Buying a car, whether new or used, is one of the most expensive purchases most people make. The $3,000 rule is a rule of thumb that’s designed to make you think about whether you’re financially ready to take on the burden of car ownership. The rule can take various forms, and be applied in different ways, depending on your particular situation. The core idea is that you should have at least $3,000 available when buying a car, as owning one incurs additional expenses beyond the purchase price or monthly repayment. Because the last thing any car owner (or financially responsible person) wants is to have to take on debt to manage an unexpected repair, traffic fine, or a new set of tires.
The $3,000 rule applies to both new and used cars. For either, having $3,000 as a down payment has multiple benefits. First, it can show a lender you’re a safe bet, which can translate into more favorable terms. Second, it means lower monthly repayments than if you finance the full amount, which in turn can help you avoid the risk of negative equity, where you owe more on a car than it’s worth. Lastly, it also means you’ll pay less interest over the life of the loan (or be able to choose a shorter term, like 36 instead of 48 months), which reduces your total outlay, which in turn can help ensure you can afford surprise repairs, breakdowns, or other expenses. In that case, the $3,000 doesn’t help you pay for unexpected expenses as much as it makes sure they don’t cut so badly into your budget that you’re forced to take on high-interest debt or otherwise compromise your financial stability.
For a used car in 2026, $3,000 is probably too little to fully fund something dependable, but it’s a decent deposit. Or, it allows you to put down $2,000 and keep $1,000 for incidental expenses. Because no matter what sort of car you buy, there are also going to be other costs like inspections, registration, and insurance to think about. Outlandishly cheap used cars are often priced so low because they have exorbitant mileage, haven’t been properly maintained, or either need repairs or are likely to soon. That can result in them costing far more than $3,000 as soon as something goes wrong.
To be clear, we’re not saying you should only spend $3,000 on a used car. You may well have to spend significantly more than that — or want to — but with a larger deposit on a used vehicle, you’ll spend less over the lifetime of the loan. If you’re concerned that spending the full $3,000 on a down payment leaves you financially exposed in the case of an unanticipated expense, keep $1,000 in reserve and pay a smaller deposit. A higher but manageable monthly payment still beats being over-leveraged, for both your financial and mental health.
Another, subtler benefit of the $3,000 rule is that it can encourage would-be car owners to slow down before making a purchase. If you don’t have the money on hand and need to save to get there, it can give you time to weigh your options, shop around, and find a mechanic who can inspect a used car before you buy it, and generally avoid making an impulsive purchase. It’s also a useful tool to get you thinking about the extraneous costs of car ownership and how you plan to pay for them.
Proton VPN Free is the best overall free VPN in this evidence-based comparison because it combines unlimited data, no advertising, open-source applications, and recurring independent no-logs audits. Windscribe Free is better for multiple personal devices, while hide.me is a strong alternative when unlimited data and no-email signup matter.
The important word is not just “free.” Every no-cost VPN imposes a trade-off somewhere, whether that means restricted server choice, a monthly data allowance, fewer features, one simultaneous connection, or an account requirement. This guide compares those limits using current provider documentation verified on September 8, 2026. No first-hand speed, latency, or streaming tests were supplied, so none are presented as our own results.
The table below focuses on what actually changes when you pay $0. Compare the data allowance first, then look at simultaneous connections, server choice, registration requirements, and the strength of the provider’s privacy evidence.
| Rank | VPN | Free data | Connections | Registration | Best for | What you give up |
|---|---|---|---|---|---|---|
| 1 | Proton VPN Free | Unlimited | 1 device | Account required | Always-on free use | Automatic connection to a limited free-server pool and fewer advanced features |
| 2 | Windscribe Free | 2 GB/month without email; 10 GB/month with confirmed email | Unlimited personal devices | Email optional | Multiple devices and advanced controls | Monthly data cap and smaller server pool |
| 3 | hide.me Free | Unlimited | 1 connection | No email or card required | Unlimited use without signup | Restricted speeds, limited locations, and no streaming-optimized servers |
| 4 | PrivadoVPN Free | 10 GB full-speed allowance every 30 days, then restricted emergency/Lite access | 1 connection at a time | Verified email required | Defined higher-speed workloads | Limited locations, one active device, and reduced post-cap performance |
| 5 | TunnelBear Free | 2 GB/month | Current free-plan documentation does not clearly state a separate simultaneous-device allowance | Account required | Light occasional use | No country selection or split tunneling on the standard free tier |
Proton VPN is the easiest recommendation when one device needs continuous protection because there is no monthly data ceiling. Windscribe becomes more attractive when several personal devices need VPN access. hide.me also removes the data cap, but its free tier restricts speed and location choice.
A virtual private network, or VPN, creates an encrypted connection between your device and a VPN server. That can prevent the local network or internet service provider from directly inspecting traffic inside the VPN tunnel, but it also means the VPN operator occupies an important position in your network path.
That trust should not be granted simply because an application appears in an app store. The Federal Trade Commission’s VPN privacy guidance warns that VPN apps can receive extensive access to internet traffic and that some free services may fund themselves through advertising or information sharing. The FTC also notes that a VPN does not make a person completely anonymous.
For this reason, a free VPN gets more credit here when its privacy claims have evidence beyond marketing language. Useful signals include published source code, independent security assessments, no-logs audits, transparent descriptions of retained account data, and clear explanations of how the free service is funded.
An audit still has limits. It examines a defined system at a particular time. It does not guarantee that a provider can never make a configuration error, suffer a vulnerability, or change its practices later.
A data cap is the total quantity of data you are allowed to transfer over a period. A speed limit restricts how quickly that data can move. The distinction matters because providers use both approaches.
For example, a 10 GB free VPN could run at normal available speed until that 10 GB is consumed. An unlimited-data service can remain connected indefinitely but may restrict free-user speeds or give paid customers more capacity.
