AI AND ML

Disclosure optional, quality mandatory

The Debian community has voted to allow members to use generative AI when creating their contributions, with the caveat that developers remain responsible for code quality.

The Linux distro’s community recently decided to develop a policy on use of AI-assisted coding tools, and asked participants to vote on one of eight proposals that included an outright ban, cautious use, or just avoiding LLMs because of their impact on Earth’s environment.

The rules of the vote saw community members asked to rank each of the eight proposals. Just under 600 people voted, but Debian’s election team rejected many for unspecified reasons, leaving almost 450 valid votes to count.

When the tallying was done, proposal E – “Responsible Use of Generative AI” – won the day.

The proposal means “Debian neither endorses nor prohibits the use of generative AI tools in the development, maintenance, or documentation of software, packaging, documentation, and other media published within the Debian Project.”

The proposal advocates that approach because “such tools can substantially improve the productivity of contributors when used responsibly, allowing volunteers to spend more of their limited time on work that requires technical expertise, judgment, review, and collaboration.”

The proposal also spells out that the Debian community doesn’t believe “AI made a mistake” is an excuse for sloppy contributions.

“The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance,” the proposal states. “The use of a generative AI tool does not diminish the contributor’s responsibility for the work they submit. Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian.”

Woe betide the dev who doesn’t check their AI-generated code, as the proposal also states, “Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian’s established development practices.”

Another element of the proposal tries to make acknowledging the use of AI a norm.

“We encourage our contributors to disclose whether a contribution was made with AI assistance, but do not require them to do so,” the text states.

As our FOSS aficionado Liam Proven wrote in his report on the vote, the Gentoo Linux team has banned use of AI, while NetBSD and OpenBSD don’t want any clanker-written code contributions.

Linus Torvalds, arguably the most influential figure in the FOSS community, welcomes AI-generated contributions.

In July he declared “Linux is not one of those anti-AI projects” – and recently proved it by using AI to squash a tricky bug. Torvalds has also sometimes complained about AI, such as his May observation that AI-generated bug reports sometimes made the Linux security mailing list “unmanageable.” ®

Bill Gates has published a memo proposing a tax on AI, a category of jobs reserved for humans and new institutions to manage the transition, and told GeekWire that industry leaders are worried privately while staying quiet publicly. He proposed a robot tax in February 2017, the same month the European Parliament adopted robotics rules that left the tax out.

Bill Gates says the people building AI are worried in private and quiet in public. “I know they’re all worried. Or all of them that I know, which is basically everybody but Elon,” he told GeekWire.

The reason he is talking is a memo he published this week. It argues the industry is crossing the safety lines it set for itself, and that nobody is preparing for what follows.

TNW covered the proposals when it landed. A tax on AI, a category of jobs reserved for humans, and new institutions to manage the transition.

The interview adds the part he did not put in writing. “Even lack of control that I thought would be many years from now, we’re seeing lack of control,” he said.

On the tax, Gates is repeating himself. He first proposed taxing robots in February 2017, when the argument was about factory automation rather than models, and the reasoning was the same.

Europe answered that question the same month. The European Parliament voted 396 to 123, with 85 abstentions, on rules for robotics, and the tax was not in what passed.

What passed instead is worth reading. The resolution asked the Commission to look at the viability of member states’ social security systems as robots spread, which is the diagnosis behind the remedy MEPs had just dropped.

It also floated something stranger. The adopted text raised electronic personhood for the most sophisticated autonomous robots, an idea that has gone nowhere since.

The rapporteur was not pleased. Mady Delvaux said certain coalitions in the Parliament had rejected a forward-looking debate about workers, and the robotics industry welcomed the outcome.

Nine years on the position has not moved. The AI Act regulates risk and requires human oversight, and TNW has asked whether it can protect jobs without stifling innovation.

It does neither of the things Gates wants. It does not tax a model, it does not reserve a category of work for people, and no member state has proposed either.

The evidence base is thinner than either side admits. TNW has argued that what AI is doing to jobs in Europe looks different from the headline numbers.

Which leaves the memo where it started. A man who proposed this in 2017 is proposing it again, and Europe has already voted.

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.

The company is signing affected users out of Claude, removing saved payment methods, and refunding charges it identifies as unauthorized.

