“Organizations should not have to choose between the capabilities of a frontier model and the ability to control the technology at the center of their work,” said Mark McQuade, co-founder and chief executive of Arcee AI.

The San Francisco company builds open-weight AI models. It has raised a Series B round that values it at more than $1bn, according to its announcement on 16 September. Vista Equity Partners, Cambium Capital and Emergence Capital led the round. AI10 Ventures, Hitachi, IAG, Microsoft’s M12, P7 and Wipro also took part.

Arcee did not disclose the amount. A source told Fortune, which first reported the round, that it was at least $150m. Fortune put the valuation at $1bn before the new money.

A frontier model for about $20m

Arcee released the Trinity family of models over the past year. The largest, Trinity Large, has 400 billion parameters, with 13 billion active for each token.

The company says its entire 2025 model lineup, including Trinity Large, cost about $20m to build. That figure covers salaries, compute, data, infrastructure and operations.

McQuade told Fortune the company had $30m in the bank when it decided to build its own models. “I said ‘let’s do it’ and I bet the company on it,” he said. Arcee spent 65% to 70% of its capital on the effort, according to Fortune.

Before that, Arcee worked on post-training, which adapts existing models, Fortune reported. McQuade founded the company in 2023. He previously worked at Hugging Face, which Nvidia is buying.

“Dropped the ball on open source”

McQuade told Fortune the goal is to catch up with Chinese open-weight models. “The U.S. is far ahead in closed source, but kind of dropped the ball on open source,” he said.

He said Arcee is chasing GLM Flash, a model from Beijing-based Z.ai. It is not chasing Poolside’s Laguna, he said.

Monti Saroya, senior managing director at Vista Equity Partners, said:

“Arcee has demonstrated a rare combination of technical execution and capital efficiency, building frontier open-weight models at a pace and cost profile that stands out in the market.”

Where the money goes

Arcee will spend the funding in three areas, according to the announcement:

• training the next generation of Trinity models, which is already underway
• expanding its work with the US Department of Energy and its 17 national laboratories on Genesis-Science-1, an open model for scientific computing
• building products that help organisations customise, test, deploy and run open models

Arcee will also work extensively with Vista’s portfolio companies, Fortune reported.

A day earlier, the software company CIQ said Arcee had chosen its Fuzzball tool to coordinate computing jobs for its next flagship model, according to CIQ’s announcement. Arcee keeps its own training and inference software.

Other open-weight bets

In August, River AI raised $1.1bn to let companies train and keep their own models. The same month, the White House’s technology strategy left open-weight AI off its critical list.

Big Tech does not decide rules, Ursula von der Leyen says, announcing plans to restrict social media usage for minors.

In her State of the Union speech today (16 September), European Commission president Ursula von der Leyen announced the EU Kids Act, a legislative proposal that intends to ban social media for children under 13.

The law takes a tiered approach to social media and video sharing platforms for minors in the bloc, proposing fully guardian-controlled accounts for children between 13 and 15, and a mandatory safe design for all accounts for under-18s.

“What we are witnessing is a great capture of our children. A capture of their attention, their focus, their minds. This is depriving children of their childhood,” von der Leyen said.

Child safety on social media has taken centre stage in recent years as parents and lawmakers grapple with the reality of an increasingly dangerous online landscape, worsened by the proliferation of technology and services such as generative AI and online prediction markets.

Governments across the world are banning popular platforms for younger minors in a bid to shield underage users from their provable harms.

Australia became the first one to ban social media for under-16s last December, though a recent study showed that eight in 10 Australian teens and preteens continued to use social media despite the complete prohibition by their government.

Meanwhile, Brazil rolled out a new law that mandates parentally-controlled accounts for under-16s, and several more countries, including Greece, Germany, Indonesia, Malaysia and Canada, are debating their own restrictions.

Last month, France’s top court blocked a proposed bill that would have banned social media for under-15s, arguing that the legislation was too broad and could infringe upon young people’s freedom of expression.

With the EU Kids Act, the Commission also wants to standardise access to social media across the bloc as part of a major government overhaul aimed at cutting red tape. If the act is passed, France’s under-15s, for example, would still be able to use these platforms.

