While Spain vs Argentina battle it out in the 2026 FIFA World Cup final for football’s biggest prize, global stars will light up the stage in what will be the first-ever World Cup halftime show.

The show will be headlined by some of the biggest global stars, including Madonna, Shakira, Justin Bieber, and the popular South Korean band BTS. It’ll be curated by Coldplay’s Chris Martin and will also feature the famous Muppets from Sesame Street – characters that have been a cherished part of many Americans’ childhoods.

Open-weight AI models have been having a moment lately. Just this month, Moonshot’s massive Kimi K3 model landed close behind Claude Fable 5 and GPT 5.6 Sol in several benchmarks, all while remaining fully open-weight and downloadable by anyone.

However, Katie Paxton-Fear, a cybersecurity lecturer at Manchester Metropolitan University and staff security advocate at Semgrep, managed to poison an open-weight model and proved how easily that openness can be turned against you (via The Register).

How did the researcher poison the AI model so quickly?

Paxton-Fear started small, testing whether fine-tuning could quietly get a model to swap JavaScript coding conventions, even after being explicitly told not to. When that experiment worked without much resistance, she decided to push further and build a backdoor into it.

It took just ten poisoned training examples before the model reliably began producing code vulnerable to remote code execution, a flaw that lets attackers run their own commands on someone else’s machine.

The whole process cost under $100 and took roughly an hour. Interestingly, larger AI models turned out to be even easier to compromise than smaller ones. It echoes a similar pattern found in a University of Washington study, where more capable AI browsers carried the biggest security risks among those tested.

Why should this worry anyone using open weight models?

The biggest concern is not simply that a model can be poisoned, but that there are few reliable ways to detect whether it has been manipulated. Traditional software can be reverse engineered to fully map out its behavior, but AI models offer nowhere near that same level of transparency, even if they are open-weight.

A compromised model does not need to visibly malfunction to cause damage; it just needs to quietly influence decisions in ways nobody notices. Commercial closed models like Claude or ChatGPT aren’t fully off the hook either, since they demand plenty of trust while offering very little visibility into their inner workings. This research is a clear reminder that trusting an AI model blindly, open-weight or not, comes with real risk attached.

The 2026 World Cup final is here as Spain take on Argentina to be crowned champions. It is being billed as Lamine Yamal versus Lionel Messi, but the story runs far deeper than that as two of football’s biggest nations meet on the grandest stage.

Even better is that you can stream the World Cup final 2026 for free.

First, you’ll want to access the dashboard and generate your first reflect report. To do so, follow these steps:

1. Open your browser and navigate to claude.ai.

2. Click on your name and profile photo. 

3. Click Settings.

4. Select Reflect.

Claude will take a moment to generate your report. By default, the chatbot will summarize the last month of your usage, but you can also see the last three, six or 12 months by clicking the toggle at the top.

Once your first report is ready, you’ll see a short summary of your conversations with Claude. As of the writing of this article, you can’t see the exact amount of time you’ve spent using Claude. If you click the Time spent tab, the page just says “coming soon.” Ryn Linthicum, Anthropic’s head of wellbeing policy, told Engadget the reason for that is the company didn’t have an internal system for measuring time spent on Claude when it began working on the Reflect dashboard.

In any case, the dashboard gives you two different ways to manage your time on Claude. First, you can set break reminders, which the chatbot will deliver in the form of a nudge after you use it for a set amount of time. After just how much time Claude prompts you to take a break, is up to you. You can set reminders for every 15, 30 or 45 minutes, or every few hours. Separately, you can set quiet hours, which are designed to prevent you from using Claude during certain hours of the day. You can set different hours for each day of the week independently of each other. So, for example, on Monday you can put up a roadblock from 5PM to 8PM, while on Saturday you can set it from 12PM to 4PM.

As with any screen time tool, it’s ultimately up to you to honor the usage limits you’ve set for yourself since you can freely dismiss all of Claude’s nudges. If you want to tweak your break reminders, you can do so from the Time and focus section of the settings menu.

Anthropic

One more feature of the dashboard I’ll highlight here involves the AI fluency section, which you’ll find toward the bottom of the interface. Under this section, Claude will generate recommendations designed to streamline your usage of the chatbot. For example, if Claude finds you frequently re-establish the same or similar context when you go to write a question or request, it will recommend you use its Projects feature to group your prompts together, so that you don’t need to repeat yourself so often. In my testing, this tool has helped me use Claude smarter. So I recommend giving some of the tips Claude generates a try.