“We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage,” Anthropic said in an email sent to an affected user, who shared it on Reddit.

“If your usage limits looked like they refilled and then drained while you weren’t using Claude, this was likely the cause,” Anthropic warned.

It is also worth noting that infostealers can copy an already authenticated browser session, which means the attacker may not need to go through the normal password and 2FA login process again.

Anthropic links attacks to Vidar, LummaC2, StealC, RedLine and other infostealers

In the email, which is also being sent out to other compromised account holders, Anthropic says its investigation is ongoing, but computers were likely already infected with general-purpose infostealer malware.

“We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” the company stressed.

According to Anthropic, the malware typically arrives through downloads or malicious apps and steals information stored locally, including browser passwords, login cookies, and credentials belonging to other apps.

“Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them,” Anthropic said.

In this case, the Redditor who shared the email confirmed that they downloaded a pirated game, which explains why their system got compromised.

Anthropic has identified multiple malware, including Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, along with Atomic Stealer (AMOS) on a small number of Macs.

If you get affected, Claude will revoke compromised sessions and remove saved payment methods to prevent unauthorized purchases.

“Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware,” Anthropic warned. “If it’s still on your computer, your next login session could be stolen the same way.”

Anthropic has urged affected users to take basic security steps, including changing credentials, revoking other sessions, and removing the malware from the PCs.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

In this week’s Sunday Reboot, Apple’s inconvenient Mac launch timing and the transition from Cook to Ternus nears its conclusion.

Sunday Reboot is a weekly column covering some of the lighter stories within the Apple reality distortion field from the past seven days. All to get the next week underway with a good first step.

An oddly earlier upgrade than normal

It is the pre-iPhone event season, and the media is hard at work preparing for what Apple will be showing off in its early September event. It’s usually a busy period, with lots of pre-writing of pieces that will be adjusted and added to as Apple makes its announcements.

Except this week, Apple decided to change things up a lot. It announced some products way earlier than we expected.

Cue a week of writing about the Mac Studio, the Mac mini, and the new M6 generation of Apple Silicon.

To people covering Apple, this meant a sudden influx of launches to analyze and write about at length. This wouldn’t entirely be a bad thing, except that we were expecting Mac stuff to arrive either during the September event or in October.

The Mac preparations usually happen after the iPhone launch posts. This meant the Mac posts this week were created with no pre-made elements, no prep work. Doing it live.

However, one thing did pop into my head about this week’s Mac launch. Why did Apple do this now?

Mac Studio, one of Apple’s August updates.

Someone speculating on Apple’s current situation may see it as an attempt by Apple to shake up how it launches products even more. After all, it’s already separated the Pro and non-Pro iPhone launches, so other changes are fair game.

The impending Ternus change could be a license for Apple to switch things up even more.

There’s also the idea that Apple would rather use its events for bigger product launches, like its new smart home items. They would certainly rank higher than a spec-bump update.

However, looking back over Apple’s launches in recent years, we also see that it’s not entirely a new phenomenon for the company.

The last time Apple launched a product in August was an iMac in 2020. Since then, it has launched Mac products in June and July, such as the M2 MacBook Pro and MacBook Air in 2022, as well as the MacBook Pro, Mac Pro, and Mac Studio updates in 2023.

There was a HomePod mini update in July 2024, but nothing Mac-based during the summers of 2024 and 2025. That doesn’t mean Apple gave up on them, as this week’s Mac launches have confirmed.

The real question is whether Apple has more products that it could put out in October to warrant a second event. With some of its Mac lineup already announced, that reduces the potential pool of Mac updates.

With this year introducing a folding iPhone that will eat into the September event’s time, we may see Apple keeping its OLED iPad mini update for the October one, alongside a much smaller collection of MacBook launches.

This early batch of Mac launches could well be in service of creating two events that have far fewer products on show.

For us at least, it helps spread the stress out a little.

Cook out for Ternus

The week ahead will be a major one for Apple’s history. Apple CEO Tim Cook is vacating his role for a similar board-based one, and giving it up for hardware chief John Ternus to take over.

It’s a transition that we have known about for months, thanks to Apple’s decision to announce the change in advance. But as the changeover date draws near, you can expect an awful lot of coverage about it.

