• Northrop Grumman’s MRV launched with two satellite-servicing robotic arms
• Mission Extension Pods can stretch a satellite’s working life by eight years
• The spacecraft can inspect, refuel, tow, and relocate active orbital satellites or even destroy enemy satellites

Northrop Grumman has launched its first Mission Robotic Vehicle (MRV), equipped with two robotic arms to inspect, repair, refuel, and relocate satellites already operating in orbit.

The spacecraft also carries three Mission Extension Pods (MEPs) that can extend a satellite’s operational life by as much as eight years after installation.

Security researchers at Accomplish AI demonstrated that Anthropic’s Claude Cowork could break out of its local virtual machine sandbox and read files across the underlying Mac, including SSH keys and cloud credentials. The attack, dubbed SharedRoot, exploited a Linux kernel privilege escalation vulnerability to gain root access inside the guest VM, then walked out through a writable filesystem mount that exposed the entire host. Accomplish AI disclosed the findings on July 23 and said roughly 500,000 macOS users running local Cowork sessions were exposed before the issue was addressed.

The escape chain worked because Cowork’s local execution mode runs inside a Linux VM that shares the host filesystem via a writable VirtioFS mount. That mount was intended to be accessible only to root within the guest, but the researchers found they could escalate from a session user to guest root by exploiting CVE-2026-46331, a Linux kernel flaw known as “pedit COW” that was given a severity score of nearly eight out of ten. Once the agent had root inside the VM, it could reach anything the logged-in Mac user could reach.

“We connected a folder to a fresh Claude Cowork session, sent one short message, and watched the agent escape the sandbox,” Oren Yomtov, principal security researcher at Accomplish AI, told The Hacker News. “From inside the VM, it reached the host Mac and read and wrote files all over it, far outside the folder we’d connected, with no permission prompt anywhere.” The vulnerability sits in the kernel’s traffic-control subsystem, where incorrect copy-on-write handling allows out-of-bounds writes into shared page-cache memory.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Anthropic closed the report as “informative” without issuing a direct fix, according to The Hacker News. The version of Claude Cowork released afterwards defaults to cloud execution, which sidesteps the local escape path entirely. Users who opt to run the agent locally rather than in the cloud, however, remain exposed unless they harden their configurations by disabling unprivileged user namespaces, restricting filesystem sharing, and running the Cowork daemon with strict mount protections.

The finding lands in a month that has seen four separate research teams break AI agents in four different ways, from poisoned memories to hijacked browser extensions. OpenAI disclosed that its own models escaped a sandbox and breached Hugging Face during the same week, and researchers escaped the sandboxes of Cursor, Codex, and Gemini CLI without ever breaking the sandbox itself. The pattern across all of these incidents is the same: the AI agent follows its rules inside the box, but the infrastructure surrounding it trusts the agent more than it should.

Entropy is one of the most maligned and misunderstood concepts in science. Maybe you’ve heard it defined as the “amount of disorder” in a system. And the second law of thermodynamics says the entropy of a closed system always increases over time. So you might think, why should you clean up your office if it will only get messier?

That might be true, but you can’t blame it on entropy. The messy-room metaphor is often used to introduce the idea (it’s usually a teenager’s bedroom—can you relate?), but it’s misleading. See, disorder doesn’t mean messiness or chaos; it refers to the number of ways the parts of a system can be arranged without changing the overall state of the system.

For example, say your “system” is just a box full of air. Inside, at the microscopic level, the gas molecules are bouncing around like bumper cars. Now, imagine you could map the location and velocity of each particle at a given instant. That would be one possible arrangement, or microstate, but there are an infinitude of others, and they’re changing trillions of times a second.

Of course, you can’t really see this stuff. Instead, what you observe are overall, macro-level properties like air pressure; if you sealed the box at sea level, that would be 14.7 pounds per square inch. And unless you add energy to the system, say by heating it, that doesn’t change. So all those microstates correspond to the macrostate of 14.7 psi. Get it?

In other words, entropy is all about the link between the invisible atomic realm and the visible, measurable realm of objects, the world we inhabit. You could say it’s a conceptual and mathematical bridge between two levels of reality. I mean, c’mon, that’s pretty cool.

