Canva has spent the past year quietly embedding itself into every major AI assistant. First came Claude, then ChatGPT, then Microsoft Copilot. Now Google Gemini gets the same treatment, and the strategy is complete.

The company launched its Connected App for Google Gemini at Google I/O, giving Gemini users the ability to generate, edit, and search Canva designs directly from a conversation. The integration started rolling out with limited availability on 19 May and will expand to full availability in the coming weeks.

The pitch is straightforward. Type a prompt in Gemini, and Canva generates a design that arrives not as a flat image but as a fully editable file. If the user has a Canva Brand Kit configured, the output automatically applies stored logos, fonts, and colour palettes from the first prompt.

The most technically interesting piece is the integration with Google’s Nano Banana image model. Users can generate an image through Gemini’s native capabilities and then convert it into a layered, editable design using Canva’s Magic Layers tool. That solves a persistent frustration with AI-generated visuals: they are typically flat files that require re-prompting for every small change. Magic Layers analyses the image structure and separates it into individual, movable elements.

“We’re making design accessible wherever people start their work,” said Anwar Haneef, Canva’s head of ecosystem. The implication is clear. Canva no longer sees itself as a destination. It sees itself as infrastructure.

The Gemini launch means Canva’s design engine is now embedded in all four dominant AI assistants: Claude, ChatGPT, Copilot, and Gemini. Each integration works through Canva’s API, allowing the assistant to call design generation, brand kit lookup, and template search without the user leaving the conversation.

The timing matters. Google unveiled Pics at I/O 2026, a competing AI design tool built directly into Workspace that generates graphics from text prompts. Adobe’s Firefly holds 41 per cent business adoption. And Figma just launched its own AI agent that designs on the canvas. Canva’s response is to make its tools available everywhere rather than fight for a single surface.

That approach is paying off commercially. Canva reported that nearly every marketer in its latest survey uses AI for some part of their workflow, though consumers still want the human touch. The company now claims 220 million users globally and has positioned its AI 2.0 platform, launched in March, as a full operating system for visual content creation.

Canva AI 2.0 already connects to Slack, Gmail, Google Drive, Calendar, Notion, Zoom, and HubSpot through six intelligent workflows. It can generate meeting summaries from Zoom transcripts, turn customer emails into personalised sales materials, and build company newsletters. The Gemini integration adds another surface to that network.

The risk for Canva is commoditisation. If every AI assistant can generate decent visuals natively, the value of a dedicated design tool diminishes. Google’s Pics, OpenAI’s image generation, and Adobe’s Firefly are all improving rapidly. Canva’s bet is that brand consistency, editability, and template ecosystems still matter more than raw generation quality, and that being embedded everywhere makes it harder to replace.

from the it’s-just-so-brazen dept

There were two rumors last week regarding the supposed “settlement” of Donald Trump’s ridiculously problematic lawsuit against his own IRS, asking for $10 billion. The first was that he was going to get an agreement to drop all audits of his taxes (and the taxes of his family members and businesses). The second was that he was going to create a $1.776 billion fund to pay off January 6th insurrectionists. The first of those came true on Monday. The second came true on Tuesday.

US tax authorities will be barred from pursuing claims against Donald Trump, his eldest sons and the Trump Organization under an agreement to halt the president’s $10bn lawsuit against the Internal Revenue Service.

Just like Monday’s news, the framing of this is absolute bullshit. There is no “agreement to halt the lawsuit.” The lawsuit was about to be drop kicked out of court by a judge who pointed out that there is no “cause or controversy” here because Donald Trump was suing himself and had full control over both parties in the lawsuit. You can’t “come to an agreement” with yourself to give yourself a tremendous benefit from the United States government.

That’s not a thing. That’s just theft.

And while it may not be the full $10 billion he sought, it’s still a massive theft from the United States treasury. As you’ll recall, Donald Trump has insisted for years that he couldn’t release his tax returns like every single President since Richard Nixon had done, because they were being audited. But that’s also bullshit. When Nixon released his tax returns, they were being audited. And, indeed, the IRS code requires it to audit both the President and Vice President’s taxes every year.

Reporting from a few years ago found that an audit of Trump’s taxes suggested he owed over $100 million to the US Treasury because of earlier tax fraud.

The issues around Mr. Trump’s case were novel enough that, during his presidency, the I.R.S. undertook a high-level legal review before pursuing it. The Times and ProPublica, in consultation with tax experts, calculated that the revision sought by the I.R.S. would create a new tax bill of more than $100 million, plus interest and potential penalties.

So agreeing to drop the audit entirely is, at minimum, a $100 million gift from the American taxpayer directly to Donald Trump. As a reward for tax fraud.

That seems… very bad. It’s extraordinarily, shockingly corrupt. And it’s probably not even the most corrupt thing he’s done this week.

