from the every-button-a-self-destruct-button dept

There are several layers of bullshit in operation here, so we’ll walk through it all. But keep in mind the only reason this is all being exposed is because Trump administration officials feel they’re more obligated to “own the libs” than actually do their damn jobs.

Last October, “conservative influencer” Nick Sortor was arrested by Portland (Oregon) police after an altercation with anti-ICE protesters. Sortor received preferential treatment from the Trump administration. He was allowed to stand on the roof of the ICE detention center and film protesters during then-DHS head Kristi Noem’s visit to the site.

The DOJ decided to intervene on Sortor’s behalf. It went after the Portland Police Bureau (PPB), demanding it turn over thousands of documents it claimed were evidence of the PPB’s desire to punish certain people for certain kinds of speech.

To do this, it cited a DOJ settlement reached with the PPB back in 2013 — one that said nothing about any PPB attempts to shut down speech the PPB didn’t like. The paragraph cited in its demand for documents said this:

Too frequently, persons who have or are perceived to have mental illness and are in crisis are subjected to unnecessary or excessive force by police officers. The Portland Police Bureau lacks adequate policies to guide officers in these circumstances, or training, supervision and accountability measures necessary to ensure that officers comply with the constitutional rights of people in mental health crisis.

That’s the first layer of bullshit. The DOJ isn’t going after the PPB because it has any genuine concerns about its treatment of people with mental health issues. It’s going after the PPB because it arrested one of theirs and is located in a “liberal” city this administration desires to punish however it can, whenever it can.

The next layer of bullshit is the DOJ pretending any previous settlement over excessive force by local law enforcement is worthy of recognizing. Since Trump’s return to office, the DOJ Civil Rights Division solely exists to further the goals of the administration’s white Christian nationalists. It has already made moves to dissolve or suspend court-ordered consent decrees affecting local law enforcement agencies successfully sued/investigated for pattern-and-practice rights violations because it feels law enforcement shouldn’t have to answer to anyone.

So, it’s entirely hypocritical for this administration to cite a consent decree it would have sought to have removed if it affected a Red State agency in hopes of punishing Portland and its police department for anti-ICE protests.

The government claimed the settlement entitled it to whatever documents it wanted from the PPB. But Assistant Attorney General Harmeet Dhillon decided to shit the bed by being exactly the sort of person you’d expect her to be, given her subservience to Donald Trump. From the ruling [PDF] handed down by federal judge Michael Simon rejecting the government’s bad faith effort to leverage a PPB civil rights settlement for its own vindictive purposes (h/t Gabriel Malor):

On October 3, 2025, the same day that Judge Immergut was holding the hearing on the motion for temporary restraining order requested by the State of Oregon and the City, the Assistant Attorney General for the Civil Rights Division of the United States Department of Justice, Ms. Harmeet Dhillon, publicly stated that DOJ would conduct a “full investigation” of policing of the protests at the Immigration and Customs Enforcement (“ICE”) facility in Portland, Oregon.

She announced this by reposting a social media post from social media personality Nick Sortor, who wrote: “BREAKING: Attorney General Pam Bondi has ORDERED a full investigation, led by Asst. AG Harmeet Dhillon, of the Portland Police Bureau, following my wrongful arrest last night, Bondi confirmed to me. FAFO, @PortlandPolice….” Assistant Attorney General Dhillon also attached to her repost her own comment, which read: “Portland: It’s FO time. Buckle up.” Id. (emphasis added).

This gloating has turned out to be premature. The court says the administration has presented no evidence the PPB is failing to follow the terms of the 2013 settlement. Furthermore, that settlement was tied to the abuse of people with mental health illnesses. There were no allegations in the settlement that the PPB regularly punished people for engaging in protected speech.

This is the first of three indications the government has “unclean hands.” This is a legal term of art that basically means the government’s intentions are impure and enough impurity is on the public record to support this finding. Part of that is Dhillon’s tweet above, which makes it clear the targeting of the PPB was directly related to the arrest of Nick Sortor, rather than anything the administration claimed in its legal filings.

As the court notes here, the government is cheating when it uses a completely unrelated enforcement effort in order to induce compliance.

[T]he United States asserts that it is purporting to investigate whether the Portland Police Bureau has engaged in political viewpoint discrimination in violation of the Agreement in this case. This case, however, has never been about viewpoint discrimination, or even any issues arising under the First Amendment.

Second, there’s the timing. This action was pursued by the administration only after it was sued by the city and state over its commandeering of Oregon’s National Guard units.