Looking to the past, there’s going to be discussions about Cook’s legacy, reminiscing about key moments at the company, and picking apart what he got right and wrong.

Then there’s the other side of the coin. Articles explaining who Ternus is, speculation on how the company could change, and a lot about potential executive team changes.

From Apple itself, you’re not going to get much of a song or dance about the situation.

Pikachu at Apple Park.

Sure, there will be press releases about Cook’s role shift, as well as one about Ternus becoming CEO. Cook will also take to social media to thank Apple employees for their work, and Apple’s fans too.

But really, this week ahead is going to be a gradual introduction of Ternus to the public. A very gradual one, that has so far involved Pikachu.

Apple will want to gently break in Ternus being in charge, because not everyone knows about this. At September’s special event, despite the long wind-up period, people are still going to see Ternus and ask who he is in complete surprise.

Maybe Apple could do its own version of the “Doctor Who” regenerations as a pre-announcement skit.

Last week’s Sunday Reboot talked about the leaked video for the AirPods Pro with Cameras, and how they could be the best smart glasses for people who wear glasses.

on-prem

Tree huggers aim to end blanket critical infrastructure status for bit barns and ensure environmental standards are met

The Green Party of England and Wales wants the government to end the blanket designation of new bit barns as “critical infrastructure” and change planning rules to stop such facilities taking precedence over households for water and energy.  

The current UK government designated datacenters as critical national infrastructure (CNI) back in 2024, putting them on the same footing as essential services such as water and power. This made them eligible for special protection, but may also make it easier for developers to overcome any local objections to their construction, as The Register pointed out.

The Green Party claims that CNI status means that server farms are prioritized for access to water and energy, even when ordinary households are hit with drought restrictions, as over 27 million people currently are in England.

It wants to see planning permission for new facilities granted only when the developer can show it will meet the highest environmental standards, and there has been full community consultation.

“We need to slam the brakes on the rampant building of new datacenters which could put our communities at risk of water shortages and drive up energy bills – and yet are currently being waved through by our government,” said Green Party leader Zack Polanski.

“Data should serve people, not the other way around – but right now, because datacenters are designated as critical infrastructure, people come a poor second, with datacenters even being given priority for water and electricity.”

“We need clear criteria to distinguish between datacenters vital to national security or public services, and those that simply serve private tech companies and private profit,” Polanski added.  

There was certainly talk earlier this year of prioritizing “strategically important” grid connections, which would include data campuses, and a report published by the London Assembly late last year highlighted the pressure on the power supply in the capital, with some areas of West London having to put a hold on new housing developments.

On the water side, MPs were warned earlier this year that official forecasts of England’s future water needs excluded datacenters, despite the growing number of them, and that they could end up competing with homes and businesses for supply.

The Green Party claims that a single large-scale datacenter can use around 1.5 million liters (396,258 US gallons) of water per day, comparable to the daily water needs of a town of around 10,000 people. Yet bit barn construction is projected to expand rapidly, with growth often concentrated in areas already classified as water-stressed, like London and the South East. 

But water consumption can vary, depending on the cooling systems in use at specific facilities. In theory, newer campuses should require less water, especially if they are deploying AI infrastructure that uses so-called direct-to-chip cooling, where fluid is circulated through a closed-loop system.

A government spokesperson told us: “A pause on building new datacenters would simply send investment and good jobs abroad, while leaving Britain dependent on overseas computing for the processing of sensitive health and defense data. Put simply, it would be a disaster for jobs and national security.”

However, the spokesperson added: “This does not mean a blank cheque for Big Tech or that every datacenter should be approved. Developers should prioritize clean power, use water responsibly, create British jobs and supply chains, and provide investment to the communities in which they are built.”

The Green Party is also calling on the government to urgently develop a comprehensive national strategy for AI infrastructure, as the country is currently dependent on foreign-owned infrastructure for critical services, from healthcare to public safety – something the Institute for Public Policy Research was warning about just this week. ®

The Manchester Airports Group data breach has been claimed by extortion group FulcrumSec, which told BleepingComputer that it stole approximately 86 GB of data.

Samples reviewed by BleepingComputer contained information consistent with MAG’s disclosure while indicating that the breach exposed considerably more detailed customer, booking, and travel information than initially revealed.

