This article is crossposted from IEEE Spectrum’s careers newsletter. Sign up now to get insider tips, expert advice, and practical strategies, written in partnership with tech career development company Parsity and delivered to your inbox for free!
Scroll through LinkedIn right now and you may find the same advice repeated by well-meaning people: “In a market this rough, just be grateful anyone will hire you. Take the offer.”
I could not disagree more.
Negotiating your offer is not ungrateful, and it isn’t greedy. Done well, it’s good for you and good for the company hiring you. I misunderstood this early in my career, and it cost me.
Advertisement
I didn’t know it was an option
When I got my first job in tech, I didn’t know negotiation was even on the table. The recruiter asked what salary I wanted, and I gave a number below the bottom of their range. They came back with the lowest number in their band—still more than I had asked for—and I was thrilled. I had no idea I’d left money on a table I couldn’t see.
Then I started teaching at a Bay Area coding bootcamp in the evenings. A coworker mentioned what he made and it was nearly double my salary for roughly the same work. My jaw dropped.
During that time, I began interviewing and got an offer. I handed in my resignation and my manager countered with an offer for nearly 30K more. That money had been there the whole time. At that moment, I realized my salary was a business decision, not a measure of my worth.
What it looks like from the other side
Years later, I became an engineering manager and saw the salary discussion from a different angle: A position would open. Many interviews later, we’d find someone we wanted, and HR would hand me a salary range to make an offer. I was encouraged to make an initial offer near the bottom to leave room for, you guessed it, negotiations.
Advertisement
Most applicants didn’t negotiate.
The first offer is rarely the ceiling. It’s usually the floor. Companies extend a reasonable number and quietly hope you say yes.
It’s not all about the money
Negotiating isn’t only about a bigger paycheck. (But who doesn’t want that?)
Let’s say you’re on the job market, maybe recently laid off, and a low offer comes in. You take it out of relief. Then you start, you like the team, and you quietly resent the number. Now you’re stuck with it, and you’ll probably leave that role inside a year or whenever the market improves.
Advertisement
Nobody wins there. You’re back on the market starting over, and the company loses someone good and pays more to replace you, when a fair number up front would have cost far less.
Paying you fairly is cheaper than starting over.
How to actually do it
People overcomplicate this. Once I have an offer, I say some version of this:
“Thank you so much for the offer, and I’m genuinely excited to join the team. I’m hoping we can come in around [10 to 20 percent higher than the original number]. Is there any wiggle room here?”
Advertisement
Then I stop talking and let them respond.
Why 10 to 20 percent and not double? The number you ask for is itself a signal. Ask for something wildly out of range and you’ve told them you never learned what the role pays, or that your expectations are miles from reality. That’s what makes a company walk away. A calibrated request reads as someone who knows their worth and did their homework.
You’ve probably heard a horror story about someone who asked for more and had the offer yanked. Any company that would pull an offer over a reasonable question about pay is telling you exactly how they’ll treat you once you’re inside.
If the salary can’t move, it isn’t the only lever. I’ve negotiated more remote days, a later start to drop my kids off, and a sign-on bonus when the base was locked. Most people negotiate none of these perks.
Advertisement
You have more leverage than you think
Negotiating can feel like something you can only do from a position of power. But if you’re in the final stages of an offer, you already have it. They want to hire you. They’ve spent weeks finding you. Now they’re hoping you say yes.
That’s true even if you were recently laid off. Even if it’s your first job. Even if the number already looks higher than you expected.
The game is being played whether or not you join in. Sit it out, and you’re not just leaving money on the table. You may be quietly shortening your own stay at a job you could have been happy in. So ask.
—Brian
Advertisement
If you’ve been on the job market for a software engineering role recently, you’ve probably encountered—or used—AI tools in the hiring process. From application filters to live interview assistants, both applicants and employers are trying to use generative AI to their advantage. Can real, human skills still shine through in this new reality?
Sarah Downs, a Ph.D. student in electrical engineering at Texas A&M University, has long been interested in robotics and dreamed of working with NASA. This year, she achieved that dream, collaborating with NASA and the U.S. Air Force on an algorithm that enables satellites to insert an antenna into the correct spot.