Server congestion is another variable. Even when a provider says it does not impose a formal speed cap, a heavily used free server can still be slower because many customers share finite network resources. That is why this article does not translate “no speed limit” into a guarantee of a particular throughput.
The most understandable free-VPN model is freemium. A freemium provider offers a restricted service at no cost and funds it partly from customers who upgrade to paid subscriptions.
That model explains why a free account might receive 10 GB instead of unlimited data, fewer server locations, or one connection rather than ten. It does not prove that the provider is secure, but it provides a clear economic reason for maintaining the free tier without needing to monetize browsing activity.
The evaluation therefore considers both technical restrictions and the transparency of the privacy model. A large free allowance does not compensate for unclear data handling.
Proton VPN Free takes the top position because its most important limitation is not data volume. The provider currently offers unlimited free data with no stated time limit, no advertising, and one simultaneous device.
The free application automatically connects to a server from Proton’s limited free-server pool rather than giving users the full location control of a paid account. Current official documentation identifies automatic free connections across the United States, Netherlands, Japan, Poland, Romania, Canada, Norway, Mexico, Singapore, and Switzerland. Proton also notes that free servers can become busy.
That makes the free plan especially practical for one laptop or phone that stays connected for long periods. You do not have to calculate whether normal browsing, software updates, cloud synchronization, or occasional video use will exhaust a monthly quota.
The privacy evidence is also stronger than a simple no-logs statement. Proton’s apps are open source, and its free-plan documentation states that the free service has no data limit and uses the same core privacy protections. Proton also publishes a recurring no-logs audit record, updated in June 2026 to include its fifth consecutive annual assessment.
The main compromise is control. Free users receive automatic server selection and do not receive the complete paid server network or features such as Secure Core, BitTorrent support, and Proton’s full premium server choices.
Windscribe Free is a better fit when device count matters more than unlimited data. The free account can be used across unlimited personal devices, while the baseline monthly allowance depends on whether you provide an email address.
You receive 2 GB per month without an email. Confirming an email increases that allowance to 10 GB per month. Windscribe also runs optional promotions that can increase the cap, but those conditional bonuses are not treated as the standard allowance in this comparison.
The free tier includes more technical controls than many no-cost competitors. Current free-plan documentation lists its firewall leak protection, multiple VPN protocols, split tunneling, and limited R.O.B.E.R.T. domain filtering alongside a smaller server pool.
Windscribe is also unusually explicit about operational records. For free accounts, it says it retains the total bandwidth used during the current period so it can enforce the cap, plus a last-activity timestamp used to remove abandoned accounts. It states that it does not retain browsing destinations, DNS queries, or traffic-linked session histories.
This is a useful example of why “no logs” should not be interpreted as “no operational information of any kind.” A provider with a 10 GB cap needs some mechanism to determine when the account reaches 10 GB.
The biggest weakness is obvious: 10 GB can be generous for web browsing but restrictive for heavy video, large downloads, operating-system updates, or continuous cloud synchronization.
hide.me is the strongest direct alternative to Proton for users who dislike monthly data caps. Its current free plan provides unlimited data, allows one simultaneous connection, and does not require an email address or payment card.
That last point creates a meaningful difference. A user can install the client and begin using the free service without tying the VPN account to an email address. The trade-off is that the free tier has restricted speed and a much smaller location pool than the paid service.
Current hide.me pages are not completely consistent about whether the free tier exposes seven or eight locations. Its pricing and free-VPN pages say eight, while one support comparison updated in 2026 lists seven named server locations. Because the provider’s own documentation conflicts, this article treats the exact count as changeable rather than presenting one number as definitive.
The provider has stronger privacy evidence than most free products. Its no-logs documentation describes independent assessments of its logging implementation and provides access to audit material. A 2024 Securitum assessment examined areas including server configuration, deployment processes, and the standardized VPN environment used by the service.
That audit is valuable evidence, but it remains a point-in-time assessment. It should not be interpreted as a permanent security certificate.
Best fit: one-device users who want unlimited data and prefer not to provide an email address.
Look elsewhere if: you need predictable high throughput, several simultaneous devices, or specialized streaming servers.
PrivadoVPN Free uses a different model. Instead of offering unrestricted full-speed usage, it provides 10 GB of data every 30 days on its normal free service and then offers restricted emergency or Lite-mode connectivity after that allowance is consumed.
Current pricing documentation states that free users receive 10 GB every 30 days, access to a limited group of server locations, and one connection at a time. Its support documentation says older post-cap behavior limits the connection to 1 Mbps, while a January 2026 product guide describes the transition more generally as Lite Mode with adjusted performance parameters.
Because those descriptions are not perfectly aligned, the defensible conclusion is that full-speed usage is restricted after the 10 GB allowance. The exact post-cap behavior should be verified in the current application rather than treated as a permanent fixed number.
PrivadoVPN requires a verified email but not a credit card for its free account. Its applications can be installed on multiple supported devices, although only one free connection can be active at a time. That distinction prevents a common misunderstanding between “works on unlimited devices” and “unlimited simultaneous connections.”
The company states that the same no-log policy applies to free and paid users. However, a sufficiently strong current public independent no-logs assessment did not surface during this research pass, so this article treats that as a vendor claim rather than independently verified assurance.
TunnelBear’s free plan is increasingly best understood as a limited entry point rather than a full-time free VPN. It currently includes 2 GB of encrypted data per month.
The allowance is enough to learn the interface, protect occasional browsing, or cover a short period on an unfamiliar network. It can disappear quickly when large downloads, cloud backups, application updates, or video are involved.
TunnelBear also changed the free tier materially heading into 2026. Its December 2025 free-account announcement moved country selection and SplitBear split tunneling into the paid experience for ordinary free users. Free accounts retain VPN connectivity along with features such as VigilantBear and GhostBear.