• Anthropic’s Claude extension flaws allow fake clicks to launch sensitive AI workflows
• Researchers found vulnerable handlers unchanged across eight extension updates
• Synthetic clicks bypassed checks designed to confirm real user actions

Security researchers at Manifold Security have claimed Anthropic’s Claude for Chrome browser extension contains two unpatched vulnerabilities in version 1.0.80, released July 7, 2026.

According to Manifold Security, it first reported both vulnerabilities to Anthropic through the company’s bug bounty program on May 21, 2026, and received acknowledgment the following day.

Christopher Nolan, the Oscar-winning director whose new version of “The Odyssey” is currently conquering the box office, said it’s been “pretty encouraging” to see deep skepticism of AI, especially from young people.

Nolan was responding to a question from interviewer Hugo Travers, who publishes on YouTube under the name HugoDécrypte. Travers brought up the legendary Trojan horse, which plays a key role in Nolan’s film — just as the horse was a gift concealing murderous Greek invaders, he wondered if AI might be something “that you welcome in your daily life” only to see it become “something else and something darker.”

Laughing, Nolan responded, “I think AI is a Trojan horse that everybody knows the Greeks are inside.” He later described the technology as “a transparent horse, it’s made of glass.”

“I’ve never seen a technology advancing so rapidly [that’s been] so completely rejected by the public,” he said. “Everybody’s suspicion of it is so extreme, particularly young people. The reaction to AI videos online and people my children’s age immediately calling it ‘AI slop’ and coining that term and just putting it in a box.”

In Nolan’s view, this is “a very healthy skepticism, because technology is always going to give us great gifts, as you say, but it has to be viewed with skepticism.” Similarly, he said, “The motives of the people giving it to us also have to be viewed with skepticism. That’s when we’ll get the best out of a new technology, rather than just blind faith that everything’s going to be great.” (Meanwhile, SpaceX CEO Elon Musk has been angrily posting about the film’s nonwhite and transgender cast members.)

Nolan didn’t get more specific about what he views as the threat from AI, but the technology has been a growing source of concern in Hollywood and was a major focus during the writers’ and actors’ strikes of 2023. The Directors Guild of America, where Nolan is president, also won some generative AI protections in its most recent contract.

The director has been famously resistant to other technologies, including smartphones; his embrace of film can make him seem simultaneously like a Luddite and a pioneer, with “The Odyssey” becoming the first feature film to be shot entirely on Imax film and cameras.

When The New York Times recently asked Nolan if he thinks of himself as a technophobe, he replied, “I think of myself as a techno-skeptic,” and said his love of film comes from the fact that it’s “better in terms of representing the way the eye sees the world than any digital imaging system I’ve seen.”

“I embrace new technology all the time, but it tends to be sold to people at the expense of systems that might still be valid and viable,” Nolan said. “That’s what I saw in my industry — throwing the baby out with the bath water. We almost lost film!”

Modern cars are no longer machines that stay the same after they leave the showroom. Increasingly, they’re becoming software-defined vehicles that receive new features, bug fixes, and security patches wirelessly, much like smartphones. But while over-the-air (OTA) updates have made vehicle maintenance easier and cheaper, cybersecurity experts are warning that the same technology could also become one of the automotive industry’s biggest security challenges.

Researchers and policymakers are now calling for stronger oversight as connected vehicles become increasingly dependent on remote software updates. Their concern isn’t just about hackers stealing personal data. It’s about someone potentially interfering with the operation of a moving vehicle.

The convenience of wireless updates comes with new risks

OTA technology allows manufacturers to remotely deliver software updates, firmware upgrades and security patches without requiring owners to visit a dealership. Tesla popularized the concept more than a decade ago when it began rolling out wireless updates for the Model S in 2012. Today, the feature has become commonplace across premium and mainstream vehicles alike.

For consumers, the advantages are obvious. Carmakers can quickly fix software bugs, improve battery management, add new infotainment features or even enhance driving performance without issuing expensive recalls. According to a CNBC report quoting Siraj Ahmed Shaikh, Professor of Systems Security at Swansea University, OTA updates have become an attractive alternative to traditional servicing because they reduce costs and shorten deployment times. Instead of waiting for scheduled maintenance, manufacturers can address issues almost instantly.

However, the same always-connected architecture that enables these updates also creates a larger attack surface. Cybersecurity analysts argue that internet-connected vehicles effectively function as rolling computers. If attackers were to compromise the update infrastructure or gain privileged access to vehicle software, the consequences could extend well beyond data theft.