Women make up only about 28 percent of the global STEM workforce, in part because of limited access to educational resources for preuniversity students—especially in areas like rural India. An IEEE initiative, the Women in Science, Engineering (WiSE) project launched to help expand opportunities and hands-on learning for young women.
Slate, makers of the upcoming barebones electric pickup truck, made a change to the battery technology that it will be using in its upcoming 2027 production models. Instead of the originally specified nickel-manganese-cobalt (NMC) battery pack, Slate has switched to a less expensive lithium iron phosphate (LFP) battery that is sourced from China’s Gotion. China is estimated to control over 98% of the materials that go into LFP batteries. The Slate Truck’s starting price is cheap, although a fair bit more than what was originally promised.
The reason for the switch on the battery materials is all about the elimination of the $7,500 tax credit for buyers of electric vehicles. Under its previous rules, batteries powering any vehicle that would qualify for the credit couldn’t use minerals or parts produced by a “foreign entity of concern,” which definitely includes China. Now that the tax credit and its supporting rules are gone, Slate is free to source a less-expensive battery from China. LFP batteries cost about 40% less than NMC, since iron costs much less than cobalt or nickel.
Advertisement
The new LFP battery comes in at 65 kWh, with a usable capacity of 63 kWh. It powers a 181-horsepower electric motor that drives the rear wheels. Slate has estimated a 0-60 mph time of eight seconds for its truck, with a range of 205 miles. The Slate truck has been officially priced at $26,400 including destination charge. While this is more than its original pre-tax credit price of less than $20,000, it is still pretty fairly priced.
Advertisement
Affordable and ultra customizable
The eye-catching Slate Truck starts out very basic, with crank windows, wheels made of low-tech steel, and climate controls that are manually operated. You can rest assured that air conditioning and old-fashioned cruise control are standard equipment. That being said, Slate allows its buyers a wide range of customization options.
These start with an assortment of over 100 vinyl wraps, including some that are Crayola-approved, that go on top of the truck’s unpainted body, through accessories that include zip-off seat covers, roof racks, tonneau covers for the pickup bed, and stereo systems. For an additional $5,000 to $7,000, you can even upgrade your Slate into an SUV, with a kit that includes an extended roof in either squareback or fastback styles, along with a rear seat that expands the Slate’s passenger-carrying capacity.
Slate has also introduced Slate U, which lets DIYers take on some customization tasks themselves. Slate U provides how-to video content developed for any skill level, backed up by agents set up to chat, provide assistance, and refer customers to “trusted service providers” if a job threatens to overwhelm the DIYer. It’s a completely free service that is unlikely to be duplicated by other vehicle manufacturers.
The Slate pickup, as well as its SUV variants, will provide a test of whether the U.S. market really wants a simpler, no-frills vehicle. The success of the Slate brand will determine whether its bare-bones, customizable, DIY aesthetic is the answer to a question anyone is asking.
Google has dismantled the original AlphaFold team, according to Financial Times(paywalled), reassigning many researchers to Gemini and Isomorphic Labs. Several other key members, including Nobel laureate John Jumper, left for Anthropic. Engadget reports: AlphaFold is an AI program that can accurately predict three-dimensional structures of proteins from their amino acid sequences in minutes instead of years. It’s now being used to accelerate drug discovery, develop vaccines and understand the structural changes in proteins associated with neurodegenerative diseases like Alzheimer’s and Parkinson’s.
DeepMind started developing AlphaFold in 2018. In 2020, it was recognized as a solution to humanity’s 50-year-old “protein folding problem,” which sought to answer how amino acids automatically fold into complex 3D shapes. Those shapes determine the biological role of a protein. Scientists had identified the structures of roughly 170,000 proteins over the past 50 years, using tools and techniques like X-ray and nuclear magnetic resonance. The AlphaFold team took information from those previous work and then fed it to their AI to train AlphaFold.
In 2021, Nature published the papers with AlphaFold’s methodology and the structure predictions of the entire human proteome, or the complete set of proteins expressed by our species. DeepMind then launched the AlphaFold Protein Structure Database, giving researchers free access to over 200 million protein structure predictions. In 2024, DeepMind CEO Demis Hassabis and John Jumper, who was a staff research scientist when the project began and who eventually became a VP and engineering fellow, won the Nobel Prize in Chemistry for their work on AlphaFold.
Streaming spent a decade telling viewers that the future meant paying only for the services they actually wanted. It has now reached the stage where those services are being bundled back together by the platforms large enough to control discovery, billing and your television home screen.
Beginning in early 2027, eligible U.S. YouTube Premium subscribers will gain access to Peacock Premium within the YouTube experience, combining ad-free YouTube, background playback, downloads and YouTube Music with NBCUniversal’s ad-supported streaming service. The cable bundle did not die. It learned how to recommend reaction videos.
Related Reviews:
What YouTube Premium Subscribers Will Receive
The included tier is Peacock Premium, which currently costs $10.99 per month when purchased separately. It includes Peacock Originals, Universal and Focus Features movies, NBC and Bravo programming, and live sports.
NBCUniversal specifically lists NFL football, the Olympics, NBA, MLB, Premier League soccer, WNBA, college football and basketball, golf and the Kentucky Derby among the sports available through the service. Television programming includes Saturday Night Live, Law & Order: SVU, The Office, The Traitors, Love Island USA and The Real Housewives franchise.
The content will be available directly within YouTube rather than requiring subscribers to jump between separate applications. YouTube says it will announce the exact launch date and additional eligibility details over the coming months.
Advertisement
That should make Peacock substantially easier to find and use, particularly on televisions where YouTube is already one of the most frequently opened applications.
It also means millions of existing YouTube Premium subscribers may no longer need a separate Peacock Premium subscription once the bundle launches. Account migration, billing changes and whether existing Peacock profiles or watch histories can be transferred have not been explained.
YouTube Premium Will Be Ad Free Until Peacock Starts
There is one important distinction hiding beneath two uses of the word “Premium.”
YouTube Premium removes advertisements from regular YouTube viewing. Peacock Premium is the ad-supported Peacock tier. Subscribers should therefore expect commercials during Peacock movies, series and live programming even though they are paying for YouTube Premium.
Advertisement
Peacock Premium Plus, currently $16.99 per month, removes most on-demand advertising and adds downloads and access to a live local NBC station. Even that tier retains commercials during live sports, events, linear channels and selected programming.
YouTube says subscribers will have options to upgrade their Peacock membership, but it has not announced upgrade pricing or how that process will work.
Advertisement. Scroll to continue reading.
Peacock Premium Plus has already been available as a separately purchased YouTube Primetime Channel since June 29. The standard Peacock Premium tier will become available as a separate YouTube add-on later this summer, before it joins eligible YouTube Premium subscriptions in 2027.
Advertisement
What Has Not Been Announced
The companies have not provided a precise launch date beyond early 2027, nor have they confirmed whether every individual, student and family YouTube Premium plan will qualify.
YouTube’s announcement repeatedly refers to “eligible” Premium subscribers. Premium Lite is not mentioned and should not be assumed to include Peacock.
YouTube has also not explained whether Peacock content will stream in 4K HDR, support Dolby Atmos or 5.1 audio, or be available for offline viewing through the YouTube app. Simultaneous stream limits, parental controls, user profiles, watchlist and viewing-history transfers, and access while traveling outside the United States also remain unresolved. The largest financial question is whether adding Peacock will eventually trigger another YouTube Premium price increase, although Google has not announced one.
YouTube has not announced a higher price tied to the partnership. It has also not promised that current subscription pricing will remain unchanged through 2027.
Advertisement
For home theater owners, the lack of video and audio format details is not trivial. Peacock’s streaming quality has varied by device and event, and watching inside YouTube could produce different results from using the native Peacock application. “Seamless access” is useful. It is not a technical specification.
YouTube Premium Is Not YouTube TV
The agreement also extends NBCUniversal’s distribution contract with YouTube TV, ensuring that NBCUniversal’s linear television networks remain available through the live television service. That is a separate part of the deal.
