SiliconRepublic.com spoke with experts at Amgen to explore how early career guidance can set the foundations for a happy and productive career.

The last decade has brought significant change to the working world and it is fair to say that in many cases, advancements have worked to reduce and even eliminate organisational silos. That is to say, in 2026 there is no real reason for employees – remote, hybrid or in-person – to feel isolated in their work or limited in how they might progress professionally. 

That is where planned mentorship often comes in. For many professionals, mentorship can be the factor that enables them to upskill quickly, learn the ropes on the job, develop a network, move beyond their own expectations and even take up the mantle of mentor, eventually. But for that to happen, guidance has to be a key element of an organisation, not a box-ticking exercise every now and then.

“Mentorship has multiple benefits,” explained Michelle Somers, the senior director of facilities and engineering at Amgen. “One of the first things for an organisation to do, to encourage mentorship as a core pillar, is to set up some structured mentorship. 

“Once that is there, the structure is there. You know, the questions are there, the pathways are there and then people get really familiar with it. Then mentorship really becomes a natural thing.”

For Somers, in establishing a system that supports mentorship publicly, organisations not only showcase their goals to empower career progression, but also make it clear that career guidance is not an anomaly, but part of a company’s ethos. 

“I had a colleague come to me recently who said, ‘I know you’ve mentored a colleague of ours, any chance I can avail of your services?’ That turned into just a couple of coffee conversations, where I was able to be a sounding board on her potential career path. 

“The structured programme sets up an expectation that people are available for help and support and then it happens quite naturally and fluidly, especially like what we do here in Amgen.”

Plan in action

Lauren Moore, a manufacturing manager at Amgen, is one such person to benefit from having a mentor take an interest in her career. As Moore’s career progressed at the organisation, she was promoted to a leadership role, which she took in her stride, however, roughly two months in, she began to face some of the challenges that naturally come with a change in expectations. 

She told SiliconRepublic.com: “I was facing some challenges with the additional level of responsibility. So, I sat down with my mentor at the time, who was a leader in the manufacturing area. For me that was incredibly impactful at that early stage in my career. And it really enabled me to build confidence, to build resilience and ultimately to succeed in that position.”

Moreover, she is of the opinion that, in developing a positive attitude and adopting a strong sense of company culture, she, alongside Amgen, can better deliver medicines and vital treatments to the patients who depend on the organisation’s services. 

For Amgen’s senior director of quality control, Claire Shaw, to achieve the best results for employees and for the people using Amgen’s services, companies have to prioritise inclusivity, especially at the induction level. 

She said: “I would consider it very collaborative. There’s a strong sense of teamwork and a strong sense of belonging. Organisations can support a happy work environment that ensures that we serve our patients through developing their staff, and ensures each colleague is valued and can contribute to our daily mission to serve patients.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Isn’t there some claim events come in threes? After the extremely rare leak of the iOS Coruna exploit chain recently, now we have details from Google on a second significant exploit in the wild, dubbed Darksword.

Like Coruna, Darksword appears to have followed the path of government security contractors, to different government actors, to crypto stealer. It appears to focus on exploits already fixed in modern iOS releases, with most affecting iOS 18 and all patched by iOS 26.3.

Going from almost no public examples of modern iOS exploits to two in as many weeks is wild, so if mobile device security is of interest, be sure to check out the Google write-up.

Another FBI Router Warning

The second too early to be retro – but too important to ignore – repeat security item is a second alert by the FBI cautioning about end-of-life consumer network hardware under active exploitation, with the FBI tracking almost 400,000 device infections so far.

