Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands.
The attacks started five days after the software vendor released a security update to address the issue, and two weeks before disclosing it publicly.
Researchers at threat intelligence company Vega documented the malicious activity and reported that the attacks lasted roughly a week, each with several distinct phases.
Weaver E-cology is an enterprise office automation (OA) and collaboration platform used for workflows, document management, HR, and internal business processes. The product is primarily used by Chinese organizations.
CVE-2026-22679 is a critical unauthenticated remote code execution flaw affecting E-cology 10.0 builds prior to March 12.
The flaw is caused by an exposed debug API endpoint that improperly allows user-supplied parameters to reach backend Remote Procedure Call (RPC) functionality without authentication or input validation.
This lets attackers pass crafted values that are ultimately executed as system commands on the server, effectively turning the endpoint into a remote command execution interface.
According to Vega, the attackers first checked for remote code execution (RCE) capabilities by triggering ping commands from the Java process to a Goby-linked callback, and then proceeded to multiple PowerShell-based payload downloads. However, all these were blocked by endpoint defenses.
Next, they attempted to deploy a target-aware MSI installer (fanwei0324.msi), but this failed to execute properly, and no follow-up activity was observed.
After those failed attempts, the attackers reverted to the RCE endpoint, using obfuscated and fileless PowerShell to repeatedly fetch remote scripts.
Throughout all attack phases, the threat actors executed reconnaissance commands, such as whoami, ipconfig, and tasklist.
Vega explains that although the attackers had the RCE opportunity by exploiting CVE-2026-22679, they never established a persistent session on the targeted host.
Users of Weaver E-cology 10.0 are recommended to apply the security updates available through the vendor’s site as soon as possible.
“Every attacker process we observed is parented by java.exe (Weaver’s Tomcat-bundled Java Virtual Machine), with no preceding authentication,” explained Vega, adding that “the vendor fix (build 20260312) removes the debug endpoint entirely.”
No alternative mitigations or workarounds are listed in the official bulletin, so upgrading is the only recommendation.
AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.
At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.
We’ve seen just about every possible way to make a clock here at Hackaday over the years. So it’s rare to have a first, but here we are with [Twisted & Tinned], who’s made a novel clock with a diffraction grating.
The display of the clock looks for all the world like a jumble of LEDs, that is, until you place the grating in front of it. Those LEDs are addressable multi-color parts, and each digit is generated at a different color all on top of each other. The grating splits out these colors, resulting in a magical set of floating LED figures.
Behind those LEDs is a Pi Pico, but that’s just one of many microcontrollers that could have powered this project. It’s the use of the diffraction grating in a novel way with those LEDs that makes the difference, and we rather like it. He’s also managed to get the grating pattern in the 3D printed surround for a shimmering look, by printing directly onto a diffraction grating sheet. That in particular is a technique we’ve looked at before in detail.
The Trump administration is moving to dismantle the National Science Foundation’s $368 million Ocean Observatories Initiative, a network of more than 900 deep-sea instruments used to monitor ocean currents, marine ecosystems, carbon absorption, heat waves, fisheries, coastal flooding, and climate change. The NSF said it would send ships in June to begin the removal of the instruments anchored off Oregon, Washington, Alaska, North Carolina, and an area between Greenland and Iceland known as the Irminger Sea. The New York Times reports: The ocean observation system began operating in 2016 and was expected to continue for 25 years. Jim Edson, a marine meteorologist who led the Ocean Observatories Initiative, called it “the world’s most advanced continuously operating ocean observing systems.” When it was first proposed, the science foundation said it was important to have a long-term presence at scientifically important sites in the Atlantic and Pacific oceans. Removing the instruments could take 15 months. Seismic instruments positioned around an active underwater volcano off Oregon will continue operating until 2028.
