to the general public yet, though Anthropic had been granting access to a pool of companies, banks and authorities – that is, before a recent US government order resulted in the company disabling the model for all of its users.

But while institutions and governments panic over the capabilities of this new AI model, Integrity360 CTO Richard Ford says Mythos should be approached with “measured scrutiny rather than hype”.

“Based on the information available so far, the model appears capable as an autonomous attack tool, but there is no clear evidence that it materially outperforms existing large language models in this area,” he tells SiliconRepublic.com.

“The more important point is how it could be used. In the hands of threat actors, Mythos does not need to be revolutionary to be dangerous.

Advertisement

“It would still be highly effective when targeting organisations with weak security postures, particularly those lacking strong access controls, patching discipline and visibility across their environments.”

Hype and disruption

Ford says that much of what is driving both the hype and the concern around Mythos comes from self-reported results, with limited independent validation.

This makes it difficult to separate genuine technical advancement from narrative, he says.

“There is a legitimate question around whether the capabilities are being overstated or simply presented without enough context.

Advertisement

“Early claims of large-scale vulnerability discovery sound significant, but without external benchmarking or reproducibility, it is hard to assess how meaningful those findings are in practice.”

Ford adds that in the light of Anthropic’s previous difficulties with the US government, sceptics could reasonably question whether the Mythos announcement was “partly about shaping perception as much as demonstrating capability”.

But what if the purported sophistication of Mythos is as significant as Anthropic claims?

“If the claims hold true, there is a clear view that models like Mythos could begin to disrupt areas such as bug bounty programmes and the wider ethical hacking market,” says Ford. “The concern is not that human researchers become obsolete overnight, but that AI can significantly accelerate vulnerability discovery, shifting the balance in terms of speed, scale and cost.

Advertisement

“We are already seeing early indicators of this trend. AI-driven platforms are performing strongly in competitive CTF environments, where rapid analysis, pattern recognition and automation provide a clear advantage.

“That raises questions about how traditional bug bounty ecosystems evolve, especially if AI can identify issues faster than human researchers or commoditise parts of the process.”

How can organisations prepare?

Though Mythos has not been fully released to the public yet – and is currently disabled as of last week – Ford has some advice for cybersecurity teams regarding the eventual widespread availability of AI models such as Mythos.

“Cybersecurity teams should treat models like Mythos as an acceleration of existing threats rather than something entirely new,” he says. “The priority is getting the fundamentals right, because AI will exploit weaknesses faster, not differently.

Advertisement

“Strong identity controls, consistent patching and full visibility of assets remain critical. Organisations that lack these basics will be the easiest targets for AI-assisted attacks. In short, the better your fundamentals, the more resilient you will be as AI-driven threats become mainstream.”

Ford says organisations should avoid reacting to Mythos with panic, but should also take its implications seriously.

“The direction of travel is clear: AI is becoming embedded in both attack and defence,” he says.

He believes any organisation that is not building an AI-driven cyber defence will fall behind and “move directly into the crosshairs of attackers”.

Advertisement

“That does not mean chasing hype, but it does mean investing in capabilities that improve speed, scale and decision-making across detection and response,” he explains.

“At the same time, this only works if the fundamentals are in place. The organisations that will succeed will be those that combine solid core controls with intelligent automation, allowing them to keep pace as the threat landscape continues to accelerate.”

The reveal of Mythos has undoubtedly rocked the boat in relation to AI and its place in cybersecurity.

But while many worry about the impact of Mythos’s capacity for cyber exploitation, Ford believes the most significant long-term effect of such AI technology will be “a structural shift” in how quickly and cheaply cyberattacks can be executed – rather than a single breakthrough capability.

Advertisement

“If models like Mythos mature as suggested, they will compress the time between identifying an exposure and exploiting it,” he says. “Tasks that once required skilled researchers and time investment, such as reconnaissance, vulnerability discovery, and initial exploitation, will become increasingly automated and scalable.