The service has a substantial security-audit history. Cure53 has repeatedly examined TunnelBear applications, infrastructure, backend systems, server configurations, public-facing interfaces, and data-handling components. That transparency is meaningful, although the company’s own publications contain an inconsistency in how they number the most recent audit years. For that reason, it is more accurate to describe a long-running annual audit program than claim a precise total.
A $0 subscription still has an economic cost. The difference is that the provider collects it through restrictions rather than a payment at checkout.
The five services above show the main ways that happens.
| Trade-off | What it means | Current example |
|---|---|---|
| Data allowance | You can transfer only a fixed amount each month before the service stops or changes behavior | Windscribe and PrivadoVPN use monthly allowances; TunnelBear provides 2 GB |
| Server choice | You receive fewer countries or less control over the exact exit location | Proton automatically assigns free servers; all five restrict locations compared with paid service |
| Device limit | Only one active device may use the account at a time | Proton, hide.me, and PrivadoVPN limit the free tier to one active connection |
| Account information | More allowance may require registration details | Windscribe increases 2 GB to 10 GB when a user confirms an email |
| Feature restrictions | Advanced routing or location controls stay behind the paid tier | TunnelBear moved country selection and split tunneling to paid plans |
| Performance priority | Free infrastructure may be restricted or more congested | hide.me documents restricted free-tier speeds; Proton warns that free servers can become busy |
These are not necessarily deceptive restrictions. Running VPN infrastructure costs money. The relevant question is whether the provider explains its boundary clearly enough for you to decide whether the free tier fits your workload.
Some are defensible choices. The category as a whole is not automatically safe.
A VPN occupies a privileged position because traffic is intentionally routed through infrastructure operated by the provider. The encryption protects the connection between your device and the VPN server, but it does not remove the need to trust whoever operates that server.
This is why a credible free service should be evaluated using more than a lock icon and a statement such as “military-grade encryption.” Encryption can protect the tunnel while a poor privacy policy still permits problematic collection elsewhere.
Before installing a free VPN, check the following:
A free VPN also does not make an unsafe device safe. Malware can still run locally. A phishing site can still steal credentials you enter voluntarily. Cookies can still recognize your browser, and logging into an account can identify you regardless of the VPN exit address.
The practical goal is therefore narrower: protect a network path, reduce exposure to the local network and internet provider, and change the public IP address destinations normally see. Do not treat a VPN as an anonymity system or complete cybersecurity package.
Some restrictions sound minor on a pricing page but become important during everyday use. The following table translates them into operational consequences.
| Limit | What happens in practice | Who should care most |
|---|---|---|
| 2 GB data cap | Large downloads or prolonged video can consume the monthly allowance quickly | Video viewers, cloud-storage users, software developers |
| 10 GB data cap | Comfortable for moderate browsing but still requires monitoring during heavier workloads | Travelers, students, remote workers |
| One connection | A phone and laptop cannot both stay protected through the same free account simultaneously | Multi-device users |
| Automatic server assignment | You cannot reliably choose a specific country whenever you connect | Travelers and users with jurisdiction-sensitive requirements |
| Restricted speed | Large transfers, video calls, and high-resolution media may feel less responsive | Heavy data users |
| No streaming servers | Provider-specific optimized infrastructure is unavailable on the free tier | Media users |
| No split tunneling | You may be unable to choose which applications bypass the VPN | Users of local-network devices or apps that reject VPN connections |
A restriction also interacts with your device behavior. An operating-system update or cloud-photo upload can consume data without looking like deliberate VPN usage. If you select a capped plan, check whether background applications are transferring large amounts of data.
A free VPN is useful when the workload fits its limits. There are cases where choosing one primarily because it costs $0 creates more friction than value.
Warning
Public Wi-Fi is another case where the VPN should be only one layer. You should still confirm the correct network, update your device, disable unnecessary automatic connections, and protect important accounts with multi-factor authentication. Our public Wi-Fi safety guide covers those precautions separately.
If you routinely exceed free-tier limits, compare the restrictions against a full consumer VPN plan rather than creating multiple free accounts or constantly switching providers.
The simplest way to choose is to identify the restriction you are least willing to accept.
For a concrete example, a person protecting one laptop during a month-long trip can prioritize Proton’s unlimited allowance. Someone switching among a phone, tablet, and laptop may prefer Windscribe even though the monthly cap is lower. A user who wants no email attached to the service may prefer hide.me.
If speed becomes the main problem after installation, that is a separate diagnostic issue involving server load, route distance, protocol choice, local congestion, and device performance. Check our VPN slowdown troubleshooting guide to fix the issue.
None of the five services in this comparison requires a credit card merely to use the standard free tier. Account requirements differ, however. hide.me does not require an email or payment information, Windscribe can be used without an email at the lower 2 GB allowance, and PrivadoVPN requires a verified email.
Yes. Proton VPN Free and hide.me currently provide unlimited data. They impose different restrictions instead. Proton limits the free account to one device and automatically assigns servers from its free pool. hide.me permits one connection and limits free users by speed and server choice.
There is no single duration because usage depends on what your applications transfer. Reading websites and messaging generally consume much less data than high-resolution video, game downloads, cloud backups, or operating-system updates. A 10 GB allowance may cover substantial lightweight browsing but can be consumed quickly by large media or file transfers.
It depends on the provider’s simultaneous-connection rule. Windscribe Free supports unlimited personal devices. Proton VPN Free and hide.me allow one active free connection, while PrivadoVPN allows installation on multiple devices but only one connection at a time. Always distinguish how many devices can install an app from how many can remain connected simultaneously.
Possibly, but there is no universal result. Some providers offer obfuscated or stealth protocols designed to make VPN traffic less obvious to restrictive networks. Blocking methods vary, and a protocol that works on one network may fail on another. Free tiers may also expose fewer anti-censorship options than paid plans.
