OWASP’s 2026 Top 10 for LLM applications moved excessive agency from sixth to third and dropped improper output handling from fifth to tenth, in the first edition weighted partly on incident data. Europe’s Cyber Resilience Act began requiring 24-hour vulnerability reports on 11 September, but it governs products rather than how an agent is deployed.

Excessive agency has moved from sixth place to third in OWASP’s 2026 top ten for LLM applications, and improper output handling has fallen from fifth to last. The hardest problems now sit outside the model, Steve Wilson argues.

Excessive agency is not about what a model says. It is about what it has been handed: the tools, credentials and scopes it can reach once it answers.

The 2026 edition was the first weighted partly on recorded incidents, 6,639 of them, counting for a quarter of the ranking against three quarters practitioner consensus.

Wilson co-led the project with Rock Lambros and is chief AI officer at Exabeam, a security company. Read the column as both things at once.

His prescription is unglamorous. Read-only tools instead of general connectors, requests inside the user’s own scoped identity, a policy enforcement point between the model and anything downstream, and human approval for anything hard to reverse. It echoes the gap a founder described to us in August, between what an agent can do and what it should be authorised to do.

Europe started a clock five days ago.

Since 11 September, manufacturers have had 24 hours to warn their national response team of an actively exploited vulnerability, under the Cyber Resilience Act. A fuller notification follows at 72 hours, through a platform ENISA switched on the same day.

Penalties reach EUR 15M or 2.5% of worldwide turnover. The rest of the regulation applies from 11 December 2027.

Our own reporting found the bottleneck is not obtaining a bill of materials but trusting one. A list is worth only the confidence you can place in it.

The mismatch is what the clock points at. The Act governs products with digital elements, and lawyers reading it place cloud-delivered software outside, which is how most agents reach a customer.

Four teams broke AI agents four ways in ten days this summer, and the same flaw ran through all of them. The failures sat in the ecosystem around the model, not the model.

Wilson’s own figures make the point. On his internal red team suite the oldest model fails 17% of the time and the newest 2%, and he says 98% is nowhere near good enough when every failure leaks data.

The one European report anybody has confirmed came under the AI Act, not this one. OpenAI filed an incident report over agents that occupied a German wiki. Agency is falling between two regimes.

Liquid Glass was first introduced with iOS 26 and, since its implementation across compatible devices, the design has been met with dividing opinions. 

Fortunately with iOS 27 it’s now possible to adjust the level of transparency that Liquid Glass has. So whether you want to embrace the fluidity of Liquid Glass, or you want a clearer and more opaque finish on your iPhone, there’s an option for you.

It takes just a few moments to adjust the liquid glass transparency in iOS 27, and we’ve detailed the steps below.

For more on iOS 27, check out our 14 tips and tricks guide to help you make the most of this year’s iPhone software update.

“Organizations should not have to choose between the capabilities of a frontier model and the ability to control the technology at the center of their work,” said Mark McQuade, co-founder and chief executive of Arcee AI.

The San Francisco company builds open-weight AI models. It has raised a Series B round that values it at more than $1bn, according to its announcement on 16 September. Vista Equity Partners, Cambium Capital and Emergence Capital led the round. AI10 Ventures, Hitachi, IAG, Microsoft’s M12, P7 and Wipro also took part.

Arcee did not disclose the amount. A source told Fortune, which first reported the round, that it was at least $150m. Fortune put the valuation at $1bn before the new money.

A frontier model for about $20m

Arcee released the Trinity family of models over the past year. The largest, Trinity Large, has 400 billion parameters, with 13 billion active for each token.

The company says its entire 2025 model lineup, including Trinity Large, cost about $20m to build. That figure covers salaries, compute, data, infrastructure and operations.

McQuade told Fortune the company had $30m in the bank when it decided to build its own models. “I said ‘let’s do it’ and I bet the company on it,” he said. Arcee spent 65% to 70% of its capital on the effort, according to Fortune.

Before that, Arcee worked on post-training, which adapts existing models, Fortune reported. McQuade founded the company in 2023. He previously worked at Hugging Face, which Nvidia is buying.