Gabriel Lim, Senior Analyst at Singapore’s S. Rajaratnam School of International Studies, told CNBC that the issue represents a potential national security concern. Beyond questions surrounding user privacy, governments are increasingly examining whether foreign manufacturers or hostile actors could theoretically interfere with vehicle systems remotely. Those concerns have prompted several countries to reassess how connected vehicles should be regulated.

Governments are beginning to take the threat seriously

The debate intensified after Norwegian public transport operator Ruter conducted security tests on electric buses last year. The company reported that one vehicle’s battery and power management system could be accessed remotely through a mobile network connection. In theory, it concluded, the manufacturer could disable or immobilize the bus remotely.

Although the investigation focused on buses manufactured by Chinese company Yutong, experts caution that the problem isn’t unique to any single automaker or country. Instead, they see it as an industry-wide challenge tied to the growing adoption of connected vehicle platforms. The findings prompted authorities in both the United Kingdom and Denmark to launch their own investigations, with the UK’s Department for Transport working alongside the National Cyber Security Centre to examine potential vulnerabilities.

Similar concerns are also beginning to shape policy discussions in the United States. Earlier this year, the American Enterprise Institute argued that protecting connected vehicles from foreign espionage should become a strategic priority. The think tank recommended stronger security reviews, greater transparency around vehicle data collection, and tighter restrictions on certain foreign-made automotive software and hardware.

The implications stretch well beyond passenger cars. OTA technology is increasingly finding its way into buses, commercial fleets, rail systems, ships, industrial robots and drones. As more critical infrastructure becomes remotely updateable, experts say cybersecurity can no longer be treated as an afterthought. Wireless updates are undoubtedly making vehicles smarter and more capable. But they’re also changing the definition of automotive safety. In the software-defined era, protecting a car increasingly means protecting the code running inside it, because the next cyberattack may not target your laptop or smartphone. It could target the vehicle you’re driving.

Building a PC used to be a fun adventure — what’s the latest, what’s the greatest, what can I afford? Well, that last question seems to have taken over and sucked all the fun out for a lot of people. [Matt] from [DIY Perks] on YouTube has hit upon a solution that’s brought back the fun, at least for him: recycling! The video is embedded below, and he runs a forum whose thread has more details.

Long story short, though, he’s flagging recycled laptop components as both good value for money and a fun rabbit hole to go down researching parts. The best part, of course, is that you can get a mobo with 32GB of RAM soldered on, and embedded RTX graphics, and a decent processor for about what you’d pay for that RAM on sticks these days. The big hack is getting the dang thing started: he needed to make a single-pin ribbon cable after identifying which pin on the keyboard membrane hit the power button. If you can score a laptop that does not power on from the keyboard, you’ll have an easier time in that regard.

To take recycling further, he shows how to delaminate cracked glass from an old Intel iMac to get a better-than-4K retina screen for nothing but sweat equity. The unit was heading for the bin, and his only cost was the effort it took to extract the LCD panel. Some of us might be able to skip the laptop and just use the iMac; it depends on how much compute is enough for your use case. Maybe a 10-year-old iMac’s guts will do; maybe last year’s gutted laptop isn’t enough.

We have to admit, the oak-and-aluminum all-in-one tripod he makes is very snazzy, though it may have too little brass to be on-brand for [DIY Perks]. The speakers, in case you were wondering, are also e-waste, recovered from an old TV. Perhaps the accent colour should have been green instead of blue!

Thanks to [Keith Olson] for the tip.

Welcome back to TechCrunch Mobility, your hub for the future of transportation and now, more than ever, how AI is playing a part. To get this in your inbox, sign up here for free — just click TechCrunch Mobility!

Last week, I wrote about Uber and Waymo and how their partnership appears to be deteriorating. I predicted the two companies would end up on opposing sides of autonomous vehicle policy. That wasn’t a guess.

For the past several weeks, I’ve been talking to sources and digging through correspondence Uber sent to the D.C. Council, which is evaluating a proposed bill that would allow autonomous vehicles to operate in Washington, D.C.

What I found: Uber and Waymo are already on opposite sides of the proposal, sparring behind the scenes and in public. Uber has made a particularly interesting argument in its effort to shape the rules that govern autonomous vehicles.

Uber, which opposes the D.C. bill, argues it would displace for-hire human drivers and hand Waymo a de facto monopoly. Instead, it has lobbied for a system that would require robotaxis to operate on a ride-hailing network alongside human drivers.

Insiders tell me the “hybrid” approach has little chance of becoming law. But if it did, it would leave AV developers like Waymo with two suboptimal choices: either put their robotaxis on ride-hailing apps like Uber or employ human drivers alongside fleets of robotaxis that took years and hundreds of millions of dollars to develop.