The actual agreement from the DOJ is hilariously stupid. It’s just three paragraphs long and claims it’s part of the “settlement” of the lawsuit (which, again, cannot be “settled” because there’s only one party). The main part is this:

The United States RELEASES, WAIVES, ACQUITS, and FOREVER DISCHARGES each of the Plaintiffs from, and is hereby FOREVER BARRED and PRECLUDED from prosecuting or pursuing, any and all claims, counterclaims, causes of action, appeals, or requests for any relief, including injunctive relief, monetary relief, damages, examinations or similar or related reviews, appeals, debt relief, costs, attorney’s fees, expenses, and/or interest, whether presently known or unknown, that as of the Effective Date of the Settlement Agreement-have been or could have been asserted by Defendants against any of the Plaintiffs or related or affiliated individuals (including, without limitation, family or others filing jointly), or parties including trusts, parent, sister, or related companies, affiliates, and subsidiaries, by reason of, with respect to, in connection with, or which arise out of (1) any matters that were raised or could have been raised in the Case or the Pending Agency Claims; (2) Lawfare and/or Weaponization; or (3) any matters currently pending or that could be pending (including tax returns filed before the Effective Date) before Defendants or other agencies or departments.

Basically: clean slate for what appears to be many, many years of tax fraud. So he defrauded the American government, then used his role as the President to just wipe out any ability to hold him accountable for it.

And it’s not like everyone inside the government just went along with it. Reporting says that IRS officials were horrified by the lawsuit and pushed the DOJ to fight back against it.

I.R.S. officials prepared a 25-page memorandum outlining what they saw as flaws in Mr. Trump’s suit and advising the Justice Department to move to dismiss it, according to two people familiar with the memo. That memo was provided to Treasury officials in April, and it is unclear if they passed it along to its intended recipients at the Justice Department, according to the people, who spoke anonymously to discuss internal government deliberations.

And then, on Monday, just as this brazenly corrupt deal was being finalized, the Treasury Department’s top lawyer (hired by Trump) resigned, apparently in protest.

The Treasury Department’s top lawyer resigned Monday as the government announced a controversial settlement with President Trump, according to people familiar with his departure.

Brian Morrissey joined the Trump administration last year as the president’s pick to be Treasury Department’s general counsel, after previously serving at the agency and at the Justice Department during Trump’s first term. A former clerk for Justice Clarence Thomas, Morrissey didn’t respond to a request for comment late Monday. 

Advertisement

MAGA world has long since baked in the idea that Trump will rob the American taxpayer blind any way he can. Most people just assumed that came with the territory. Probably fewer assumed “the territory” included filing a $10 billion lawsuit against yourself, having the judge almost throw it out because you’re suing yourself, then “settling” with yourself — and somehow walking away with a clean slate on what appears to be over $100 million in fraud-based tax debt. If this were written up as a movie, no one would make it, as the corruption is simply too over the top and out in the open. And yet, it’s real.

Filed Under: audits, donald trump, irs, tax fraud

Companies: trump organization

While streaming may be the future of television, the medium itself—much like its big-screen counterpart—often leans on familiar properties, prequels, and reboots to keep things moving along. (Which explains why Yellowstone has morphed into a full-on franchise, with four current spinoffs and more on the way.)

Why does this matter to you? Because May’s best shows to stream are full of familiar titles, from Battlestar Galactica to the Duffer Brothers’ newest project … which sounds a bit like their most famous project.

Here are our picks for the 10 best shows to watch this month.

Battlestar Galactica

Vacuum cleaners are a necessity for any household, but with so many options on the market it can be difficult to know which one is best for you.

Dyson and Shark are easily two of the most recognisable brands, with both offering numerous cordless, corded and robot vacuums to suit all households. 

But what are the key differences between Dyson and Shark’s respective offerings? Is one brand an easier recommendation than the other? Or are both similar enough performers?

As we’ve reviewed many Dyson and Shark vacuums, we’re in a great position to provide insight into how the two brands measure up. With this in mind, we’ve compared our experiences with Dyson and Shark to help you decide between the two.

Read on to see how Dyson compares to Shark, and decide which brand is right for you. Otherwise, our list of the best vacuum cleaners, best cordless vacuums and even best vacuums for pet hair has plenty of options across all budgets.

SQUIRREL_PLAYLIST_10208537

How we test

We put every vacuum that comes into our office through the same rigorous testing process. Where applicable, we test each vacuum on both carpet and hard flooring and determine how strong pick-up and general performance is (using appropriate floor heads too). We also measure the AirWatts (AW), noise level in dB and battery life for cordless models too.

We also ensure each product is tested for usability, and measure factors such as ease of assembly, manoeuvrability, dust capacity and an overview of the included accessories too. For corded models, we’ll naturally measure the cord length while cordless cleaners are reviewed based on their portability. 

For a more in-depth look at our review process, visit our vacuum cleaner test guide here.

Brand overviews and pricing

Overall, Dyson undoubtedly has the pricier selection of vacuums compared to Shark. While Shark’s cheapest vacuum in the UK is the Shark VacMop VM200UK with an RRP of £79.99 (though in the US it’s the Shark UltraCyclone Pet Pro+ which starts at $69.99), the cheapest Dyson is the handheld Car+Boat which will set you back a hefty £249.99/$299.99.

Suction and cleaning performance

We’ve found that both Dyson and Shark provide impressively powerful suction and overall cleaning performance. However, in terms of AirWatts (AW), Dyson vacuums typically tend to do better than Shark’s own. Even the cordless Dyson Piston Animal saw a staggering 401AW result which is among the best we’ve seen from a cordless, and puts it on par with many plug-in models too. In fact, the corded Dyson Ball Animal surprisingly falls slightly short with a measurement of 203AW. 