Hackers claim theft of 86 GB of data

Manchester Airports Group (MAG), the United Kingdom’s largest airport operator, disclosed on August 27 that an unauthorized third party had stolen customer data related to Manchester, London Stansted, and East Midlands airports.

The company said the affected information came from car park, lounge, and Fast Track bookings and in-airport Wi-Fi registrations.

In emails to BleepingComputer, FulcrumSec claimed responsibility for the attack and shared samples of the allegedly stolen data as evidence.

BleepingComputer validated one record by comparing it with the traveller’s known Manchester Airport purchase history.

The record accurately listed previous Fast Track purchases, booking and scheduled-arrival times, the terminal used, amounts paid, purchase references, total spending and the apparent purpose of the trips.

The material included a roughly 21.5 GB Manchester customer export containing consolidated profiles that combined customer identifiers with historical booking activity and marketing classifications.

The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.

These records allegedly contain dates, times and booking information linked to personally identifiable information.

FulcrumSec says it intends to publish the stolen data and a technical account of the intrusion. However, it told BleepingComputer that it is considering withholding or redacting those records because of the potential for “real-world harm.”

While the samples appeared authentic, BleepingComputer could not independently verify the alleged source or extent of the threat actor’s access, the overall size of the stolen dataset, or the claim concerning nearly 200,000 upcoming-travel records.

After completing its verification, BleepingComputer securely deleted all supplied material without retaining copies and will not publish or share any part of it.

FulcrumSec is a financially motivated data-extortion group active since 2025 that focuses on stealing sensitive corporate data and threatening to publish it rather than encrypting victims’ systems.

The group has previously claimed attacks on organizations including LexisNexis, Novo Nordisk, Global Schools Group, and Avnet.

MAG declines to address hackers’ claims

BleepingComputer contacted MAG again before publication and asked the company to address FulcrumSec’s claims concerning the 86 GB dataset, exposed credentials and future-travel data.

A spokesperson declined to address the specific claims, referring instead to an updated statement confirming that affected customers with upcoming bookings had been contacted.

“MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support,” a MAG spokesperson told BleepingComputer.

The attackers reportedly demanded a monetary ransom, which MAG was understood to have refused to pay.

Scope appears broader than initially suggested

Beyond the email addresses, phone numbers, vehicle registrations and postcodes disclosed by MAG, sampled records contained purchase and booking references, airport and product selections, prices, discounts, booking status, parking dates and times, historical spending, IP addresses, approximate locations, device information and customer-engagement data.

BleepingComputer did not observe payment-card or bank-account information in the reviewed samples.

Unlike US ZIP codes, which generally cover broader delivery areas, a full UK postcode can identify a small group of neighboring properties. According to the UK Office for National Statistics, a typical small-user postcode covers approximately 15 addresses, while some postcodes are assigned to a single address.

Combined with contact, vehicle and travel information, these details could allow attackers to reference a victim’s airport, vehicle, parking dates, booking status or purchased services in convincing phishing emails, text messages or telephone scams impersonating MAG or a booking provider.

MAG said it has contacted affected customers and advised them to remain vigilant for suspicious emails, text messages, and telephone calls.

The airport operator stressed that it would never contact customers unexpectedly to request payment-card details, banking information, or passwords.

The incident has not caused operational disruption, and MAG says passenger safety and aviation security were not compromised.

A MAG spokesperson previously told the Manchester Evening News that around 8.7 million customers were affected, although only email addresses were exposed for the “vast majority.”

That makes it the largest known customer data breach affecting a British airport operator.

With files from Bill Toulas

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

A specific cadence for contemporary group chats eludes me. The rapid-fire tempo of texts combined with custom stickers, often based on inside jokes, leaves me behind. My digital fate: the silent lurker. As I let the notifications wash over me, I am a ghostlike figure haunting the group chat, a silent watcher who rarely responds without a specific invocation.

Group chats are dominating the social lives of younger Americans. In a recent YouGov poll, 34 percent of adults under 30 said they are in at least four group chats, whether via text or other messaging app. Power texters are spending hours juggling multiple message threads—3 percent of adults under 30 said they are in more than 20 distinct group chats.