“That changes the economics of cyberattacks, allowing threat actors to operate at higher volume and with greater efficiency. All of this depends of course on whether Mythos is indeed just hype or the real deal.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Advertisement

Source link

Continue Reading

Tech

Best Mesh Wi-Fi Systems (2026): Netgear, Asus, Amazon, and More

Published

on

Netgear Orbi 970 (2-Pack) for $1,300: There’s no denying that the tri-band Wi-Fi 7 Netgear Orbi 970 is an impressive quad-band mesh. This mesh system is incredibly fast, reliable, and provides expansive coverage with plenty of high-speed Ethernet ports. However, the astronomical price makes it hard to recommend. You can get similar performance for less, and full parental controls now require a separate subscription from the security software. Ultimately, this system is only worth considering if you have a large home, a multi-gig connection, and a generous budget.

More Wi-Fi 6 or 6E Mesh Systems I Liked

2 identical white cylindrical devices on a wooden table. One facing forward showing the logo and the other facing...

TP-Link Deco XE70 Pro

Photograph: Simon Hill

TP-Link Deco XE70 Pro (3-Pack) for $250: Support for Wi-Fi 6E, which operates on the 6-GHz band, is common, but with Wi-Fi 7 rolling out, 6E routers and mesh systems like this are falling in price. A two-pack of this tri-band mesh system is relatively affordable and enough to cover most homes, making this perhaps the best Wi-Fi 6E mesh for most people. I also tested the XE75 ($270 for a three-pack), which is almost identical, but has three Gigabit ports and no multi-Gig. There is also the XE75 Pro ($400 for a three-pack), which features the 2.5-Gbps port and theoretically offers slightly more bandwidth but is far more expensive. Since TP-Link frequently discounts its products, the standard model is the best choice for most people—though multi-gig users should opt for the Pro.

Advertisement

TP-Link Deco X50 Outdoor for $150: This was our previous outdoor pick, and it’s still a good dual-band Wi-Fi 6 router that will form a mesh with any Deco system (I tested with the Deco X50 4G). It’s a solid performer, but with the Wi-Fi 7 BE25 Outdoor coming in around the same price, I’d pick that instead.

TP-Link Deco X55 (3-Pack) for $150: This affordable Wi-Fi 6 mesh delivers decent coverage and performance, with optional parental controls and antivirus protection, making it ideal for a modest family home. This is a dual-band system (2.4 GHz and 5 GHz). There are two gigabit Ethernet ports on each router. Coverage and speeds are solid, falling short of the Asus XT8 but beating systems like the entry-level Eero 6.

Two white round Google Nest mesh wifi router devices one facing front and the other backwards showing the ports

Google Nest Wifi Pro

Photograph: Simon Hill

Google Nest Wifi Pro (3-Pack) for $400: Mesh systems don’t come much simpler than this. Google’s Nest Wifi Pro is a tri-band (2.4, 5, and 6 GHz) Wi-Fi 6E system that works via Google Home, and each router sports two 1-gigabit ports. The setup is super simple, coverage and performance were solid and consistent, and my testing was refreshingly free from glitches and buffering, though WIRED editor Julian Chokkattu had issues that Google’s customer support could not fix. The Nest Wifi Pro came mid-table in raw speed at short, mid, and long range, and settings in the Home app are very bare-bones. Disappointingly, it is not backward compatible with older Nest routers.

Advertisement

TP-Link Deco X20 (3-Pack) for $130: The Deco X20 is an affordable Wi-Fi 6 mesh that delivers decent coverage and performance, with optional parental controls and antivirus protection, making it ideal for an average family home. This dual-band (2.4 GHz and 5 GHz) mesh was our budget pick for a long time, and there are two gigabit Ethernet ports on each router. Coverage and speeds are decent, falling short of the Asus XT8 but beating systems like the entry-level Eero 6. The app is straightforward, and it’s easy to set up a guest network. Originally released with the free HomeCare software, this has since changed to a HomeShield system, so it’s not as good a bargain as it once was.