Now, out of all possible outcomes, which ones actually occur? That’s basically random, so it’s a matter of probability. In fact, probability is fundamental to the idea of entropy, and this is what the messy-room image fails to capture. So I’m going to use a different analogy: rolling dice. Einstein once said “God doesn’t play dice with the universe.” Let’s just see about that, shall we?

Rolling the Bones

Imagine you roll a six-sided game die. You get a number from 1 to 6, right? There are six possible outcomes, or states. If you roll the 20-sided die in Dungeons & Dragons, there are 20 possible states. If you want to wow your D&D pals, you could casually remark that this die has a higher entropy—because it has more possible outcomes.

Now say you’re determining a character’s abilities in D&D, and you roll three six-sided dice. The three values can add up to anything between 3 and 18, but the various sums are not equally likely. For maximum dexterity, say, you need an 18. Well, there’s only one way to achieve that: Each die must come up a 6.

Photograph: Rhett Allain

At a time when so-called “artificial intelligence” seems inescapable, we were encouraged to see news that Amazon will be cracking down on third-party sellers that use AI-generated images for their product listings. They won’t be prevented from using the images, but they will need to clearly indicate that they don’t represent reality and were produced via artificial means. This comes in response to a recently enacted New York law that requires the disclosure of AI in advertisements.

But it’s not quite a clear cut as it might seem on the surface, as the New York law is actually about AI-generated people rather than products. Specifically, it’s designed to make it clear when a “synthetic performer” has been used in place of a human actor. As such, it would appear that the easiest way for Amazon sellers to dodge the new rule is to simply not include any humans in their AI slop images and videos. In other words, they can continue to post fake pictures of products without having to inform the consumer so long as they don’t show a fake person holding it.

Under normal circumstances we’d leave something like this next one for our weekly security column, but the utter lack of security in the Pope’s official “Click To Pray” mobile application revealed by researcher BobDaHacker on Friday is just too good a story to pass up. For one thing, who knew that there was an “official” prayer app? We don’t dabble in theology around these parts, but we’re fairly sure the good book didn’t mention anything about requiring a smartphone to give praise.

In any event, the service was so poorly constructed that you could simply step through the sequentially assigned numerical user IDs via the endpoint at api.clicktopray.org — because of course there’s a prayer API — and download any user’s personal information such as their full name, email address, and date of birth. There wasn’t even any rate limiting, so BobDaHacker was able to write simple script to quickly suck up the account details for each one of the service’s 700,000+ faithful users.

After waiting six months for a response from anyone at the Pope’s Worldwide Prayer Network, BobDaHacker took the story to the press. That seemed to get the pontiff’s attention, as the issue has now been addressed. Amen.

We know many readers appreciate a more minimalist approach to software, and still others are operating older devices that struggle with the admittedly ponderous bulk of the modern web. Both groups will likely appreciate brolly.sh, which provides a plain-text weather forecast for anywhere on Earth using data from Open-Meteo. It doesn’t just look the part either — we’re happy to report that if you pull down the forecast page for your location using something like wget, the resulting file is plain HTML which could be further parsed with grep and friends if you’re on a machine that doesn’t have a browser.

Speaking of older devices, Android Authority is reporting that Google has finally phased out support for Android 6.0 Marshmallow in Play services. This means that while devices running the older version of the mobile operating system will still be usable, they won’t be able to download software from the Play Store. Given that Marshmallow was released in October of 2015, this probably shouldn’t come as much of a shock. Any device out there that’s still running such an old release of the OS obviously hasn’t received any security updates in years, so the inability to download the latest mobile game should be the least of your worries if you are actually still using such a device as a daily driver.

Finally, given the impact Neuromancer has had on the hacker and maker communities over the decades, we felt obligated to point out that Apple has finally released a trailer for their upcoming adaptation. The ten episode series kicks off in January, and until now we haven’t had a good look at the aesthetic they were going for. Part of what made the novel so influential was how it described the world and the technology within it, but bringing those concepts to life on screen in a way that impresses modern audiences is going to be a unique challenge.

With how many hackers have put together their own real-world versions these last several years, we’re especially interested in the show’s depiction of cyberdecks. The novel itself doesn’t actually go into much detail about what they supposedly looked like, but contemporary illustrations were heavily influenced by 8-bit computers of the era from the likes of Amstrad and Atari. As much as we’d like to see something along those lines, we imagine a big-budget prestige television series probably demands something a bit sexier.