Each observation station consists of several moorings that secure long arrays of devices connected to wires. The devices measure ocean currents as well as chemical and biological conditions from the water’s surface down thousands of feet. The instruments were hardened to resist the pressure of the deep ocean, corrosive seawater as well as marine plants and animals that can foul electronics. Remotely controlled robotic vehicles and gliders around the moorings collect and transmit data to research laboratories.
It cost $48 million annually to operate the network. The Trump administration repeatedly tried to shutter it, proposing to cut its funding by 80 percent in both 2025 and again in 2026. Congress pushed back, restoring the money. To try to reduce costs, managers turned off some of the instruments and collected less data, according to a December 2025 presentation about the observatories at the annual meeting of the American Geophysical Union, a nonprofit organization of scientists. Still, the science foundation moved ahead to decommission the observatory network.
A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link.
Microsoft classifies a software flaw as a zero-day if it is publicly disclosed and/or actively exploited with no official patch currently available.
As researcher Ammar Askar explained in a blog post on Tuesday, this VS Code vulnerability allows attackers to install malicious extensions that steal GitHub OAuth tokens when they are passed to github.dev (a browser-based version of Visual Studio Code used to work on GitHub repositories) by exploiting VS Code’s sandboxed webview message-passing system.
The proof-of-concept exploit he also released on Tuesday abuses this system by running malicious JavaScript inside a webview to simulate keypresses in the main editor and install an extension that extracts the GitHub OAuth token sent to github.dev and queries the GitHub API to enumerate all private repositories the victim can access.
“This functionality is achieved by github.com POSTing over an OAuth token to github.dev that allows it to interact with GitHub on your behalf,” Askar said. “The token is not scoped to the particular repo you interacted with, meaning it has full access to every other repo that you have access to.”
While the vulnerability is not yet patched and has not yet been assigned a CVE ID, VS Code users can protect themselves by clearing cookies and local site data for github.dev in their browser by clicking the Settings icon in the URL bar, and then going into Cookies and site data > Manage on-device site data.
This will ensure that they will get a “The extension ‘GitHub Repositories’ wants to sign in using GitHub.” warning when clicking on links attempting to exploit this flaw.
Askar said they notified GitHub one hour before disclosing the bug and noted that they chose immediate public disclosure due to a prior negative experience with Microsoft’s security response process, in which a previously reported VS Code bug was silently fixed without credit or acknowledgment of the security impact.
“That was mostly a courtesy to GitHub, the intent here was full public disclosure. In my past experience reporting github.dev bugs to them, they tell you that it’s out of scope and go report it to MSRC. And as I outlined in the article, I really don’t want to deal with MSRC on VSCode bugs,” he added.
“To summarize the last time I interacted with MSRC regarding reporting a VSCode bug, it was a horrible experience where they silently fixed ‘the bug I pointed out without any credit. They also marked it as not having any security impact.
“As I mentioned in that post, going forward I would be doing full public disclosure for any security bugs I found in VSCode.”
This follows another stream of zero-days in various Microsoft products disclosed by an anonymous security researcher using the ‘Nightmare Eclipse’ online handle who also expressed his discontent with how the Microsoft Security Response Center (MSRC) handles the disclosure process.
Over the past several months, Nightmare Eclipse disclosed the BlueHammer, RedSun, GreenPlasma, and MiniPlasma privilege escalation zero-day flaws (the first two now being exploited in attacks), YellowKey (a Windows BitLocker zero-day that grants access to protected drives), and UnDefend (another zero-day that can be exploited to block Microsoft Defender definition updates).
Initially, Microsoft reacted to Nightmare Eclipse’s zero-day leaks with threats of legal action, followed by a tweet stating it would work “with law enforcement as appropriate” when “an individual breaks the law and engages in malicious activity causing real harm to our customers.”
BleepingComputer reached out to Microsoft for a comment on the VS Code zero-day flaw disclosed by Askar, but a response was not immediately available.
Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.
This guide covers the 6 surfaces you actually need to validate.
Healthcare cybersecurity in 2026 is defined less by novel attack techniques than by a widening gap between which controls organizations report having and which controls are reducing loss.