Limiting access to social media, meanwhile, is only a part of the problem. “Children are pulled ever deeper into feeds designed to keep them scrolling,” von der Leyen said, calling algorithms the “great capture of our children”.

She added: “We do not have to accept addictive features. We do not have to accept children being drawn into ever more extreme content. We do not have to accept that girls have their photos used for AI-generated sexualised images.”

Earlier this year, the bloc greenlit a provisional deal to ban AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material.

“Platforms will have to prove that they are safe. Because it is not about our minors accessing social media. It is about when and how do we allow social media to access minors,” von der Leyen continued.

The bloc is also introducing a new Digital Fairness Act this autumn that will aim to tackle addictive features on platforms.

“I am aware that many perceive the power of Big Tech as overwhelming and impossible to roll back. I disagree,” the president said. “Europe has the power to act. It is we who decide our rules, not Big Tech.”

US president Donald Trump, an avid critic of the EU’s strict rules, reportedly considered imposing sanctions on the EU for using its Digital Services Act against US technology heavyweights.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

If you’re a fan of Amazon’s ecosystem, whether that’s asking your Alexa speaker to tell you about the weather or compulsively checking the video feed from your Ring doorbell, then it makes sense to expand and build onto the system. It’s always easier to keep to one ecosystem as much as you can with smart home gear, letting you stick to a single app and single subscription if you decide to invest in one.

While we’ve liked Ring’s cameras and home security products fine enough, they’re hard to recommend at the top of our guides since Ring is reintroducing a policy to enable local law enforcement to request footage directly from Ring users. It’s up to you if that’s something you want to invest in, and if you already have Ring products, it might make the most sense to continue adding onto that ecosystem than diving into a new one.

No matter the reason, if you’re looking to add a Ring product to your home, don’t get one without using our Ring coupon codes to get it for a better price.

Ring Promo Code: 50% Off Ring Cameras, Doorbells, and Outdoor Cameras

Ring is running a deal all month long with up to 50% off different products and bundles. You can get all kinds of Ring cameras and security accessories for a variety of discounts, from Ring’s video doorbell to indoor and outdoor cameras.

The Outdoor Smart Home Gear I’ll Always Recommend

These locks, lights, and other smart home upgrades let you add automation without messing up your home’s vibe.

Save $150 on Wired Doorbell Pro and Floodlight Cam

If you’re looking for an outdoor combination, you can get both Ring’s Starter Pro Kit, which includes the Wired Doorbell Pro and Floodlight Cam, for $150 off the set. It’s a great option if you want to get a camera feed both at your doorstep and over your garage.

Ring

Spotlight Cam Pro Battery

Bundle and Save on Ring Whole Home Basic Kit

Looking to deck out your whole home? Ring’s Whole Home Basic Kit is also discounted for $59 off. It includes Ring’s Outdoor Cam Plus Battery, Battery Doorbell, and the Alarm Security Kit, so you can get everything from video surveillance around the outside of your home and sensors to pair with the alarm system for inside of it.

Ring has a variety of subscription plans, which you’ll want since there’s no option to locally store your video footage. That means in order to play any video back to see what set off the camera or who was at the door, you’ll need one of these plans. Here’s a quick breakdown. Basic Ring Plan: Get the basics with video event playback and smart notifications for one camera. $5 per month or $50 per year. Standard Plan: All the core Ring experience with enhanced features for all your devices. $10 per month, or $100 per year. Premium Plan: Ring home the best of the best with our most advanced AI and recording features. $20 per month or $200 per year.

Ring Coupons: $29 Off Pet Basic Kit + Pet Tag

Ring has a pet package you can get for a discount, too. You’ll get both Ring’s Indoor Cam and the Pet Tag, which has a QR code that lets anyone who finds your pet scan it and get your information to contact you. It’s 50% off right now, so if you’re looking for new tags and a camera to keep an eye on your favorite furry companion, this is your moment.

Get $40 Off the Ring Outdoor Cam Plus Battery + Battery Doorbell

If you’ve been looking to upgrade your home security system, now’s a great time to invest in the Ring Outdoor Cam Plus Battery + Battery Doorbell for $30 off (now $160). This discounted Ring bundle includes the Outdoor Cam, plus Battery, Battery Doorbell, and a free 30-day trial of Ring Protect2. With this enhanced Ring bundle, you’ll be able to see all around your home as well as welcome your guests without needing to get up from the couch.