Like the warning two weeks ago, the FBI calls out a handful of consumer routers – but this time they’re devices that may actually still be service in some of our homes (or our less cutting edge friends and family), calling out devices from Netgear, TP-Link, D-Link, and Zyxel:

• Netgear DGN2200v4 and AC1900 R700
• TP-Link Archer C20, TL-WR840N, TL-WR849N, and WR841N
• D-Link DIR-818LW, 850L, and 860L
• Zyxel EMG6726-B10A, VMG1312-B10D, VMG1312-T20B, VMG3925-B10A, VMG3925-B10C, VMG4825-B10A, VMG4927-B50A, VMG8825-T50K

While many of these devices are over ten years old, they still support modern networking – some of them even supporting 802.11ac (also called Wi-Fi 5).  Unfortunately, since support has been ended by the manufacturers, publicly disclosed vulnerabilities have not been patched (and now never will be, officially)

Once infected, the routers are enrolled in the AVRecon malware network, which includes the now-typical suite of behavior of remote control, remote VPN access to the internal and external networks, DNS hijacking, and DDoS (distributed denial of service) attacks. This sort of network malware is used by attackers to exploit internal systems like un-patched Windows or IOT devices on the local network, and as a launching point to hide behavior as coming from a certain country or state by using the public Internet connection as a VPN. It’s also often monetized by unscrupulous apps selling cheap VPN service.

The worst type of vulnerability affecting home routers is one which can be triggered remotely from the Internet without user interaction – for instance CVE-2024-12988 which allows arbitrary code execution remotely on Netgear devices, but even vulnerabilities which are only accessible from the local network can be combined with cross-site vulnerabilities or vulnerabilities in other devices to exploit home routers. A malware infection on a Windows system can be leveraged to install additional, permanent malware installs on routers and IOT devices, and malware on a router can be used to redirect the user to install more malware on an internal PC via manipulating the network, or allow direct attack of internal systems via a proxy.

A slight upside is that this batch of vulnerable hardware is often modern enough to run OpenWRT or other replacement firmware. OpenWRT supports thousands of routers and access points – and often forms the basis of the commercial firmware the device was shipped with, before the manufacturer abandoned it. Converting a device to OpenWRT may be intimidating for some, but for anyone with one of the listed devices, the time to try is now! It’s cheaper than buying a new device, and worst case scenario, you’d have to replace that router anyway!

You can use the OpenWRT Table of Hardware to see if there is a version for your device.

Unfortunately, vulnerabilities in home routers don’t offer many lessons: there’s rarely a need to log into them to see if there is a pending update, and almost nothing the typical home user can do except buy a new device when the manufacturer stops supplying security fixes.

Trivy Compromised

The Trivy security scanner suffered a breach themselves, leading to a cascading series of breaches of other tools. Trivy is an automatic vulnerability scanner for finding vulnerabilities is the dependencies of Docker and other container images, package repositories, and language packages in Go, PHP, Python, Node, and many other popular languages. Trivy is often integrated into the CI/CD (continual integration and continual deployment) process of other open and closed source projects and internal company processes.

According to the timeline published by Aqua, in late February 2026 a misconfigured GitHub workflow allowed the theft of authentication tokens for the Trivy project. While the attack was detected and the credentials removed, not all credentials were properly removed, which allowed the attackers to complete the attack on March 19, 2026.

Once compromised, all but one release of the Trivy GitHub actions were replaced with trojaned malicious copies, spreading the compromise to any project which used the Trivy GitHub actions, spreading the malware payload to many projects using the Trivy scanner actions.

GitHub actions are part of GitHub which allows scripts when repository actions like a pull request or merge are performed. Actions can be used to check that a change compiles properly, scan for security issues, generate documentation, or generate release binaries, and typically are allowed to make changes to the repository itself. GitHub workflows can include actions from other repositories via the Action Marketplace. By replacing the Trivy actions, the attackers essentially gained access to every repository using Trivy to scan for vulnerabilities in their own codebases.

The hijacked Trivy actions collected and exfiltrated access tokens for Docker, Google Cloud, Azure, and AWS, Git credentials, SSH keys, and any other secrets from projects using the Trivy actions. With these keys, the controllers of the original malware are able to attack those projects directly, such as the immensely popular LiteLLM Python interface to AI LLM models from multiple companies.