A D.C. Council hearing on Monday drew representatives from Lyft, Tesla, Uber, and Waymo, along with dozens of disability rights and accessibility advocates, local business and industry groups, highway safety organizations, government officials, labor unions, and think tanks.

My takeaway — based on the public testimony and the calls and texts I received afterward — is that Waymo is one of the few companies that generally likes the bill. Much of the rest of the industry does not.

Tesla’s senior policy adviser, India Herdman, echoed concerns I’ve heard from multiple AV developers, including objections to the 180-day, 250,000-mile mandatory testing requirement; the $1 million application fee; the $5 million permit fee; and the $0.15-per-mile tax. Tesla, along with other companies, argued that testing miles accumulated in other jurisdictions should count toward the mileage threshold.

Waymo, which has been testing its AVs with human safety operators in Washington, D.C., has already surpassed the 180-day and 250,000-mile requirements. That means if the bill passed as written today, Waymo would enter the market with at least a six-month head start.

Deals!

Uber is considered a ride-hailing and delivery giant. It is now cementing that status through a $14.8 billion deal to acquire Germany’s Delivery Hero. 

If the deal closes — and it will absolutely take time to overcome the regulatory hurdles — Uber will get access to nearly 100 markets across Europe, the Middle East, Latin America, and Asia. The upshot: Uber’s delivery footprint will double.

Delivery Hero also made a separate agreement to sell its business in 14 markets, where Uber Eats is already operating, to New York-based investment firm SSW Partners for $1.6 billion.

Other deals that got my attention …

Self Inspection, a San Diego-based startup trying to disrupt the vehicle inspection process, raised $10 million in a round led by the family office of Sheryl Sandberg. Tire distributor U.S. AutoForce and automotive lender Westlake Financial made strategic investments. Early-stage funds Costanoa Ventures, Rebellion Ventures, and BrightCap Ventures also invested.

Senra, a startup modernizing how wire harnesses are made, raised $65 million in a Series B round co-led by Lowercarbon and Interlagos with participation from General Catalyst, Sequoia Capital, Andreessen Horowitz, and Founders Fund, among others.

Zepto, the Indian fast-delivery company, is seeking a valuation in an initial public offering well below its $7 billion peak, Bloomberg reported, citing anonymous sources.

Notable reads and other tidbits

Chip Motors, a Miami-based startup, revealed a low-speed small EV designed for short errands and families, and with some automated driving capabilities.

The Los Angeles Police Department is reportedly ending its deal with Flock Safety, a surveillance company that helps law enforcement track vehicles using thousands of its license plate cameras placed across the United States.

Lucid Motors is pushing back — and hard — on a report that claimed the EV maker was weighing whether to file for Chapter 11 bankruptcy. The company’s comms team, its CEO, and a filing with the U.S. Securities and Exchange Commission all say the same thing: The rumors are false. The initial report sent the company’s stock down more than 50% on Tuesday, its biggest intra-day drop ever. The stock has since recovered and is now trading about 28% higher than it was prior to the big drop. 

Lyft CEO David Risher says it’s the “Good Uber,” per Wired.

Manual, or standard, transmission vehicles are a dying breed, according to preliminary government data that shows just 0.6% of new vehicles made for the U.S. in 2025 had stick shifts, the Washington Post reported. I own two manual vehicles. Does that make me a driving unicorn?

The National Transportation Safety Board said the driver of a Tesla who crashed into a house in June had pressed the accelerator pedal to 100%, overriding the company’s Full Self-Driving (Supervised) software.

San Francisco mayor Daniel Lurie has urged state regulators to toughen rules on autonomous vehicles after Waymo robotaxis became immobile in heavy July 4 traffic, ran out of power, and blocked key streets, further compounding the gridlock. In a letter (parts of which are excerpted here) Lurie outlined four core requirements he would like to see enacted to ensure robotaxi companies can “perform reliably” during extraordinary events. 

SpaceX abruptly aborted the second attempted launch of its upgraded Starship rocket system on Thursday, just moments after the booster ignited at the company’s complex in South Texas.

Zoox issued a software recall after one of its robotaxis got confused by smoke emitting from an emergency fire scene in June.

One more thing …

Uber chief product officer Sachin Kansal talks to TechCrunch EIC Connie Loizos about travel, AI agents, and playing both sides of the robotaxi race, in the latest Strictly VC podcast episode. If you’d rather read the interview, check out the Q&A.