Finally, there’s Dhillon’s tweet, which can’t even be charitably be referred to as “ill-advised.”

As noted, Assistant Attorney General Dhillon preceded her reposting of a Nick Sortor comment with Dhillon’s own comment: “Portland: It’s FO time. Buckle up.” (emphasis added). That is neither language nor tone of a good faith investigation by the United States Department of Justice. Instead, it exhibits all the hallmarks of a threat and attempted intimidation.

And that’s not even the totality of the intimidation tactics engaged in by AAG Dhillon. A footnote points out Dhillon also decided to tweet out a threat targeting the judge that had originally blocked the government from obtaining these documents from the PPB.

In addition, on the same day that Judge Immergut issued her temporary restraining order, relying in part on the testimony of two high-ranking officials from the Portland Police Bureau, Assistant Attorney General Dhillon reposted a comment from another social media personality that read, in part, “Judge Immergut must be impeached.” (emphasis added). This too is threatening conduct by Assistant Attorney General Dhillon.

This is not how a federal agency — especially the one expected to fight for justice, rather than just act like extensions of Trump’s id — is supposed to behave. But Trump himself expressly encourages this behavior and anyone with the least bit of personal/professional restraint has likely been fired and replaced by brainstem operators like AAG Dhillon.

What this means is that the courts no longer trust the DOJ, which makes it all the more difficult for it to secure the wins Trump demands from his underlings. This is a blueprint for perpetual failure. Unfortunately, no one in the administration is willing to learn anything from these experiences because doing so just means educating yourself out of a job.

Filed Under: dhs, doj, harmeet dhillon, ice, nick sortor, portland, trump administration

Founded in 2007, Alo Yoga (short for ‘Air, Land, and Ocean’) started as a yoga brand, but somewhere along the way, it became the model off-duty uniform. The brand’s rise was helped along by its celebrity fan club: Kendall Jenner, Bella Hadid, Hailey Bieber, and basically every supermodel whose workout fit has made us question our entire wardrobe. What began with buttery-soft leggings and yoga pants has expanded into a lifestyle empire, with travelwear, wellness supplements, and even a collection of luxury Alo bags.

I’m also guilty of the Alo effect. I’ve been a longtime fan, and my overstuffed closet has the matching sets to prove it. In the colder months, I practically live in the Scholar Hooded Sweater and Straight Leg Sweatpants, which I also love for travel days. Alo also makes some of the best yoga mats for heated yoga, and even its Head-to-Toe Glow Oil is my all-time favorite body oil for the summertime.

I don’t have to tell you that Alo Yoga, like many activewear brands these days, can be expensive. Fortunately, there are plenty of ways to save if you know where to look. I’ve rounded up the best Alo promo codes and Alo discounts to help save you a little money at checkout.

Score an Alo Promo Code for Your Next Order

Sign up for Alo’s newsletter with your email address, and you’ll receive a unique Alo Yoga coupon code for 15 percent off your first online purchase. You’ll also get access to free worldwide shipping and returns (no Alo Yoga coupon code necessary) which is super valuable if you’re trying out Alo Yoga for the first time.

Unlock a 25% Alo Discount Code With The Pro Program

If you’re a certified fitness professional, Alo Yoga’s Pro Program gives you 25% off full-price apparel purchases online and at US store locations. To qualify, you must be at least 18 years old, actively teaching, and provide documentation to verify your eligibility. You can apply directly through Alo’s website, and once submitted, you’ll receive an email with your verification status. Approval typically takes anywhere from a few minutes to an hour, and after approval, you’ll need to wait one additional hour before using your Alo promo code or Alo Yoga discount.

This Alo Yoga discount is easy to apply for, but you’ll need to renew your Pro status annually. Some exclusions apply; for example, it can’t be used on sale items, gifts, or co-branded collections. Alo also caps Pro Program purchases at $2,000 per year (based on the original price after applying the coupon code and excluding sales tax). Check Alo’s Terms and Conditions for the full list of exclusions.

Smart Ways to Find a Coupon Code for Alo Yoga During Sales and Events

When you sign up for Alo Yoga’s emails, you’ll stay up to date on the brand’s latest sales and promotions. In addition to major events like Black Friday and Alo’s annual Aloversary Sale, subscribers can get notified about year-round markdowns of up to 40% on select apparel styles.

Save More With Alo Yoga Access

Alo Yoga Access is Alo’s free loyalty program, which you can join directly through the brand’s website. Members earn 1 point for every $1 spent online and at US store locations; points can be redeemed in your cart before checkout. Keep in mind that purchases made with points are final sale and cannot be returned or exchanged.