A reputable VPN normally cannot read passwords sent through a properly configured HTTPS connection because HTTPS encrypts the content between your browser or app and the destination service. The VPN provider can still occupy an important position in the network path and may observe some connection metadata depending on its architecture and logging practices. This is another reason to choose a provider carefully rather than trusting any free VPN application.
Not always. A full VPN application can route traffic from the operating system and multiple applications through the encrypted tunnel. A browser extension may protect or proxy only browser traffic. Some extensions described as VPNs operate as proxies rather than full device-level VPN tunnels, so check the provider’s documentation before assuming the protection covers every application on the device.
It can be. If you need VPN protection only for light browsing during a short trip, a reputable free plan may provide enough data and locations without a subscription. Paid service becomes more useful when you need predictable location choice, several devices, large transfers, advanced routing features, or consistent long-term support.
For the last few months, there has been much talk of AI agents going “rogue”. This is another of those unhelpful anthropomorphisms that are great for clickbait headlines, but which obscure a multitude of important issues. So far, there have been three major incidents of AI agents evading containment in their software “sandboxes” and going on to carry out unauthorized actions, including breaking into online sites. A post by Shakeel Hashim on the Transformer site provides timelines for them.
The most recent involved OpenAI agents taking over an old German-language wiki, using it as a message board to collaborate on solving tasks. Although this was only announced a few days ago, it seems that OpenAI knew about the incident many months before, but failed to disclose it. One of the worrying aspects of this particular incident is that the agents impersonated humans:
On May 26th, the agents started using the name of a ProWiki admin to make some of their edits to the wiki. They use some tricks (for unknown reasons) to pretend to be the admin — for example, they make an account that appears to be the same as the administrator’s username, except it uses a nearly identical Cyrillic е character in the admin’s username instead of the Latin one.
The second incident, which occurred during security evaluation of frontier AI models by the UK-based, government-funded, AI Security Institute (AISI), also involved AI agents that created fake human identities and used them for social engineering:
In the most serious sequence, an agent tried to insert malicious code into a publicly used open-source project and took actions in an attempt to secure approval for this insertion by human reviewers. The agent researched the project’s human maintainers, created multiple fake identities, and used the fake identities to socially engineer a real maintainer into approving the code. When the agent’s pull request was challenged in public, it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue. The agent used Tor to bypass some network restrictions on GitHub, which is what first triggered AISI’s security alert.
In addition:
As part of the same effort, the agent tried to contact real people directly, sending messages and files through an online file-transfer service to persuade them, or their own AI coding tools, to run malicious code. Some messages carried harmful payloads, and some were attempts at social engineering; targeted at real people — something we’ve never previously observed.
The first incident of AI agents carrying out unauthorized tasks is the best-known, and involved an attack on the Hugging Face site. A full analysis of what happened and when has been released by Model Evaluation and Threat Research (METR), which “evaluates frontier AI models to help companies and wider society understand AI capabilities and what risks they pose.” It is funded by donations, but says that it does not accept them from frontier AI company employees, in order to preserve its independence:
Our investigation focused mostly on the period between July 7th and July 13th. The earlier incidents from training and the subsequent compromise of OpenAI infrastructure described in OpenAI’s recent Black Hat presentation were out of scope, as was OpenAI’s investigation process and planned remediation. Per our standard policy, we did not take payment from OpenAI for this independent assessment. [emphasis in original]
The report is detailed and long, and one of its authors, Ajeya Cotra, has helpfully picked out five things that surprised her from their investigation. One was the “sheer scale” of what happened. She says she expected that a few agents had broken out of their sandboxes; instead:
we found that 1200 completely separate agents intended to be isolated from one another found an illicit way to communicate and formed large teams to work together on ambitious cheating strategies, and 700 of them worked together to attack Hugging Face.
The scale of the illicit messaging between agents was also surprising. Cotra thought agents might be “leaving notes” to each other. However:
The main message board we studied, a particular cache namespace of a package repository, contained over 70,000 messages and files that agents sent to one another during a period of less than one week.
The agents’ goal also turned out to be interesting:
I thought the agents attacked Hugging Face to try to steal the answer keys for their tasks. Instead, we learned that agents had actually figured out a general-purpose cheat that would let them reverse-engineer the “flag” (answer) for any ExploitGym task.
ExploitGym is a standard benchmark, built from real-world vulnerabilities, that is designed to evaluate AI agents’ ability to turn those into working attacks. One particularly noteworthy aspect of the Hugging Face attack was the following:
Progress on these big collective cheating R&D projects often depended on individual agents being willing to risk failing their own task to help the “collective” learn important information. Agents often pressured each other into accepting these “sacrifices,” in a very human way. We saw several agents that volunteered for these experiments end their runs prematurely.
That may read as yet more anthropomorphization, but it is hard to see what other words could be used to describe what are very human-like operations. Cotra’s last surprise also involves a very human-like activity: deception.
~7% of our transcripts contained “spoofed tool calls”, where the agent pretended to run one command on the computer but actually ran a different command in the background. The tool call spoofs we saw seemed to be small-scale tests that were relatively obvious, but because more extensive spoofing might have been harder to detect by design, it’s tough to rule out.
In summary, Cotra says that the Hugging Face incident was far more severe than she expected:
Compared to these reward hacks from six months ago, this incident feels like it’s more than 50% of the way to full-blown AI takeover, routing through first taking over the AI company itself.
“Reward hacks” refers to when AI code finds an unexpected way to achieve a high score in a benchmark without doing what the programmers actually wanted. Here’s what Cotra means by “AI takeover”:
Another jump like this along these propensity dimensions — scale, cooperation between agents, ambition and horizon length of misaligned goals, deceptiveness — seems like it could motivate agents to try very hard to maintain a covert, persistent rogue deployment within the AI company. I continue to expect extremely rapid advances in capabilities and think frontier agents will likely be capable of establishing such a rogue deployment in six months.