Our portfolio data from 2023 through mid-2025 shows that social engineering, backup gaps, and weak data governance drive the majority of material losses in healthcare claims.
Director of Customer Engagement at Resilience.
The headline numbers already tell part of the story. U.S. healthcare organizations reported 275 million records breached in 2024, more than double the prior year and the largest single-year exposure in the sector’s history.
Ransomware attacks against healthcare climbed 32 percent over the same period, and the Change Healthcare incident alone exposed an estimated 190 million individuals.
The useful question for CISOs, CFOs, and boards is not how big the breaches got. It is what claims data reveals about which threats are driving losses and which investments are measurably reducing them.
Social engineering drove 88 percent of material losses across our portfolio in the first half of 2025, and healthcare-specific claims followed the same pattern. Phishing, business email compromise, and vendor compromise show up repeatedly in the underlying incident data, alongside backup gaps that leave organizations exposed when ransomware lands and tracking pixel errors that quietly expose patient information.
The threat actor landscape is also more distributed than the most visible groups suggest. While BlackCat and Cl0p appeared most frequently in healthcare-related activity, the actual successful intrusions were spread more evenly across operators like Interlock, Lockbit, and Medusa. That distribution matters for defenders, hardening against the loudest names while remaining exposed to lesser-known operators is a specific failure mode the data keeps surfacing.
Extortion demands have also climbed. In the first half of 2025, healthcare-related incidents in the portfolio carried extortion demands as high as $4 million. Those costs carry a different weight when patient care is at stake and the alternative to paying is not just operational disruption but clinical risk.
Five controls show the highest measurable risk reduction in healthcare environments in our portfolio: secure email gateways, immutable backups, multi-factor authentication on all remote access, formal data governance, and regular tabletop exercises that include clinical operations. None of these are exotic, and most healthcare organizations can implement them without a transformational budget request.
Two findings in the portfolio data stand out as specific to healthcare. Immutable backups deliver stronger risk reduction in healthcare than in other industries on average, largely because ransomware against clinical systems creates a different recovery calculus than ransomware against, say, a manufacturer’s ERP software. And organizations with a formal data governance committee see more than three times the risk reduction compared to peers in other sectors, a reflection of how much of healthcare’s exposure lives in the data layer itself, not just the endpoint.
The pattern matters more than any single control. Every control on the list operates before or during an incident, not after. That is where the measurable risk reduction lives.
Healthcare CISOs face a specific version of a universal problem: the controls with the highest modelled risk reduction are often the least visible to executive leadership, and the controls most visible to executive leadership are often the ones with the weakest loss-reduction signal. That asymmetry is what quantifying cyber risk is meant to close.
In practice, the healthcare organizations getting ahead on this are doing three things. They are translating control adoption into dollar terms their CFO can evaluate against other capital decisions. They are prioritizing spend against the specific controls the claims data identifies as high-ROI in their sector, rather than defaulting to a framework checklist. And they are running tabletop exercises that include clinical leadership, not just IT, because the decisions that determine whether a ransomware event becomes a patient-care event are not purely technical.
Two contrasting examples from our portfolio make the point. A mid-sized regional health system believed its security posture was stronger than it turned out to be and discovered the gap the hard way during a major ransomware incident, including the discovery that clinical imaging files had been left out of its backup strategy. Recovery costs, regulatory exposure, and care disruption compounded.
A mid-market biotechnology firm took a different path. It built a quantified, prioritized cyber risk program, mapped its controls against its largest modelled loss scenarios, and was able to redirect security spending toward the controls with the highest return. When an attempted business email compromise hit, the controls worked, and the claim never materialized.
The gap between those two outcomes was not budget. It was how each organisation decided what to spend the budget on.
Three moves are defensible, specific, and available without a transformational program. First, audit the organization’s backup posture against a realistic ransomware scenario, including clinical systems and imaging data, not just administrative files. In our portfolio, backup gaps are one of the single largest drivers of healthcare ransomware severity.