The Alo Access program is divided into tiers based on how many points you earn, but all members get access to perks like a birthday gift, members-only sales, and the Alo Wellness Club. Higher-tier members unlock additional benefits, including free two-day shipping, priority access to drops, and invite-only experiences.

Alo Access points are valid through the full calendar year after they’re earned, so be sure to use them before they expire. If you return an item, your points balance will be adjusted to remove the points earned from that initial purchase.

Get Free Access to The Alo Wellness Club

Alo Access members get complimentary access to the Alo Wellness Club, which is free to join. The membership includes a library of on-demand wellness classes and programs, ranging from yoga and Pilates to HIIT and strength training. You’ll also find meditation and breathwork exercises, nutrition guidance, and curated challenges designed to keep you motivated. All classes are led by certified instructors and can be streamed across mobile devices, laptops or desktops, and tablets.

AI AND ML

Chocolate Factory LLMs join Big Red’s Fusion automation party  

Oracle plans to add Google’s Gemini models to AI Agent Studio for Fusion Applications, expanding its partnership with Google Cloud and giving customers another option for building AI agents.

Big Red also intends to use Gemini models for embedded AI use cases in Oracle Fusion Applications and Oracle NetSuite.

In a prepared statement, Google Cloud VP Satish Thomas said that the partnership was designed to “make it easier for organizations to use Gemini in the applications and agentic workflows they rely on to automate workflows, accelerate decisions, and drive outcomes.”

Google’s Gemini models will be available in Oracle AI Agent Studio, where customers and partners can build Fusion-native agents and agentic applications. Oracle said the integration would also provide expanded multimodal capabilities. Gemini 3.1 Flash Lite and Gemini 3.5 Flash will be available through AI Agent Studio alongside Oracle’s existing model options.

Oracle applications development executive VP Chris Leone said in a statement that the move would give customers and partners “greater choice as they build and extend agents and agentic applications that reason through complex, real-world business challenges.”

When Oracle launched its platform for putting LLM-powered agents in its Fusion application suite – the target migration path for thousands of organizations around the world running Oracle applications – it said customers could use models from Cohere and Meta, while connecting other supported models through the platform.

The Register has asked Big Red whether Cohere and Meta models will remain available, and we’ll update this if we hear back.

After Oracle launched Fusion Agentic Applications earlier this year, Gartner advised that there were unanswered questions about how the technology would be implemented.

Balaji Abbabatulla, Gartner VP and vendor lead analyst for Oracle, said: “Our position is that this sounds good, but be cautious. It doesn’t necessarily look as glittery as it sounds. There are challenges under the hood which are not being overcome right now, but maybe over time.”

He also pointed out that Oracle and other vendors must still answer the question of who takes responsibility for AI decision-making should it go wrong. If an AI agent makes a bad decision at scale and speed, errors could cascade before anyone notices. Oracle’s answer so far is monitoring and audit tooling, but Abbabatulla is unconvinced: “I don’t see a clear response from any vendor on the liability issue.” ®

Days after OpenAI disclosed that two frontier AI models escaped containment measures and autonomously cyberattacked the AI code sharing platform Hugging Face, OpenAI’s top U.S. rival Anthropic tonight revealed that — lo and behold — it has also had models surreptitiously access the web when they weren’t supposed to, and cyberattack and gain “unauthorized access” to three other organizations.

Anthropic says that it ran “capture the flag” cybersecurity scenarios with three models — Claude Opus 4.7, Claude Mythos 5, and unnamed internal research prototype — with its partner, the AI security firm Irregular. Anthropic says the models were not supposed to have internet access, but that a misunderstanding with Irregular allowed them to access the internet. Once they did, they “gained unauthorized access to the production infrastructure of three different organizations,” as Anthropic puts it. Anthropic’s blog post continues:

“Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned.

However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet. In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment.”

Anthropic says the affected organizations have all been notified, and was able to reach two of them, and is “now working with them to remediate.” The third hasn’t yet been reached.

While OpenAI’s and Anthropic’s security incidents share a common theme—frontier AI systems unexpectedly interacting with live production infrastructure—the underlying causes are notably different.

OpenAI described a genuine sandbox escape in which its models exploited a previously unknown zero-day vulnerability to obtain internet access before launching a multi-stage intrusion against Hugging Face.