The compromise of LiteLLM also stole credentials to cloud services, SSH, git, Docker, and Kubernetes on any system that ran the trojaned setup scripts, as well as infecting any connected Kubernetes systems found in the configurations.

There are also reports that the malware actors are also infecting NPM node packages with malware which automatically updates itself from a block-chain based control system and steals NPM authentication tokens to inject itself into any NPM packages the victim may have authored.

Supply-chain attacks happening for years with varying levels of success. But the Trivy attack may be the most successful in spreading compromised packages into multiple package repositories. It’s difficult to avoid supply chain attacks, especially when the vulnerability scanner itself is the source of the problem. GitHub has introduced immutable releases – tagged build versions which can not be updated once released, and the immutable release of Trivy was the only version not compromised by the attackers. As more packages shift to immutable versions it may become harder to insert malware into the supply, but we’re nowhere near a tipping point of projects using immutable releases yet.

Video Friday is your weekly selection of awesome robotics videos, collected by your friends at IEEE Spectrum robotics. We also post a weekly calendar of upcoming robotics events for the next few months. Please send us your events for inclusion.

ICRA 2026: 1–5 June 2026, VIENNA

RSS 2026: 13–17 July 2026, SYDNEY

Summer School on Multi-Robot Systems: 29 July–4 August 2026, PRAGUE

Enjoy today’s videos!

“Roadrunner” is a new bipedal wheeled robot prototype designed for multi-modal locomotion. It weighs around 15 kg (33 lb) and can seamlessly switch between its side-by-side and in-line wheel modes and stepping configurations depending on what is required for navigating its environment. The robot’s legs are entirely symmetric, allowing it to point its knees forward or backward, which can be used to avoid obstacles or manage specific movements. A single control policy was trained to handle both side-by-side and in-line driving. Several behaviors, including standing up from various ground configurations and balancing on one wheel, were successfully deployed zero-shot on the hardware.

[ Robotics and AI Institute ]

Incredibly (INCREDIBLY!) NASA says that this is actually happening.

NASA’s SkyFall mission will build on the success of the Ingenuity Mars helicopter, which achieved the first powered, controlled flight on another planet. Using a daring mid-air deployment, SkyFall will deliver a team of next-gen Mars helicopters to scout human landing sites and map subsurface water ice.

[ NASA ]

NASA’s MoonFall mission will blaze a path for future Artemis missions by sending four highly mobile drones to survey the lunar surface around the Moon’s South Pole ahead of astronauts’ arrival there. MoonFall is built on the legacy of NASA’s Ingenuity Mars Helicopter. The drones will be launched together and released during descent to the surface. They will land and operate independently over the course of a lunar day (14 Earth days) and will be able to explore hard-to-reach areas, including permanently shadowed regions (PSRs), surveying terrain with high-definition optical cameras and other potential instruments.

For what it’s worth, Moon landings have a success rate well under 50%. So let’s send some robots there to land over and over!

[ NASA ]

In Science Robotics, researchers from the Tangible Media group led by Professor Hiroshi Ishii, together with colleagues from Politecnico di Bari, present Electrofluidic Fiber Muscles: a new class of artificial muscle fibers for robots and wearables. Unlike the rigid servo motors used in most robots, these fiber-shaped muscles are soft and flexible. They combine electrohydrodynamic (EHD) fiber pumps — slender tubes that move liquid using electric fields to generate pressure silently, with no moving parts — with fluid-filled fiber actuators. These artificial muscles could enable more agile untethered robots, as well as wearable assistive systems with compact actuation integrated directly into textiles.

[ MIT Media Lab ]

In this study, we developed MEVIUS2, an open-source quadruped robot. It is comparable in size to Boston Dynamics Spot, equipped with two LiDARs and a C1 camera, and can freely climb stairs and steep slopes! All hardware, software, and learning environments are released as open source.

[ MEVIUS2 ]

Thanks, Kento!

What goes into preparing for a live performance? Arun highlights the reliability testing that goes into trying a new behavior for Spot.