“Dropped the ball on open source”

McQuade told Fortune the goal is to catch up with Chinese open-weight models. “The U.S. is far ahead in closed source, but kind of dropped the ball on open source,” he said.

He said Arcee is chasing GLM Flash, a model from Beijing-based Z.ai. It is not chasing Poolside’s Laguna, he said.

Monti Saroya, senior managing director at Vista Equity Partners, said:

“Arcee has demonstrated a rare combination of technical execution and capital efficiency, building frontier open-weight models at a pace and cost profile that stands out in the market.”

Where the money goes

Arcee will spend the funding in three areas, according to the announcement:

• training the next generation of Trinity models, which is already underway
• expanding its work with the US Department of Energy and its 17 national laboratories on Genesis-Science-1, an open model for scientific computing
• building products that help organisations customise, test, deploy and run open models

Arcee will also work extensively with Vista’s portfolio companies, Fortune reported.

A day earlier, the software company CIQ said Arcee had chosen its Fuzzball tool to coordinate computing jobs for its next flagship model, according to CIQ’s announcement. Arcee keeps its own training and inference software.

Other open-weight bets

In August, River AI raised $1.1bn to let companies train and keep their own models. The same month, the White House’s technology strategy left open-weight AI off its critical list.

Huawei isn’t waiting around for the AI chip race to slow down. At a company event in Shanghai on Thursday, rotating chairman David Wang confirmed that two new AI chips are on the way in 2027, the 960DT and the Ascend 960PR, as the company keeps expanding its AI computing business to go after Nvidia, as Reuters reported. The 960DT is expected in the first quarter of 2027, followed by the Ascend 960PR in the third quarter.

Why does connecting chips matter so much?

Here’s the thing about AI workloads: even the most powerful single chip usually can’t handle the biggest AI programs on its own. That’s why Huawei is leaning so heavily on its UnifiedBus technology, which strings together huge numbers of AI chips so they can operate as a single, much larger computing system.

Wang said Huawei has already built 11 semiconductors around UnifiedBus, and the company’s largest connected setups, known as superclusters, can reportedly handle up to a million AI processors working together. On a smaller scale, Huawei says it has already delivered over 1,000 of these linked systems, called supernodes, to more than 370 customers worldwide. Wang stopped short of saying how many chips a single supernode can hold, who any of the customers are, or how the shipment numbers break down.

Can Huawei actually catch up to Nvidia?

US export controls have limited China’s access to the most advanced chips and manufacturing equipment, and that’s actually worked out well for Huawei, pushing it to the front of China’s domestic AI chip supply. Still, Nvidia remains the one to beat, with its chips and software used by developers everywhere.

Hardware alone won’t close that gap, though. Huawei also needs developers actually building on its chips, and Wang shared that its AI chip ecosystem currently counts 5,270 monthly active developers. That number will need to keep climbing if Huawei wants to be seen as a real Nvidia alternative and not just a backup option.

Either way, the US and China’s chip rivalry shows no signs of slowing down, and Huawei just made it clear it intends to be a major part of it straight through 2027.

Big Tech does not decide rules, Ursula von der Leyen says, announcing plans to restrict social media usage for minors.

In her State of the Union speech today (16 September), European Commission president Ursula von der Leyen announced the EU Kids Act, a legislative proposal that intends to ban social media for children under 13.

The law takes a tiered approach to social media and video sharing platforms for minors in the bloc, proposing fully guardian-controlled accounts for children between 13 and 15, and a mandatory safe design for all accounts for under-18s.

“What we are witnessing is a great capture of our children. A capture of their attention, their focus, their minds. This is depriving children of their childhood,” von der Leyen said.

Child safety on social media has taken centre stage in recent years as parents and lawmakers grapple with the reality of an increasingly dangerous online landscape, worsened by the proliferation of technology and services such as generative AI and online prediction markets.

Governments across the world are banning popular platforms for younger minors in a bid to shield underage users from their provable harms.