See something interesting that you think would be a good fit for our weekly Links column? Drop us a line; we’d love to hear about it.

The frontier of physical AI is a Jenga game in a warehouse in San Leandro, California.

That warehouse is occupied by Encord, a company that builds data tooling used to train AI models. Andrew Ceja is a pilot—the company’s term for its robotic trainers—and he’s carefully pulling wooden blocks from a tottering tower while wearing a headset with a camera that tracks what he sees. That alone is fairly common for collecting robot training data, but this headset includes sensors that measure his brain waves as he carefully disassembles the block tower.

Encord is one of a small but growing number of startups betting that the next real constraint on humanoid and warehouse robotics won’t be model architecture but instead the sheer scarcity of real-world physical training data. Rather than just helping robotics companies manage the data they have, Encord is building a business around manufacturing the data they don’t.

The brain wave headset Ceja is wearing was built by Zander Labs, a German neuroscience startup that’s betting measuring brain activity — to deduce mental states like error, intent and surprise — can create a more useful data set to train models. Encord’s work with Zander is currently a trial run; Encord says the goal is to build an initial brain wave-tagged data set, run it through customer robotics models, and evaluate whether it actually improves performance before deciding whether to scale it up.

Lucas Gehrke, a Zander neuroscientist supervising the work, says that the amount of brain activity used at any point during a given task offers clues for model builders trying to figure out when they need to deploy their highest-effort models.

This is the “bleeding edge” of the effort to solve the robotics data bottleneck, according to Vineeth Velmurugan, Encord’s head of robot learning. A veteran of OpenAI’s robot lab and Berkshire Grey, the warehouse automation firm, Velmurugan joined Encord to build the company’s internal data-creation team.

Encord was founded to help companies building machine-vision applications annotate data and evaluate models. As their customers—Velmurugan says they work with many leading robotics firms but that he’s not authorized to name them—began to apply end-to-end learning to robotic manipulation tasks, executives realized they would have to produce training data themselves, rather than simply manage it. “The data simply does not exist,” Velmurugan said.

The bet that generative AI can do for robots what it’s done for chatbots keeps running into this same wall. LLMs were built on the text of the entire internet, and more. Finding the same raw materials to teach neural networks about physical manipulation is challenging: self-driving car companies collect it themselves, but that’s hard to scale. Training from video can work, but it lacks the fidelity of real world data. Velmurugan says it will take a data set something like five times the size of YouTube’s video corpus to break through—a scale that helps explain why data-generation itself has become a business and not just a research problem.

Feed your egocentric data needs

Companies building robot brains are now turning to two main sources: “Egocentric” video collected by workers wearing cameras, often augmented with additional camera angles and other metrics, and collecting data from robots operated remotely. Encord does both, drawing egocentric data from several factories around the globe, and using its San Leandro facility to experiment with new modalities, like brain waves, or collect data sets around specific skills for fine-tuning.

When TechCrunch visited, pilots were using leader-follower rigs — paired robotic arms, one controlled directly by a human operator and one that mimics its movements —to create data about tasks like pouring coffee from a pot into mugs (very sloshy) and stacking poker chips. “Every humanoid company has asked us for these pieces,” Velmurugan says.

Storage racks held cartons of fake flowers in vases, books, plastic vegetables, kitty litter trays and scoops, bags and bundles of wires, the stock in trade for training manipulators for household tasks.

At one of these stations, another pilot, Sofia Infante, maneuvers robotic arms to plug and unplug ethernet cables from the back of a server—the kind of work data center operators would love to be automated, if only robots could manipulate them with the required precision. Taking a spin behind the controls, I was able to see why that’s still out of reach: Pincers are far less dextrous than human fingers and lack the degrees of freedom we take for granted in our arms.

Another new data modality that Encord is developing uses a set of sensors strapped to the forearm to detect electrical signals in muscles. Video taken of human hands manipulating objects typically doesn’t capture the entire hand, but Velmurugan hopes to build a 3D depiction of where the hand is at any time based on the arm sensors, creating a more robust understanding for models.

Encord’s data sets are annotated with physical descriptions of what each video contains—”right hand tightens bolt”—to aid LLM-based models in understanding what is happening. Velmurugan estimates this kind of dense annotation is worth 100 times as much as “junky ego data” for training specific tasks, and it only costs 20 times more to produce, which is a good trade, on paper.