These group chats are not just for the young folk, though. All attempts at social interactions now spark a new group message. A WhatsApp thread for our monthly book club. An Instagram group for that weekend getaway. A bulbous iMessage chat with random cousins attempting to plan a family reunion. Group chat hell is everywhere you turn.

Here are a few tips for maintaining your sanity during the reign of the group chat, without becoming a textless social pariah. Hint: It’s all about boundaries.

Core Compromise

Maybe you thrive in the chaos of hundreds of notifications, but I don’t. I started by choosing which text threads were most important to me. A text thread with my immediate family is nonnegotiable. A group message about a trip that’s in one month is actually helpful for logistics. A random thread where people are throwing out Halloween ideas might be fun, but it’s on the chopping block. Make a short list of what you actually want to participate in and stay there.

Walk Away

For the others, you can leave the chat. It really is that easy. Especially for event-based group chats, I’m quick to leave the conversation after it’s all wrapped and any outstanding bills are settled. Much like I’m not going to be the last person to leave an afterparty, I’m walking away from group chats without hesitation. If there’s a specific aspect of the conversation I want to keep going, I’ll follow up with those people.

Mute It

You’ve picked your core group chats you don’t want to give up, and you’ve walked away from the rest. Now is your time to play with the notification settings and see what your smartphone offers. It’s worth looking into the settings overall, as well as the options for individualized threads inside apps, especially if some notifications rarely come through while other text threads are more active.

If you balk at the idea of notification distractions, consider Do Not Disturb settings. Be forewarned that being this unreachable can sometimes become a headache for those closest to you.

Get Creative

For those group chats you decide to stay in, why not spruce up the place a bit? Whether you’re on an iPhone or Android, there are plenty of options for making your group chats more specific to your context and potentially just more fun to use. Right now I’m watching Game of Thrones from the beginning for the first time. I have a group chat with friends to process some of our reactions and update the background image to whatever character I’m currently rooting for.

Go Direct

I mentioned earlier that when I leave a group thread and I want to keep some aspect of the conversation going, I’ll follow up directly with people. This seems to be the better direction to take overall. While you may get a dopamine rush from shooting off hilarious memes and receiving reaction emojis in the group chat, cultivating relationships often happens best with one-on-one moments. Directly texting someone feels like a worthwhile compromise to escape from group chat hell, without fully excluding yourself from modern messaging. Though a face-to-face chat always feels best.

If what you value in a label maker is a result that looks polished, professional, and decidedly not homemade, the P-touch Cube Plus is calling your name. It allows for great versatility in its labels, printing on tape as narrow as 6 mm and as wide as 24 mm, meaning you can use it to organize the small jars on your spice rack and large boxes in your storage unit.

The Cube Plus also supports a huge selection of designs, with hundreds of fonts, borders, and graphics, available via your choice of three design apps and platforms accessible via Bluetooth connection: Brother Design&Print 2 (also compatible with the Brother PT-n25bt), iPrint&Label, and P-touch Editor software that you can use with a desktop, the latter of which I did not test. Like the Brother Design&Print 2 app, discussed above, the iPrint&Label is seamless to use. Its templates are less ornate, but on this upscale device, I found this simple quality to be nice, eliminating the time-suck of customization flourishes but still producing a professional-quality label. You do have to use one of these apps, though, as there’s no on-device keyboard. Once you select “print,” the connection is quick—just a couple of seconds—and the Cube Plus self-cuts your new label for you.

At nearly three times the price of the Brother PT-n25bt, the Cube Plus’ upscale features do come at a cost, though—and the bills don’t stop once you buy the machine. The Cube Plus works with Brother’s TZe laminated label tape; replacement cartridges start at $15 for black print on clear tape and are pricier for specialty colors, like $24 for black print on glitter yellow tape. But the labels feel as premium as they claim to be, with text printed between seven layers of lamination. In my testing, the tape held up to heat, sunlight, microwaving, dishwashing, and general wear and tear.

Price aside, there is something joy-inducing about making a jazzed-up label—my 4-year-old, for one, was thrilled about his shimmery gold new lunchbox label. Also, I was intrigued to learn that Brother sells a TZe fabric label tape that’s compatible with the Cube Plus. Though I didn’t test it, fabric tape is something I haven’t seen as an option on other home label makers, and parents in particular will find the ability to label clothes super-useful, even though this version still requires the extra step of ironing it on.