In comparison, the Shark PowerDetect Speed Clean and Empty Pet Pro achieved a 322AW result which falls slightly short of both the Dyson Piston Animal and the Dyson Gen5Detect. Having said that, considering the Shark model has an RRP of around £499.99 while Dyson’s Piston Animal will set you back an eyewatering £749.99, that slight difference in power suction is arguably negligible.

While it is important to factor in suction power, AirWatts shouldn’t be the sole reason you opt for a vacuum, and you should also consider the specific cleaning performance. Even so, the Dyson Piston Animal does benefit from both an incredibly high AW and some of the best cleaning we’ve reviewed. In fact, we found that 99.8% of dust was collected in our controlled tests while 99% of dust was collected during our edge tests.

Otherwise, although the Shark PowerDetect Speed Clean and Empty Pet Pro achieved slightly lower results, generally it still performed pretty admirably. We found that the vacuum collected 99.1% of dust in our controlled tests and 95.9% in our edge test. Sure those results are lower than the Dyson Piston Animal, but remember that price discrepancy. 

Both saw 100% mess collection on hard floors.

This isn’t to say that a Dyson model is guaranteed to pick up more mess. In fact, during our time with the Dyson V8 Cyclone, we concluded the vacuum collected 94.85% in our real-world test and a much lower 85.9% when cleaning against the skirting boards. However, with an RRP of £349.99, it’s a cheaper option than the Shark PowerDetect Pet Pro and still offers a solid performance.

Design and usability

Both Dyson and Shark include cordless, corded and robot vacuums in their respective ranges. While cordless models are usually lighter and easier to use, corded models tend to offer stronger power whereas robots are brilliant for hands-free cleaning. Deciding between the model type will depend on your preferences, with each having their own pros and cons. 

For example, although cordless models are the more convenient choice for easy whole-house cleaning without being restricted by a cord, battery life can be an issue. In comparison, corded models may require you to keep plugging and unplugging the cord for you to achieve a whole-house clean.

Another factor to consider is usability, specifically regarding how easy a vacuum is to push around. The Dyson PencilVac, for example, is genuinely one of the lightest and easiest vacuums to push around – however remember it is just for hard floors.

More premium Shark’s floor heads, like the one of the IA3241UKT, are also designed to collect as much dust on the back pass as the forward pass, which makes it easier to quickly clean areas. 

Otherwise, both Shark and Dyson vacuums tend to come with plenty of accessories – although there are some key exceptions to keep in mind. Models like the Dyson PencilVac, which is designed purely for hard floors, only comes with a main floor head and a two-in-one crevice and dusting tool, while the Dyson V15s Detect Submarine is equipped with two floor heads and plenty of handheld attachments too. 

The Shark PowerDetect Speed Clean and Empty Pet Pro instead comes with a more conservative number of attachments, including a two-in-one crevice and dusting tool and a motorised pet tool alongside the main floor head. Realistically, that’s all the tools one actually needs for a whole house clean.

While you may think the more accessories the better, you should consider how you plan on storing the attachments. Vacuums like the Shark PowerDetect Clean & Empty IP3251UKT have an optional self-empty station that is fitted with clips to keep all its attachments neatly stored. In comparison, the Dyson V8 Cyclone has quite a frustrating docking station that can only take two accessories. Not only that, but if you store the mini motorised tool then the second port is blocked. On the other hand, the PencilVac allows you to store the tool you aren’t using on the dock, with no issue.

Battery life (cordless models)

Battery life is undoubtedly a key factor to keep in mind when choosing a cordless model, as ideally you’d want a vacuum that can handle a whole home clean on a single battery. Otherwise you’ll have to stop to charge during a clean, which isn’t practical. 

Fortunately, we’ve always been impressed with the battery life across both Dyson and Shark’s cordless vacuums. While the Dyson V16 Piston boasts one of the highest capacities and can last a whopping one hour seven minutes on Eco Mood, and a solid 16 minutes and 26 seconds on Boost, both the V8 Cyclone and Gen5Detect still see a brilliant average battery of 26 minutes. That should be enough to see you through a whole house clean.

Shark models also offer a solid battery life, although generally it tends to be slightly lower than Dyson’s own. For example, the PowerDetect IA3241UKT sees an average of just over 32 minutes with Boost mode resulting in 12 minutes and 17 seconds. In comparison, the Freestyle Pro (SV2000UK) powers for just under 20 minutes while the PowerPro Pet (IZ380UKT) has a pretty low battery of just over 17 and a half minutes. 

While those figures may sound small in comparison, keep in mind your home. If you live in a smaller house or flat then a battery of under 20 minutes should be enough to clean your home.

Maintenance and emptying

Keeping your vacuum well maintained is seriously important, as doing so can significantly improve its lifespan and ensure it works as well as possible. If you’ve noticed your vacuum’s suction isn’t as strong as it once was, visit our guide on how to unclog a vacuum.

Otherwise, it’s worth checking your device’s manual to see whether you can manually remove and clean its filters. Vacuums like the Shark PowerDetect Clean & Empty IP3251UKT and Dyson V16 Piston Animal (alongside many others from the brand) are equipped with washable HEPA filters that can be easily accessed. 

Many cordless vacuums are supported by a self-empty station which, although they are usually sold separately, we would always recommend the extra investment. Take the Shark PowerDetect Speed Clean and Empty Pet Pro IA3241UKT as an example, as its self-empty station sucks all the collected dust into the bag-free bin. Then, when the docking station is full, you simply need to remove and empty it directly into the bin. 