Australia became the first one to ban social media for under-16s last December, though a recent study showed that eight in 10 Australian teens and preteens continued to use social media despite the complete prohibition by their government.

Meanwhile, Brazil rolled out a new law that mandates parentally-controlled accounts for under-16s, and several more countries, including Greece, Germany, Indonesia, Malaysia and Canada, are debating their own restrictions.

Last month, France’s top court blocked a proposed bill that would have banned social media for under-15s, arguing that the legislation was too broad and could infringe upon young people’s freedom of expression.

With the EU Kids Act, the Commission also wants to standardise access to social media across the bloc as part of a major government overhaul aimed at cutting red tape. If the act is passed, France’s under-15s, for example, would still be able to use these platforms.

Limiting access to social media, meanwhile, is only a part of the problem. “Children are pulled ever deeper into feeds designed to keep them scrolling,” von der Leyen said, calling algorithms the “great capture of our children”.

She added: “We do not have to accept addictive features. We do not have to accept children being drawn into ever more extreme content. We do not have to accept that girls have their photos used for AI-generated sexualised images.”

Earlier this year, the bloc greenlit a provisional deal to ban AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material.

“Platforms will have to prove that they are safe. Because it is not about our minors accessing social media. It is about when and how do we allow social media to access minors,” von der Leyen continued.

The bloc is also introducing a new Digital Fairness Act this autumn that will aim to tackle addictive features on platforms.

“I am aware that many perceive the power of Big Tech as overwhelming and impossible to roll back. I disagree,” the president said. “Europe has the power to act. It is we who decide our rules, not Big Tech.”

US president Donald Trump, an avid critic of the EU’s strict rules, reportedly considered imposing sanctions on the EU for using its Digital Services Act against US technology heavyweights.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

If you’re a fan of Amazon’s ecosystem, whether that’s asking your Alexa speaker to tell you about the weather or compulsively checking the video feed from your Ring doorbell, then it makes sense to expand and build onto the system. It’s always easier to keep to one ecosystem as much as you can with smart home gear, letting you stick to a single app and single subscription if you decide to invest in one.

While we’ve liked Ring’s cameras and home security products fine enough, they’re hard to recommend at the top of our guides since Ring is reintroducing a policy to enable local law enforcement to request footage directly from Ring users. It’s up to you if that’s something you want to invest in, and if you already have Ring products, it might make the most sense to continue adding onto that ecosystem than diving into a new one.

No matter the reason, if you’re looking to add a Ring product to your home, don’t get one without using our Ring coupon codes to get it for a better price.

Ring Promo Code: 50% Off Ring Cameras, Doorbells, and Outdoor Cameras

Ring is running a deal all month long with up to 50% off different products and bundles. You can get all kinds of Ring cameras and security accessories for a variety of discounts, from Ring’s video doorbell to indoor and outdoor cameras.

The Outdoor Smart Home Gear I’ll Always Recommend

These locks, lights, and other smart home upgrades let you add automation without messing up your home’s vibe.

Save $150 on Wired Doorbell Pro and Floodlight Cam

If you’re looking for an outdoor combination, you can get both Ring’s Starter Pro Kit, which includes the Wired Doorbell Pro and Floodlight Cam, for $150 off the set. It’s a great option if you want to get a camera feed both at your doorstep and over your garage.

Ring

Spotlight Cam Pro Battery

Bundle and Save on Ring Whole Home Basic Kit

Looking to deck out your whole home? Ring’s Whole Home Basic Kit is also discounted for $59 off. It includes Ring’s Outdoor Cam Plus Battery, Battery Doorbell, and the Alarm Security Kit, so you can get everything from video surveillance around the outside of your home and sensors to pair with the alarm system for inside of it.

Ring has a variety of subscription plans, which you’ll want since there’s no option to locally store your video footage. That means in order to play any video back to see what set off the camera or who was at the door, you’ll need one of these plans. Here’s a quick breakdown. Basic Ring Plan: Get the basics with video event playback and smart notifications for one camera. $5 per month or $50 per year. Standard Plan: All the core Ring experience with enhanced features for all your devices. $10 per month, or $100 per year. Premium Plan: Ring home the best of the best with our most advanced AI and recording features. $20 per month or $200 per year.