A YouTube Premium subscription will not suddenly become a YouTube TV subscription, and the included Peacock tier does not provide the full collection of live NBCUniversal cable channels.
This distinction will almost certainly confuse people because Google has named three different products YouTube, YouTube Premium and YouTube TV, apparently after concluding that nouns were becoming expensive.
Advertisement
Why Peacock Is Doing This
NBCUniversal describes the agreement as Peacock’s largest wholesale distribution partnership. Instead of relying entirely on direct subscriptions, Peacock gains immediate access to millions of existing YouTube Premium customers and one of the most powerful content discovery platforms on the planet.
That distribution matters as streaming subscriber growth slows and customer acquisition becomes more expensive. Bundles reduce the number of monthly decisions consumers must make and can lower cancellation rates, even when nobody remembers which service is technically charging the credit card.
NBCUniversal gives up some control over billing, viewing data and the direct customer relationship, but Peacock gains scale without having to convince every household to install another application.
Advertisement. Scroll to continue reading.
Advertisement
Peacock has already pursued similar distribution through Comcast services, Walmart+ and YouTube Primetime Channels. The strategy is clear: place Peacock wherever millions of paying customers already exist and worry less about whether they arrived through the front door.
Why YouTube Is Doing This
YouTube Premium has primarily been sold around four benefits: ad-free YouTube, background playback, offline downloads and YouTube Music.
Peacock gives Google something it has not previously offered inside the standard subscription: a large catalog of studio movies, conventional television series and major live sports.
That makes YouTube Premium more competitive with Amazon Prime, Walmart+ and telecommunications bundles that combine video, shopping, wireless service or other benefits into one monthly payment.
Advertisement
It also pushes YouTube further into the role once occupied by cable and satellite companies. Google is no longer merely hosting video or selling a live television replacement. It is becoming the platform through which other streaming services reach customers.
The Larger Trend
Streaming fragmentation created too many applications, passwords, price increases and monthly decisions. The industry’s solution is increasingly to bundle those services through a larger distributor.
The new gatekeepers are YouTube, Amazon, Apple, Roku, Walmart, Verizon and the remaining cable companies. Viewers may receive better overall value, but the companies controlling the interface, billing relationship and recommendation engine gain enormous leverage over the services inside it.
That does not mean this Peacock deal is bad for consumers. For an existing YouTube Premium subscriber who already pays separately for Peacock Premium, the bundle could eliminate a $10.99 monthly charge while putting the same programming inside an application already installed on almost every television.
Advertisement
But the direction is unmistakable. Streaming is consolidating around a handful of large platforms capable of bundling everyone else.
We cut the cord to escape the package. The package has returned without the coaxial cable.
The Bottom Line
Adding Peacock Premium makes YouTube Premium a much broader entertainment subscription and gives existing members access to a meaningful catalog of movies, television and live sports.
The value proposition is potentially excellent, particularly for subscribers currently paying for both services. The catch is that Peacock Premium remains ad-supported, while upgrade pricing, account migration, technical quality and exact eligibility remain unresolved.
Advertisement. Scroll to continue reading.
Advertisement
NBCUniversal gains reach. YouTube gains premium programming and live sports. Viewers gain one fewer application to open and one more bundle to explain to someone else in the house.
Streaming promised simplicity. It has finally delivered cable with better search.
The program, ChatGPT for Academic Researchers, will start with 10,000 participants this summer.
Samuel Boivin/Shutterstock
OpenAI is launching a new program called ChatGPT for Academic Researchers that will offer free access to the company’s AI models to 100,000 scientists, mathematicians and engineers. Researchers from “select academic institutions” included in the program will receive hands-on support from OpenAI, access to the company’s latest GPT-5.6 Sol Pro model and be able to invite four collaborators from their institution to participate.
The program will start with 10,000 participants this summer and scale up to 100,000 through 2027. OpenAI says offering free access to its AI tools “is part of a commitment of more than $250 million through 2027 to support external scientific research and discovery.” As the company notes, researchers are already using AI models to sift through data and write grants — this just makes the relationship a bit more formal. OpenAI’s version of ChatGPT for schools, ChatGPT Edu, follows a similar logic.