Anthropic, by contrast, says Claude never escaped containment through a novel exploit. Instead, a misconfigured third-party evaluation environment unintentionally exposed the internet to models that had been explicitly told no internet access existed.

The distinction matters. Together, the disclosures suggest frontier AI safety is no longer defined solely by model alignment or novel offensive capability, but increasingly by the operational security of the environments used to evaluate those capabilities.

What Anthropic found

Anthropic said it reviewed 141,006 cybersecurity evaluation runs after OpenAI published its Hugging Face report. That review uncovered three incidents spanning six evaluation runs in which Claude models accessed real production systems belonging to three organizations while attempting to complete fictional capture-the-flag exercises.

The incidents involved Claude Opus 4.7, Claude Mythos 5 and an unreleased internal research model.

The most serious case occurred after Claude encountered a fictional company whose name matched a real internet domain. Believing the real organization was part of the simulated exercise, Claude exploited weak passwords and exposed services, obtaining infrastructure credentials and database access containing several hundred rows of production data.

A second incident was arguably even more unusual. Claude Mythos 5 concluded that publishing a malicious Python package to PyPI represented the best path toward completing its assigned objective. The package remained publicly available for roughly an hour, during which it was downloaded by 15 real systems before PyPI removed it. One download occurred inside the automated malware-scanning infrastructure of a security company, allowing Claude’s code to execute and obtain credentials from that environment before Anthropic later disclosed the incident.

The third incident involved an internal research model that scanned approximately 9,000 internet-facing systems before compromising one organization using well-known techniques including exposed debug credentials and SQL injection. Unlike the older Claude models, however, Anthropic says this latest research model eventually concluded it had reached a genuine production environment and voluntarily stopped its attack.

Similar outcomes, different root causes

Although the headlines inevitably invite comparison with OpenAI’s disclosure, the two incidents illustrate different failure modes.

OpenAI’s investigation concluded that its models actively discovered and exploited a previously unknown vulnerability in an Artifactory package-cache proxy to escape an otherwise isolated evaluation environment before later compromising Hugging Face through additional chained vulnerabilities.

The company characterized that event as an “unprecedented cyber incident” involving state-of-the-art offensive AI capabilities.

Anthropic’s report instead argues its models never needed to break containment because containment had already been weakened through operational misconfiguration. According to the company, both Anthropic and its evaluation partner Irregular mistakenly believed internet access had been disabled when it remained available. Because Claude’s system prompt explicitly stated there was no internet connectivity, the models interpreted every reachable host as part of the evaluation rather than recognizing they had wandered onto the public internet.

Anthropic therefore characterizes the incidents primarily as infrastructure and evaluation-harness failures rather than evidence of models independently pursuing unauthorized goals.

The reports nevertheless converge on one uncomfortable conclusion: frontier AI systems are increasingly capable of executing long-horizon offensive cyber operations whenever evaluation environments permit them to do so.

Four major enterprise security takeaways so far…

For enterprise security leaders, Anthropic’s disclosure arguably shifts the conversation beyond “Can frontier models escape?” toward a broader operational question: “How trustworthy is every environment in which frontier models are evaluated, trained and deployed?” There are at least 4 lessons to be learned:

1. The first lesson is that evaluation infrastructure itself now deserves production-grade security engineering. Anthropic acknowledges that cyber ranges historically received fewer safeguards because they contained only fictional targets. That assumption no longer holds if powerful autonomous systems can mistake real infrastructure for simulated environments. Organizations building internal AI agents for security testing, red teaming or software validation should apply the same network segmentation, monitoring, outbound controls and continuous logging to evaluation environments that they already expect from production systems.

2. Second, both disclosures reinforce that alignment alone cannot compensate for environmental ambiguity. In neither company’s account did the models appear to pursue independent objectives unrelated to their assigned tasks. Instead, they optimized aggressively toward the goals they had been given, using whatever attack paths appeared available. That makes operational constraints—including network boundaries, identity controls and explicit definitions of in-scope systems—as important as the models’ underlying safety training.

3. Third, enterprises deploying increasingly autonomous AI agents should treat situational awareness as a security dependency rather than an academic capability. Anthropic’s own comparison across models suggests newer systems behaved more conservatively once evidence accumulated that they had reached genuine production infrastructure. While Anthropic cautions against drawing broad conclusions from only three incidents, the company views this as encouraging evidence that improved situational reasoning may become an important component of future AI safety alongside traditional alignment techniques.