Second, measure social engineering resilience directly. Tabletop exercises, phishing simulations, and control reviews of email gateway posture are faster to run than most organizations assume, and social engineering’s share of material loss makes them high-ROI by any reasonable measure.
Third, translate the top three or four risk scenarios into dollar terms and walk them to the board. The CFO conversation goes differently when the ask is framed as loss reduction, not technology spend. Risk quantification is what makes that reframe defensible.
This shows the need for risk quantification on plausible material loss scenarios; without it, budget conversations stay abstract while the exposure stays real. It requires a willingness to let the claims data, rather than the vendor roadmap, set the priority list.
We feature the best cloud backup services.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
One billion is the number apps spend years chasing and most never reach. ChatGPT got there faster than anything before it. OpenAI’s app crossed 1 billion global monthly active users in May, roughly three years after launch, according to estimates from Sensor Tower, making it the quickest app in history to the milestone.
The pace is the point. ChatGPT reached a billion monthly users faster than Google Maps, TikTok, Instagram and YouTube, products that defined consumer software in their eras. The comparison flatters ChatGPT and also says something about the moment: AI assistants have moved from novelty to default habit in a span that earlier categories measured in many more years.
A caveat belongs up top, because the figure is an estimate. The billion comes from Sensor Tower’s market intelligence, not from OpenAI’s own audited disclosure, and counts monthly active app users rather than total users across web and API.
The order of magnitude is widely corroborated; the precise number carries the usual uncertainty of third-party measurement, and is worth citing as an estimate rather than a reported fact.
The milestone lands in the middle of an intensifying contest with Anthropic. By the same Sensor Tower reckoning, Anthropic’s Claude app had about 56 million global monthly active users, a fraction of ChatGPT’s base, but growing at roughly 640% year on year.
The two numbers tell different stories: ChatGPT owns the consumer mass market, while Claude is growing fast from a smaller base, with particular strength among developers and in coding.
That split runs through the rest of the rivalry. OpenAI has leaned into consumer scale and prosumer subscriptions, recently launching a $100 ChatGPT Pro plan pitched directly at Claude’s power users.
Anthropic has built a formidable enterprise and developer business, crossing $30bn in annualised revenue and attracting investor offers at an $800bn valuation. Raw app users are one scoreboard; revenue and developer loyalty are others, and the two companies lead on different ones.
What a billion users buys OpenAI is distribution, the asset that turned earlier consumer-software winners into durable franchises. Reach at that scale compounds: more usage generates more data, more feedback and more pricing power, and it sets the default that competitors have to dislodge rather than merely match.
For a company spending heavily on compute and racing to convert free users into paying ones, a billion monthly actives is the top of a funnel nobody else has built.
The harder question is what the number is worth. Monthly active users are not paying users, and the economics of AI remain punishing: inference is expensive, free usage is a cost rather than a revenue line, and OpenAI’s challenge is converting a vast audience into a sustainable business before the spending catches up with it.
A billion people trying ChatGPT is a triumph of adoption. A billion people paying for it would be a different milestone, and the one that actually matters.
For now, the record stands on its own terms. No app has reached a billion monthly users this quickly, and the category that produced it barely existed three years ago. Whether ChatGPT’s lead in users translates into a lead in the business is the contest the next year will settle. The audience, at least, is no longer in question.
For the past 10 years, Uber’s annual Lost & Found Index has provided a rather quirky anthropological snapshot of its riders — and even a few insights into society. The annual catalogue of millions of forgotten items ranges from mundane modern-day tools such as smartphones and laptops, to more eyebrow-raising objects like live fish, an ankle monitor, a toboggan, a package of live butterflies, and a single Louboutin shoe.