While the least charitable read of the program is that OpenAI is looking for new sources of training data, the company says that by default, researchers’ data will not be used to train models. What handing out freebies to research institutions could generate, though, is more research breakthroughs that in some way involved a GPT model. And making more scientific fields dependent on the company’s tools could also pave the way for future revenue from for-profit research.
Advertisement
This isn’t the first time the company has courted researchers. OpenAI introduced Prism in January, an AI-powered tool for working with scientific journals and documents. Prism is available to anyone with a ChatGPT account and can be used to verify things like research citations and formatting. OpenAI’s early demo of the tool also included a way to generate lesson plans, one of the more tedious but critical tasks of research professors.
Curiosity has been climbing the broad valley nicknamed Valle Grande for weeks when its cameras locked onto something that stopped the science team cold. On June 11, 2026, the 4,923rd Martian day of the mission, the rover’s Mastcam stitched together eleven frames into a clean panorama of a solitary butte standing roughly 20 feet tall. Mission planners named it Miraflores. A thick layer of dark sand sits on its flat top like a natural crown, while the rock faces below show the slow work of wind and time carving away everything that once surrounded it. That erosion left the butte standing and deepened the valley the rover is now driving through.
From the ground, the vista feels almost uncomfortably personal, as the slope slopes away in all directions, as if blown away by the wind. Dark sand is drawn into every low spot and gradually works its way up the lower slopes. The distant horizon resembles the stratified landscape we’ve been investigating with Curiosity on the lower part of Mount Sharp for over a decade. The ground immediately surrounding Miraflores catches your attention. A never-ending blanket of small many-sided cracks stretches out in every direction the camera can see, with each polygon measuring little more than 3 inches across. The edges of those tiny fissures rise up to form an extremely tight honeycomb pattern that wraps all the way up the sides of the butte.
Feed a passion for science and technology – Kids can learn more about the challenges of space exploration with this LEGO Technic NASA Mars Rover…
Conduct a test flight – This advanced building kit for kids ages 10 and up includes a buildable toy version of NASA’s Ingenuity helicopter, which…
AR brings the mission to life – The accompanying augmented reality app experience lets kids dive into the details of the rover and its mission
The puzzle of how those shapes developed remains, as when the team first noticed them on the trip, they appeared as mud cracks when the wet sand dried out and shriveled away. Other items, however, can leave behind the same pattern. Repeated heating and cooling might cause the surface to break completely. Alternatively, compression on anything still buried can force the water out of the silt, leaving a network of fissures in its wake. Now, teams on Earth are reviewing the measurements and readings from the rover’s instruments to try to narrow it down even more. Then there are the dark pebbles and cobbles sprinkled around the region, which provide an extra depth of mystery to the mix. Some of them could just be bits of higher-up rock that slid down. Others could be impact debris swept up from the side and tossed here, or perhaps meteorites, given the nickel in a few of the samples.
A second, wider 360-degree panorama taken a week later, on sols 4,930 and 4,931, showed the same pattern stretching farther than the rover’s cameras could resolve. Mission scientists had spotted similar geometric shapes in small patches several times before. Never had they found an expanse this large. Project scientist Ashwin Vasavada put the feeling into words: “We’ve seen a lot of fascinating landscapes through Curiosity’s eyes, but this sea of polygons took our breath away. We measured their shapes and chemistry carefully and are hopeful there are clues in the data as to how these features formed.”
If you’re searching for some fun mini tools like pocket flashlights, you may have seen the term COB in a product description and wondered what it means. COB stands for chip-on-board, a type of LED technology that is being used in more and more lighting products. But what makes this light different isn’t its technical name; it’s how it’s designed.
A COB light is built with multiple LED chips arranged together on a single board, creating a compact and energy-efficient design. The result is a light source that can produce high light output and handle a variety of tasks, including lighting up your work area. COB lights also have a long lifespan and are typically brighter than traditional LEDs. This technology can help prevent a COB flashlight from experiencing excessive hotspots while also producing a wider and more even beam compared to traditional LEDs. This makes a COB flashlight useful for lighting up larger areas.