Ring Coupons: $29 Off Pet Basic Kit + Pet Tag

Ring has a pet package you can get for a discount, too. You’ll get both Ring’s Indoor Cam and the Pet Tag, which has a QR code that lets anyone who finds your pet scan it and get your information to contact you. It’s 50% off right now, so if you’re looking for new tags and a camera to keep an eye on your favorite furry companion, this is your moment.

Get $40 Off the Ring Outdoor Cam Plus Battery + Battery Doorbell

If you’ve been looking to upgrade your home security system, now’s a great time to invest in the Ring Outdoor Cam Plus Battery + Battery Doorbell for $30 off (now $160). This discounted Ring bundle includes the Outdoor Cam, plus Battery, Battery Doorbell, and a free 30-day trial of Ring Protect2. With this enhanced Ring bundle, you’ll be able to see all around your home as well as welcome your guests without needing to get up from the couch.

There’s a reason these motion-activated, 1080p HD cameras have become ubiquitous: they’re super simple to setup and use. Just charge the battery, stick it by your door, and keep tabs on your place from wherever you are, day and night, through motion history or a live feed you can watch on an app. Two-way communication lets you chat with visitors or scare away porch pirates, while an optional subscription to Ring’s Protect Plan will let you share videos with your community. 

Secure Your Business With Ring

Having a security camera to protect your business is important. That’s where Ring Business Security Systems come into play. These security and alarm systems are tailored for your business needs, with options like Business Starter Kits, with curated options to fit your needs, and Inventory and Equipment Protection so you can keep an eye on all of your important merchandise and supplies, day or night. Plus, if you want to create your own solution specifically for your business’s needs, you can build your own custom system.

Apple is developing an enterprise server built on its own M8 Ultra chips and has discussed using Nvidia’s NVLink Fusion to connect them, aiming at AI developers, companies and governments from around 2029, The Information reported. The European Commission proposed its Cloud and AI Development Act in June, grading public cloud contracts by how far a provider sits outside third-country control.

Apple is working on an enterprise server built on its own chips and has discussed using Nvidia’s networking equipment, The Information reported. It would sell the machine to AI developers, companies and governments.

Two versions are described, one carrying two of Apple’s forthcoming M8 Ultra chips and a larger one carrying four. Nvidia’s NVLink Fusion would connect them, the interconnect it already licenses to Qualcomm, Arm, Fujitsu, Marvell and others.

Nothing would reach the market before 2029. The effort could be cancelled, or proceed without Nvidia’s technology at all. Shares in both companies barely moved on the report.

Apple already builds servers, for itself. Private Cloud Compute ran only on Apple silicon until June, when the company extended it to Google Cloud running on Nvidia GPUs and Intel processors.

It has not sold one since 2011, when the Xserve was discontinued after a run of nearly nine years.

Governments is the interesting word.

The Commission’s June proposal for a Cloud and AI Development Act would grade public contracts by tiers of sovereignty assurance. The highest tier, meant for defence and national security, requires a European cybersecurity certificate and effective control over every software component. No third country may control a provider’s design, development or maintenance.

Europe has already shown what it accepts in practice, and it is less absolute than that sounds.

A six-year, EUR 180M sovereign cloud framework went to four groups in April. One was a Proximus-led consortium including a Thales and Google venture, alongside Mistral AI. American infrastructure qualified.

Non-European technologies, operated within a strict and appropriate framework, can meet the minimum level of sovereignty required, the Commission said at the time. Bidders were judged against eight objectives, from legal exposure to supply chain transparency.

The distinction is between sovereign operation and sovereign technology. A machine a government owns and runs in its own building is an easier argument to make than a service somebody else runs.

The Act covers cloud services rather than hardware, so a server sale would sit outside it altogether. The procurement instinct behind it would not, and buyers write their own conditions.

Europe is short of the thing no regulation conjures. You cannot regulate your way to sovereignty, as Dan Toma argued here last month, when the silicon is American either way.