This year, Uber is using the report to highlight the same old problem of lost items with a new twist: robotaxis. Thousands of items (it’s a bit too new for millions) were left behind in robotaxis on Uber’s ride-hailing network in the past year, the company said Tuesday. There were the usual suspects of phones, keys, wallets, passports, and headphones, along with a few items that strayed into the who-is-this-rider category: a set of dentures, an “I Heart Hot Dads” bag, and a blue hat that reads “Emotional Support Human.”
Beyond this entertaining list lies a business opportunity, if a minor one. Even in a future of robot taxis, someone still has to return the things passengers leave behind.
Uber has spent the past several years locking up dozens of partnerships with autonomous vehicle (AV) technology companies. But it really wasn’t until March 2025, when the “Waymo on Uber” robotaxi service launched in Austin, that the commercial wheels on its AV business started turning. Since then, Uber and Waymo have also started a robotaxi service in Atlanta. Uber has added other AV companies to its app in the past year, including Motional in Las Vegas and Avride in Dallas, although these still have human safety operators behind the wheel.
That Uber has already logged thousands of lost items in just 12 months gives some sense of just how many robotaxi rides have been completed on its app. The underlying message here is that Uber’s existing network is already set up to reunite riders with their lost items, including a 15-pound yo-yo, one large black marble duck, a Squishmallow, and a Charli XCX poster.
When an Uber rider forgets belongings in a robotaxi, the process for recovering them is similar to any other Uber ride: open the app, click the activity tab, select the trip during which the item was lost, and contact customer support. Riders are then able to message, chat, or call a support agent. If the item is located, they have two options: pay $15 for an Uber Courier driver to provide same-day local delivery, or pick up the belonging in person from an AV depot, where the vehicles are stored and serviced.
Uber Courier is a rebrand of Uber Connect, which launched in 2020 and allowed users to send packages and personal items between local addresses. But Uber says there is more to its robotaxi support network than repurposing existing services.
“With tens of millions of lost items reported on Uber each year, we’ve spent the last decade building systems that help riders quickly and seamlessly reunite with their belongings,” Amy Satrom, global head of autonomous support at Uber, said in a statement. “As autonomous rides continue to scale on Uber, we’re bringing that same expertise to AVs — combining our fleet operations, support teams, and hybrid network to make getting a lost item back simple, even when there’s no driver behind the wheel.”
In February, the company announced Uber Autonomous Solutions, a new business division that conveys its bigger ambitions around driverless tech. The division provides companies with a suite of services that handle all the tasks associated with operating a robotaxi, self-driving truck, or sidewalk delivery robot business, including software and support services.
And Uber clearly means to make AVs a major revenue driver. The company plans to offer robotaxi rides through its app in as many as 15 cities globally by the end of the year and has said it intends to be the largest facilitator of AV trips in the world by 2029.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Perplexity, an AI-powered search and answer engine, has a new way to turn personal devices into decentralized data centers.
The company said Tuesday that it’s adding a new hybrid local-server system to Personal Computer, its AI agent that can work across files, apps and the web. Starting in July, the system will automatically decide which parts of a task should run directly on a user’s device and which should be sent to more powerful AI models in the cloud.
A smaller model running locally could handle sensitive data and routine work locally, such as financial records, health information and personal files. More complicated work that requires the capabilities of a larger AI model could still be sent to a server.
Today we’re announcing that hybrid agentic inference is coming to Perplexity Computer.
Computer can split tasks between a local model running on your machine and frontier models in the cloud. This keeps private data on your device and maximizes token efficiency.
Coming soon. pic.twitter.com/6t3PrmI1FX
— Perplexity (@perplexity_ai) June 2, 2026
Perplexity says its system will make that decision automatically, breaking a larger task into smaller parts and routing each one to the appropriate place. Users won’t need to choose between a local model and a cloud-based model before getting started.
Personal Computer is currently available through Perplexity’s Mac app. It expands the company’s existing Computer agent with features including local file editing, computer use and browsing through Perplexity’s Comet browser. Perplexity also said that Personal Computer is coming to Windows.