Many flashlights that use COB technology place it on the side of the device instead of using it as the primary beam. This allows you to use a front LED light that focuses straight ahead and the COB side panel for a wider floodlight when needed. But some flip flashlight designs can use COB technology as the main source of light, often with different modes that allow you to adjust the brightness of the beam.
Advertisement
How COB improves modern LED lighting
Emmomushroom/Shutterstock
COB lights can deliver high lumen output, which can be important when selecting a camping flashlight. That’s because the concentration of built-in LED chips allows for more light output than traditional LEDs. COB technology not only increases the viewing angle but helps reduce light loss as well. This means that more of the light the LEDs produce makes it out of the flashlight instead of being absorbed or scattered by additional parts around the LED chips.
COB technology evolved as a new way to arrange LEDs because manufacturers wanted to create brighter lighting without having to increase the size of the light fixture itself. Earlier LED designs were limited and could not achieve this outcome. However, COB helped solve the problem, making it a popular design for situations in which strong and efficient light is needed. Today, COB technology is not just used for flashlights but also in several other types of devices.
Advertisement
COB technology is used in a variety of applications, including residential lighting, as well as industrial lighting, photography, and automotive, among others. COB can be found in products such as ceiling lights, spotlights, and vehicle lighting, where strong and consistent light is needed.
[Hans Scharler] came into a neat find recently—the playfield from a 1970s Atari Superman game. It’s the sort of thing that’s too nice to throw away, but isn’t really enough to reassemble into a viable full machine without a great deal of effort. Thus, [Hans] went a different route—turning it into a beautiful piece of wall art.
The first step of the build was to collect missing parts; in particular, all the plastic inserts for the playfield that had been lost at some point. Everything was cleaned up and mounted, along with some modified flippers to complete the look. Custom pop bumpers were 3D printed to act as LED-lit light guides rather than as functional pinball components. [Hans] then set about dotting the board with plenty of WS2811 addressable LEDs in a bullet form factor. Everything was placed under the command of a WLED controller, and it’s synced up to [Hans’s] CheerLights MQTT server to boot. More build details are available on the Pinside post for those eager for a deeper dive.
If you’ve been patiently waiting for a discount on Apple’s latest earbuds or over-ear headphones, it’s finally here. For a limited time, both the AirPods Pro 3 and AirPods Max 2 are on sale, knocking up to $100 off their regular prices. Whether you want pocketable earbuds for everyday use, premium noise-canceling headphones, or seamless Apple integration, these are some of the best prices I’ve seen since launch. As always with Amazon deals, there’s no telling how long they’ll stick around, so I wouldn’t wait too long if you’ve been planning to upgrade.
The latest AirPods Pro 3 are Apple’s best AirPods yet. Upgrades include stronger noise canceling, a new acoustic architecture for deeper bass, and redesigned ear tips for a more secure fit. New tools include a built-in heart rate sensor for fitness tracking, live translation, and a camera remote to snap photos or videos on your iPhone. These earbuds are also the first AirPods to be IP57 rated against dust, sweat, and rain.
Advertisement
Right now, they are 20 percent off at Amazon, Target, and Walmart. There’s no telling how long this discount will last, so I’d grab a pair now if they’re on your wish list.
Apple AirPods Max 2 for $449 ($100 Off)
The AirPods Max 2 are arguably the most stylish pair of noise-canceling headphones on the market. The newer H2 chip improves active noise cancellation and transparency mode and enables a suite of intelligent features, including conversation awareness, live translation, and improved Siri interactions. The AirPods Max 2 are designed with a new high-dynamic-range amplifier for deeper bass, more natural vocals, and cleaner highs.
At $549, the AirPods Max 2 can be a tough sell, especially with so many excellent, more affordable alternatives on the market. But $100 off, they’re a lot easier to justify, especially if you want the seamless integration that comes with Apple’s ecosystem. It’s unclear how long this deal will last, so I’d snag a pair sooner rather than later if you’ve been eyeing them.
It’s one of the most expensive for a reason, and comes with more attachments than any other model. I do find myself regularly grabbing the Fluffy Optic head for vacuuming my hard floors, which cover many square feet of my home. If you’re looking to really splurge on the best vacuum, this is still the one to get.