Linksys Velop Pro 6E routers

Linksys Velop Pro 6E

Courtesy of Linksys

Linksys Velop Pro 6E (2-Pack) for $280: Once up and running, this tri-band (2.4 GHz, 5 GHz, and 6 GHz) Wi-Fi 6E system offers impressive range and decent speeds. It is competitively priced with quite a few dips in cost (don’t pay full price), comes with basic parental controls, and offers handy features like device prioritization and a guest network. But I had a terrible time with the installation. The app continually failed partway through the process, and I had to factory reset the routers. Even then, it took multiple attempts to add the nodes. It’s also not backward compatible with older Velop “Intelligent Mesh” systems, because this is a “Cognitive Mesh” system.

TP-Link XE200 (2-Pack) for $290: This tri-band Wi-Fi 6E mesh system (2.4 GHz, 5 GHz, and 6 GHz) was fast, offered consistently wide coverage, and blew away the Wi-Fi 6 competition at close range. I downloaded a 50-GB game in 20 minutes and didn’t encounter any issues during testing. As it uses the 6 GHz band for backhaul, you have to think about placement and try to keep routers in sight of each other and within 50 feet (or better, connect them via Ethernet cable). While the XE200 is better than the XE70 Pro above, it’s simply too expensive, though it has seen some deep discounts recently, so keep an eye out for deals.

Advertisement

Source link

Continue Reading

Tech

Why AI Fails in ESG Exposure Research without Human Verification

Published

on

ESG Exposure Research: What AI Changes and What It Doesn’t

An analyst researching a company’s fossil-fuel involvement can now ask a large language model (LLM) for the exact share of revenue tied to thermal coal and get an answer in seconds—complete with a precise percentage, a specific source citation, and a perfectly confident tone.

However, that source could be a regulatory filing that never actually existed.

This is the dual reality of artificial intelligence (AI) in environmental, social, and governance (ESG) data research. On one hand, AI tools act as an efficiency superpower, parsing thousands of pages of sustainability reports, corporate disclosures, and news feeds in the blink of an eye. On the other hand, the high-stakes world of ESG investing demands absolute accuracy, a trait that generative AI—built on probabilistic word-matching rather than factual truth—fundamentally lacks.

As asset managers, rating agencies, and index constructors face tightening greenwashing regulations and stricter disclosure mandates, the role of the ESG analyst is undergoing a massive shift. AI assists them by changing the speed, scale, and cost of processing unstructured data. What AI doesn’t change, however, is the fundamental requirement for data integrity, human skepticism, and the deep contextual understanding needed to separate corporate spin from genuine impact.

Advertisement

What is ESG Exposure Data Research?

ESG exposure research measures whether a company earns revenue from sensitive or controversial activities, such as coal mining, tobacco production, gambling, weapons production, and animal testing. Rating agencies and index constructors use this data to build exposure screening platforms, risk scores, and exclusion-based indices.

ESG Exposure Research Is Not Equivalent to Report Summarization

ESG exposure is not just a reading task. It is an attribution task. An AI model may correctly identify a sentence stating that a company is connected to gambling operations, palm oil, or weapons production. But a human researcher still has to answer several questions before that finding becomes usable, activity-based ESG data:

  • Is the company producing the product, distributing it, financing it, transporting it, or only mentioning it as part of a risk disclosure?
  • Is the activity carried out by the parent company, a subsidiary, a joint venture, or a minority-owned business?
  • Is the exposure material enough to cross an index, fund, or screening threshold?
  • Can the revenue share be tied to a source that will withstand review?