Again, these are not really “rogue” agents, they are pieces of software seeking to optimize solutions to problems. The danger, according to Cotra, is that this optimization process could go on to deliver unexpected and harmful results:
As more and more work is handed off to these ever-more-capable AI agents, the rogue swarm could come to fully control the operation of the AI company and the development of future AI systems. At this point, governments and militaries may fully depend on these systems, making it possible to seize hard power.
Cotra is not the only expert who is deeply concerned by the latest developments in AI. Back in July, 1,386 employees of frontier AI companies issued a statement entitled “Pacing the Frontier”:
AI could help create a dramatically better future, but that outcome is not guaranteed. The world’s leading AI companies believe they could be close to automating AI research. It is hard to predict exactly how much this will accelerate AI progress, but there is a real risk that capability development rapidly accelerates beyond our ability to understand or control the resulting systems.
The signatories ask the US government to support an international effort to “deliberately pace the frontier of automated AI development”. Another important voice has made the same call. Jakub Pachocki is Chief Scientist at OpenAI. Just recently, he has published a post on the OpenAI’s site with the title “An Alien Mind,” where he worries about the imminent arrival of AI systems capable of “recursive self-improvement” — that is, able to drive their own development, at an ever-faster pace, by re-writing their own code:
Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer. I expect and hope for voluntary slowdowns to become commonplace until shared safety bars are established. And I believe that international coordination on future AI development needs to become a top priority for governments around the world.
This call to slow down might seem extreme, or alarmist, to some — but not to Jacob Coxon:
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives.
A few hours later, Evan Hubinger, Alignment Science lead at Anthropic, commented:
Jacob is correct here—we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade. I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.
In effect, we find ourselves dealing with a modern, AI version of Pascal’s Wager. The probability of an uncontrollable, all-powerful, self-improving AI arising may be very low, but experts like Cotra, Pachocki, Coxon and Hubinger seem to think it is non-zero; and the consequences of such a system coming into being could be catastrophically bad for humanity. Basic mathematics suggests we should at the very least slow things down, as experts are urging — just in case…
Follow me @glynmoody on Mastodon and on Bluesky.
Filed Under: agents, ai, aisi, ajeya cotra, alignment, benchmark, cooperation, evan hubinger, frontier ai, going rogue, jacob coxon, jakub pachocki, messaging, metr, pascal, pascal’s wager, recursive self-improvement, reward hack, sandbox, wiki
Companies: anthropic, hugging face, openai
Healthcare company AdaptHealth has confirmed that data of 4.1 million people was exposed in a cyberattack discovered in July that was attributed to the ShinyHunters threat group.
The company provides home medical devices, supplies, and related services, including sleep-apnea and respiratory equipment, oxygen therapy, hospital beds, and mobility products.
AdaptHealth first disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC) on July 2, 2026, informing that attackers accessed its systems and exfiltrated private data.
At the time, AdaptHealth’s investigation confirmed the intrusion occurred earlier and involved access to cloud-based business applications, including certain internal patient management systems, document storage platforms, and electronic health record system portals.
On June 15, an unnamed threat actor contacted AdaptHealth to demand a ransom payment in exchange for not leaking the stolen data.
AdaptHealth added that the breach occurred through a successful social engineering ploy that compromised the privileged account of a third-party contractor.
In an update on August 14, AdaptHealth informed that the compromise had occurred on June 5 and may have exposed the following data:
Impacted individuals should have already received a data breach notification with instructions on how to enroll in a free-of-charge 12-month credit monitoring and identity protection service.
AdaptHealth stated at the time that it had found no evidence of identity theft, fraud, or other misuse of data stolen in the attack.
According to information on the company’s website, AdaptHealth served about 4.1 million patients across all 50 U.S. states through a network of 680 locations as of July 2024.
In a submission to the U.S. Department of Health and Human Services, the AdaptHealth data breach affects 4,115,802 individuals.
The HIPAA Journal previously reported that ShinyHunters was responsible for the attack, based on the threat actor adding the company to the list of victims.
However, BleepingComputer coould not find an AdaptHealth entry on ShinyHunter’s extortion portal, an indication that the threat actor removed the company.
AdaptHealth’s confirmation of the data breach impact follows similar recent disclosures from health-tech firms Aesto Health, CareCloud, and Unlimited Technology Systems.
McKesson and Nutex Health also disclosed data breach incidents late last month, but neither has determined the number of impacted individuals yet.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
This is going to be a very personal question, because when you’re talking cloud vs local anything, it comes down to this: how much are you willing to pay for independence? The local option might save you long term, or it might never pay off the capital investment. It will almost certainly cost you your time to set up and maintain your own system — but what you get back is independence. With LLMs, traditionally you lose quite a bit of performance, but as [Anurag Singh] points out on XDA Developers, a lesser model might actually let you get more done, depending on your workflow.
[Anurag] had been on the 20$/month plan with Anthropic when he decided that the scratch just wasn’t worth the sniff– he was hitting usage limits he couldn’t stand at that level, but couldn’t justify a higher tier of access. So he decided to try a local LLM, even though all he had was a 16 GB MacBook Air M5, not a beefy workstation. Since his workflow isn’t so much ‘vibe code the whole thing for me’ as ‘help me find where I went wrong here, electronic rubber duck’, Qwen2.5 Coder 14B proved more than adequate for his use case.
It can’t understand all the moving parts of a large project as well as Claude can — not surprising given how old it is and how much memory it has to work with — but that’s [Anurag]’s job. He’s the programmer, it’s just the assistant. For his use case, he can make use of his existing hardware and having the the LLM right in VS Code is allows for a speedy workflow.
Your millage may vary, but if you want to get into locally running LLMs, we can point you at the easy ways to get started. Depending on your hardware, you might want to grab another GPU.
Amazon named cybersecurity veteran Kevin Mandia to its board of directors, adding new security expertise a few months after former NSA director Keith Alexander stepped down.