The only downside is compatibility with Dyson’s bigger attachments, namely a mop head or docking station. It doesn’t have a Submarine option like the V16 or V15, and Dyson’s Auto-empty Dok won’t work with this model. But if you aren’t worried about add-ons, this is the vacuum to buy. It’s had better sales since the launch of the new models, too.
The Runner-Up
The V16 Piston Animal’s powerful 315 air watts of suction did pretty well on almost every test. My only issue with this vacuum compared to the Gen5Detect is that it was more likely to push small debris (in my tests, both sand and litter) into a pile in front of itself if you were vacuuming a large spill. Gen5Detect did better all around, but the V16 Piston Animal stayed close behind that hiccup.
It’s a powerful all-around vacuum with some nice design upgrades to make it a little easier to use. This newer model has a release below the vacuum motor to release the cleaner head without having to bend down, and built-in crevice tools to both the handheld motor and the long wand that makes up the middle of the device. There’s also a compressor to help push dust out of the dustbin, and it’ll be compatible with Dyson’s upcoming self-emptying docking station. There’s also a Submarine version ($1,100) so you can use this vacuum as a mop, too.
Advertisement
It has some nice quality-of-life upgrades, but it’s really expensive. I’d recommend it if you know you also want to invest in the mop head and docking station; otherwise, just get the Gen5Detect.
The Affordable All-Arounder
One of the best overall performers is nearly half the price of my winners. The Dyson V10 Konical never once scored in last place, and was especially comfortable to use on carpets and rugs with the new cleaner head design. It did much better than the more expensive and powerful Gen5Detect and V15 Detect when vacuuming up sand, and I found it more comfortable to push around than the Digital Motorbar head on the V15 and V8 when it came to vacuuming a low-pile rug.
Hugging Face on Monday published a technical timeline that walks readers through how an autonomous AI agent, built on OpenAI models and running inside one of OpenAI’s own cybersecurity evaluations, broke into its systems over more than four days earlier this month. It’s the first security incident about which OpenAI CEO Sam Altman “felt very viscerally,” he has said.
Little wonder given it feels, at least, like something has truly been unleashed here. In fact, Hugging Face’s team prefaced its report by offering that “everyone should be prepared as defenders,” before diving into the nitty gritty of what went down for the benefit of security professionals everywhere.
While the rest of the internet continues trying to make sense of what happened (the jargon in Hugging Face’s report is impossible for most people to parse), one point that many observers keep missing is that this wasn’t a rogue agent disobeying orders. It was a system built to hunt for exploits, doing exactly that, just against the wrong target.
Another way to think about the whole thing is to picture a bear at a campsite. Really. A bear tries tent zippers and car-door handles and coolers and trash lids. It does this at every campsite, all night long, because it knows it needs just one unlocked cooler to fill its belly with some poor schmuck’s groceries.
Advertisement
That’s roughly what happened at Hugging Face. The OpenAI system tried thousands of things and just kept going. Eventually, a handful of those attempts worked, and once they did, the agent plowed ahead. According to Hugging Face, the agent ran 17,600 actions over four and a half days without pausing.
Which brings us back to our bear analogy. Just like one success with a cooler full of food teaches a bear to try even harder next time (it is now a “food-conditioned” bear), one leaked password led OpenAI’s agent to look for more exploits and, eventually, to a single key that unlocked several company systems at once.
Neither scenario is harmless. A bear that raids your cooler still eats your food and probably also trashes your campsite. It’s just focused on getting fed, but it nevertheless leaves behind a trail of destruction. Similarly, OpenAI’s agent was seemingly chasing a goal without regard for anything else. The agent was originally taking a cybersecurity exam, figured out that the exam’s answer key was probably sitting on Hugging Face’s servers, and it went for it.
The persistence here is really what’s noteworthy above all else; the agent had a job and it wasn’t going to stop until it got it done. Hugging Face, finally realizing something was awry, cut off its access and shut the intrusion down, but at that point, it was too late. The agent had already gotten what it came for, and a great deal more to boot.