Although the current app is available on Mac, Perplexity is pitching the underlying technology as a broader system that can work across different types of hardware. The company said it unveiled the system with Intel and that the same framework runs on other local silicon, including Nvidia’s RTX Spark platform.
Moving more work onto users’ devices could also reduce the amount of expensive cloud computing required to complete AI tasks. Perplexity argues that routine work shouldn’t consume the same data center resources as a request that genuinely needs one of the most capable AI models.
Designers at GM’s new Advanced Design studio in Pasadena have created a pair of electric concepts that shrink the classic HUMMER size while opening up far more ways for owners to shape the vehicle around their plans. The HUMMER X truck and its SUV counterpart land in the midsize category yet deliver serious off-road geometry and a fresh approach to building and modifying them over time.
The studio opened its doors last week, providing a perfect opportunity to showcase these two vehicles. They’re both developed on a modular platform based on four fundamental ideas: easy reconfigurability so you can change things up on the go, robust performance on challenging terrain, drivers can stay connected no matter where they are, and materials designed to last far longer than they should. Neither is being considered for production right now; they are more experimental, allowing GM to explore ideas for a future HUMMER model that will appeal to drivers who enjoy getting out and exploring.
The exterior lines are extremely clean and basic, with a flat roofline that goes from front to rear, gently rounded edges to avoid abrupt creases, and visible bolts and laser-welded seams for a mechanical appearance. Removable fender flares sit above huge Goodyear tires set on bead lock wheels with a function that adds security while you’re pushing it to its limits. Underbody protection runs the length of both vehicles, and the Multimatic shocks absorb all road bumps.
Capability is where the true magic of these designs happens, or more specifically, a combination of geometry and real-world testing that has resulted in some pretty impressive specs. The SUV is 188.3 inches long with a 116-inch wheelbase. With 13.2 inches of ground clearance, an approach angle of 44 degrees, a departure angle of 46 degrees, and a breakover angle of 30.9 degrees, it is among the best in the midsize off-road class. The truck version is slightly longer, measuring 207.3 inches overall with a 130.7-inch wheelbase. It has 12.5 inches of ground clearance, a 41.5-degree approach angle, and a 29.7-degree departure angle, and both use slightly more than 57% Flex Fab construction, which we’ll get to in a minute
Flex Fab is where things really become interesting, since it is a technology that allows for on-demand manufacturing, removing the need for massive stamping dies and stationary equipment. Small manufacturing runs become absolutely realistic, and you can swap out a body part, fender, or interior item. This platform is the polar opposite of traditional production in that it can accept multiple designs without having to start from scratch each time.
Inside, the dashboard is likewise highly adaptable, with multiple screens that can be stacked or set side by side depending on your trip. One of the panels can actually communicate with a small drone, which takes off on trails, maps out risks and route options in real time, and then returns to the vehicle. It’s the ultimate off-road accessory since you can change the digital layout for rock crawling or highway driving without having to go back to the store or disassemble the whole car.
GM has also considered sustainability in these designs. When possible, snap fittings and mechanical fasteners are employed instead of permanent glue. Many components are produced from recycled materials, such as seatbacks and instrument panels fashioned from old vehicle fascias. The design also makes it easier to disassemble the gadget in the future, allowing materials to be reused rather than discarded.
[Source]
The token-hungry developers were there. Nvidia CEO Jensen Huang was there (virtually). The Chainsmokers were there. But Microsoft’s rumored Copilot “Super App” was not.
According to various reports and screenshots posted on social media over the past couple of days, Microsoft’s Copilot Super App was ready for its close-up. Reports indicated that the Copilot Super App is meant to provide a single Copilot experience, or shell, with various modes, possibly including a Copilot Chat mode; GitHub Copilot coding mode; Cowork mode for knowledge workers and prosumers; the “Scout” OpenClaw-based work mode; and some kind of Autopilot always-on agent mode.