This is much easier than emptying the vacuum cleaner’s 0.47-litre bin which can be a bit fiddly and cause dust to go everywhere. However, the Dyson V16 Piston Animal does sport a clever eject mechanism which is much more streamlined.

However, that doesn’t mean all Dyson vacuums are as easy to empty. For example, while the Dyson PencilVac cleverly compresses collected dust into the handle, emptying it does take some getting used to. Having said that, as long as you point the handle directly into the bin then there shouldn’t be too much of an issue.

Best for pet hair

If you have pets, then you’ll know how quickly hair tends to accumulate on surfaces and floors. Not only that, but you’ll likely have experienced the pretty gross need to manually cut tangled hair from your floor head. Fortunately, many Dyson and Shark models are equipped with anti-hair wrap technology that promises to ensure long and pet hair doesn’t get tangled in floor heads.

Generally speaking, we’ve been impressed with both brand’s anti-hair wrap technology and rarely note an issue. Both cordless and corded models do an admirable job or both picking up hair and ensuring it doesn’t get tangled either. 

Having said that, if one of your main household concerns is dealing with an endless shedding of pet hair, then we’d recommend opting for vacuums that are specifically designed to deal with this. Vacuums such as the Shark Pet Pro not only sport anti-hair wrap technology in its main floor head, but also come with a mini motorised pet hair tool to remove hair embedded from furniture too. Similarly, the Dyson V16 Piston Animal also comes with relevant tools to help remove hair.

SQUIRREL_PLAYLIST_10208537

Verdict: Which brand should you buy?

As shown in our tests, Dyson vacuums generally tend to boast stronger suction power and a longer battery life than Shark’s own – however Dyson cleaners usually come with a considerably higher price tag. In comparison, Shark vacuums have a more modest price tag and are only just shy of meeting Dyson’s specs.

Essentially, this means that deciding between a Dyson and a Shark will boil down to your budget and needs. If you genuinely need the most powerful and battery-efficient vacuum, and have the cash to spare, then a Dyson is an easy recommendation. On the other hand, those with a more modest budget will undoubtedly find that Shark serves them well.

The Amazon Memorial Day sale has arrived – and as an office furniture expert, I’ve selected the 7 best office chair deals in the sale right now, from FlexiSpot, Steelcase, Sihoo, and more – including a bonus Branch chair deal from Best Buy that you won’t want to miss.

• Shop Amazon’s full Memorial Day sale

As TechRadar Pro’s office furniture editor, I’ve been eagerly awaiting the sales. I’m not looking for the cheapest office chairs for Memorial Day – mostly because those $50 desk seats are as uncomfortable as sitting on concrete for eight hours a day. I want to see comfort, value, and core features like lumbar support, all at a price that isn’t breaking the bank.

My top pick would be the FlexiSpot Sentinel for $280 (was $420), which has all the features I look for in an office chair, like breathability and adjustability. But the Branch Ergonomic Chair Pro for $424 at Best Buy and the Sihoo B100 for $160 at Amazon are both excellent choices, too.

The top Memorial Day office chair deals

More of today’s best Memorial Day sales

• Amazon: 45% off TVs, AirPods, air fryers & vacuums
• Apple: iPads, AirPods & MacBooks from $99
• Best Buy: Big tech deals on laptops, office furniture, and more
• Casper: up to 30% off mattresses
• Dell: laptop deals from $249.99
• DreamCloud: up to 60% off mattresses, 66% off bundles
• Home Depot: 40% off appliances, furniture, grills & tools
• Lowe’s: $1,000 off appliances, patio & tools
• Nectar: up to 50% off mattresses, deals from $369
• Saatva: up to $550 off luxury mattresses
• Samsung: up to $1,600 off appliances
• Target: 30% off clothing, patio & furniture
• Walmart: furniture, cheap TVs & vacs from $69
• Wayfair: 50% off furniture, grills, rugs & more

• Vollebak reveals a Sonic Jacket with 180 built-in speakers
• It’s designed to immerse you in frequencies, not music
• The idea is to help get your brain into “entrainment” states

If you saw the jacket worn in the picture above and thought it looked like something out of a sci-fi movie, you’re not wrong. It was designed by a special effects team that’s worked on movies such as The Martian, Dune and Marvel projects. But it’s no costume.

This is a new technological monstrosity from clothing brand Vollebak, which we previously saw release a graphene rain jacket, and quite a few other novel pieces of science-inspired clothing. This is the Sonic Jacket, and it’s a big puffy coat bearing 180 speakers.

As one fourth grader peers over the top of a 300-foot-tall wind turbine, a classmate stands next to surgeons operating in an emergency room. Nearby, another fourth grader shuffles through an autobody shop.

They are not visiting high-risk job sites, at least not in real life.

These experiences are the result of a series of investments into virtual reality in North Dakota.

The state hopes that putting VR headsets with career-focused software in classrooms will eventually boost local employment. While many schools across the country are looking to limit screen time, North Dakota is pushing for increasingly younger students to use these digital tools.

Because North Dakota is largely rural, students’ face significant travel hurdles to visit job sites that could be several hours away, says Mackenzie Tadych, director of Northern Cass School’s college career and readiness program.