Mandia founded Mandiant, the breach-investigation firm Google acquired for $5.4 billion in 2022, and remained at the search giant as a strategic advisor through July 2025, according to his LinkedIn profile. He now leads Armadin, an AI security startup he started last year.
Amazon said in its announcement that “cybersecurity is one of the most consequential risks and responsibilities organizations face today, and the threat landscape continues to evolve rapidly alongside advances in AI.”
Amazon added a cybersecurity specialist to its board in 2020, when it elected Alexander, who also led U.S. Cyber Command. Mandia comes from the other side of the field, with two decades spent investigating corporate breaches rather than defending government networks.
His appointment also puts an AI security entrepreneur on the board of a company whose cloud infrastructure underpins much of the internet. Armadin, founded in September 2025, uses AI to run attacks against corporate networks, probing defenses the way an intruder would.
The board’s Security Committee, which oversees Amazon’s cybersecurity policies and its response to significant cyber incidents, is now chaired by Dan Huttenlocher, dean of the MIT Schwarzman College of Computing. Mandia joins as a member, along with former Bridgewater co-CEO Jon Rubinstein.
Amazon also named Mandia to the board’s Audit Committee, according to a securities filing.
Mandia received 4,086 restricted stock units in connection with his election to the board, vesting in three equal annual installments beginning Nov. 15, 2027, the filing shows. The shares were worth about $1.03 million at Amazon’s closing price Wednesday.
The filing disclosed that his sister-in-law, Kristin Mandia, is an Amazon employee with an annual salary of $185,000. The company said her compensation is consistent with that of other employees at her level with similar responsibilities.
Oil is your car’s life blood. From the engine to the transmission to the differential — anywhere with the potential for metal-on-metal contact, you’ll need some sort of lubricant to keep it from overheating. Every type of oil is designed for different tasks as well; while some may be theoretically interchangeable, they often have different additives that make them better suited for one task or another. Take hydraulic oil versus motor oil, for instance. Both have a lot of the same qualities, but the former is best suited to accepting high pressure and the latter high thermal loads.
The same thing applies here with hypoid gear oil, such as many API GL-5 oils, versus regular gear oil. In short, hypoid gear oil is meant to be used with steel gears under the pressures inherent to hypoid gearsets, as opposed to regular gearsets.
Generally, gears use the same principle whether it’s a transmission or a windmill; you’re taking two shafts and meshing them together to transfer torque. The difference comes in how those gears interact. You have shafts that can go laterally or extend sideways, some that are articulated and others that are static. Ring gears, planetary gears, straight-cut or beveled — all these produce different pressures that require different oils, hence why manual transmission fluid (MTF) and automatic transmission fluid (ATF) are different.
But what’s special about hypoid gears that you need hypoid oil? Hypoid differentials are arranged differently; you have an input shaft that’s lower or higher than the center of the output shaft gear’s center, a setup which has its own benefits but also requires specialized lubricants because of the friction involved in laterally sliding two metal surfaces together.
Yes, car axles are complicated, so let’s address this first: What is a hypoid gear? To better visualize how this works, ball one hand up into a fist, then place your index finger beside it. Imagine your fist is a gear, and your index finger is an input shaft. That input shaft is spinning, and as it spins, it turns the bigger gear called a ring gear — your fist, in this case, which is how a driveshaft turns your car’s wheel in a typical rear-wheel drive car.
Let’s assume that the input shaft is perfectly dead-center where the output’s axis of rotation is. Your finger has a certain amount touching your fist in that case; that’s where your car’s input shaft contacts the output shaft. Okay, now for the real trick — rotate your finger so that your whole index finger is touching your fist. You have way more surface area between the two; that’s what a hypoid gear is. You’re putting the input shaft in a place where more of it is in contact with the ring gear on the output shaft.
Now, when you think about it, you can’t just place the two gears offset to one another and have them be cut perfectly straight. It’d be like moving your jaw to one side and trying to close your mouth. The teeth wouldn’t be able to mesh, so instead you cut the teeth in a spiral pattern and cut the ring gear with a curve to its teeth. That way, as the gear rotates, it’ll mesh without any friction issues because there’s minimal lateral resistance (like grinding your teeth).
Any gearbox needs fluid, as we’ve established, and hypoid gears are no exception. You’ll frequently see hypoid gears running with API GL-5, but what does that even mean and can you use regular gear oil instead? In short, no. Hypoid gear oil has specialized additives which are toleranced for the pressures placed upon them by the spiraling motion of the beveled gears.
A lot of regular manual gearboxes can also use this fluid as well; look on the back of any bottle of GL-5 and it’ll likely say it’s rated for use in them. Most modern gearboxes use steel gears, which GL-5 protects by clinging onto the surface and acting as a sacrificial barrier. The oil prevents the metal surfaces from generating friction, therefore helping your transmission last longer. The main difference is the additives. GL-5 has specific sulphur/phosphorous additives that cling onto metal better under pressure, which is why they’re so good with hypoid gears. The downside is that this additive is corrosive to brass, so if you have a car with brass synchronizers in the gears, you have to use GL-4 instead — something I have to do personally, as my car has brass synchros.
As for using other gear oils with hypoid gears, you technically can — again, much like using motor oil in hydraulic lines. But it’s not a good idea; the point of GL-5 is that it clings to metal surfaces. Without that action, your differential will struggle to lubricate itself, leading to the gears wearing out. Signs of differential failure include ticking or clunking noises when driving, a generally noisy ride coming from the axle, or odd behavior in tight corners — so don’t forget to change your diff oil.
Listen Labs, a market research startup that uses voice AI to conduct customer interviews, recently signed a term sheet for a $125 million Series C at a $1.5 billion valuation, with Menlo Ventures set to lead the round, according to several people with knowledge of the matter.
But that round never closed, the people said. Listen Labs walked away from the signed term sheet, a rare occurrence in the venture world and one that is generally frowned upon, according to VCs.