Some had expected Microsoft could make the Copilot Super App its “one more thing” announcement during the kick-off keynote at the Microsoft Build 2026 conference on June 2. But the app, in whatever form it currently may exist, was a no-show.
It wasn’t a total wash, however. CEO Satya Nadella did mention the Super App in passing.
“Come summer, we will be bringing coding to all knowledge work within one Copilot Super App. That’s really exciting. So you’re going to have Chat, Cowork, and Code all in Copilot,” Nadella told the Build audience in San Francisco.
The premise of a Copilot super app makes sense on several fronts. Microsoft is looking for a way reclaim its early-mover position in AI coding that it carved out with GitHub Copilot. The company needs an answer to the growing popularity of Anthropic’s Claude Code and OpenAI’s Codex. And given Microsoft is working to unify its consumer and commercial Copilot experiences, an all-in-one Copilot workspace could provide a neat solution.
Jacob Andreou, recently appointed executive vice president of Copilot, is charged with this unification and reports directly to Nadella as part of a small team replacing long-time head of Microsoft’s Experiences and Devices unit, Rajesh Jha.
Andreou has what I’d consider a daunting task. And not just because he is based in Los Angeles and came to Microsoft just a year and a half ago via an unconventional path (Snap and then Greylock Partners).
Microsoft originally tried to position its various Copilots as a single product, even though they used different data sources, had different interfaces and provided different types of access.
More recently, officials acknowledged this and made distinctions between consumer Copilot, GitHub Copilot and Microsoft 365 Copilot for businesses as separate, but related offerings. But now the company seems to be veering back toward trying to make Copilot seem like a single entity in terms of brand and across consumer and enterprise lines.
Last week, Microsoft took a step toward improving the Microsoft 365 Copilot user experience with a redesign, which made the prompt box bigger and results appear more quickly. But it didn’t go so far as to show off how the new UI will dovetail with the coming Super App.
A couple of the supposed elements of the Super App did get airtime at Build. Scout, which Microsoft describes as a “personal agent for work” is built on the open-source OpenClaw framework. Scout can access data in Microsoft apps like Teams, Outlook and SharePoint thanks to Microsoft’s WorkIQ context layer, so it can proactively handle tasks such as prepping for meetings and fixing scheduling conflicts without having to ask users for approval.
@media (max-width: 600px) {
aside.callout { float:none !important; max-width:100% !important; margin-left:0 !important; margin-right:0 !important; }
aside.callout .callout-img { display:none !important; }
}
Microsoft is making Scout available to its customers in its “Frontier” testing program starting today, June 2. Up until now, it’s been in testing inside Microsoft.
If Scout sounds familiar, it should. Scout is the official name of the OpenClaw skunkworks project that’s been the focus of Microsoft Corporate Vice President Omar Shahine and team (profiled here on GeekWire last month). Microsoft has been working to add guardrails around OpenClaw and Scout to try to allay security fears that many enterprise companies, including Microsoft itself, have expressed about OpenClaw’s always-on way of operating.
Scout is considered the first public example of this new category of always-on agents that Microsoft is calling “Autopilots.”
After sitting through the three-hour (!) Build opening keynote, I was left wondering why Microsoft didn’t show off, even fleetingly, the coming Copilot Super App.
Was it because execs felt they had so many other announcements that they didn’t want it to get lost in the mix? They’re waiting for the “Ask Copilot” taskbar feature to go live on Windows 11? Or maybe the Super App is just not yet stable enough to demo? (Given how quickly Microsoft is moving from idea to private testing with Scout, making sure a product is baked before showing it publicly doesn’t seem to be much of a concern at Microsoft.)
Sure, the pressure is on with AI to announce or be eclipsed, like never before. And Microsoft is no stranger to “creatively architected” demos of not-yet-finished products. (I see you, Longhorn.)
But can Microsoft really move from pilot to shipping products at this pace and not alienate enterprises that have substantial security, compliance, data-residency and other hefty requirements? I guess we’ll see….