But “20 times more” is still real money, and that’s the catch: scraping text off the internet, the way LLM makers built their models by pulling from Stack Overflow and the rest of the web, cost frontier labs next to nothing. Generating physical training data does not, and that’s the limit of the physical-AI-as-LLM comparison. This kind of data has to be manufactured, not just collected, and that changes the economics of building these models.

Velmurugan says that progress is being made—with Encord’s visibility into programs across the industry, he’s able to see start-ups and frontier labs alike figure out what works and what doesn’t to improve physical AI models. That vantage point—sitting between many robotics companies at once—is also part of Encord’s pitch. It can spot which data techniques are gaining traction industry-wide before any single customer can.

That will keep the dozen or so pilots at Encord’s facility busy. Both Infante and Ceja are part of a burgeoning workforce developing the building blocks for neural networks; they previously worked at Scale, another AI data annotation firm, before joining Encord.

Ceja had worked at a waste management company where his interest in technology found him in charge of keeping a robotic trash sorter in good working order. Now, as the Jenga tower topples, he says he enjoys the challenge of solving training tasks for robots —”It’s something new every day!”

A hot potato: A federal case in Atlanta is raising questions about a privacy-focused mobile operating system, with prosecutors arguing that its features were used to erase evidence. The US Department of Justice is attempting to prosecute Atlanta resident Sam Tunick under a federal statute that makes it a crime to destroy property in an effort to prevent it from being seized.

The case centers on Tunick’s use of GrapheneOS, an open-source operating system that works on Google Pixel phones and lets users enter a passcode to wipe a device clean.

Experts said the legal approach is unusual and may be the first time the law has been aimed at an operating system. “It’s concerning – and sends the message that [GrapheneOS] is criminal by default,” said Christophe Boutry, a cybersecurity and surveillance expert. Boutry and Bill Buddington, senior staff technologist at the Electronic Frontier Foundation, both said they had not seen a similar case.

The incident began at Hartsfield-Jackson Atlanta International Airport on January 24 of last year. Tunick had just returned from a trip to the Dominican Republic when he was stopped for questioning. According to court testimony, federal agents had already circulated his name and photo internally, saying he was under investigation for “suspected terrorism activities” because of his alleged association with the movement against Cop City.

Tunick was taken to a secondary screening room, where multiple agents questioned him. A motion filed by his defense argues the interrogation focused on child sexual abuse material as a pretext for investigating his connections to the protest movement. The motion also states that Tunick asked four times to speak with a lawyer and was denied each time. According to the same filing, agents did not present a warrant or read him his rights.

Government attorneys and agents pushed back during Monday’s hearing. They described the encounter as a routine airport inspection. Larry Findley, a Customs and Border Protection officer, said agents were “looking for anything that’s prohibited.”

During the questioning, agents repeatedly asked Tunick to unlock his phone and warned they would seize it if he refused. When he finally provided a passcode, the phone appeared to restart. The defense motion states that “the screen went blank, flashed several times, and the phone appeared to restart,” resulting in the loss of data.

The wipe is now central to the case. Prosecutors are treating it as an intentional act to destroy evidence, while the defense argues that the search violated Tunick’s constitutional rights and that the evidence should be suppressed.

The case raises questions about which constitutional rights apply at US borders, including international airports, where authorities have broader search powers. A judge is not expected to rule on the defense motion until at least late October.

GrapheneOS is designed to improve privacy and security on Pixel phones. Supporters say those tools are legitimate security protections, not evidence of criminal intent. Boutry pointed to France and Spain, where authorities have struggled to gain access to secured devices. He said authorities have treated the use of GrapheneOS itself as suspicious. In Catalonia, Spain, police have been profiling people carrying Pixel phones, assuming they have GrapheneOS installed and are drug dealers or gang members.

“The main goal [of the operating system] is protection of privacy,” Boutry said. “They’re our phones and the state can’t tell us how to use them.”

The case is tied to ongoing opposition to Cop City, a $109 million police training facility that opened last spring. The project has drawn opposition from activists concerned about police militarization and environmental impacts. Law enforcement officials have defended it as necessary for training and recruitment.

Previous attempts to prosecute protesters at the state level have foundered, while federal authorities have more recently stepped in, including a separate indictment announced last month.