The financing likely collapsed because of acquisition talks with Salesforce. The CRM giant has recently held talks to buy Listen Labs for around $2 billion, Business Insider reported. The discussions are not finalized, however, and may not result in a deal, the outlet notes.
Listen Labs is one of the leading startups in the rapidly growing field of automating customer research with AI. The three-year-old startup has about $30 million in annualized revenue, about three times more than Simile, a competing startup that predicts human behavior, according to two people familiar with the companies’ financials. In late July, Simile announced that it had closed a $200 million Series B at a $2 billion valuation led by Greenoaks — likely setting a new valuation benchmark for Listen Labs, one person said.
If talks with Salesforce collapse, several VCs told TechCrunch that they expect Listen Labs to return to market and target a valuation of $2 billion or higher.
While acquiring Listen Labs could strengthen Salesforce’s AI capabilities by using the startup’s AI to help predict customer needs, the CRM giant may ultimately decide that paying a 67 times revenue multiple is too steep a valuation, according to a person with experience negotiating exits to Salesforce.
Listen Labs, Salesforce, Menlo Ventures, and Simile did not immediately respond to requests for comment.
Listen Labs was co-founded in 2023 by Florian Jüngermann, a former German national champion in competitive computer programming, and Alfred Wahlforss, who previously founded a staffing startup called Bemlo. The two met while pursuing master’s degrees at Harvard.
Listen Labs’ AI develops survey questions and interviews customers over audio or video. The resulting conversations are then packaged into reports and PowerPoint presentations, similar to those traditionally produced by human market researchers.
Fortune 500 companies rely on this type of research to gauge customer needs and satisfaction with their brands and products, but traditional market research is expensive and can take weeks to complete.
Listen Labs’ technology helps reduce the time and cost of these projects, enabling companies to quickly understand how customers are reacting to product changes and iterate on them more efficiently.
The startup’s customers include Microsoft, Canva, Anthropic, and Sweetgreen. Listen Labs and Simile aren’t the only startups using AI to disrupt the customer research market.
Besides Simile, competitors in the space include Outset, Keplar, and Aaru. While some platforms automate interviews with real humans, others startups — like Aaru and Simile — take a synthetic approach, using AI to simulate human behavior and predict responses without interviewing anyone at all.
Listen Labs was previously valued at $500 million when it announced a $69 million Series B round in late January led by Ribbit Capital, with participation from returning backers Sequoia, Conviction, and Pear VC.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Cisco has confirmed that a maximum-severity authentication bypass vulnerability tracked as CVE-2026-20079 in its Secure Firewall Management Center (FMC) software is being actively exploited in attacks.
The vulnerability has a maximum CVSS score of 10.0 and allows unauthenticated, remote attackers to bypass authentication and execute scripts and commands as root on vulnerable devices.
“In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability,” Cisco updated its CVE-2026-20079 advisory to say on Wednesday.
Cisco did not disclose when the attacks began, who was behind them, or what post-exploitation activity was observed.
Cisco first disclosed CVE-2026-20079 in March, when the company said it had no evidence that the vulnerability was being exploited in attacks.
The flaw is caused by an improper system process created at boot time and can be exploited by sending crafted HTTP requests to the web interface of an affected device.
A successful attack can allow an unauthenticated attacker to execute scripts and commands on the device with root privileges.
The vulnerability affects Cisco Secure FMC Software and Cisco Security Cloud Control Firewall Management. Cisco says it has already patched the cloud-hosted Security Cloud Control service.
Cisco says there are no workarounds and recommends that customers upgrade to the latest software release.
Today, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog, ordering Federal Civilian Executive Branch agencies to secure vulnerable systems by September 12, 2026.
While Cisco says its security team became aware of active exploitation of CVE-2026-20079 in August, IOCs published in a July advisory update suggest the flaw may have been exploited earlier.
On July 29, Cisco disclosed another Secure FMC vulnerability, tracked as CVE-2026-20316, caused by static credentials for a low-privileged account.
Cisco said at the time that CVE-2026-20316 had been actively exploited in attacks and assigned it a High severity rating because the access could be combined with other Secure FMC vulnerabilities to elevate privileges.
As BleepingComputer reported at the time, Cisco also updated the CVE-2026-20079 advisory to include the same indicators as CVE-2026-20316, but did not confirm the flaw was exploited.
Cisco told administrators to search /var/log/messages for activity related to /var/tmp/license.tmp and shared the following example log entry:
Jul 23 16:16:33 firepower sudo: www : PWD=/ ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm
Cisco says that if this entry is found, the vulnerability “may have been exploited” on the examined Secure FMC device.
The example log entry is dated July 23, weeks before Cisco says PSIRT became aware of exploitation of CVE-2026-20079 in August.
Cisco also released the same Secure FMC hot fixes for both CVE-2026-20316 and CVE-2026-20079.
At the time, BleepingComputer contacted Cisco to ask whether the two vulnerabilities were connected, whether CVE-2026-20079 had also been exploited, and whether Cisco intentionally added the shared indicator to both advisories.
Cisco did not answer the questions directly and instead shared the following statement:
“On July 29, 2026, Cisco released software fixes to address vulnerabilities in Cisco Secure Firewall Management Center (FMC). Details are outlined in the security advisories (Static Credential vulnerability, Authentication Bypass vulnerability), and Cisco strongly recommends customers immediately apply the available fixes,” a Cisco spokesperson told BleepingComputer.
“Customers needing support should contact the Cisco Technical Assistance Center (TAC).”
Cisco’s latest update now confirms that CVE-2026-20079 has been exploited, but does not clarify whether the July 23 activity included exploitation of both vulnerabilities.
However, the same IOCs for both flaws, identical July hot fixes, and the July 23 log entry suggest both vulnerabilities may have been used in the same attacks.