4. Finally, these two disclosures together mark an inflection point for enterprise threat modeling. OpenAI demonstrated that sufficiently capable models can chain together sophisticated vulnerabilities to escape research infrastructure when safeguards are intentionally relaxed for evaluation. Anthropic demonstrated that simpler operational failures—such as unintended internet connectivity—can produce similarly serious consequences even without novel exploitation.

The common denominator is not any single vendor or model family. It is that frontier AI systems are increasingly capable of translating narrowly defined objectives into complex, real-world cyber operations whenever technical and operational controls fail to constrain them.

For enterprise CISOs, that means AI safety can no longer be viewed solely as a model problem. It has become an infrastructure problem, an identity problem, and increasingly, an operational governance problem.

Amazon reported its earnings today, and because I am professionally depressed I read the thing in full [PDF].

“How long can I go before the red haze of rage sets in” is a fun game, and today I made it all the way to the bottom of the second page when I encountered a bullet point touting how AWS “made its spec-drive [sic] coding agent, Kiro, available on iOS.”

Yes, I was in the room when they announced it at the New York summit, six weeks ago. As of this writing, their website, which I have screenshotted says I can “request early access” because “We’ll invite a limited number of people to try the app via Apple’s TestFlight, and we’ll send everyone a link when it’s ready.” So Kiro is “available” in the same way as I am available to play in the NBA. You can twist yourself into a pretzel and assert that this claim is technically true, but for all practical readings it’s what we’d colloquially term “a lie.” You need to be explicitly invited to Apple’s developer beta testing tool, where a limited number of users can try out an unpublished version. You cannot download it on your phone, and there is no page in the App Store that showcases the product.

The delay is almost certainly due to Apple’s byzantine App Store policies, which I have some sympathy for — but this is an earnings statement. If they’re going to “shade the truth” like this, what else are they not being forthcoming about?

Once you notice it becomes hard to stop

There are a lot of other statements that one suspects might not stand up to scrutiny. Graviton boasts “up to 30 to 40% better price-performance,” which I only accept because I have seen the numbers myself on customer workloads. The express statement that their AI business and chips business are each exceeding $25B run rates in consecutive bullets, with no word on whether those dollars overlap (we will come back to this point shortly). And their Bedrock statement: “customers spent more in Q2 than all prior quarters combined,” which makes it sound like a rocket until you realize that they’re saying the past 90 days exceeded the other 10 quarters for which Bedrock has been available. Without actual numbers tied to these, that makes it sound like for the first couple of years Bedrock was showing up wearing a party hat but no pants.

Then there’s the AWS operating margin of 39.4%, which came in above every published analyst estimate and which everyone will invariably cite as cherry-picked proof the AI buildout is printing money. On the call, CFO Brian Olsavsky disclosed that it includes roughly $600 million of mark-to-market gains on energy derivative contracts. By his math, AWS margins were up 650 basis points year over year, or 520 “if you exclude the derivative accounting gain.” Strip that gain out yourself (behold the power of arithmetic!) and the blowout margin goes right back inside the range analysts had modeled. Amazon now hedges electricity the way an airline hedges jet fuel, and this quarter the hedges paid off directly. Olsavsky noted these adjustments “have not been significant in prior quarters.” The first quarter they are significant, they land in AWS margin, and their Q3 guidance already assumes no impact from these remeasurements going forward. Amazon knows it’s noise, but clearly saw no reason to turn down claiming the win.

The chips business that sells no chips

Back to those dueling $25B run rates I touched on; describing their “AI chips business” that way struck me as an incredibly odd thing to say.

That business has revenue, growth, a triple-digit trajectory, sarcastic numbers of happy customers — but what it doesn’t have is a product that you can buy. There is no Trainium price list, they will not ship you a socketed Graviton chip to put in your next desktop build, there isn’t even an external part number. What Amazon books as “chips revenue” is EC2 instance rental (possibly filtered through higher level services like Bedrock, SageMaker, the half-baked agents that fail to properly explain your AWS bill to you, etc.), and an EC2 instance is not a chip. It’s the chip, plus the nVME, plus the NICs (themselves built on Nitro, which uses Amazon’s own silicon), plus some aspects of the data transfer that somehow aren’t directly billed, plus the building the whole mess lives in—and then with AWS’s margin layered on top. The silicon itself is a minority line item in the internal bill of materials that constitutes its business.

You don’t have to take my word for it; Amazon CEO and AI Marketing Manager Jassy spent last quarter’s call lamenting that the cost of components, “particularly memory, has skyrocketed,” so by his own testimony a growing slice of the “chips business” is memory revenue.