There’s a reason these motion-activated, 1080p HD cameras have become ubiquitous: they’re super simple to setup and use. Just charge the battery, stick it by your door, and keep tabs on your place from wherever you are, day and night, through motion history or a live feed you can watch on an app. Two-way communication lets you chat with visitors or scare away porch pirates, while an optional subscription to Ring’s Protect Plan will let you share videos with your community. 

Secure Your Business With Ring

Having a security camera to protect your business is important. That’s where Ring Business Security Systems come into play. These security and alarm systems are tailored for your business needs, with options like Business Starter Kits, with curated options to fit your needs, and Inventory and Equipment Protection so you can keep an eye on all of your important merchandise and supplies, day or night. Plus, if you want to create your own solution specifically for your business’s needs, you can build your own custom system.

A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.

Researchers at Elastic Security Labs found that the malicious extensions bypass Chromium’s integrity mechanisms and load in browsers as if they had been approved by the user.

The infection chain starts after the target user opens a JavaScript file disguised as a bank receipt, invoice, payment record, or business document.

After passing anti-sandbox checks, the file triggers a fake error while simultaneously downloading Node.js, establishing persistence through a scheduled task, and retrieving the additional payload location from an Ethereum smart contract.

Despite the name, KREMLIN is linked to a Brazilian operation responsible for at least seven campaigns since May 2025 that use lures impersonating 12 banks.

Installing Chrome and Edge add-ons

A standout feature of KREMLIN is its capability to install extensions on Chrome and Edge browsers without asking the user to approve them.

It waits for the browser to close or terminates it when it detects idle status, and then copies the extension into the app’s profile directories. Next, it enables developer mode and adds the extension to Chromium’s Secure Preferences.

To hide its activity, the malware uses the encryption keys the browser uses to protect sensitive data and then recreates the integrity checks Chrome uses to detect changes in browser preferences.

This makes the malicious extension appear valid to the browser despite never being approved by the user, a documented but rarely used technique according to the researchers.

“KREMLIN uses a documented technique rarely observed in malware: it manually copies the extension into the browser’s profile directories and registers it in the Secure Preferences file,” Elastic explains.

“Because Chromium protects these entries with cryptographic integrity checks, the malware must retrieve the required keys and regenerate the associated HMACs and encrypted hashes.”

Once installed, the extension masquerades as AVSync and performs the following actions:

• Steals cookies, local storage, and session storage
• Keylogs text entered into forms, including passwords
• Captures screenshots and page source
• Enumerates open tabs and browsing history
• Intercepts HTTP request bodies and headers
• Injects attacker-controlled HTML into websites
• Redirects clicks to attacker-selected destinations
• Receives commands through a WebSocket connection

Apart from the malicious extension, the KREMLIN toolkit also acts as an info-stealer that can archive and exfiltrate browser databases, cookies, installed extensions, and the App-Bound cryptographic keys needed to decrypt protected data.

Disrupting the operation

Elastic Security Labs researchers found that KREMLIN malware campaigns use Ethereum smart contracts as dead-drop resolvers and also abuse the Internet Archive service to host payloads hidden inside JPEG images.

In more recent campaigns, the threat actor deployed the REMCOS remote access tool, but past operations pushed the Pulsar RAT. According to the researchers, the switch was likely due to REMCOS being more feature rich.

By connecting the dots through infrastructure analysis and code artifacts, the researchers found the Ethereum wallet that deployed and updated the smart contracts

According to the researchers, the wallet handled roughly 20,800 USDT (Tether) and 19,000 USDT in incoming and outgoing transfers, respectively. Elastic has confirmed 1,515 infected systems, almost all located in Brazil.

The security firm disrupted the current KREMLIN campaign by registering a domain that the malware used as an anti-sandbox canary, causing the loader to stop due to false flags on systems that would otherwise qualify for infection.