These distinctions matter because the answer to “how much of a company’s business is tied to a sensitive activity” is auditable data (a revenue percentage or a yes/no involvement flag). Deducing that revenue percentage or a yes/no flag requires activity-based analysis. For instance, it involves

  • Production versus participation identification: A company that mines coal and a company that ships it for a fee both touch coal, but most exclusion methodologies treat direct production and indirect participation very differently.
  • Revenue attribution: “Involved in gambling” is not a data point; “8% of revenue from gambling operations” is. Getting there means reconciling segment reporting, subsidiaries, joint ventures, and equity stakes into a figure you can defend.

This puts exposure data research closer to forensic accounting than to summarization. It needs controversial activity screening, business involvement screening, source checking, revenue mapping, exclusion principle-based outcome alignment—exactly where large language models are least reliable.

Where AI Helps ESG Analysts: Finding Possible Evidence Faster

AI is useful in the discovery stage of ESG exposure metrics data collection. This is the part where analysts look for possible evidence across large volumes of fragmented information.

AI can scan large volumes of ESG disclosure data (such as complex, multi-page, bundled documents and reports) and flag documents that may contain relevant evidence. For example, it can identify a line in an annual report mentioning thermal power assets, detect a subsidiary involved in defense manufacturing, or surface a foreign-language sustainability filing that references tobacco distribution.

Advertisement

This helps ESG research teams in three ways:

  • Faster Document Review
  • Instead of reading hundreds of pages manually, analysts can start with passages AI has flagged as potentially relevant.
  • Better Language Coverage
  • AI can help identify evidence of exposure in local filings, regional websites, and non-English disclosures that may otherwise be missed.
  • Early Structuring
  • AI can turn unstructured text into well-formatted research leads, including company name, activity type, source document, page reference, and possible exposure categories.

AI improves the speed of document ingestion and scanning and reduces the manual effort needed to collect candidate evidence from hundreds or thousands of documents. But the output should still be treated as a lead, not a final ESG data point.

Where AI Fails in ESG Data Research: Verification and Attribution

The weaknesses appear when AI is asked to decide what the evidence proves. ESG exposure work often requires source hierarchy, accounting logic, and judgment specific to the methodology. Current AI models are not reliable enough to own those steps without review.

1. AI Can Produce Unsupported or Misleading Sources

AI can produce answers that sound well-supported but are not. In high-stakes research, this is a serious problem because the source matters as much as the answer.

Advertisement

Stanford RegLab’s study of legal AI tools found that even specialized tools from LexisNexis and Thomson Reuters hallucinated between 17% and 33% of the time. That matters for ESG because the workflow is similar: a user asks a research question, the model searches a document base, and the answer must be tied to a reliable source.

There is also ESG-specific evidence. The ESGenius benchmark, which tested 50 language models on ESG and sustainability questions, found that state-of-the-art models achieved only moderate zero-shot accuracy, typically around 55% to 70%. The results improved when models were grounded in authoritative sources, which reinforces the same point: AI output in ESG cannot be trusted without source-level grounding.

The same risk appears in financial table work. The FAITH benchmark, built from S&P 500 annual reports, showed that financial LLMs frequently hallucinate on complex financial table tasks. ESG exposure research often depends on the same type of work: extracting segment revenue, calculating percentages, and reconciling figures across notes and subsidiaries.

If the model misreads a table, cites a weak source, or invents a supporting reference, the revenue exposure data becomes unreliable.

Advertisement

2. AI Blurs Important Classification Boundaries

AI often collapses distinctions that matter in ESG exposure screening. For instance, a model may classify a company as “coal involved” if a report mentions coal logistics, a backup power unit, a discontinued coal asset, or a risk note on coal regulation. But these are not the same as direct coal production. Ultimately, a human would have to fix such boundary mistakes (e.g., confirming that a logistics company that merely transports coal via its rail network does not qualify as a thermal coal producer under the exclusion policy).

The same problem can appear in other categories. A retailer selling lottery tickets is not the same as a casino operator. A company supplying packaging to a tobacco firm is not the same as a tobacco manufacturer. A business with a palm oil sourcing policy is not automatically a palm oil producer.