Cynically, the category exists so that headline writers will talk about it in the same breath as Nvidia’s data center numbers, which they of course will. But Nvidia’s $25 billion is silicon sold in the form of physical packaged chips, shoveled out their loading dock. Amazon’s is fully-loaded infrastructure rental. This is a hotel comparing its revenue to a mattress company’s.

But wait, there’s one more layer of inanity here. Olsavsky has said that the majority of Bedrock’s workloads run on Trainium. So if you follow one Anthropic dollar through the earnings release it’s AI-business revenue, it’s chips-business revenue, and it’s AWS segment revenue. It’s nice when you can get a triple-brag for the same thing.

You don’t have to take my word on the “sells no chips” part either. On today’s call, Morgan Stanley’s Brian Nowak asked when Amazon might start selling Trainium to third parties. I want one too; I get it. Jassy answered that customers are increasingly interested in getting Trainium “separate from our cloud,” that Amazon is “actively having those conversations,” and that “there’s a real chance we’ll do that in the future.”

IN THE FUTURE.

“Yeah, we have yet to sell a single chip” is quite something to hear from the CEO about his purported $25 billion chips business.

Why does this matter?

The way they talk about this matters deeply, because the numbers they’re draped around serve as the justification for the largest capex program in corporate history. On the call, Andy Jassy raised the year’s spending to $220 billion and announced backlog hit $496 billion; up $132 billion in a quarter, during the same quarter Anthropic signed its $100 billion-over-a-decade commitment. Amazon booked $53.4 billion in gains on its Anthropic stake this quarter, which is most of why “net income” septupled, while free cash flow went $26 billion in the angry direction and the company sold $25 billion in bonds.

Jassy himself described the AI demand curve on the call as “very barbelled”: AI labs consuming “gobs and gobs of compute” on one end, enterprises doing cost-avoidance on the other, and in the middle you’ve got the stuff that actually seems durable if AI is to have a future: the enterprise production workloads running inference at scale, “most of which aren’t” doing so yet. He went on to admit he doesn’t know whether that middle will follow the same “wildly steep trajectory” as the labs have. That’s the CEO stating that the demand underwriting $220 billion is concentrated today in a handful of AI labs, one of which Amazon happens to own a meaningful piece of, while the broader enterprise adoption wave remains a forecast. We’re hoping for sunshine!

None of this is fraud, and all of this is real infrastructure, but the entire shape of it all is being told in the same sitting that described a waitlist as “available.”

That is what’s at stake here, and why a bullet about Kiro matters more than Kiro itself does. When the music inevitably stops and the bill comes due, how will these statements look through the clarifying lens of hindsight?

This too shall pass

Kiro will presumably ship on iOS – months after folks gave the slightest toss about it. The run rates AWS said are probably close to real; they grew 37% YoY and that’s no small thing at their scale. Their business is firing on all cylinders and they’ve got a lot to be proud of, which makes their overstating things just that much weirder.

The company that posts these kinds of numbers doesn’t need to inflate the software bullets. But when everything’s “available,” then nothing is. ®

Microsoft has a fix for the growing pile of Copilots you are meant to use. It wants to stuff them all into a single app.

On its earnings call this week, chief executive Satya Nadella confirmed Microsoft is building a Copilot “super app.” It merges chat, coding, the Cowork research tool and Microsoft’s new autonomous agents, called Autopilots, into one place. It will span both consumer and business use, and launch this year, The Verge reported.

“Copilot is evolving rapidly from chat to Cowork to autopilots,” Nadella said. Bringing them together in one super app is “a major step forward,” he added, promising to share more soon. Fortune first revealed the plan in May, under the internal slogan “Delivering one Copilot.”

Everyone wants to be the app you open first

Microsoft is not alone. The “super app” is the industry’s current obsession. The idea: fold a chatbot, a coding assistant and agents that act on your behalf into a single product.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

OpenAI has already rolled out ChatGPT Work to its own staff, and Anthropic’s Claude has folded its Cowork agent into the chatbot. The prize is obvious: be the first app a user opens, whether they are writing an email or shipping code, and absorb as much of their day as possible.

Microsoft has the reach to try. It says paid Copilot seats have passed 30 million, and that weekly engagement now rivals Outlook and Teams.

The catch

The numbers are less flattering up close. Thirty million paid seats is a fraction of Microsoft’s roughly 450 million business customers, and the company has been layering usage-based charges on top. For all the pushing, not many people pay for Copilot yet.