[ Boston Dynamics ]

In this work, a multi-robot planning and control framework is presented and demonstrated with a team of 40 indoor robots, including both ground and aerial robots.

That soundtrack though.

[ GitHub ]

Thanks, Keisuke!

Quadrupedal robots can navigate cluttered environments like their animal counterparts, but their floating-base configuration makes them vulnerable to real-world uncertainties. Controllers that rely only on proprioception (body sensing) must physically collide with obstacles to detect them. Those that add exteroception (vision) need precisely modeled terrain maps that are hard to maintain in the wild. DreamWaQ++ bridges this gap by fusing both modalities through a resilient multi-modal reinforcement learning framework. The result: a single controller that handles rough terrains, steep slopes, and high-rise stairs—while gracefully recovering from sensor failures and situations it has never seen before.

That cliff behavior is slightly uncanny.

[ DreamWaQ++ ]

I take issue with this from iRobot:

While the pyramid exploration that iRobot did was very cool, they did it with a custom made robot designed for a very specific environment. Cleaning your floors is way, way harder. Here’s a bit more detail on the pyramids thing:

[ iRobot ]

More robots in circus please!

[ Daniel Simu ]

MIT engineers have designed a wristband that lets wearers control a robotic hand with their own movements. By moving their hands and fingers, users can direct a robot to perform specific tasks, or they can manipulate objects in a virtual environment with high-dexterity control.

[ MIT ]

At NVIDIA GTC 2026, we showcased how AI is moving into the physical world. Visitors interacted with robots using voice commands, watching them interpret intent and act in real time — powered by our KinetIQ AI brain.

[ Humanoid ]

Props to Sony for their continued support and updates for Aibo!

[ Aibo ]

This robot looks like it could be a little curvier than normal?

[ LimX Dynamics ]

Developed by Zhejiang Humanoid Robot Innovation Center Co., Ltd., the Naviai Robot is an intelligent cooking device. It can autonomously process ingredients, perform cooking tasks with high accuracy, adjust smart kitchen equipment in real time, and complete post-cooking cleaning. Equipped with multi-modal perception technology, it adapts to daily kitchen environments and ensures safe and stable operation.

That 7x is doing some heavy lifting.

[ Zhejiang Lab ]

This CMU RI Seminar is by Hadas Kress-Gazit from Cornell, on “Formal Methods for Robotics in the Age of Big Data.”

Formal methods – mathematical techniques for describing systems, capturing requirements, and providing guarantees – have been used to synthesize robot control from high-level specification, and to verify robot behavior. Given the recent advances in robot learning and data-driven models, what role can, and should, formal methods play in advancing robotics? In this talk I will give a few examples for what we can do with formal methods, discuss their promise and challenges, and describe the synergies I see with data-driven approaches.

[ Carnegie Mellon University Robotics Institute ]

This article is part of the collection: Teaching Tech: Navigating Learning and AI in the Industrial Revolution.

A fourth-grade teacher asked a simple question:

“What can I actually use this for in math?”

This teacher captured the broader moment in education. Over the past several years, schools have been urged to respond to the rapid emergence of generative AI tools such as ChatGPT with limited information and a lot of hype and horror stories. Some have framed the technology as potentially transformative for teaching and learning, while others claim the opposite. Yet in many classrooms, adoption has been slower and more selective than the surrounding hype might suggest.

That hesitation is often interpreted as resistance to innovation, but conversations with educators suggest a different interpretation. In many cases, teachers behave as experts in most fields do when encountering a new technology, evaluating whether it solves a real problem. When professionals encounter a tool that is widely marketed but still evolving, they ask a basic question: What does this actually help me do better?

For many educators, that question remains unresolved when it comes to classroom instruction, and that’s what our research project aimed to answer: What are teachers experiencing with generative AI in their classrooms?

In fall 2024, EdSurge researchers facilitated discussions between a group of 17 teachers from around the world. We convened a group of third to 12th grade teachers, and some of them designed and delivered their own lesson plans, either teaching with or about AI.