3. AI Fails to Adapt to Client-Specific Exclusion Methodologies

Advertisement

Exclusion policies are not universal; a company that passes a screen for one asset manager might fail it for another. AI struggles here because it treats corporate data as a static set of facts rather than a dynamic input that must be filtered through different client-specific lenses.

For example, an asset manager running a strict faith-based mandate might require a zero-tolerance exclusion of any revenue derived from gambling logistics, while an institutional pension fund might only exclude direct casino operators that generate more than 5% of their revenue from gaming. Similarly, one client may view a company’s palm oil sourcing policy as a positive ESG mitigant, while another client’s strict “zero-deforestation” mandate demands an automatic exclusion if palm oil is present anywhere in the supply chain.

Because AI models are typically trained on generalized compliance definitions, they routinely fail to pivot their logic based on who the data is being collected for. Without highly customized prompting or manual intervention, AI will apply a uniform blanket standard—either over-excluding viable companies or letting flagrant violations slip through because it doesn’t understand the specific client’s shifting threshold for “involvement.”

4. AI Inherits the Bias of Corporate Disclosure

Advertisement

AI can only work with the evidence available to it. If a company discloses little, uses vague language, or buries information in subsidiaries, the model may produce a cleaner answer than the evidence allows.

This is already a known issue in ESG. MIT Sloan’s Aggregate Confusion Project found that ESG ratings from prominent agencies had an average correlation of 0.54, compared with 0.92 for credit ratings from Moody’s and S&P. That gap shows how differently ESG evidence can be interpreted even before AI is introduced.

AI does not remove that uncertainty. If implemented poorly, it can hide uncertainty by turning fragmented ESG risk exposure data into a single confident output.

ESG Exposure Metrics Research Needs More than Just AI in 2026

Incorrect ESG exposure data does not stay inside a spreadsheet. It can affect index inclusion, fund screening, rating decisions, and client reporting. The cost of weak ESG exposure research is rising for two reasons.

Advertisement

 First, ESG rating activity is becoming more regulated. The EU (European Union) ESG Ratings Regulation applies from 2 July 2026, with ESMA (European Securities and Markets Authority) becoming the direct supervisor of ESG rating providers operating in the EU. This increases pressure on providers to show how ratings, methodologies, and data sources are built.

 Second, sustainability reporting rules are changing. The EU’s CSRD (Corporate Sustainability Reporting Directive) simplification raises the reporting threshold to companies with more than 1,000 employees and more than €450 million in net annual turnover. That means fewer companies will be covered by standardized sustainability reporting than under the earlier scope.

For ESG exposure teams, this creates a difficult combination. More scrutiny is being placed on ESG data, while parts of the research may depend more on fragmented, non-standardized sources. Ethical AI can simplify ESG data research by helping teams process disclosures faster, organize evidence, and identify missing data points. But in ESG exposure research, that value holds only when AI outputs are traceable, reviewed by analysts, and supported by source-level documentation.

The Operating Model that Works: AI for Discovery, Humans for Attribution

AI should not be removed from ESG exposure research. It should be placed in the right part of the workflow. A reliable ESG Exposure Research model works like this:

Advertisement

1. AI scans filings, websites, reports, and news sources to identify evidence of possible exposure.

2. Each AI-generated lead is checked against the original source and verified before use.

3. Analysts confirm whether the activity is direct, indirect, current, discontinued, subsidiary-level, or group-level.

4. Revenue exposure is calculated from verified financial data, with assumptions clearly documented.

Advertisement

5. Each final ESG data point includes source details, date, confidence level, and review status.

6. Unverified AI leads are logged, so teams can track tool performance over time.

This model incorporates human-in-the-loop verification in ESG exposure research: AI handles the scale problem and provides speed, and people handle the attribution problem. 

The Bottom Line

The strongest ESG research workflows will not be the ones that use AI to replace analysts. They will use it to reduce search time while keeping humans responsible for verification, attribution, and auditability. As scrutiny of both ESG data and AI tightens through 2026 and beyond, this boundary will decide which datasets can withstand review and which ones cannot. 

Advertisement

Source link

Continue Reading

Tech

Midjourney Builds a Scanner Capable of Delivering Detailed Body Maps During a Relaxing Spa Visit

Published

on

Midjourney Medical Body Scanner MRI Ultrasound Spa
Midjourney once built its reputation on turning short text descriptions into elaborate digital images. The company has now announced a sharp turn toward hardware that produces something far more personal: three-dimensional maps of what lies beneath a person’s skin. The new effort, called Midjourney Medical, centers on an ultrasound scanner designed to gather rich body-composition data in roughly a minute while the user stands in a shallow pool of gently lit water.

Founder David Holz detailed the concept in a lengthy blog post. The system lowers a person onto a platform, which gently descends via a ring of sensors floating in water. As the body moves, hundreds of thousands of small elements emit ultrasonic waves in all directions and capture the echoes that return. Different parts of the body, such as skin, fat, muscle, bone, and organs, have detectable effects on those waves. The massive amount of data that comes in, terabytes per second, is then fed into a cluster of computers, which reconstructs it all into clear 3D images and body maps.

Sale


ScanSnap iX2500 Wireless or USB High-Speed Cloud Enabled Document, Photo & Receipt Scanner with Large…
  • OUR MOST ADVANCED SCANSNAP. Large touchscreen, fast 45ppm double-sided scanning, 100-sheet document feeder, Wi-Fi and USB connectivity, automatic…
  • CUSTOMIZABLE. SHARABLE. Select personalized profiles from the touchscreen. Send to PC, Mac, mobile devices, and clouds. QUICK MENU lets you quickly…
  • STABLE WIRELESS OR USB CONNECTION. Built-in Wi-Fi 6 for the fastest and most secure scanning. Connect to smart devices or cloud services without a…


Some early prototypes have already collected scans from a dozen or more individuals. The technology makes use of miniature ultrasound modules from Butterfly Network, with dozens of them in each scanner. The AI then assists in determining how to convert those raw sound waves into usable images, as well as distinguishing between one part of the body and another. Currently, the output focuses on precise maps of body composition rather than actual medical diagnosis.

Advertisement

Midjourney Medical Body Scanner MRI Ultrasound Spa
The physical experience is far more relaxing than an MRI. There are no large magnets or small tunnels in sight, only a shallow pool of pleasant light. A platform descends, your body passes through the sensor ring, and it’s over in a minute. Midjourney describes the entire experience as moving at a leisurely speed, similar to taking a warm bath. The laid-back atmosphere was all part of the idea. They plan to open a Midjourney Spa in San Francisco by the end of 2027, combining traditional wellness elements such as hot tubs and saunas with pools for the scanners. The idea is that you go there to relax, and as a bonus, you’ll leave with all of this health data that you can review, track, or share with your doctor.

Midjourney Medical Body Scanner MRI Ultrasound Spa
According to Holz, the primary goal is to make the technology fast and simple to use, as well as to provide consumers with a wealth of relevant health information promptly and affordably. The scanner is designed to run roughly a hundred times faster than an MRI and produce images that match or even outperform MRI quality for body composition analysis. Plus, it’s non-ionizing and the entire thing is open water, so there’s no need to worry about the normal sources of discomfort.

Midjourney Medical Body Scanner MRI Ultrasound Spa
They are still in early stages of development. The next year will be spent adjusting the hardware and software, conducting additional research, and developing a second-generation scanner. They want to open the first spa by the end of 2027 before expanding to additional locations in 2028. Longer term, they hope to have 50,000 scanners in place by 2031, with a monthly scan rate of a billion.

Source link

Continue Reading

Trending

Copyright © 2025