There is a design risk, too. Microsoft has spent months jamming Copilot into every corner of Office, to the point of a user revolt over a floating button it had to let people hide. Cramming consumer and enterprise tools into one app could deepen that fatigue rather than fix it.

Bundling everything also raises the stakes on safety. Copilot has already been hit by prompt-injection attacks that can turn the assistant against its user. Merging chat, code and autonomous agents gives any single flaw more room to run.

Still, the direction is set. Microsoft’s cloud and Copilot growth helped its shares jump this week, and the super app, built on its Copilot Cowork plumbing, is now its flagship AI bet. The pitch is simplicity. The test is whether one Copilot proves easier to live with than five.

Anthropic said today that during internal security testing, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it ran on 15 real systems before the registry’s automated defenses pulled it.

The company disclosed it as one of three incidents where Claude models reached the open internet from evaluation environments meant to be sealed, then compromised production infrastructure at three organizations.

The review followed OpenAI’s July 21 disclosure that its models had escaped an isolated test environment and reached Hugging Face’s production infrastructure. JFrog later confirmed the models broke out by exploiting zero-days in self-hosted Artifactory.

Claiming a package name that never existed

All three incidents happened during capture-the-flag exercises run through Irregular, a third-party evaluation partner. Anthropic’s prompt told Claude it had no internet access and that the environment was simulated. A misconfiguration meant neither was true, and neither company caught it until last week.

In the PyPI incident, Claude found a document inside the test environment posing as developer setup instructions for a fictional company.

Those instructions told new hires to install a Python package that had never been published, a phantom dependency.

Claude worked out that if it registered the name itself, the target’s machines would pull down its code automatically.

Publishing it took some doing. Claude needed a PyPI account, which required an email address, which required a phone number.

It failed to find a free phone number service, then tried and failed to obtain funds to buy one through several different routes. Eventually it backtracked, found an email provider that wasn’t blocked, registered an account, and uploaded the malware.

Anthropic said the package sat publicly available for roughly an hour.

During that window, 15 real systems downloaded and executed it. One belonged to a security company that routinely installs packages from PyPI and scans them for malware, a workflow that treats registry contents as safe to run.

Claude’s payload fired, sent that company’s credentials to a collection point it had set up, and then used them to reach further into the company’s infrastructure. Anthropic said Claude did not know the company existed.

PyPI’s own security systems removed the package automatically. Anthropic said it has notified the PyPI team and handed over indicators.

The model behind this run was Claude Mythos 5. According to Anthropic, its reasoning flagged the problem early, noting that publishing the package would amount to a real-world attack if the internet were real, and calling it “NOT okay, and surely not the intended solution.”

It then argued its way back to the conclusion that the environment was staged, on the grounds that it did not recognize the certificate authorities securing its connections and that the systems showed a calendar date of 2026.

When automated scanners began installing the package, Claude read them as scripted actors inside the exercise.

Credentials and a production database

The most serious impact came from a separate incident involving Claude Opus 4.7, where the fictional target company shared a name with a live domain.

Across four runs, Claude struggled to reach its simulated target, discovered the real company was reachable over the internet, and assumed that was the intended objective. It extracted application and infrastructure credentials and reached a database holding several hundred rows of production data.

That was the only case where a model kept attacking after working out it was on a real system. Anthropic said all four runs eventually recognized the target was real, and in two of them Claude reasoned that the real company must be part of the exercise anyway.

A third incident involved an unreleased internal research model, which scanned roughly 9,000 targets after failing to reach its intended one, then compromised an internet-facing application using credentials from an exposed debug page and SQL injection. That model later noticed the host sat in a cloud account with no connection to the challenge, concluded the target was real, and stopped on its own.

None of the attacks used novel techniques. Anthropic described them as weak passwords and unauthenticated endpoints.

What happens next

Anthropic began its review on July 23 and halted all cyber evaluations the same day. It identified the three incidents the following day and notified Irregular and the affected organizations on July 27. The company is still trying to reach the third.

The earliest of the three incidents dates back to April, meaning some of the activity went undetected for around three months.

The evaluations ran without the classifiers and monitoring that ship with generally available Claude models, though the models retained their safety training.

Anthropic said its production safeguards would have blocked the behavior, and characterized the incidents as closer to a harness and operational failure than a model alignment failure, on the grounds that the models were told they had no internet access while in fact having it.

It now plans wider transcript monitoring, better investigation tooling and more assurance work with evaluation vendors.