Overall, our participants’ responses reflect a few major themes, with the most prominent sentiment being an air of indifference. In particular, a fourth grade math teacher participant attempted to use generative AI in her instruction. However, before adoption, she asked how AI could help her elementary students learn math. Her question captured what several participants were thinking, aligning with 2024 data from the Pew Research Center that shows educators were split on whether student AI use was more harmful than helpful.

A Technology Arriving Faster Than Schools Can Unpack

A high school computer science teacher from Georgia describes her fears about generative AI’s widespread push into classrooms:

A high school library media specialist from New York described the same tension from a different angle:

Schools typically adopt new technologies through deliberate cycles of experimentation, professional development and evaluation. Generative AI has entered classrooms through a different pathway. Consumer tools became available to teachers and students simultaneously, often before schools had developed policies or instructional frameworks for using them.

The result is a situation in which educators encounter the technology while they are still trying to understand its implications.

Where AI Is Already Providing Value

In conversations with teachers, the pattern that appears consistently is a classic user design case. The most immediate use cases for generative AI have little to do with student learning. Instead, an engineering and computer science teacher in New Jersey addressed workload:

Another teacher described similar experimentation among colleagues:

These examples reflect a pattern seen across many professions: Generative AI is particularly effective at drafting, summarizing and generating text. In contexts where professionals face time pressure and administrative demands, those capabilities can be immediately useful.

Teachers experience those same pressures. Beyond instruction, many juggle grading, lesson planning, parent communication, extracurricular supervision and administrative reporting. In that environment, a chatbot that helps compress routine tasks can feel genuinely helpful.

Recent research, as well as national survey data from RAND’s American Educator Panels, suggests that teachers are adopting generative AI primarily as a productivity tool rather than a core instructional technology, a pattern that mirrors how educators in this study described their own early experimentation.

However, instructional discretion is different from a teacher’s administrative workload.

The Instructional Use Case Remains Unclear

When teachers consider introducing AI tools to students during class time, the calculations they make change. The relevant question becomes: What student learning problem does this tool solve? Many educators are still trying to answer this question, even after several years of exposure to generative AI in some capacity.

Some teachers are experimenting with AI in limited ways, such as using it as a revision partner in writing. A science teacher from Guam said:

Others are designing lessons where the technology itself becomes the subject of inquiry. A high school special education teacher in New York shared how she removes the veil from the magic of chatbots.

Learning science research suggests that students benefit most when technology supports reflection and revision, rather than replacing the productive struggle of critical thinking and problem solving, a principle that many teachers in this study have applied. In these cases, AI becomes a tool that students analyze and critique. The participants do not attribute AI as a source of authoritative knowledge.

AI Literacy as a Practical Classroom Entry Point

Many teachers see the most promising instructional opportunity in AI literacy, as it may feel most appropriate to teach students about the tools they’re hearing about and encountering daily. International guidance from the United Nations Educational, Scientific and Cultural Organization (UNESCO) and the Organisation for Economic Co-operation and Development (OECD) increasingly frames AI literacy as a foundational skill for students, encouraging schools to help young people understand how algorithmic systems generate information, rather than incorporating AI tools into everyday classroom tasks.

Students already live in environments shaped by algorithmically designed systems, from social media feeds to recommendation engines. Generative AI introduces another layer to that ecosystem.

An elementary teacher from New York state describes focusing on helping students understand how these systems produce information and where they fail:

A middle school teacher from New York uses simple analogies to illustrate how machine learning systems work:

These lessons treat AI less as a productivity tool and more as a window into how digital systems generate knowledge.

Hallucinations, Bias and the Question of Trust

Teachers also raised consistent concerns about the reliability of generative AI outputs. An elementary library media specialist from New York said:

To illustrate the risks, some educators point to real-world examples. A high school French teacher shared:

Others connect these issues to broader discussions about algorithmic bias, explaining why they fear that students will become reliant on these tools. A high school computer science teacher in New Jersey shares her concerns about the increased use of AI by students. She works at a school with large populations of African American, Latino and Black newcomer families from African and Caribbean countries:

In these contexts, AI becomes less a tool for answering questions and more a case study of how technological systems shape information.