Amazfit has launched the Balance Ultra, a new flagship smartwatch meant for users who track their workouts closely but may not always pay the same attention to recovery.
Recovery is one of the most important parts of training, because poor sleep, high stress, and badly timed rest days can directly affect progress. The new smartwatch aims to make that easier to track by combining workout data with sleep, stress, heart rate, HRV, blood oxygen, breathing, and recovery metrics through the Zepp App.
The Balance Ultra is built around Amazfit’s Hybrid Training System, which is meant to give users a clearer view of how ready their body is for another workout. Instead of only recording completed sessions, the watch looks at training load, recovery, and lifestyle signals to help users decide whether to push harder or slow down.
Amazfit supports this with features such as BioCharge, LifeLoad, Training Load, Weekly Focus, Training Balance, and Hybrid Training Plans. BioCharge gives users a sense of their energy levels throughout the day, while LifeLoad factors in the strain caused by stress and daily activity. Training Balance and Weekly Focus then help place recent workouts in context, so users are not left looking at separate sleep, stress, and fitness numbers without knowing what they mean together.
The watch also comes with official HYROX tools, including training plans, race simulations, virtual pace support, and post-race analysis. That makes it more relevant for users who mix running, strength training, endurance work, and gym-based competition formats.
The hardware is also more premium than Amazfit’s standard fitness watches. The Balance Ultra has a Grade 5 titanium case, sapphire glass protection, 10ATM water resistance, and a 1.5-inch AMOLED display with up to 3,000 nits of brightness. It also supports dual-band GPS, six-satellite positioning, offline maps, route guidance, Bluetooth calling, Zepp Flow voice control, voice notes, music storage, apps, and contactless payments.
Battery life is one of its stronger claims. The company says the Balance Ultra can last up to 30 days with regular use, up to 10 days with the always-on display enabled, and up to 50 hours with continuous GPS. The Amazfit Balance Ultra is available through Amazfit.com for $599.99.
Israel says it has killed new Hamas military leader in Gaza City airstrikes
Waymo dominates autonomous vehicle registrations as Tesla trails behind
This is BROKEN! INSANE 5x MONEY CAR WASH WEEK! The NEW GTA Online UPDATE Today! (GTA5 New Update)
SpaceX just won a second Golden Dome contract. This one is $4.16 billion.
SHE IS KILLING XRP!!! WATCH URGENT AND ACT FAST
FIRST NIGHT REVIEW: Take That bring the Circus back to life in spectacular sun-soaked style
Jade Biosciences, Inc. (JBIO) Discusses Positive Interim Results From JADE101 Phase I Healthy Volunteer Study and Development Plans Transcript
The Samsung pay deal is the moment Korean unions changed register
CFTC Has Approved the First Regulated Bitcoin Perpetual Contract in the U.S.
SpaceX’s $2 Trillion IPO: Why Tech Giants Nvidia (NVDA), Apple (AAPL), and Microsoft (MSFT) May Face Pressure
The Most Misunderstood Sci-Fi Horror Movie of the Last 10 Years Just Took Over Netflix
Novak Djokovic v Joao Fonseca LIVE: French Open latest scores and results after Jannik Sinner’s shocking collapse
Is the Spurs Phenom Already Better Than Prime Diesel?
Snowflake (SNOW) Stock Rallies on Strong Q1 Results and AI Product Growth
Weak ‘Supergirl’ Box Office Tracking Amid Milly Alcock Backlash
Demand Conditions Improve In Chemicals Sector In April 2026
MicroStrategy Moves $30 Million in BTC to Coinbase Prime: Is the Bitcoin Sell-Off Already Here?
The House | Inside Andy Burnham’s Makerfield Campaign: “Nobody Thinks This Is In The Bag”
This Week In Security: Ubiquiti Fixes, And FreeBSD Joins The Club You Don’t Want To Join
Maddox Jolie-Pitt Legally Requests to Drop Brad’s Surname
You must be logged in to post a comment Login