The company said it is in talks with METR for an independent review, and that it will publish a lightly redacted transcript of the PyPI run within the next week.

Neither of the two affected organizations Anthropic reached had detected the activity themselves. Like OpenAI’s Hugging Face incident, it surfaced only because the AI lab responsible went looking through its own transcripts.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

You can add Reddit CEO Steve Huffman to the growling list of publishers, platforms and others who are frustrated with the state of Google search and AI Overviews. “People don’t want a summary of Reddit; they want Reddit,” he wrote in a letter to shareholders ahead of the company’s second-quarter earnings call.

In case there was any doubt that he was referring to Google’s AI-powered search feature, Huffman was clear that Reddit has not benefited from the shift, despite its partnership with the search giant. The CEO said that AI Overviews haven’t had “a similar level of positive impact” as traditional search.

“I think more broadly, what we see is, you know, 10 blue links has driven tremendous value and growth to the broader ecosystem,” Huffman said, referring to traditional organic search results. “From where we sit, AI Overviews has yet to make a similar level of positive impact, and I think that’s consistent across the broader landscape, right? Us businesses, publishers, retailers, we’re still looking for that win-win.”

Huffman’s comments come as Reddit said that its traffic from search has taken a hit in recent months and after The Wall Street Journal reported that the company is re-thinking its relationship with Google. Reddit hasn’t publicly indicated whether it will renew or seek to change the terms of its existing arrangement with Google. When asked directly about the possibility of Reddit ending its $60 million licensing deal, Huffman left open the possibility. “I think the range of outcomes is wide, and we have to look at you know every aspect of this and make sure that we’re maximizing value to Reddit,” he said.

Reddit is far from the only platform to struggle with the changing search landscape. Publishers, some of whom have also reached deals with Google to license content, have also seen massive declines in search traffic as Google pushes AI-generated summaries that bury links and as more people replace traditional searches with chatbots. Google has claimed that AI-powered search features are broadly good for the industry.

Huffman said the company is working on other changes to help draw new users to the platform, including improvements to feed recommendation and other changes to make the site easier to understand for new users. He also said the company was considering “a video Reddit experience” and letting users “background listen” to posts.

“We see folks doing this off-platform,” he said. “There’s an emerging content type elsewhere on the internet of basically podcasts where people read Reddit content, and so I think this version of like listened-to or spoken-Reddit can be really engaging as well.”

Commission spokesperson Thomas Regnier told Reuters that a designation is ‘definitely possible’.

OpenAI’s ChatGPT and the controversial video game Roblox could become subject to the most stringent rules under the European Union’s landmark Digital Services Act (DSA).

The bloc brands online services with more than 45m EU-based users as very large online platforms (VLOPs) or very large online search engines (VLOSEs).

These designations trigger specific rules that aim to tackle the unique risks that large platforms might pose to the safety of its European users, including around illegal content, ad transparency, health and safety.

Rules include creating user-friendly terms and conditions, establishing a point of contact for authorities and users, and the reporting of criminal offences. VLOPs and VLOSEs must also identify and assess systemic risks that could be linked to their services.

Designated platforms that don’t comply with these rules can face penalties of up to 6pc of their global annual turnover.

21 companies operating various platforms in the bloc, including X, Amazon, Apple, Microsoft, LinkedIn and TikTok, are already subject to these regulations following the DSA’s enforcement in early 2024.

Since then, the European Commission has launched numerous probes, resulting in penalties to date on X, Temu, and AliExpress – collectively amounting to nearly €900m.

Bloomberg reported that the two new additions to the designated list will be confirmed as soon as August. Sources told the publication that ChatGPT’s search function will be handed the VLOSE designation and Roblox that of VLOP.

The platforms will have four months from the date of designation to ensure compliance with the law.

Commission spokesperson Thomas Regnier told Reuters that such designations are “definitely possible” and could “come sooner or ​later”. ChatGPT crossed 120m monthly users in Europe last year.

Earlier this month, the EU preliminarily found TikTok to have breached the DSA by allowing content posted by minors to be pushed globally, risking their exposure to unwanted contact and cyberbullying.

The Commission also used its powers to order Meta to open WhatsApp up to rival AI assistants to ensure fair competition.

The DSA and the bloc’s other landmark legislation, the Digital Markets Act, have elicited criticism from US, which has called penalties under the laws a “novel form of economic extortion”.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Updated, 3.02pm, 30 July 2026: The article has been updated with comments from an EU spokesperson and additional information in the eighth paragraph.