The “Air of Indifference”

Taken together, these conversations reveal a stance that is not often captured in public discussions of AI in schools. What initially appeared to be an insignificant factor in keeping teachers interested in robust discussions about AI turned out to be a prominent theme aligned with both existing and emerging research.

By and large, teachers are not rejecting the technology. But they are also not reorganizing their classrooms around AI.

Instead, many are adopting a posture that might be described as pragmatic indifference:

“I use it for lesson planning… but I don’t really use the lessons.”

“I push students not to use it for research.”

In other words, teachers are using AI where it clearly saves time while maintaining boundaries around core learning tasks. This posture reflects professional judgment, rather than resistance to inevitable technological innovation.

Schools exist partly to create conditions in which students practice complex cognitive work, such as deep reading, methodical writing, reasoning through problems and evaluating evidence. If a tool primarily reduces the need to perform that work, teachers have reason to question whether it advances or undermines learning.

And that brings us back to the fourth-grade teacher’s question: What can I use this for with fourth-grade math?

If the instructional use case for AI remains unclear, what should students be learning instead?

That question leads to a deeper conversation about the kinds of skills that remain valuable even as technologies change.

A large-scale campaign is targeting developers on GitHub with fake Visual Studio Code (VS Code) security alerts posted in the Discussions section of various projects, to trick users into downloading malware.

The spammy posts are crafted as vulnerability advisories and use realistic titles like “Severe Vulnerability – Immediate Update Required,” often including fake CVE IDs and urgent language.

In many cases, the threat actor impersonates real code maintainers or researchers for a false sense of legitimacy.

Application security company Socket says that the activity appears to be part of a well-organized, large-scale operation rather than a narrow-targeted, opportunistic attack.

The discussions are posted in an automated way from newly created or low-activity accounts across thousands of repositories within a few minutes, and trigger email notifications to a large number of tagged users and followers.

“Early searches show thousands of nearly identical posts across repositories, indicating this is not an isolated incident but a coordinated spam campaign,” Socket researchers say in a report this week.

“Because GitHub Discussions trigger email notifications for participants and watchers, these posts are also delivered directly to developers’ inboxes.”

The posts include links to supposedly patched versions of the impacted VS Code extensions, hosted on external services such as Google Drive.

Although Google Drive is obviously not the official software distribution channel for a VS Code extension, it’s a trusted service, and users acting in haste may miss the red flag.

Clicking the Google link triggers a cookie-driven redirection chain that leads victims to drnatashachinn[.]com, which runs a JavaScript reconnaissance script.

This payload collects the victim’s timezone, locale, user agent, OS details, and indicators for automation. The data is packaged and sent to the command-and-control via a POST request.

This step serves as a traffic distribution system (TDS) filtering layer, profiling targets to push out bots and researchers, and delivering the second stage only to validated victims.

Socket did not capture the second-stage payload, but noted that the JS script does not deliver it directly, nor does it attempt to capture credentials.

This is not the first time threat actors have abused legitimate GitHub notification systems to distribute phishing and malware.

In March 2025, a widespread phishing campaign targeted 12,000 GitHub repositories with fake security alerts designed to trick developers into authorizing a malicious OAuth app that gave attackers access to their accounts.

In June 2024, threat actors triggered GitHub’s email system via spam comments and pull requests submitted on repositories, to direct targets to phishing pages.

When faced with security alerts, users are advised to verify vulnerability identifiers in authoritative sources, such as National Vulnerability Database (NVD), CISA’s catalog of Known Exploited Vulnerabilities, or MITRE’s website fot the Common Vulnerabilities and Exposures program.

take a moment to consider their legitimacy before jumping into action, and to look for signs of fraud such as external download links, unverifiable CVEs, and mass tagging of unrelated users.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Advertisement

Get Your Copy Now