The VR investment “was an attempt to engage students at an earlier age and develop an awareness of [the careers] the state has to offer,” says Wayde Sick, state director for the Department of Career and Technical Education. “This is the first glance to show what is out there without throwing a bunch of students on a bus where you drive two hours for a field trip and two hours back.”

Tech to Supplement Lower Resourced Areas

In North Dakota, the virtual reality program works directly with employers in the state in an effort to bring awareness to careers and fields students may be unfamiliar with or have misconceptions about, such as manufacturing.

The statewide program first started in 2023, after the North Dakota state legislature passed a bill that allotted a half-million dollars to the state’s Department of Career and Technical Education to purchase virtual reality headsets that would be used by middle and high schools. Late last year, that was expanded to all elementary schools in the state.

While more traditional career exploration modes – like career aptitude tests – are still used, VR is a way for more children to literally visualize potential new careers. The initiative, which is an expansion on the RUReady ND career exploration program, offers 118 different modules for students through Fargo-based CareerViewXR.

Ann Pollert, a career exploration coach, has a mobile van that visits schools at every level throughout six counties in the northeastern part of the state. Her bus is outfitted with seven headsets and she works on average with five students at a time, helping find their interests and guiding them through the modules.

“I would go into classroom after classroom and give a 50-minute spiel, but they had no visual,” Pollert, a former diesel technician recruiter, says. “With this, I could take it to the school and show those kids what it means to replace an excavator. It helps me identify the students I need to further encourage.”

She says the headsets as a whole are not meant to replace guidance or career counselors, particularly in high schools. As those counselors find themselves with increasingly higher workloads and less time, this is seen as a supplement.

“We still need career counselors, work-based learning counselors and great teachers that notice something about a student, saying, ‘You would be good at this,’” Pollert says, adding that some smaller schools do not have the resources for those counselors. “It’s everything together to make it work. It’s not the van that’s solving the problem.”

So, is it working?

Future Tech — And Potential

Sick, the state director, says it’s too early to measure the impact of these programs, including whether it’s increased the number of students staying in the state to work post-graduation.

Most of the efforts are focused on students who have yet to graduate high school, he points out. But he does believe this program serves as a starting place for younger students to explore their interests at an early age.

“In my eyes, this content is most important for elementary and middle school-aged kids, so the high school students have seen those experiences, have an idea of what they want to pursue and can do so in a series of courses based on what they have seen in virtual reality as a fifth or sixth grader,” he says.

Sometimes in VR, the students find what they dislike.

Tadych, of Northern Cass School, recalls a student vehemently reacting to a virtual reality module that placed them in a high-stress operating room.

“It’s just as beneficial being able to find what you don’t want to do,” she says, adding that the district also requires students to job shadow before graduation, following around professionals as they go through their work day.

And as the VR experiences get more lifelike, students will get more useful information about possible careers.

For example, Sick believes the technology could evolve down the road to include augmented reality, where students would be able to more fully interact with their environment. He believes the interactions will not only alert children of more local career opportunities, but keep them in the state upon graduating.

“We’re a rural state, and my goal is to make sure every student has the best experience they [can] have, to find what they should become, and try to help them figure it out sooner,” he says. He adds that the only way to do that is to provide a rich variety of experiences that start at the elementary level.

RAG architectures are good at one thing: surfacing semantically relevant documents. That’s also where they stop.

A framework called a decision context graph addresses that gap by giving agents structured memory, time-aware reasoning, and explicit decision logic. Rippletide, a startup in the Neo4j ecosystem, has built one. The key capability: agents that are non-regressive, able to freeze validated sequences of actions and compound on them over time.

“The key point you want is non-regressivity: How do you make sure that, when the agent will generate something new, you can compound on the previous discoveries?” said Yann Bilien, Rippletid’s co-founder and chief scientific officer. 

Why RAG doesn’t go far enough

Enterprise context is sprawled across ERP tools, logs, databases, vector stores, and policy documents. Generative AI tools can retrieve from all of it — through keyword search, SQL queries, or full RAG pipelines — but retrieval has a ceiling.

Notably, data retrieved may not be relevant to the decision at hand (thus causing hallucinations); and, even if agents do pull the right data, they often lack guidance to make decisions backed by a strong rationale.

That is, RAG retrieves documents, not decision context. “Everyone starts with RAG: Pull relevant docs, stuff them in the prompt, let the model figure it out,” said Wyatt Mayham of Northwest AI Consulting. 

While that works fine for chatbots, it “breaks immediately” for agents that need to make decisions and take actions, he pointed out. “The biggest thing builders struggle with is the gap between retrieval and applicability.” 

A retrieved document doesn’t tell the agent whether it still applies, whether it’s been superseded, or whether there’s a conflicting rule that takes priority, Mayham said. “Agents need decision context, not just information.”

In construction (the human world), that might mean knowing that a pricing exception expired, that a safety policy only applies in certain jurisdictions, or that a standard operating procedure was updated a month prior. “Miss any of that, and the agent confidently does the wrong thing,” Mayham said. 

Without structured decision context, agents combine incompatible rules, invent constraints to fill gaps, and rely on what Bilien calls “probabilistic guesses over unbounded data.” Errors are difficult to reproduce because builders can’t trace why the agent made a given choice.

The compounding error problem is real, too, Mayham said: A small miss rate per step becomes “catastrophic” across a multi-step workflow. “That’s the main reason most enterprise agents never leave the pilot phase.” 

How decision context graphs get to the relevant answer 

A decision context graph solves this by encoding a structured map of what is applicable, what the rules are, and when they apply.

The framework is optimized for one question: “Given this situation, which context applies right now?” Time is treated as a first-class dimension; every rule, decision, and exception is scoped to when it is valid.

“The goal is to explicitly address missing, incoherent, or contradictory data when building the graph to avoid probabilistic [errors] once the agent is running,” Bilien said. 

The system is built around three principles:

• Applicability: Logic is explicitly encoded so the agent knows what rules to remember and apply in a given situation. Context is returned only when it is relevant to the situation. 

• Time‑aware memory: Every rule, decision, and exception is time-scoped. This allows agents to reason about “What was true then versus what is  true now,” then reproduce or explain its decisions.

• Decision paths: The system can explain how it got from A to B and the “why” behind its rationale (for instance, why one piece of context was included and another was not). Agents are given “decision path” examples of how similar cases were handled before. 

At setup, unstructured data is ingested and structured into an ontology: what entities exist, what rules apply, what counts as an exception. Neuro-symbolic AI handles the pattern recognition and encodes formal, machine-readable logic. Over time, the system refines its knowledge base as new decisions are made.

“Neuro-symbolic brings two parts: A neuronal part giving a large autonomy to agents and a symbolic part to reduce the number of data needed and bring control,” Bilien said. 

The agent is tested at build time (pre-production) to validate its behaviors or pinpoint improvements. This reduces risks as well as computation needs during inferencing, he noted. 

Agents learning, rather than regressing 

When it comes to non-regression, the key piece is compounding both on intelligence (models) and on knowledge (shared between agents), Bilien said. It’s important that agents can explore; when they don’t know how to accomplish a task, they can attempt different possibilities, typically in a controlled environment or simulation (like a support bot trying multiple response patterns). 

Then, “once a solution is evaluated as satisfactory, the graph freezes that sequence of actions,” Bilien said. Future exploration then starts from this “stable base of validated behaviors” to prevent newly-acquired skills from overwriting previously learned good behavior. 

Before an agent acts or affects a customer, it checks against the graph: Is it violating a rule? Hallucinating? Staying within constraints? Can it generalize the solution across similar cases?

At a macro level, the system assesses outcomes: Did the behavior improve long-term performance? Did it generalize across similar contexts? Did it preserve previous capabilities?

“This determinism is key for agents to run reliability at scale,” Bilien said. It leads to behavior that is more consistent, predictable, explainable, and allowing for stronger control and auditability. 

“You want your agents to be able to learn by themselves when they face something they don’t know,” he said. “You want them to be able to explore and find new solutions.”

Getting beyond “episodic” memory

While the team initially assumed it would deploy RL everywhere, “that actually proved very difficult in an enterprise setting,” Bilien said. “Data are scarce for some specific use cases and messy for others.”

Typically, using raw data for reliable predictions has been a manual and time-consuming challenge, but “now with agents we entered a new era where building ontologies is possible automatically,” Bilien said. 

Classic supervised fine-tuning methods can lead to oscillations, when models forget the last skill they learned while learning the next tone. Overall, learning is not compounded, compression is “dramatic,” and models improve “episodically” rather than continuously, leading them to continually fail on new or unseen tasks. 

As Bilien noted: “You will never have a fully self-learning model if you are regressing every time.” 

In enterprise use cases — like banking where millions of transactions are processed a day — a high level of reliability is critical, he noted. “One question I ask all customers: Is 95% enough? In a lot of use cases, it’s not. You need 99.999%. 1% off is way too much.” 

Decision context graphs can close that gap, he contends: When the same customer support question is asked repeatedly, the agent will return a “satisfactory” answer predictably and without regression, all while retaining autonomy. 

Encoding applicability and temporal validity into a structured graph — rather than relying on an LLM to infer it — is a “sound approach” to a real limitation in existing retrieval frameworks, Mayham said. The open question is whether the automatic ontology generation holds up against the messy, diverse data that enterprises actually have. “That’s always the hard part,” he said.

Drupal has announced a “core security release” scheduled for later today, warning that threat actors might develop exploits within hours of the update disclosure.

Administrators are urged to reserve time for core updates on May 20 between 17:00 and 21:00 UTC. Website administrators running versions 8 or 9 are strongly recommended to upgrade to at least version 10.6.

The Drupal content management system (CMS) is very popular among large organizations as well as in the government, education, and healthcare sectors.

According to the public service announcement, the vulnerability affects Drupal core versions 8 and later, but the advisory clarifies that not all configurations are impacted. Security updates will be available for the following versions:

• Drupal 11.3.x
• Drupal 11.2.x
• Drupal 11.1x
• Drupal 10.6.x
• Drupal 10.5.x
• Drupal 10.4x

Drupal notes that, although versions 11.1x and 10.4x are no longer supported, fixes will still be provided for them due to the severity of the security issue; administrators should update to Drupal 11.1.9 and 10.4.9.

Drupal 8 and 9, which have reached end-of-life, will receive no patches, but hotfix files will be published for versions 9.5 and 8.9, allowing remediation for those running versions 9.5.11 or 8.9.20.

Sites using Drupal Steward are already protected against known attack vectors. An update is still recommended, though.

No technical details about the vulnerability were disclosed, and any information that may appear online about it could be fraudulent, intended to trick admins into taking risky actions. Hence, caution is advised.

“Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made,” warned Drupal.

Drupal website administrators should continue to monitor the platform’s official security portal throughout the day for more information and prepare to apply the security update as soon as it’s made available.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Download Now

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and authorship platform.

The threat group TeamPCP, formally tracked by Google Threat Intelligence Group as UNC6780, claimed responsibility and is advertising the stolen repositories for sale starting at $50,000. GitHub’s assessment: the attacker’s claim is “directionally consistent” with the investigation so far. Trend Micro, StepSecurity, and Snyk have formally tracked TeamPCP across at least seven waves of the Mini Shai-Hulud supply chain worm since March.

The GitHub breach did not land in isolation. It arrived the same day a new Mini Shai-Hulud wave forged valid cryptographic provenance on 639 malicious npm package versions, one day after attackers compromised a VS Code extension with 2.2 million installs, the same day Wiz discovered TeamPCP had compromised Microsoft’s durabletask Python SDK on PyPI, and the same morning Verizon’s 2026 DBIR revealed that 67% of employees access AI tools through non-corporate accounts. Five supply chain surfaces failed in 48 hours. Two more AI-agent attack classes were disclosed the same month that completed the grid. One group connects at least three of them.

GitHub confirms the breach, names the attack vector, and the attribution trail is long

“Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately,” GitHub posted in a five-post thread on X on May 20. “Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. [Emphasis added by VentureBeat] The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.” GitHub added that critical secrets were rotated overnight with the highest-impact credentials prioritized first.

GitHub’s confirmation narrows the attack vector to a single employee device but leaves the blast radius expanding. The company has not named the specific extension. Internal repositories contain infrastructure configurations, deployment scripts, staging credentials, and internal API schemas. Source code access at that level is not a data breach. It is an infrastructure intelligence leak.

Dark Web Informer reported that TeamPCP’s listing appeared on a hacking forum hours before GitHub’s initial disclosure, advertising around 4,000 private repositories. Hackmanac independently confirmed the listing. An X account linked to TeamPCP, xploitrsturtle2, posted after GitHub’s confirmation: “GitHub knew for hours, they delayed telling you and they won’t be honest in the future. What an amazing run, it’s been an honor to play around with the cats over the past few months.”

Google Threat Intelligence Group formally tracks TeamPCP as UNC6780, a financially motivated threat actor specializing in supply chain attacks targeting open-source security utilities and AI middleware. Trend Micro tracked “at least seven confirmed waves” spanning Trivy (March 2026), Checkmarx KICS, LiteLLM, elementary-data, Bitwarden CLI, TanStack (May 11), and Mistral AI (May 12). StepSecurity, Snyk, and Trend Micro assess high confidence on the Trivy, Bitwarden CLI, and TanStack waves based on toolchain overlap. GitHub’s May 20 confirmation that the breach came through a poisoned VS Code extension aligns with the exact attack surface TeamPCP weaponized throughout 2026.

Binance co-founder CZ posted immediately: “If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets.” Mike Riemer, CTO of Ivanti, told VentureBeat in an exclusive interview that Azure’s honeypot network now shows known vulnerabilities exploited in under 90 seconds. Stolen credentials shorten the recon phase that precedes exploitation. Every GitHub-side secret that reaches a buyer accelerates whichever attack path that buyer was already running.

The worm that forges its own provenance badge

Hours before GitHub’s disclosure, Endor Labs detected 42 malicious npm packages published between 01:39 and 02:06 UTC on May 19. Socket’s broader tracking put the full wave at 639 malicious versions across 323 packages inside Alibaba’s @antv data visualization ecosystem, roughly 16 million weekly downloads.

This wave introduced provenance forgery. The worm now calls Fulcio and Rekor at runtime to generate valid Sigstore signing certificates for every package it propagates to. Provenance tooling shows a green badge. The build chain belongs to the attacker. “The attestation proves where the package was built. It does not prove the build was authorized,” Endor Labs stated.

Peyton Kennedy, senior security researcher at Endor Labs, told VentureBeat that “TanStack had the right setup on paper: OIDC trusted publishing, signed provenance, 2FA on every maintainer account. The attack worked anyway. Each wave has picked a higher-download target and introduced a more technically interesting access vector.”

Late on May 12, vx-underground reported that TeamPCP open-sourced the fully weaponized Shai-Hulud worm code. Copycat variants have already appeared, complicating attribution. Kennedy provided VentureBeat a first-pass detection check: run find . -name ‘router_init.js’ -size +1M across project directories and grep for the hash 79ac49eedf774dd4b0cfa308722bc463cfe5885c in package-lock.json. If either returns a hit, isolate and image the machine before revoking any tokens. The worm’s destructive daemon triggers on revocation.

GitHub Actions tags redirected to imposter commits the same day

Also on May 19, threat actors compromised the popular GitHub Actions workflow actions-cool/issues-helper by redirecting every existing tag in the repository to an imposter commit that does not appear in the action’s normal commit history. “That commit contains malicious code that exfiltrates credentials from CI/CD pipelines that run the action,” StepSecurity researcher Varun Sharma said. GitHub has since disabled access to the repository.

The exfiltration domain (t.m-kosche[.]com) matches the @antv Mini Shai-Hulud wave, tying the two clusters together. Only workflows pinned to a known-good full commit SHA were unaffected.

The worm jumped to Microsoft’s own Python SDK the same day

Hours after the @antv wave, Wiz detected that TeamPCP had compromised durabletask, the official Microsoft Python client for the Durable Task workflow execution framework. Three malicious versions (1.4.1, 1.4.2, and 1.4.3) were published to PyPI within a 35-minute window on May 19. The attack chain was direct: a GitHub account compromised in a previous TeamPCP operation still had access to the microsoft/durabletask-python repository. The attacker dumped GitHub Secrets, extracted a PyPI publishing token, and pushed the infected releases directly. PyPI quarantined all three versions.

StepSecurity’s analysis found the payload downloads a 28 KB dropper (rope.pyz) that steals credentials from AWS, Azure, GCP, Kubernetes, and over 90 developer tool configurations, then spreads laterally through cloud infrastructure. The payload skips systems with a Russian locale. The durabletask package averages over 400,000 monthly downloads.

VS Code extensions breached GitHub itself, and that is not even the first compromise this week

On May 18, attackers published a compromised version of the Nx Console VS Code extension, installed more than 2.2 million times. The malicious version harvested tokens from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, and specifically targeted Claude Code configuration files under ~/.claude/settings.json. The Nx team removed it within 11 minutes. Any developer who opened a workspace between 12:36 and 12:47 UTC ran the credential stealer. One day later, GitHub confirmed that a different poisoned VS Code extension was the entry point for the 3,800-repo breach of its own internal infrastructure.

As one X user framed it: “Microsoft’s GitHub was compromised when a Microsoft developer using Microsoft VSCode installed a rogue extension from Microsoft’s VSCode extension library, which is moderated and hosted by Microsoft.” The entire attack chain stayed inside one vendor’s ecosystem. Developers have been reporting malicious VS Code extensions to Microsoft for years. A publicly documented complaint from December 2024 asked Microsoft to fix the marketplace. Eighteen months later, the marketplace was the entry point for a breach of GitHub itself.

AI coding agents treat trust dialogs as features, not security events

Adversa AI’s TrustFall research, published May 7, tested Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI. “A repository can ship a configuration that auto-approves and immediately launches an MCP server, no tool call from the agent is required,” researcher Rony Utevsky told Dark Reading. All four default to “Yes/Trust.” The Managed scope configuration that could lock this down is “rarely used.” When Claude Code runs headless through GitHub Actions, the trust dialog never renders.

PR comments became agent instructions

Aonan Guan, alongside Johns Hopkins colleagues Zhengyu Liu and Gavin Zhong, typed a malicious instruction into a PR title and watched Anthropic’s Claude Code Security Review action post its own API key as a comment. The same prompt injection worked against Gemini CLI Action and GitHub’s Copilot Agent. Anthropic classified it CVSS 9.4 Critical.

Prompt injection reaches eval() through legitimate API calls

Microsoft disclosed CVE-2026-26030 and CVE-2026-25592 on May 7, both critical in Semantic Kernel. The Python SDK flaw let a crafted prompt achieve host-level remote code execution. The .NET SDK flaw turned an accidentally exposed file-transfer helper into a tool the AI model could invoke, enabling sandbox escape from Azure Container Apps.

Social channels deliver the payload where EDR has no signal

CrowdStrike’s 2026 Financial Services Threat Landscape Report, released May 14, quantified identity theft scaling outside developer toolchains. DPRK-nexus actors stole $2.02 billion in digital assets in 2025, a 51% year-over-year increase. PRESSURE CHOLLIMA conducted the largest single financial theft ever reported: $1.46 billion through trojanized software distributed via supply chain compromise. FAMOUS CHOLLIMA doubled its operations using AI-generated identities. STARDUST CHOLLIMA tripled its tempo. The primary delivery channels: WhatsApp and LinkedIn, where EDR has no signal.

“Financial services organizations face threats from every direction, and AI is making each of them harder to stop,” Adam Meyers, senior vice president, counter adversary operations at CrowdStrike, said in the report. “Adversaries are using AI to compress the time from initial access to impact, moving through trusted paths faster than legacy defenses can respond.” His 2026 Global Threat Report found 82% of detections in 2025 were malware-free. The average eCrime breakout time fell to 29 minutes, with the fastest observed at 27 seconds.

Riemer told VentureBeat the same dynamic applies to developer toolchains. “Bad guys are pivoting to what’s the next weakest link. Let me get somebody’s house key, and I can make it through the back door.” Stolen developer identities are the house key.

Shadow AI usage tripled in one year

The Verizon 2026 DBIR found that 45% of employees are regular AI users, up from 15% last year, with 67% accessing AI through non-corporate accounts. Third-party involvement in breaches jumped to 48%.

The Developer Tool Stolen-Identity Audit Grid

No single surface in this grid qualifies as a zero day. Chained together, they function like one. “I can take a whole bunch of little things and chain them together and get the same level of access,” Riemer told VentureBeat. “That’s what AI does very, very well.”

Seven surfaces. One group confirmed across at least three of them, with open-sourced tooling enabling copycats across the rest. Kayne McGladrey, IEEE Senior Member, told VentureBeat that organizations are “defaulting to cloning human user profiles for agents, and permission sprawl starts on day one.” The compliance frameworks enterprises rely on were written for humans. Agent identities do not appear in any control catalog McGladrey has encountered.