Elastic Security Labs researchers shared the tactics and techniques used in KREMLIN attacks, as well as a set of indicators of compromise.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Apple is developing an enterprise server built on its own M8 Ultra chips and has discussed using Nvidia’s NVLink Fusion to connect them, aiming at AI developers, companies and governments from around 2029, The Information reported. The European Commission proposed its Cloud and AI Development Act in June, grading public cloud contracts by how far a provider sits outside third-country control.

Apple is working on an enterprise server built on its own chips and has discussed using Nvidia’s networking equipment, The Information reported. It would sell the machine to AI developers, companies and governments.

Two versions are described, one carrying two of Apple’s forthcoming M8 Ultra chips and a larger one carrying four. Nvidia’s NVLink Fusion would connect them, the interconnect it already licenses to Qualcomm, Arm, Fujitsu, Marvell and others.

Nothing would reach the market before 2029. The effort could be cancelled, or proceed without Nvidia’s technology at all. Shares in both companies barely moved on the report.

Apple already builds servers, for itself. Private Cloud Compute ran only on Apple silicon until June, when the company extended it to Google Cloud running on Nvidia GPUs and Intel processors.

It has not sold one since 2011, when the Xserve was discontinued after a run of nearly nine years.

Governments is the interesting word.

The Commission’s June proposal for a Cloud and AI Development Act would grade public contracts by tiers of sovereignty assurance. The highest tier, meant for defence and national security, requires a European cybersecurity certificate and effective control over every software component. No third country may control a provider’s design, development or maintenance.

Europe has already shown what it accepts in practice, and it is less absolute than that sounds.

A six-year, EUR 180M sovereign cloud framework went to four groups in April. One was a Proximus-led consortium including a Thales and Google venture, alongside Mistral AI. American infrastructure qualified.

Non-European technologies, operated within a strict and appropriate framework, can meet the minimum level of sovereignty required, the Commission said at the time. Bidders were judged against eight objectives, from legal exposure to supply chain transparency.

The distinction is between sovereign operation and sovereign technology. A machine a government owns and runs in its own building is an easier argument to make than a service somebody else runs.

The Act covers cloud services rather than hardware, so a server sale would sit outside it altogether. The procurement instinct behind it would not, and buyers write their own conditions.

Europe is short of the thing no regulation conjures. You cannot regulate your way to sovereignty, as Dan Toma argued here last month, when the silicon is American either way.

Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide.

The malware features data theft and espionage capabilities that collect email, Telegram, and WhatsApp communications, take screenshots, and record audio.

The threat actor primarily targeted individuals in the U.S., U.K., and the Netherlands, whose cybersecurity agencies published a joint advisory with the FBI.

A typical attack begins with social engineering messages impersonating trusted contacts or technical support agents, sent to targets via WhatsApp or Telegram.

The threat actor tricks victims into opening malicious files disguised as legitimate applications (e.g., Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, KeePass), often suggesting they launch them on personal devices to bypass corporate security blocks.

Depending on the pretext used, the hackers sometimes used even medical-related lures, the agencies found.

The apps display a convincing interface that matches the lure, while silently installing CHOSEN BRICK in the background and securing persistence through Windows Registry Run keys.

The malware adds Microsoft Defender exclusions to evade detection and connects to a unique Telegram bot that matches the victim’s ID and provides command-and-control (C2).

Once launched, CHOSEN BRICK can perform the following actions:

• Collect system information
• Enumerate running processes
• Capture screenshots
• Record audio through the microphone
• Steal email content
• Steal Telegram or WhatsApp browser data
• Download additional payloads to “C:\Windows \SysWOW64”
• Delete files
• Wipe the entire host system

The stolen data is exfiltrated through Telegram or cloud services like VultrObjects and StorjShare, while newer CHOSEN BRICK variants route traffic through SOCKS5 proxies to conceal the activity.

The advisory notes that the stolen data sometimes ends up on pro-Iranian leak sites, serving as a form of harassment and increasing the physical risk for dissidents abroad.

“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists,” the government agencies say.

“In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”

Potential victims and organizations should inspect Registry Run entries for suspicious entries, search logs for indicators of compromise (IoCs) shared in the advisory.

Unexpected connections to Telegram’s API, Backblaze B2, VultrObjects, StorjShare, IPRoyal, and LightningProxies should be investigated as suspicious.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat