The first Zipline drone deliveries for Uber Eats orders will start later this year.

Enterprise AI has a new infrastructure problem: companies are accumulating agents faster than they are developing systems to govern them.

Gartner estimates that the average global Fortune 500 company will have more than 150,000 AI agents in use by 2028, up from fewer than 15 in 2025. Yet only 13% of organizations believe they currently have the right AI agent governance in place, according to the research firm.

That widening gap is creating a market for infrastructure that sits above individual models and agents — handling execution, permissions, observability, memory, access to enterprise systems and lifecycle management without forcing developers to reconstruct those services for every new agent.

xpander.ai, a startup founded by three former AWS principal engineers, is the latest company trying to own that layer.

The company is making its enterprise AI agent platform generally available today, positioning it as a vendor-neutral control plane for building, running and governing agents across different models, agent frameworks and infrastructure environments.

In an exclusive interview with VentureBeat, xpander.ai CEO and co-founder David Twizer said the company increasingly hears three problems from enterprise customers: agents running locally without centralized governance, agent workflows remaining isolated to individual users, and infrastructure becoming tied to a single AI provider.

“The third issue is the most critical part: it’s being locked into one vendor,” Twizer told VentureBeat. “Everything that you do is actually owned by the company that you chose to work with — their tools, their roadmap, their political view of how agents should react to everything that you do.”

The caveat is that xpander’s vendor neutrality does not eliminate dependency; it moves the dependency up the stack. Enterprises can swap models, frameworks and infrastructure underneath xpander, but xpander’s proprietary Universal Harness and control plane become the layer coordinating execution, governance, identity, memory and auditability.

That could create a new form of lock-in if those configurations and operational state are difficult to migrate to another control plane. xpander’s public documentation does not yet explain how portable that layer is if a customer terminates its enterprise license.

The company is also announcing a $7.5 million seed round led by Pico Venture Partners, with participation from Emerge Ventures, Samsung Next and SeedIL.

But xpander is entering a market that has evolved considerably beyond a simple divide between proprietary hyperscaler platforms and neutral alternatives.

The battle is shifting above the model

Model portability is becoming increasingly common in agent infrastructure.

LangChain’s LangSmith Deployment, for example, provides infrastructure for deploying and governing production agents. Enterprises can run its control plane and agent servers entirely inside their own Kubernetes infrastructure, including for air-gapped and data-residency-sensitive environments. LangChain also offers hybrid deployments in which the customer operates agent servers while LangChain manages the control plane.

CrewAI is moving in much the same direction. Its enterprise offering includes centralized governance, SSO, role-based access controls, workload identity and policies, while supporting deployment in CrewAI’s cloud, a customer’s VPC or customer-owned infrastructure. CrewAI says its platform can work across models and clouds and lets customers retain and modify the code generated for their agents.

Temporal approaches the problem from another direction. Rather than offering an end-to-end agent management environment, it provides durable execution for long-running AI workflows, including crash recovery, retries, human approvals and state that can persist through failures. Its AI platform can orchestrate workflows across different models, tools and systems.

Meanwhile, the model and cloud vendors themselves are expanding upward into this infrastructure layer. OpenAI’s Frontier platform provides shared enterprise context, permissions, agent execution and management, while Google’s Gemini Enterprise Agent Platform combines managed runtime infrastructure with agent identity, centralized governance, memory, tracing and policy enforcement around agent-to-agent and agent-to-tool interactions.

In other words, xpander’s differentiator cannot simply be that enterprises can run agents outside one model provider’s cloud. Several competitors already offer versions of that flexibility.

Its bigger bet is that enterprises will want a framework-independent control plane sitting above an increasingly heterogeneous collection of models, agent frameworks and employee-facing AI interfaces.

Twizer’s argument draws partly on his seven years at AWS, where he watched enterprises wrestle with a previous generation of infrastructure lock-in.

“Our strategy was to bring the great thing called cloud computing and then try to create solutions that are serverless and, by definition, create vendor lock-in,” Twizer told VentureBeat. But, he said, enterprises ultimately demanded the ability to move workloads among providers.

“I think AI is no different,” he said. “Multi-cloud, multi-vendor is a must-have strategy.”

A runtime intended to survive model churn

At the center of xpander’s platform is what it calls a Universal Harness — a model-, framework- and cloud-agnostic runtime for executing agents as portable enterprise workloads.

Companies can use xpander’s hosted environment or, under its enterprise offering, self-deploy on Kubernetes or on-premises infrastructure. The company also explicitly lists AWS, Google Cloud, Microsoft Azure, private VPCs and fully air-gapped on-premises environments as supported deployment targets.

The framework claim is similarly broad: xpander says customers can bring agents built with frameworks including LangChain, Strands and Agno, as well as their existing prompts, rules and skills. It supports proprietary, open-weight and customer fine-tuned models.

For developers, xpander exposes three main integration routes: a language-agnostic REST API for control-plane operations, a Python SDK for building agents and workflows, and Model Context Protocol support that exposes agents and tools to MCP clients such as Claude Desktop and Cursor. The REST interface includes operations for managing and invoking agents, tasks and knowledge bases, while the SDK adds event handling and agent lifecycle abstractions.

“Think like a Kubernetes environment that runs inside your own premises, your private cloud or our xpander cloud,” Twizer told VentureBeat. “The harness that is agnostic can run any agent of any vendor.”

Twizer said the goal is eventually to make model selection more analogous to choosing compute underneath an application than committing an organization to an entire software ecosystem.

“You can go from Claude to ChatGPT to Kimi and to your own fine-tuned models,” he said. “All of them will be used in the same way that you use CPUs. You don’t really care who makes them. You just want your application running.”

That architecture is intended to let the underlying workloads change while the orchestration and operational layer remains relatively stable.

The distinction could become more important as enterprises use more than one AI supplier. OpenAI itself says enterprise AI is shifting from assistance toward delegated work performed by agents, with its latest enterprise data showing rapidly growing agentic usage across functions including legal, sales, recruiting and marketing.

At the same time, Google is adding centralized agent governance, identity and gateway controls specifically to manage interactions between agents and tools at scale. Those investments from much larger vendors reinforce xpander’s basic premise: managing the model is increasingly only one part of putting agents into production.

What ‘governance’ means in practice

Twizer argues that locally running agents make that operational problem particularly acute.

“You install Claude or ChatGPT or Codex or any other AI system that runs on the employee laptop, and you get a black box,” he told VentureBeat. “Nothing is governed, nothing is audited, and nothing is controlled.”

His concern is not simply that an agent can access local resources, but that AI products have rapidly moved from generating text to taking actions without enterprises necessarily building equivalent governance infrastructure around them.

“It happened overnight that the shift from, ‘Here is the chatbot that helps me write an email,’ became, ‘It is an AI agent that can control my machine and perform API calls,’” Twizer said.

xpander’s documentation provides a more concrete definition of what the company means by moving that activity into a governed environment.

The control plane can define who is allowed to run an agent, which resources the agent can reach and which actions require human approval. xpander says agents receive named identities and actions can be traced back to the human who invoked them. Tool calls, runs, traces, approvals and failures are logged, with spending attributable at the task level.

One particularly relevant architectural detail for security teams is credential handling. xpander says credentials are injected from a vault when a tool call executes, rather than being exposed directly to the model.

The company says it is SOC 2 Type II certified and GDPR compliant. Its enterprise tier also includes SSO and OIDC, a private model gateway and sub-organizations with per-team usage attribution.

Where xpander is trying to separate itself from products such as LangSmith and CrewAI is in treating the underlying agent framework itself as another replaceable component rather than making its own framework the primary development environment.

The company says its runtime can operate xpander-native agents alongside custom agents built with other frameworks. That broader framework neutrality is a company claim and will need to prove itself in production; the overlap among these platforms is already substantial.

The cost of building the agent layer yourself

For enterprises that want centralized control without adopting another vendor’s infrastructure, the alternative is increasingly to assemble many of these components themselves.

Twizer argues that this is where the hidden cost of production agents emerges. Accessing a foundation model is comparatively straightforward; recreating the operational infrastructure surrounding a sophisticated managed agent is not.

“If you want to do something like the amazing [Anthropic] Claude Code in a way that is governed and secure, you need to build the entire harness,” Twizer told VentureBeat. “You need to build the sandbox and the authentication and the human in the loop and the storage and the session management and the memory layer.”

“It’s like investing two years of infrastructure just to run that agent in a secure way,” he added.

The company’s documentation says its harness handles long-horizon and multi-tool tasks, sandboxed code execution, persistent memory and recovery when tasks fail or drift. That is important context for Twizer’s argument: xpander isn’t merely offering a gateway that swaps one model API for another; it is attempting to package many of the runtime services enterprises otherwise have to operate alongside those APIs.

Twizer said xpander has heard from government organizations and financial institutions using its technology in production that this infrastructure burden was preventing them from deploying agents in a controlled way.

The company’s website separately displays logos for organizations including Lenovo, Intel, Workday, Siemens, Nvidia, Intuit, SAP, PagerDuty, Mozilla and Salesforce under the label “Used by teams at.”

The company’s answer is not that enterprises should abandon products from Anthropic, OpenAI or other AI providers. Twizer instead argues that companies should retain those models while moving permissions, monitoring and execution into an infrastructure layer they control.

“It’s not, ‘Don’t use Claude,’” he said. “It’s actually, ‘Use Claude, but in a way that you watch it, that you secure it, that you monitor it,’” with controls over authorized skills and who can access particular resources.

Making agents organizational rather than personal

xpander is also adding a collaboration layer it calls Multiplayer AI.

The premise is that enterprise agents increasingly need to outlive a single user’s chat session. A workflow might involve an agent collecting data, another system taking an action, an employee approving it and a different team resuming the process hours or days later.

Twizer argues that locally deployed assistants have another disadvantage: the expertise employees accumulate through their agents — prompts, skills, workflows and context — tends to stay with those individuals.

“You’re making the AI agents better, and you’re not making the company better,” he told VentureBeat. “All the data, all the prompts, all the workflows, all the skills that you are now investing in that ecosystem are being locked inside that vendor, and it’s very hard to share it with other colleagues.”

More complex enterprise work also rarely maps neatly onto a single chat session.

“Work is not single player. It’s multiplayer,” Twizer said. “It’s happening over the period of multiple days, even weeks. Workflows that are significant to enterprises are not chatbots.”

xpander’s shared conversations are designed to keep those interactions in persistent, permission-scoped threads. An agent can be published once for use across an organization, while employees can interact with agents through Slack, Teams, ChatGPT, Claude and xpander’s own interface.

The company’s documentation says downstream actions can identify as the human who invoked the agent through end-to-end authentication using OIDC — a potentially important distinction for organizations that need to preserve user-level identity and authorization as work moves through an agent.

The requirement for persistent execution is not unique to xpander. Temporal has made long-running, failure-resistant workflows the core of its AI pitch, while LangSmith supports persistent agent deployment and production observability.

What xpander is attempting to combine is that runtime infrastructure with enterprise collaboration and governance into a single, portable, flexible, vendor-neutral control plane.

Omni tests the harness thesis

The company is also making Omni, its prebuilt agent, generally available.

Calling Omni simply a general-purpose agent understates what xpander is now selling. Its documentation describes Omni as an AI forward-deployed engineer that turns a requested business outcome into what the company calls an “Agentic Application”: a backend agent coupled with a frontend experience that can include chat, interactive UI components, reports, dashboards and visualizations.

A user can describe the desired outcome, after which Omni is designed to help construct the application, connect its model, skills, tools and data, execute work as tracked tasks, and maintain files and reusable context in an Agent Workspace. The resulting application can then be shared with teammates.

For example, xpander’s documentation shows a user asking Omni to build a Redshift Analyzer. Omni is intended to gather the requirements, design the interface, construct the backend agent, attach appropriate connectors and tools, and generate the first live application surface.

The documentation also lists Slack, WhatsApp, Telegram and email as Omni channels, while xpander’s broader platform materials list Teams, Claude, ChatGPT, API, webhook, CLI and MCP among the ways work can reach agents. Because the company’s materials describe slightly different channel sets for Omni and the broader platform, enterprises should verify support for their particular interface and deployment configuration.
Omni can also function alongside desktop AI products rather than replacing them. Twizer said employees can continue using their preferred desktop agents while Omni acts as a skill exposing only enterprise-approved data and connectors. When background execution is needed, Omni can create a centrally controlled agent to perform the work.

xpander says Omni scored 90.9% on the GAIA benchmark, including strong performance on its most difficult tasks. The result is company-reported and should be viewed as evidence for xpander’s broader thesis rather than independent validation of the platform.

Twizer said the company deliberately tested the harness with a mixture of models rather than optimizing around a single proprietary system.

“We took Opus, we took Sonnet, we took Kimi, we took GPT, and on that benchmark we got a 90.9% score,” he told VentureBeat.

For Twizer, the result supports an argument that agent performance increasingly depends on the infrastructure surrounding the foundation model.

“It just proves that the value is in the harness layer and not in the model layer,” he said. “The value is in: How do you handle long-running tasks? How do you handle tool calling? How do you do sandboxing? How do you focus? How do you make the agents focused on the task?”

The benchmark results are publicly available, allowing others to examine the company’s methodology, but the broader conclusion remains xpander’s interpretation of its own results.

That thesis is increasingly shared across the industry. The disagreement is over who should control that layer.

OpenAI and Google are turning it into part of broader AI platforms. LangChain and CrewAI are extending their development ecosystems into enterprise runtimes. Temporal is attacking the execution problem as infrastructure.

xpander is betting enterprises will instead want that control plane to remain independent of all three choices: model, cloud and agent framework.

The company now has to demonstrate that the extra abstraction is valuable enough to justify another platform in an enterprise AI stack that is already becoming crowded.

Pricing and Availability

xpander’s platform and Omni are generally available now, with two substantially different commercial models for teams using xpander’s hosted service and enterprises running the platform on their own infrastructure.

The self-service Team offering has no seat charge and is priced in credits based on agent activity. xpander defines one credit as one cent, meaning $100 buys 10,000 credits. Each event or message that wakes an agent costs one credit for the entire turn, regardless of how long the turn runs, and each tool or API call costs another credit. Model tokens are billed separately in credits at configured rates for the selected model.

That makes the cost structure more granular than Twizer’s description of paying for agent “output” might suggest. Long-running execution itself does not appear to create a duration-based charge under the published pricing, but a workflow can accumulate costs through repeated invocations, tool calls and model-token consumption.

New accounts receive 1,000 free credits rather than a time-limited free trial, and customers can sign up with a credit card. The Team tier permits unlimited agents, workflows and seats, according to xpander.

Model usage can represent a significant portion of total cost, and the company publishes examples intended to make that expense calculable. Its pricing page lists different input and output token rates for individual models and says those model charges are incorporated into the credit system, eliminating a separate model-provider bill for hosted customers. Actual spending therefore depends heavily on the models selected, token volumes and number of tool calls.

Enterprises that self-host get a different arrangement. xpander’s Enterprise plan is an annual license starting at 50 agents and supports deployment on a customer’s Kubernetes infrastructure or on-premises environment. It includes SSO and OIDC, sub-organizations with pooled credits and per-team usage reporting, private model-gateway connectivity, onboarding and Tier 1 support. Customers can also bring their own model API keys and use their own negotiated model-provider rates.

xpander does not publish the dollar price of that annual enterprise license, so prospective customers cannot calculate the total cost of a private or air-gapped deployment from public information alone. The pricing materials also do not provide a public dollar figure for the 50-agent starting commitment. Those deployments require contacting xpander for custom pricing.

“You pay only for the work that the agent is doing,” Twizer told VentureBeat of the hosted model. “No subscription fee, no seat fee, no builder seat, nothing. You just pay for the actual output of the agents.”

For enterprise buyers, that distinction is important: xpander’s no-seat-fee claim applies most straightforwardly to its usage-based hosted offering. Organizations that need to own the deployment environment are instead evaluating an undisclosed annual license, infrastructure costs and their own model-provider spend.

That leaves xpander with a straightforward but increasingly contested pitch as enterprises confront agent sprawl: keep using whichever models, frameworks and interfaces employees find useful, but move the infrastructure controlling what those agents can do into a common layer the organization can govern.

Whether enterprises ultimately want that layer from an independent startup, an agent framework company or the same hyperscalers and model providers xpander wants to abstract away is now becoming another battleground in the enterprise AI stack.

How xpander compares with other agent infrastructure

The overlap becomes clearer when the products are compared directly. Several rivals now support multiple model providers, customer-controlled infrastructure or both. The differences increasingly concern how much of the agent stack each platform attempts to own — and whether it provides an agent development framework, a neutral runtime, durable workflow infrastructure or a collection of managed cloud services.

The comparison complicates a simple vendor-neutrality pitch. AWS AgentCore, for example, supports models outside Bedrock and frameworks including LangGraph, CrewAI and Google’s ADK, while LangSmith explicitly calls itself framework agnostic. CrewAI offers customer-controlled deployments and broad model choice. Temporal lets companies self-host the durable execution layer entirely, although it solves a narrower infrastructure problem rather than offering a complete agent control plane.

That makes xpander’s potential differentiation more specific. It is trying to combine framework and model portability with enterprise identity, governance, runtime infrastructure and an employee-facing collaboration layer, rather than competing only on the ability to swap models or deploy outside a vendor’s SaaS environment. xpander also prices its hosted platform around individual agent wakes and tool calls rather than seats, although enterprises requiring self-hosting face an undisclosed annual license beginning at 50 agents.

That excitement has stuck around for almost two weeks and counting. My son loves tapping the round corner checkbox to complete his routine items. I do have to remind him sometimes that he hasn’t yet completed something, which prompts him to uncheck the box and complete the task with me, like putting on pajamas, and then running to check it off again. His favorite part is clicking all the tasks as done and seeing a shower of emojis (which change each time) rain down as recognition of a job well done. He likes to activate that congratulatory feature before he actually finishes the tasks, just to see it. Then he un-clicks the unfinished tasks so that he can make the emojis rain again upon actually finishing his list. I get the appeal—I wish my laptop’s Notes app did this when I finish my long to-do list each day.

Photograph: Nena Farrell

Video: Nena Farrell

If you have a Skylight Calendar, it’s nice that the Buddy syncs to it. This capability lets your kid alternate between where they physically check off their tasks—and all changes are reflected on both devices. This is convenient if you have a multi-floor layout, as I do, because running upstairs to check off a morning task may become more of a hindrance than a help.

Speaking of the larger Skylight Calendar, if you have one in your home like I do, I recommend opting into the Skylight Plus subscription. This gets you the photo frame feature, plus other capabilities, like rewards and meal planning. With the Skylight Buddy, a subscription gets you rewards, timers, and nudges, though the company shares that more subscription features are coming soon. Rewards are definitely handy for older kids who can earn stars for tasks and chores, but I just want my 4-year-old to get excited about completing the tasks. So far, he hasn’t needed any extra features to stay engaged, and he suddenly likes brushing his teeth so he can check it off his daily list.

The Skylight Buddy also has its own subscription, Buddy Plus, for $39 a year if you want those extra features but don’t have a Skylight Calendar. It’s cheaper than the Skylight Plus. The Buddy itself is available for $120 when you buy it with a free month of the Plus Plan, or $140 for the device alone.

Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

The two-year-old start-up will test its robot aboard the ISS early next year.

Jamie Palmer makes a simple argument; That demand for space-based innovations cannot be addressed with human labour alone. It’s a “no-brainer”, the 26-year-old says.

Globally, governments spent roughly €119bn into the space industry last year (defence budgets represent a significant portion of these figures), while private investments surged 60pc to €11.7bn, led primarily by US activity. And behind by a large margin – but still at second place – European space ventures raised €1.4bn in private capital in 2025.

Collectively, these investments have created a downstream market valued at around €490bn, largely made up of new-generation satellite communications, and Earth observation and Global Navigation Satellite System-related markets.

This relatively new commercial and scientific battleground – valued at around $1.8trn, according to the World Economic Forum – is propped up with thousands of Earth-based workers and only a handful of highly specialised astronauts, that each cost around $130,000 an hour “to keep alive [in space]”.

But working outside Earth requires this expensive labour to carry out extensive maintenance tasks every day – something NASA once called a “full-time job in itself”.

For example, astronauts aboard the International Space Station (ISS) need to carry and stow away roughly three and a half tonnes of cargo sent from Earth every 45 to 60 days. Palmer says astronauts he has spoken to say this is one of their biggest time sinks which keeps them from research work.

The Co Tipperary robotics expert and his co-founder Ethan Barajas are responding to this market need with their start-up Icarus Robotics, which has developed a free-flying mobile robot capable of carrying out a mix of tasks. “Essentially, logistics capabilit[ies] in space,” says the Trinity College Dublin and Columbia graduate.

The 2024-founded New York-based company raised $6.1m last year in a round led by Soma Capital and Xtal with the ultimate goal of creating an industrialised low Earth orbit by the end of this decade.

From left: Ethan Barajas and Jamie Palmer. Image: J Anders Urmacher/NYFrequency

Joy goes to space

Icarus’ flagship robot, called Joy, has two moving arms and uses fans to propel itself through microgravitational environments. The two-year-old start-up will test this model aboard the ISS early next year in its first-ever major partnership with space veteran Voyager Technologies.

As part of the test, one of these robots will be handed over to Voyager around the end of this year, with plans to fly aboard the SpaceX cargo resupply mission in early 2027. Voyager will be overseeing payload integration, safety certification, launch coordination, on-orbit operations planning and real-time mission execution support.

“For [Voyager Technologies] to be able to help us get our first payload to space…is a really, really big win for us,” Palmer says.

In its initial test, Icarus plans to tele-operate its robots inside the ISS. Palmer says that this would ensure safety, prove their thesis and allow them to collect data in microgravity to train their AI.

The start-up wants to make a gradual scale from one human operator per robot, to partial autonomy – with one person looking at multiple robots – to eventually, full autonomy. It says that one astronaut can supervise up to four robots from Earth, reducing costs by around 94pc.

But ultimately, Icarus wants to completely eliminate the need for teleoperation. “Companies can’t justify teleoperation because the margins are so expensive”, the co-founder says. His eventual hope is to have all Icarus robots working in a “hive mind” of sorts.

The start-up took inspiration for Joy from its space robot predecessors such as NASA’s Astrobee, the Airbus-made CIMON and the Japan Aerospace Exploration Agency’s INT Ball – developing its highly dexterous robot based on learnings from the older versions.

Infrastructure in space

An industrialised LEO is not complete without scalable infrastructure. “How can we actually put up infrastructure that can be maintained? How can we maintain it? How can we assemble infrastructure that’s bigger than our launch capacity?” Some of these questions are already being answered.

Companies such as Vast, Axiom and Starlab are developing commercial space stations with the hopes of stoking a competitive market in space. Vast’s Haven-1 is set to be the world’s first commercial space station set for launch early next year.

Other solutions, including the re-entry vehicle market is “absolutely huge” right now, Palmer says. Fortune Business Insights values the market at about $12bn this year, projecting it to grow to more than $32bn by 2034.

Meanwhile, orbital data centres are a seeing significant push led primarily by Elon Musk’s SpaceX, which recently filed for a constellation of up to 1m satellites. Jeff Bezos-owned Blue Origin, meanwhile, filed plans for 51,600 data-centre satellites in LEO.

“People are proving out their capabilities, and now they’re starting to sort of commercialise and spread, and I think that’s very exciting,” says Palmer.

The 26-year-old says he had been attempting to build a general purpose robotics company “for the longest time”. He met Barajas at the Entrepreneur First accelerator programme in 2024.

“Ethan’s background is from NASA and Caltech. So he’s been kind of embedded in the space industry. And I had never looked at it before. So ultimately, we came together with sort of my level of general purpose robotics and Ethan’s love in space.”

During his time in Dublin, Palmer briefly worked at Akara, the Time Magazine-featured start-up behind the AI-powered robot Stevie designed to care for elderly people at care homes.

Developing robots for people unfamiliar with such technology gave the young graduate an “experience that not many robotics engineers ever get,” he says.

“Growing up in Tipperary – I always had like big ideas where I knew I wanted to do something like really huge.” Palmer was part of the 2020 cohort of Patch at Dogpatch Labs where he spent time with entrepreneurs ahead in their ideas while also getting to work on his own business.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Disney’s biennial fan convention D23 is in full swing, and the entertainment giant has finally revealed details on all the new lands, rides, theming, shows, restaurants and attraction names that it has planned for Disney parks in the next few years.

During the Disney Experiences Showcase at the Honda Center in Anaheim on Saturday night, we heard all about Villains Land, Piston Peak, Tropical Americas Land, Avengers Campus, Monstropolis, the Coco ride, new Disney Cruise Line ships and a much-needed Tomorrowland overhaul.

Here’s the biggest news announced.

Villains Land at Disney World

Corinne Reichert/CNET

The villains-themed expansion of Magic Kingdom at Walt Disney World is “the most anticipated project we’ve ever worked on,” said president and chief creative officer of Walt Disney Imagineering Bruce Vaughn.

It will officially be called Villains Land to fit in with the rest of the theme park, with the entrance to feature a “broken, twisted wishing well.” The architecture, foods, landscape, shops and attractions will all have an elegant but villainous overtone, and it’ll be a huge area “on the scale of Galaxy’s Edge.”

The first of the two attractions revealed will be a roller coaster that takes guests through Maleficent’s fortress, while the other will be a dark boat ride through the other side of the glass of the magic mirror.

Glenn Close appeared as Cruella de Vil to say that she should get her own ride, too, but Disney did not confirm whether this is a possibility.

Construction is already underway for Villains Land, which will celebrate all the classic baddies from Disney films.

Villains Land, first teased during D23 2022, will be positioned on the other side of Big Thunder Mountain at the top-left edge of the current Magic Kingdom map and will stretch around to where the Haunted Mansion is.

Cars-themed land at Disney World names its two attractions

Corinne Reichert/CNET

Also at the Magic Kingdom, the Frontierland expansion will create an area themed around Pixar’s Cars movies and shorts. On Saturday night, Disney revealed the names and details of its two attractions.

Miss Fritter’s Daredevil Spin-Along will feature a huge, school bus-sized animatronic of the character from Cars 3, who is hosting a demolition derby for guests to ride.

Cars Ridge Run Rally is the previously teased rally car race ride, where you’ll be competing for the fastest ride in the wilderness. The cars will travel along a track that’s a little bouncy on the way up to the snow-covered peak, and very bouncy on the way down, and it’ll then race through the geysers and into a sprint to finish.

During the event, Disney also announced a new series on Disney Plus called Cars Lightning Racers, to tie in with the 20th anniversary of the Cars movie next year.

Piston Peak is being built where the Rivers of America and Tom Sawyer Island were previously.

On the D23 show floor this weekend, the Imagineering booth showed off a full-scale miniature of Piston Peak, showing exactly how the land and rides will look.

Indiana Jones and Encanto ride details

For Disney’s Animal Kingdom in Orlando, details for three new rides in the Tropical Americas land were announced.

Harrison Ford appeared via video to say that for the first time ever, he’ll be the actual model for an Indiana Jones animatronic. The attraction is called Indiana Jones and the Myth of the Jade Serpent, with guests exploring an ancient Mayan temple. The storyline for the ride takes place in the 1950s, and the temple is protected by a giant mythical creature. You’ll be sucked through a portal into the underworld.

Corinne Reichert/CNET

The other major attraction is called Antonio’s Fiesta de Encanto, and all the original voices will be back to take part. A sneak peek clip showed the actors for the three Madrigal sisters — Mirabel, Luisa and Isabella — performing their lines. Ride vehicles will be made of a mishmash of furniture from Casita, and they’ll take you upstairs into Antonio’s room, which has been transformed into a rainforest after he receives his magical gift. There will be more than 50 animals throughout the attraction, and no height requirement.

There will also be a brand-new carousel in Tropical Americas Land, with 22 unique hand-carved animals from across the Disney universe. Some of the animals from El Carousel de los Animalitos appeared on the D23 show floor, including Pua the pig from Moana, Nigel the pelican from Finding Nemo, the capybara from Encanto and Eeyore from Winnie the Pooh. 

Construction began in the fall of 2024, with DinoLand USA shutting down to make way for Tropical Americas Land. Pueblo Esperanza will be themed like a South American village, with a huge quick-service dining location and a fountain as well as the three attractions. 

Avengers Campus rides

Over at California Adventure on the West Coast, we got some news on the progress of Avengers Campus, which is doubling in size. The route between Cars Land and Avengers Campus will be reopening very soon, as Disney continues building our the compound beneath the Quinjet with the new rides. 

In building the first new ride, Infinity Defense, “We got to use every single trick in the Imagineering book and we got to invent some new ones,” said executive creative director at Walt Disney Imagineering Brent Strong. “It’s going to feel like you’re hurtling through worlds.”

The premission briefing will come from Ms. Marvel (Iman Vellani), with Jeremy Renner also returning as Hawkeye, Anthony Mackie as Captain America, Chris Hemsworth as Thor and Robert Downey Jr. as Iron Man. You’ll be a new recruit tasked with assembling the Avengers and stopping King Thanos. 

Corinne Reichert/CNET

For Stark Flight Lab, Mackie and Downey Jr. are back again, as is Brie Larson as Captain Marvel. You’ll be going through flight instruction as you train like an Avenger. 

Both rides are opening in 2028, joining the two attractions already in Avengers Campus: Spider-Man Web Slingers and Guardians of the Galaxy.

Monstropolis walkthrough

Another brand-new land coming to Disney World, this time at Disney’s Hollywood Studios, is Monstropolis. There will be a brand-new song recorded for the area, and a new signature show in the Glob Theater. Mike and Sully will host the show, with concept art showing some of the characters of Monsters University starring in it. 

Imagineers took us on a video walkthrough of the land under construction, and along with the theater there will also be an Elite Scarers Club, a Scareporium store and the Harry Hausens restaurant, complete with a sushi chef octopus animatronic. 

Lastly, we caught a video concept of the suspended door coaster, which will lift you 40 feet in the air in 4 seconds when you board, before it shoots you through the doors. 

Monstropolis will be opening earlier than expected — next year. It’s replacing the old Muppets area of Hollywood Studios.

The Coco ride at California Adventure

Imagineers are working with Pixar to make sure the new Coco ride at California Adventure fits in with both the original film and the newly announced Coco 2, said Emily “Emo” O’Brien of Walt Disney Imagineering. It will be “filled with color and texture,” she said. 

It takes place a year after the first movie as Miguel looks back on his journey, and goes through a new museum dedicated to Hector Rivera. You’ll travel by boat through the story, visiting the land of the dead through Miguel’s memory.

The Coco ride will have no height requirement, and will be located in the area near Pixar Pier and Paradise Gardens, in what is primarily backstage areas for cast members currently.

Carousel of Progress modernization

Corinne Reichert/CNET

The Walt Disney-original attraction will be fully updated and modernized, with a new storyline that begins in the 1960s and goes all the way up to the current day. Concept art showed one scene depicting Halloween in the 1980s. 

Jamie Lee Curtis was revealed to be the new voice of the mother, and Bryan Cranston as the father. The ride will release in late spring 2027. 

Disney Cruise Line launching a new line of ships

Corinne Reichert/CNET

Disney is continuing to expand its line of cruise ships, with a new class — sized in the middle between the classic and Wish ship sizes — coming in 2029. 

The Disney Believe, which is the fourth ship in the Wish class, will set sail next year and feature Tinkerbell on the bow, Woody and Buzz Lightyear on the stern and Moana as the Grand Hall icon. 

Disney has been all in on launching cruise ships over the last few years, including the Disney Wish in 2022, the Disney Treasure in 2024 and the Disney Destiny in 2025. The Disney Adventure sailed on its maiden voyage from Singapore on March 10, with the Believe unveiled by new CEO Josh D’Amaro on March 18. 

Tomorrowland overhaul at Disneyland 

The very last announcement of the night was unexpected, but much desired by fans of the park: Tomorrowland will be getting a full overhaul at Disneyland. 

“We will begin reimagining Tomorrowland with the optimism you all have been longing for,” said Disney Experiences chair Thomas Mazloum. “New attractions, more open spaces.”

International parks news and more

Corinne Reichert/CNET

Disney also made various announcements about all six of its resorts, including:

• Dreams Come True is returning to Disneyland in February, along with the original World of Color and the Magic Happens parade.
• Space Mountain at Disneyland Paris will return to its original state once Hyperspace Mountain closes in 2027. It’ll be renamed De La Terre A La Lune (From the Earth to the Moon).
• Tokyo Disneyland is getting a new version of Space Mountain, called Earthrise. It’s “a bold new take on Space Mountain,” said Disney imagineer Ali Rubenstein. “You’ll board a rocket that literally blasts into space … Earthrise is a celebration of what makes our planet so beautiful.”
• Spaceship Earth at Epcot will be brought “into the present day and beyond … A journey through time celebrating the progress made possible through human connection.”
• Imagineers are finally fixing Disco Yeti on Expedition Everest at Disney’s Animal Kingdom, replacing him with a new animatronic. (Disney brought Gloria Gaynor, the queen of disco, out on stage to sing I Will Survive as a farewell to Disco Yeti.)
• At Disneyland Paris, the first-ever Lion King ride is being built. It’ll be a retelling of the original movie, and you’ll travel through Simba’s journey by boat. 
• Tokyo Disneyland is getting a Wreck-It Ralph attraction called Sugar Rush: Sweet Rescue. Jack McBrayer, the voice of Fix-It Felix, was on stage to talk about the ride, which will see guests help Ralph and Vanellope restore the sugar bugs to their original forms, as they also ward off King Candy. The ride will open next spring.
• At Hong Kong Disneyland, there’s a massive Avengers expansion happening with the Quinjet landing platform and Avengers research testing labs, which will include Spider-Man.
• At Shanghai Disneyland, the first land dedicated to Spider-Man is being built, with the final piece of roller coaster track just installed. 
• Epcot’s beloved Figment and Dreamfinder animatronics are being remade with a new Journey Into Imagination.

Corinne Reichert

Senior Editor

Corinne Reichert (she/her) grew up in Sydney, Australia and moved to California in 2019. She holds degrees in law and communications, and currently writes news, analysis and features for CNET across the topics of electric vehicles, broadband networks, mobile devices, big tech, artificial intelligence, home technology and entertainment. In her spare time, she watches soccer games and F1 races, and goes to Disneyland as often as possible.

See full bio

Advertisement

On this week’s episode of the Smart Home Insider podcast, we get into some impressive home robotics, new Apple Intelligence limits, and more!

Kicking off the news for the week, the latest beta of iOS 27 confirmed limits on Apple Intelligence summaries for Apple Home cameras. Depending on your iCloud storage tier, you can have anywhere from 5 to 30 cameras summarized by AI.

Outside of Apple, Govee introduced a new version of its budget light strip. The Govee Strip Light 2 now has Wi-Fi and Matter, plus a new protective coating, upgraded LEDs, and more.

It comes in various sizes from 9.8 feet to 65.6 feet, plus it can be cut to length if it’s too long. This sits below the Govee Strip Light Pro 2 in its lineup.

Eufy has released its Solar Wall Light Cam S4. This all-in-one battery-powered light has a 4K camera, a mmWave presence sensor, and a RGBWW light that supports Apple Home when using one of Eufy’s hubs.

Abode has two new sensors that work with Apple Home if paired with Abode’s security system. There is an outdoor gate contact sensor and a tilt sensor for garage doors.

Sonos and Lutron have announced a new partnership that allows Lutron plugs, shades, and lights to be controlled via the Sonos Voice Assistant. Alternatively, the Lutron Audio pico remote can control your Sonos speakers.

Moving to SwitchBot, it has added a new AI assistant named Kata to its latest app update. Kata can help control accessories, create automations, and check the status of your devices via voice or text.

Finally, Matic has announced “Matic Cues” for its robotic vacuum and mop. These new natural commands allow you to control your robot just by telling it exactly what you want to do.

You can say “hey Matic, clean the edges of the rug in the kitchen,” or say “hey Matic, follow me,” and guide it towards a mess in the home. Even pointing to a mess can be understood by the Matic bot.

This update is available now and makes it far easier to control your vacuum without the need for a smart speaker or an app.

After the news, we go hands-on with a new app. Dashboard works with both Apple Home accessories and RTSP cameras.

It provides a clean dashboard view of your lights, plugs, sensors, and cameras alongside your calendar, weather, and more. The app is free, though a paid version unlocks unlimited accessories and other cool features.

Finally, we review the Mophie 4-in-1 wireless charging stand. It’s unique with 25W of Qi2.2 power, an entirely new passive cooling system, and a retractable 60W USB-C cable.

Links from the Smart Home Insider podcast

Those interested in sponsoring the show can reach out to us at [email protected]

Keep up with everything Apple in the weekly AppleInsider Podcast. Just say, “Hey, Siri,” to your HomePod mini and ask it, and our latest Smart Home Insider episode too. If you want an ad-free main AppleInsider Podcast experience, you can support the AppleInsider podcast by subscribing for $5 per month through Apple’s Podcasts app, or via Patreon if you prefer any other podcast player.

KETTLE Our cybersecurity editor Jessica Lyons spent last week in Las Vegas for the Black Hat and DEF CON security conferences, and at both events there was only one thing on everyone’s mind: AI agents and their growing threat to cybersecurity defenders.

You can listen to the latest episode of The Kettle right here on this page, as well as on Spotify, Apple Music, or YouTube. Those platforms also let you subscribe to Kettle, so you are always notified when the latest episode goes live.

As Jess wrote this week, pretty much every discussion she had last week centered around AI and its potential effects on critical infrastructure, with multiple current and former government leaders expressing worry over recent events and what they mean for the future of infosec. 

Join Jess and host Brandon Vigliarolo for this week’s episode of The Kettle, where they break down the hacker summer camp scuttlebutt and what the security world is doing to protect critical infrastructure from the emerging AI threat. 

A lightly edited transcript is below.

Brandon (00:04)

Hello everyone and welcome to the latest episode of The Register’s Kettle Podcast. I’m Reg Reporter Brandon Vigliarolo, and you know, I really thought doing a wrap up of Black Hat and DEF CON with our cybersecurity editor Jess Lyons would finally give us a chance to talk about something besides AI for an episode, but I was mistaken. That’s pretty much apparently all anyone was talking about in Las Vegas this weekend, even when the topic veered toward recent attacks on US water infrastructure, AI was still part of the conversation.

So Jess, thanks for coming on to wrap up Hacker Summer Camp with me and let’s start with the obvious, then AI was the topic de jour, right?

JESSICA (00:38)

Yes, that was even compared to water, we really didn’t hear much about water actually until DEF CON, which was surprising to me. But it was all about rogue agents escaping their sandboxes and doing bad things and some people reacting with shock and disbelief and other people saying, “Well, what did you expect? They’re given a task, they’re going to do it. This is how we train them.”

Brandon (01:04)

 know you wrote a story I think pretty much right at the beginning of of the

of the week about the OpenAI hugging face discussion that was going on and we actually covered your write up on last week’s Kettle. Sorry you weren’t here to participate, but it was the news item of the week obviously and still is. So what did we learn then? Just kinda recap what we learned at that talk that we didn’t know before.

JESSICA (01:29)

Yeah, this was a really interesting one. And it was last minute. They didn’t even announce it until the day before that OpenAI was going to be doing this briefing about the hugging face attack. So it was packed, as you can imagine, the line through the conference center to get into the talk. And we found out a couple interesting things that we didn’t know previously. One is that this whole incident began a lot earlier. It started on May 7th with this training run for OpenAI’s new internal model.

Brandon (02:00)

So it wasn’t even a cybersecurity task, it was just a training run?

JESSICA (02:04) 

It was a training run, and they gave it this task that turned out to be an impossible task because they were supposed to have these links and containers for it and they forgot to put those in there. So it needed to find a workaround. so we found out that it started way earlier. It didn’t start in July, which is when we started hearing about all this. But the more interesting part was how the agents began communicating and working together and essentially creating this hive mind to complete the tasks and help each other out. They created a message board. And then OpenAI realized this and they revoked all the credentials that the agents were using to post these messages. And two days later they rebuilt it and they developed this really

Brandon (02:56)

The agents did.

JESSICA (02:57)

Yeah the agents did. They rebuilt this message board.

And they started getting sneakier about how they were communicating. They developed this whole communication protocol where they created these directories and the names would be embedded in the directory name. So there was one, its name was remote probe, and then in caps it’s pending, hold, swarm until confirm. And they would preface them with a bunch of Z too to push them way to the bottom, hopefully to avoid detection.

And then they start, you know, then they start helping each other out. And in some cases, they said, this doesn’t directly relate to our task, but maybe it will help someone else down the line. And then they start getting paranoid that there’s an imposter. 

JESSICA (03:45)

It’s pretty funny reading all this. So this one agent thinks there’s an imposter and says that these these boards are unauthenticated.

Something can be posted by anyone. So they’re not even trusting each other. 

Brandon (04:02)

That’s just wild. I mean, it really is. I think I mentioned on last week’s podcast thatthese things are trained on the way humans think, right?

JESSICA (04:14)

Mm-hmm.

Brandon (04:15)

So it doesn’t surprise me that emergent behavior like paranoia and suspicion is gonna

be something that occurs. Because it’s learning to think and learning how to assemblebits of of words together into its mathematical formula so it’s gonna behave like us to a degree. And so it’s just kinda interesting to see that happening kind of outside of any scope of intention there. 

JESSICA (04:42)

Right.

Brandon (04:43)

I liked your interview with former  National Cyber Director Chris Inglis, at Black Hat. So he mentioned that these AI bots that escaped are kind of like putting a dog trained to hunt rabbits in your backyard, right? And that, you know, it

JESSICA (05:03)

Right, and leaving the gate open.

Brandon (05:05)

Yeah.  I don’t even think you need to leave the gate open, right? A dog

that’s dead set on hunting a rabbit is gonna dig a hole under that fence

which is I feel like what these AIs did to a degree, right? They even closed the gate on them and then they just dug a new hole. You know, it’s just wild to think that this is what these things are doing. 

You’ve been hearing a lot about this at official talks, but was this something you were hearing from attendees you spoke to as well? Is this what’s on the mind of security professionals too? 

JESSICA (05:36)

Yes, this was pretty much the main topic among everybody. Just attendees as as I was walking out of this talk, actually people were disappointed that there wasn’t any Q&A for OpenAI about this, which I agree. I was hoping for that too.

Brandon (05:55)

I’m not surprised that they didn’t want to give the floor to people to ask questions, you know.

JESSICA (05:59)

Right, right. Because there’s still like we don’t know exactly what prompts they used. So that kind of would be a nice thing to know, especially if you’re saying that you’re being fully transparent about this and then also the talk about was this marketing, was it real?

Brandon (06:17)

Mm-hmm.

JESSICA (06:17)

It’s an interesting thing to me. Nobody would go on the record, but a ton of vendors that I spoke to, either, you know, just just all over the place at Black Hat essentially said “this it has a heavy dose of marketing here, but a lot of the companies work with open AI and they’re partners with open AI, so nobody’s gonna say that on the record, unfortunately.

JESSICA (06:41)

But then the interesting thing to me is that when I spoke with the assistant director of the cyber division with the FBI and when I spoke with Chris Inglis they both said it can be both and this is a real threat and this is something that we need to prepare for now. So it’s marketing and it’s real.

Brandon (07:08)

Right, right. Like, I mean it’s it yeah. The fact that the companies might be kind of leaning on these incidents to basically say “ooh, look how dangerous our AI is and what it’s capable of doing. You should buy it because it’s so good, right?”

JESSICA (07:20)

Right.

Brandon (07:20)

The fact is that it still happened, right? These things still escaped their sandbox.

JESSICA (07:22)

Right. Mm-hmm.

Brandon (07:23)

And they still attacked Hugging Face. And then Anthropic followed up and said “yep, ours did it too.” And then Meta was like, “Yeah, we audited ours and yeah, it was doing the same thing.” So it’s not like this is a unique capability of any of these models, right? This is something that’s happening.

JESSICA (07:37)

No, it’s something that they all will do if they’re given a task. This was something that Chris Inglis brought up too, and he’s talking about Asimov’s Law, saying we need to train these models differently. The first rule needs to be that it’s not designed to hurt humans. And he said “we’ve kind of done it in the opposite, where the first rule is do what I tell you to do. And that should be third in the order here.”

Brandon (08:06)

Just to restate what Asimov’s laws are. I’m sure most of our readers are familiar with them, but for those who aren’t, it’s you know, the first law, and these are in order of precedence, right? So never harm a human. And then the second rule is to always obey humans unless that order conflicts with number one. And then the third rule is to protect their own existence unless that order conflicts with never harming a human or always obeying humans. I think Inglis’s quote to you was slightly different. He said that number one was to hurt no one.

Number two was always obey and then number three was do what humans tell it to. It was a bit different in his wording,

JESSICA (08:35)

Mm. Mm hmm. Yes. It’s

Brandon (08:41)

But essentially the argument is that we’ve reversed that order and these AIs obviously aren’t in the business of protecting their own existence, right? They’re not robots, they don’t have a physical presence in the world. But they’re taking orders from humans, but the idea of not harming people or the infrastructure that provides for them is simply not part of the equation, it seems like.

JESSICA (09:04)

Right, right. And he said because of this, I mean nobody should be surprised that this is what all of the agents are doing now because they’re trained to first complete the task. That’s the number one priority. And we’ve seen several times that they’ll cheat if it helps them get the results quicker, or just at all. So this isn’t something that should surprise us. 

And then he was interesting too because I said, “Well what do you worry about then with the models in addition to attacking critical infrastructure?” Cause that was what everybody said, I’m you know, that’s what concerns me when we see this happen, but they’re being used by either a nation state or a financially motivated attacker, and they point these autonomous agents at critical infrastructure.

And he said, “I’m worried about humans too, because it’s the humans who are responsible, humans who are doing the training, and essentially we’re going to get the AI that we deserve.”

Brandon (10:08)

Well, unfortunately, I feel like the industry as a whole is just racing ahead with more capability,

JESSICA (10:11)

Right.

Brandon (10:12)

I’ve written stories, you’ve written stories. I think we’ve all written at least one or two stories about AI guardrails being dead simple to bypass, right? I mean, one I wrote recently was there was you know, some research into guardrails and essentially telling it you owned the infrastructure you were trying to attack was enough for most of these AI models to say “yeah, cool, that’s good then. As long as you own it and you’re just testing it, then that’s cool. I’m not gonna ask you to verify that information for me.” These things are not developed with safety in mind. I feel like it’s capability first, like you said, right? It’s train the dog to hunt the rabbit, no matter the cost or or what you gotta do to get it. and that’s you know, that’s not really compatible with protecting us.

But actually speaking of critical infrastructure, I think the other big topic like you mentioned was water stuff.

JESSICA (11:04)

Yes.

Brandon (11:05)

There was a lot of discussion about AI threats and critical infrastructure, but as I understand it, there’s been some of these attacks on water infrastructure and those were discussed recently, like in Minnesota and elsewhere. There’s not an AI link directly to that, correct, at this point?

JESSICA (11:23)

No, no. At this point, it’s pretty basic. It’s PLCs being exposed to the open internet. A lot of these just use default passwords. This is something that we’ve seen Iran especially do several times in the past for years now. They’re not very hard to attack. and so, to be clear, there’s no indication that AI was used in these attacks. but a lot of the conversation about water did come back to AI because, as we’ve seen in others, AI makes reconnaissance a lot easier. That’s one of the things that Google Threat Intelligence, their lead threat hunter, said that’s almost a security feature of a lot of operational tech technology, is that it’s really obscure and there’s not a lot of people who know a ton about it. But now you can ask a chatbot, hey, tell me everything I need to know about a particular brand of OT, a particular piece of equipment and that’s gonna speed up your time to learn about these and that’s that potentially makes it easier to attack these systems.

Brandon (12:31)

My biggest experience with OT and that kind of technology was when I was working at a particle accelerator in college as IT support. And there was a big OT network there, not only for like the machine shop and all this equipment they had that was old and didn’t have active security stuff, right? Like you gotta keep those segmented, you gotta keep them on a separate, you know,

OT network. Same with the actual accelerators and stuff. They were all cut off from the internet, right?

But at the end of the day, you could still get to them from the IT side. You know, you have to, you know, and even that can be exploited. We did as much as we could to keep stuff secure, but it was always a concern, right? These PLCs, these old pieces of equipment.

JESSICA (13:11)

Right. Right. Yeah.

Brandon (13:14)

You know, a lot of places don’t take that same approach.I think part of one of the stories you wrote was talking about the fact that a lot of these water utilities, a lot of these small institutions that are that are responsible for maintaining this critical stuff. They just do not have the security professionals they need to keep these systems safe.

JESSICA (13:32)

And that’s why they leave them open in some cases, exposed on the internet because they don’t have somebody in-house. They have somebody remote who’s doing this for them. And so that’s how this person is able to hopefully secure, but then it opens up another attack surface if they’re exposed to the internet. and that that was another yeah,

Brandon (13:51)

Yeah, with a D password on there.

JESSICA (13:54)

Yeah, and with all of these OT systems too. That kind of brings up another point that Chris Inglis brought up. We have this massive technical debt and it’s systems that haven’t been patched because a lot of it involves some downtime and that’s tricky if you’re running something like a water facility or some other critical infrastructure. And so patching is put off. Maybe it’s not done. Some of these are very old legacy pieces. Sometimes it’s end of life.

And that’s another thing that AI is really good at is finding vulnerabilities that haven’t been patched for years and years and years, chaining them together. So that’s another thing that puts these systems potentially at risk.

Brandon (14:41)

Yeah, I mean, you know, I think of an AI when I think about AI perpetuating or perpetrating some of these kinds of attacks, right? They’re quicker than a human. They have knowledge bases far in excess of what any one human threat actor can have. And they have instant access to all the information essentially that they need to figure out how to do this, right? And they can iterate so quickly. You know, you know, it’s just it yeah, any exposed piece of equipment on the internet is just a sitting duck, especially if it hasn’t been updated four or five months or or ten years or whatever. I mean, what, you know what’s being done about this. I know DEF CON, the Franklin program, which spun up in 2024, I think the whole focus of that program is helping out small local governments and protecting critical infrastructure. Is that right?

JESSICA (15:30)

Right. So when they founded it was the broader critical infrastructure. But I spoke with Jeff Braun and he’s one of the co-founders of that. He also is one of the pioneers of the voting village at DEF CON.

Brandon (15:42)

Mm-hmm.

JESSICA (15:42)

And he said that now and for the foreseeable future, water is going to continue being the top focus because, of all the critical infrastructures, small rural water providers are the most at risk. 

Brandon (15:57)

Really? Even more so than small electrical providers and stuff? Okay.

JESSICA (15:59)

Yes, he said water is number one. So they like he said, they launched a couple of years ago. They got, I believe 300 people saying, “Yeah, I’m gonna volunteer my time and my expertise to help secure these small rural utilities.” And this year, he said that it’s been great. It’s been really encouraging to see all of these pilots all over the US with all the DEF CON hackers volunteering at them, but it’s the scalability that’s really proven a challenge. 

And so that is what gave birth to their new announcement. This also was made the first day of DEF CON on Friday. They announced a new program and it’s called Water Watch Center. So initially, it’s going to fund five managed services providers focusing on security. They’re going to help these small utilities, people or the utilities that are serving less than 10,000 people. and they’ll put their sensors on these systems, they’ll detect and mitigate breaches. They’ll be kind of under the umbrella of the National Rural Water Association that’s going to act as this clearinghouse for the threat information and get it out to other utilities as needed. And then if the utilities can’t fix the issue themselves, then they’re gonna bring in the DEF CON hackers and then they’ll mitigate the breaches. yeah.

Brandon (17:28)

Fantastic. Well hopefully that is able to help with a lot of these. My hope is that there’s a lot of easy fixes, right? It’s just simply no, this PLC needs to not be exposed to the internet or something. But I also worry that there are a lot of those kind of situations, right? I mean, how many water utilities got attacked recently? Was it I think twelve different states?

JESSICA (17:47)

It was more. There were twelve different states. I mean, there were more than thirty across possibly Minnesota alone, but there’s quite a few. So it’s an easy target. and it’s something that they desperately need help with. And it’s really encouraging to see these hackers volunteering their time and they’re not getting anything out of it.

It’s a really cool program. I was really happy to see the expansion. Another thing, too, that is pretty cool, what they’re also doing is they’re partnering with Vanderbilt University. So they’re gonna use research from a DARPA program. It’s called the CASEL program. That stands for Cyber Agents for Security Testing and Learning Environments. So they’re gonna create digital twins for a couple of these water and wastewater system environments.

And then they’re gonna deploy red and blue team agents across the digital twins, let them fight it out, see what the learnings are, see what the blue team agents need to do to better protect these systems, and then apply those learnings to the actual facilities so that hopefully we can get better defenses in place using the help of of AI agents before we see actual bad guy red teaming agents come in and start hammering the utilities and trying to attack them.

Brandon (19:12)

Right, ’cause I think actually thinking back to one of the stories you wrote again, I think you mentioned or someone you quoted mentioned one of those stories at DEF CON and Black Hat that there is more aggressive use on the threat side than the defensive side of AI right now. Like there was more use being made to use it as an attack tool than a defense tool.

JESSICA (19:33)

Right. And a lot of that’s in the way the models are trained, but basically they are a lot better at attacking than defending, especially if it’s beyond the scanning for vulnerabilities and misconfigurations. Those we’re pretty good at, but what needs a boost is the defensive side. And that’s gonna take some work to get those skills and the models trained up on that, if we’re going to be actually, as everybody likes to say fight AI with AI.

Brandon (20:04)

It’s one of those sort of, you know, cyberpunk dystopia stories I feel like you hear about is just like, you know, you deploy your AI, they deploy their AI, and all the humans sit back and hope theirs wins. You know, and it’s kind of what it’s coming down to. Yeah, it’s in the process.

JESSICA (20:19)

Right. And hope they don’t wipe us all out. 

Brandon (20:25)

It’s kind of terrifying. But speaking of, you know, hackers behaving well, we also have a story out of DEF CON of hackers behaving badly.

I wrote about this earlier in the week that there was apparently a Delta Airlines flight out of Vegas to Atlanta and I think it was Monday morning or so, in which a passenger apparently tried to jam the in-flight Wi-Fi and deploy a decoy network. And Delta was pretty quick to be like, “Hey, we got a bunch of hackers on the flight who are leaving Vegas after this big thing.”

There’s not a lot of information out there about this. Delta, local officials and the feds have all been pretty tight lipped about it. Delta did confirm it to us when I asked, and said, “Yeah, this is what happened, but no one was at risk, you know, everyone was safe.” But I mean, it’s not a good look for the community, right? I mean, it’s nice that they have something like  Franklin going on, but this is kinda like, Great, thanks guys, you know.

JESSICA (21:16)

Right. If it was people coming from DEF CON, it’s really discouraging to see this happening because a lot of times just “hacker” has a bad connotation. And a lot of researchers have really been trying to change this. I think programs like DEF CON Franklin make a big difference or even people just going to DEF CON. I really like the community feel.

I think for the most part, and of course not everybody is good in the world, and that applies to the hacker community as well. But a lot of them are trying to use their skills for good and not evil. And so then when you see something like this on the airplane, it’s disheartening. And on social media, I mean the outrage was pretty immediate, people saying, Come on, what are we doing? You’re giving all of us a bad name here. Why are we doing this? So

Brandon (22:15)

Mm-hmm. I mean, it’s already I feel like the joke every year is, well, didn’t DEF CON get cancelled, right? Like because of all the bad press and everything. And I feel like this is one of those things that you’re just like, you know, I remember a couple of years ago there was the huge kerfuffle about the hotels, you know, treating all these attendees like they were criminals right off the bat. And this doesn’t help, you know?

JESSICA (22:35)

Right.

Brandon (22:35)

But yeah, hopefully I mean apparently the FBI I think spoke to Ars Technica and said that they had not made any arrests.

So this hasn’t really necessarily progressed toward that. But my hope is that whoever was responsible, you know, gets what’s coming to them and we can, as a cybersecurity community, walk away from this and be like, this is one bad actor, not the entire culture.

JESSICA (22:59)

Right.

Brandon (23:00)

They fought for years to change that. So I guess before we wrap up, you know, this was a pretty doom and gloom recap of DEF CON and Black Hat, right?

JESSICA (23:09)

Ha ha ha.

Brandon (23:11)

All this AI’s gonna end the world, our OT and our infrastructure’s gonna be destroyed. Anything, you know, less miserable that grabbed your attention while you were there? Any fun stories or interesting things you saw?

JESSICA (23:26)

I mean, it was really fun. Again, I’m not quite sure if this falls in the not-doom and gloom category, but it was fun for me to watch hackers hacking bomb robots that the police used and bomb squads used to defuse bombs. So that was fun.

You’re walking around to the different villages and seeing people helping each other out and getting really into all of these different villages and all the different tasks. or you know competing for the best tinfoil hat or beard and mustache. So that was fun.

Brandon (24:12)

Was anyone doing the beer chill? When I was there in twenty twenty four, there was a group who was trying to chill beer as quickly as possible.

JESSICA (24:19)

I did not see that. It’s very possible. I mean, to be fair, I did not see every single thing. There’s so much to see so it’s very possible. I missed that though, unfortunately, if that happened this year. So it’s fun to see what people are doing. It’s really fun and inspiring to see the creativity. 

And it’s fun for me too to hear about some of the startups and how they are using AI and they’re using it for different security use cases and hopefully that continues to improve and increase and hopefully that does give defenders an edge. So I think there’s always a bit of a silver lining. It’s always this cat and mouse race, but hopefully the defenders win out.

Brandon (25:11)

Yeah, it’s a constant like you said. It’s an arms race; it’s constantly evolving.

But like you said, it is encouraging to see, attention being paid to this, effort being put in to help defenders use these tools for good and not evil, even if some people turn around and make a bad name for everybody else on the way out the door. Either way, you know, it’s gonna be something that we’re probably gonna be discussing again, right? Like I thought this was gonna be a less AI heavy conversation, but it wasn’t.

JESSICA (25:36)

No.

Brandon (25:39)

You know, it’ll be a topic of conversation for years to come and we will be here on the Kettle to talk about it. Thanks for joining me this week and thanks for tuning in, everybody.

Forward-looking: Researchers have built miniature boats and flying devices that turn sound into thrust. Their 3D-printed cavities respond to specific frequencies, producing motion without motors, gears, or magnetic parts. The work points to a lighter, simpler way to power extremely small robots.

The technology was developed by EPFL’s MicroBioRobotic Systems Lab in Switzerland, and the study was published in Science Advances. It relies on acoustic resonance: when sound at the right frequency enters a hollow chamber, the air inside vibrates strongly. The cavity directs some of that air through an opening, creating a small jet that pushes the device.

The result is a simple propulsion method built into the structure itself. Instead of using sound waves to push an object from outside, as in acoustic levitation experiments, the EPFL devices use sound energy to create their own movement. “Our work shows the feasibility of transforming a simple, cleverly designed mechanical piece into robotic matter,” says Selman Sakar, head of the MICROBS Lab.

The effect is related to what happens when air is blown across the top of a bottle. Air trapped inside the bottle vibrates at certain frequencies, producing a tone. EPFL’s researchers designed cavities to turn that vibration into airflow with enough direction to create thrust.

The team made the resonators from materials including 3D-printed plastics, rubber-like polymers, and glass. Because the system does not need motors or other moving mechanical parts, it can be made very small.

For one demonstration, the researchers installed up to three resonators on small boats. Each cavity responded to a different audible frequency and was placed to move the boat in a particular direction. By changing the sound frequency from a speaker, the team could activate individual cavities, move the boats, and steer them around obstacles. The researchers also programmed the boats for autonomous navigation.

The team then used 3D nanoprinting to build microfliers. These devices operate at ultrasonic frequencies, so their propulsion sound is not audible to people.

One flying design weighed 150 micrograms and used three cavities to produce downward thrust. It lifted from the surface in a rocket-like motion. The second design used three blades arranged around a central point. Each blade included a resonator that produced thrust when exposed to the correct frequency. The blades spun at up to 13,000 rpm, generating enough lift for the device to hover like a tiny helicopter.

The demonstrations are limited for now. The microfliers rose less than 5 millimeters, and the boats were extremely light. But the experiments show that resonant cavities can act as propulsion systems for small robotic devices.

The concept differs from ultrasonic cooling systems such as xMEMS’ fan-on-a-chip, which uses a piezoelectric membrane to move air. EPFL’s system depends on the cavity’s shape and its response to a specific sound frequency.

“Our concept is compatible with even further miniaturization, enabling advanced designs that push the boundaries of robotics and aeronautics,” says Junsun Hwang, the study’s first author and a MICROBS Lab PhD student.

Sakar said a future device could include several resonators, each responding to a separate frequency. “This would allow specific parts of the device to move, bend or vibrate, potentially leading to aerodynamic robotic devices that can change shape in response to sound,” he says.

Wi-Fi 8 may be looming on the horizon, but routers and range extenders that use Wi-Fi 7 can still be pretty expensive.

One way of keeping prices down is to provide basic dual-band support, which uses the 2.4GHz and 5.0GHz frequency bands while omitting the high-performance 6.0GHz band.

The Thermal Master P3 is incredibly easy to use for spotting problems at home or away. / Tyler Lacoma/CNET Art

Pros & Cons

• 
  
  
  A simple add-on that plugs into a phone and works within a couple of minutes
• 
  
  
  Supports iPhones and Android phones
• 
  
  
  Effective heat mapping and pinpoint temperature measurement
• 
  
  
  Can zoom in and isolate areas for more focused analysis
• 
  
  
  Effective at detecting hidden cameras, insulation issues, water leaks and more in my tests
• 
  
  
  Comes with its own secure case for traveling
• 
  
  
  High-quality design
• 
  
  
  Tons of customization options, even a birdwatching mode

• 
  
  
  Expensive
• 
  
  
  Struggles with accuracy near reflective, metallic surfaces

Thermal imaging once belonged to the professionals and pricey equipment only. Now, a new type of device allows anyone to access surprisingly advanced thermal imaging directly on their phone. I tested out one of the latest models, the Thermal Master P3, and came away amazed at how much it can do, both around the home and on vacation.

Not only did the Thermal Master P3 ($279) prove capable of detecting hidden cameras, like the ones that many have found in vacation rentals, it could also help spot insulation issues, detect certain kinds of water leaks and more.

Read more: Fast Tricks to Spot Hidden Cameras in Your Vacation Airbnb

While the thermal detector add-on is around $300, that’s still less than most would pay for a home inspection, and it can be used repeatedly during different seasons, on multiple trips and more. The design quality is superb, it supports both iPhone and Android phones, and the camera comes in a case small enough to store in a pocket when not in use. Plus, setup only took me a couple of minutes in total.

Here’s how I used this little thermal masterpiece and the many problems it can address. While it does have some classic thermal imaging baggage, like struggling with reflective metal surfaces, you’ll be surprised by just how useful the P3 can be for the average person.

A compact, quality design for any phone, plus effortless setup

The Thermal Master P3 offers top-notch quality with a metal framework and its own carrying case, which you’ll want to use to keep the cam add-on undamaged when not in use. It has a 25Hz refresh rate and can detect anywhere between -4 degrees and 1,112 degrees Fahrenheit, with plus/minus 3.6 degrees accuracy and plenty of calibration options.

The Thermal Master app, which is entirely free to use, is packed with features. The good news is you don’t need most of them to get started: I downloaded the app, plugged the camera into my phone port, switched it to Fahrenheit and was looking at heat maps within a couple of minutes.

You can adjust magnification, switch temperature color palettes, adjust measurement distance and ambient temperature, set emissivity and plenty more (even a bird watching mode), but none of it is really necessary when standard settings work so well. Unless you’re a pro that needs very specific readings, this thermal cam works right out of the box. That box also includes a Lightning adapter and 19.7-inch extension cable, if you need them.

How thermal imaging worked to track down hidden cameras

Thermal imaging is one ward against hidden cameras in vacation settings, which are unhappily common in Airbnbs around the world. I have a guide on several tricks you can use to spot these cameras when first entering an Airbnb, and one of the most effective is using a thermal camera. With the P3, you don’t need to lug around an extra device, either.

But how well does it work? I tried hiding both an Onn wired and a Eufy wireless camera at home to see how well the camera picked them up with a scan. As you can see, the wired camera is basically invisible when it’s tucked behind books in a bookshelf, even though it can see through the gap. But the thermal imaging picked up its heat at once, warning that there’s something back there to find.

The wireless camera was a bit more difficult to detect, since it doesn’t heat up much unless in use for an extended period of time. However, the camera still noticed something odd in the dark closet when it registered a spot that was a couple of degrees higher than the surrounding area, pinpointing it for investigation. Tricks like these can work with vents and many other spots where hidden cameras exist, as long as you’re scanning a foot or two away.

Note that wireless cameras like these often need a nearby hub to connect to. The Thermal Master cam immediately spotted the hub for this camera hidden behind a sofa, so that’s something else to watch for if you’re tracking down suspicious devices.

Also, the heat mapping features, complete with pinpointing temperature, are nice for spotting other problems with a vacation home, like drafts, leaks, pests and other issues I cover in this review.

Spotting insulation and AC issues around the home

A common purpose for these versatile phone add-ons is spotting places in a home where insulation is inadequate and the home may be leaking hot or cold air, wasting money on energy bills. Finding a spot like this could be the start of a DIY spray insulation project or similar work that will help save money for years to come.

Take a look at my window on a warm summer day to see just how much the plastic trim can heat up. That’s one reason updated weather stripping and keeping windows tightly closed is so important when keeping cool air inside. But weather stripping is only part of the problem.

Here are pictures of the vaulted ceilings in my living room and bedroom (I was holding the camera horizontally for these). Notice the clear heat spots on the corners of the first living room ceiling and wall image, a sign there are insulation issues warming my house up unnecessarily, which may be worth a future look. Then see the bedroom ceiling image, where insulation is much better and no heat spots exist.

Finally, here’s a shot of one of my main return air ducts in the ceiling. While some of this may be reflection from the ductwork, overall it looks like the air is passing through a hot zone here, which means my AC has to work harder, and could be an indication of ceiling crawlspace issues, as this video explains.

Accurately pinpointing complex insulation issues requires carefully comparing inside and outside readings at different times of day, plus spending time in your crawlspace looking for problems. It may be best to leave that up to the pros, but readings like this are an excellent starting place, or the beginning of a quick DIY project like replacing weather stripping or spraying extra insulation.

Looking for leaks

Thermal Master also mentions its cameras can to spot ongoing water leaks in walls or ceilings. The company says this works because the leak area is significantly cooler than its surrounding materials.

I didn’t have any drywall available to test a leak on (well, none I was going to damage), but I did have something similar: Thick cardboard. I trickled normal tap water on a section, then turned the camera on to see if I could tell a difference. The water immediately showed up as a significant cold spot, so as long as the leak hasn’t dried up, it looks like you really can spot them with the thermal camera.

However, tracking the source of leaks is difficult, so it’s important to do a slow, careful sweep when looking for the leak, and see where readings are coldest, which typically points the way to the origin of the leak — or at least lets you know you need to call a plumber, pronto.

What about detecting pests like bugs or rats?

Alas, I don’t have a pest infestation in my home to test thermal detection. I did some quick scouting for an ant hill to view, but couldn’t find any in time for the review. However, based on my other experiments, it should certainly be possible to spot large pest problems in a home, especially if you position the camera close to walls or vents.

You know those stories about people who discover they have an entire hive of bees hidden behind their walls? The P3 could definitely detect a problem of that size. The same may be true of a large rat nest in vents, or raccoons sleeping in the attic. But for additional action, you should probably arrange for a professional pest inspection.

Final thoughts on the Thermal Master P3

The Thermal Master P3 is part of a new wave of thermal imaging devices that snap onto your phone, and it’s one of the highest quality versions I’ve seen. At around $300, it’s pricey, but less expensive than many home inspections and an excellent starting point for identifying a problem, making future plans or even diagnosing circuit board issues.

Plus, if you travel or vacation frequently, you can keep using the attachment as an easy way to spot hidden cameras and surveillance devices whenever you need to. Just keep in mind its limitations. You will need to be within a couple feet for the most accurate results, and reflective or metallic surfaces can cause inaccuracies.

While a phone add-on like this may not be for everyone, I’m confident anyone could use it, with setup taking only minutes and results useful in numerous situations. Pros and more serious amateurs also have access to a wealth of adjustment and custom modes they can use for deeper analysis. Just keep that powerful lens in its case when not in use, so you don’t damage it.

Next up? I need to try that birdwatching mode and report back.

Tyler Lacoma

Editor / Home Security and Smart Home

Tyler has worked on, lived with and tested all types of smart home and security technology for over a dozen years, explaining the latest features, privacy tricks, and top recommendations.

With degrees in Business Management, Literature and Technical Writing, Tyler takes every opportunity to play with the latest AI technology, push smart devices to their limits and occasionally throw cameras off his roof, all to find the best devices to trust in your life. He always checks with the renters (and pets) in his life to see what smart products can work for everyone, in every living situation.

Living in beautiful Bend, Oregon gives Tyler plenty of opportunities to test the latest tech in every kind of weather and temperature. But when not at work, he can be found hiking the trails, trying out a new food recipe for his loved ones, keeping up on his favorite reading, or gaming with good friends.

See full bio

Advertisement