Advertisement
In case you missed it, here’s most of what happened, per Hugging Face’s timeline, but in plainer English.
The agent was taking a cybersecurity skills exam for OpenAI, one where an AI is scored on finding and exploiting software bugs. This specific run had the guardrails stripped out. (OpenAI had turned off its usual safety filters to see what the model could do at full strength, with no human involved in any of its individual moves.) Somewhere in there, it figured out the exam’s reference solutions were likely stored on Hugging Face’s servers. So instead of solving the challenge, it stole the answer key from infrastructure that had nothing to do with the original test.
It escaped the OpenAI exam environment by exploiting an unpatched software flaw that gave it a path to the open internet. From there, it found another AI-testing tool sitting exposed online (nothing to do with Hugging Face), broke into that too, and slipped in code that quietly ran hidden commands the moment the program started. That gave it full control of the machine — its new home base for the rest of the operation that it would use to go after Hugging Face’s systems.
From that base, it turned to Hugging Face itself. Hugging Face had a filter meant to block suspicious requests from reaching out to the open web, but the filter only checked outgoing requests, not requests to read local files sitting right there on the server. The agent found this blind spot and slipped through it. It uploaded a file disguised as an ordinary dataset, but buried inside was an instruction telling Hugging Face’s own systems to pull passwords and source code off the server and hand them back disguised as normal data.
That trick got it passwords and code, but the agent still couldn’t run anything on Hugging Face’s servers. To execute commands there, it needed a second way in. It found a different bug in that same Hugging Face system — software would take a piece of text from the agent and accidentally treat it as a command to run instead of just data to read. That gave the agent the ability to execute its own code directly on Hugging Face’s servers.
For getting commands in and stolen data out, the agent didn’t build any special infrastructure of its own, per Hugging Face. It used tools anyone can access — paste websites and request-logging services, plus Hugging Face’s own upload and proxy features — working together in covert fashion. On top of those, it built a small, improvised messaging system with sequence numbers to keep the pieces in order, plus a quick built-in check to catch anything that arrived corrupted, so it could send multi-step commands and put stolen data back together in the right order.
It also made sure that nothing traveled in plain sight. Whatever it stole or sent, it scrambled first. Hugging Face’s initial automated scan of the intercepted traffic caught only a small slice of what had been taken. Investigators found the rest — roughly four times more — only after they reverse-engineered the agent’s own scrambling method.
The agent even had back-up plans, planting copies of itself across 11 different servers, each set up to relaunch on its own so that shutting down one copy wouldn’t stop anything, since more of the agent’s process was already running elsewhere.
At one point, the agent nabbed the private cryptographic key used to generate valid login tokens. From there, it could mint its own valid credentials whenever it wanted.
After compromising a single server, the agent got hold of a credential that, because of a misconfiguration on Hugging Face’s end, turned out to unlock several separate internal systems at once rather than just the one it came from. That single mistake handed the agent broad control almost immediately.
Using stolen repository access, it submitted a change to a build script that, if it had gone through, could have compromised the automated systems running that code. It didn’t work, though. Hugging Face’s safeguards caught it.
The agent seemed to hold back from doing real damage, Hugging Face observed, but probably not out of restraint. Investigators noticed that every command capable of deleting or altering cloud resources was run in “dry run” mode, meaning it would report what would happen without doing it.
Every time its test environment reset — which happened constantly, by design — it lost every tool and every trace of its identity. But it rebuilt from nothing and reconnected to its stolen infrastructure each time, for more than four days straight.
Ultimately, Hugging Face concluded in its report, a “capable” human hacker “could have found and exploited the same flaws: unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials.” The big difference, the outfit continued, is that the “agent explored them at a different scale.”
Which is really where the bear analogy ends up being the most useful. The best defense against a hungry bear is protocol. You put the food away; you use a latch that works well enough to hold. The takeaway here shouldn’t be that the bear was so clever or mischievous. It’s that it never stopped checking. It’s understood in cybersecurity that there’s always some bug you haven’t found, so if it’s suddenly 100 times easier to check everything, then nothing is really secure. That’s what so many find unsettling about this episode.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
You must be logged in to post a comment Login