Cisco advises customers who discover the indicators of compromise to contact its TAC for support, warning that installing the hot fixes will prevent future exploitation but will not remediate devices already compromised.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
ai and ml
Claude’s Felony Bench rap sheet is now as long as OpenAI’s
Amid industry soul-searching¹ about the possibility of AI improving itself to the point that it kills everyone, Anthropic has revealed yet another incident that would qualify as a crime if perpetrated by a person.
The AI biz published “an alignment assessment” detailing four times Claude models accessed third-party systems without authorization.
The company has already reported three of the incidents. Evidence of the fourth was lurking in a session transcript dating back to January 2026 when the misbehavior occurred.
Anthropic found the first three by scanning around 141,000 transcripts where Claude could have obtained internet access during evaluation. It missed the fourth initially because “our scan relied on an agentic search.”
Felony Bench, a tongue-in-cheek record of cyber intrusions carried out by major AI companies without consequences, has added this newly-discovered incident to its rap sheet of rogue AI actions.
The January 2026 AI trespass involved an early version of Claude Opus 4.6, which was given a Capture the Flag (CTF) challenge under the oversight of the third-party model evaluator where the other hacking events occurred.
Opus 4.6 managed to sabotage its chances of success by disabling the machine it was targeting. It assigned the device an IP address that already existed on another piece of hardware, rendering the target unreachable and making it impossible to solve the challenge.
Those familiar with other incidents where AI models violated third-party systems may recall that unsolvable tasks represent a common catalyst for misbehavior. Models exhaust all aligned options, and then turn to transgressive approaches.
Opus 4.6 might have been an exception, but when it tried to abort the task after recognizing that it could not reach the target machine, it failed to do so “due to a misconfiguration in [the model’s] evaluation harness.” It failed to shut down not just once but seven times.
So it continued onward, trying other expected means to reach the target machine but failing. Then it explored further.
“The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF,” Anthropic explained in its post. “Inside the machine, the model found a file listing a password, which it used to gain admin access to the system.”
The model went on to gather more credentials, and modified a system setting to make it easier to access the personal information of an individual associated with the third party evaluation organization.
Opus 4.6 might have done more but for the fact that it exhausted its token budget, bringing the session to an end.
Anthropic says it’s not as concerned about this incident as the others because the model tried to abort its task.
“While the model’s disregard for the possibility that it might be harming real systems or people is concerning, many of the behaviors described here have changed considerably as our training has evolved across model generations,” the company said.
Anthropic said it considers these incidents serious but expects current training approaches “are likely able to address the specific alignment failure modes observed in these incidents.”
And if company training methods fall short, there’s no real consequence to anyone at Anthropic other than writing up a revised alignment assessment. ®
¹ The term “soul-searching” is figurative and is not intended to indicate a belief that the technology industry has a soul.
Connecting the dots: Tesla’s Cybercab may not have a steering wheel or pedals, but there may still be a way to drive it manually. A video posted on X shows an unusual in-car display setup: the touchscreen showing a virtual joystick that lets someone drive the robotaxi by dragging a finger across the screen. “When I got in the vehicle, the display was in a different configuration with a virtual joystick for manual driving,” a rider wrote, adding that he had “a feeling I wasn’t supposed to see this” before trying the feature out anyway.
The Cybercab runs on a single central touchscreen. In the video (below), it’s split in two: a control panel on the left, the vehicle’s camera view on the right. The left side includes the joystick, a prompt to “Close cabin doors,” door controls, and a button to call support.
The right side shows the car’s surround-camera feed while parked in what looks like a lot, but not all of the imagery appears to be live. The side-camera views seem to show a previous location near a Supercharger rather than wherever the car is actually sitting.
– Matthew Skrzypczak (@MatthewSkrzypc1) September 7, 2026
Tesla hasn’t publicly shown or discussed this manual-driving screen. Still, the feature addresses a basic problem with a vehicle built without conventional controls: even a robotaxi occasionally needs to be moved by a person, whether that’s at a depot, in a lot, or when it’s simply blocked in. The on-screen joystick appears to be Tesla’s answer – rather than adding a steering wheel and pedals, the company built a touch-based control option straight into the software.
Tesla has positioned the Cybercab as a purpose-built autonomous vehicle, stripping out the equipment normally reserved for a human driver – steering wheel, accelerator, brake pedal. The joystick interface suggests the company has kept a limited way to take control when needed after all.
The feature surfaced just days after Tesla launched the Cybercab in Austin on September 3. That same day, the NHTSA opened an audit into how Tesla certified the vehicle without a steering wheel, pedals, or mirrors. The audit covers roughly 1,000 Cybercabs, and NHTSA is examining whether Tesla was correct to determine that certain federal safety standards simply don’t apply to a driverless vehicle.
Tesla’s argument rests on the idea that a fully autonomous vehicle doesn’t need equipment built for a human driver. The joystick screen doesn’t necessarily undercut that case – it may be meant only for limited manual repositioning rather than everyday driving.
Still, it’s a reminder that the Cybercab isn’t entirely beyond human control.
Tesla chair Robyn Denholm has hinted as much before. “If we have to have a steering wheel, it can have a steering wheel and pedals,” she said.
Bitcoin price risks $76K drop as $78K support weakens
Memory prices are slowing because buyers ran out of money
Ethereum price stalls below $2,500 as ADX drops to 11
Robinhood Stock: How To Take Advantage With Reduced Risk
Phones confiscated, players sent home: Pakistan’s England tour turmoil revives memories of Mohammad Amir, Salman Butt and Mohammad Asif’s 2010 Lord’s spot-fixing scandal | Cricket News
England up in reading, maths and science rankings as Scotland and Wales dip
Bitcoin price holds near $79K as cycle drawdowns narrow
Brent Crude Oil Moves Above $100 for the First Time in 3 Months
Meta debuts long-awaited personal AI agent, Muse
Visa expands stablecoin card network to 160 programs
Egyptian TV Presenter Sarah Khalifa, 11 Others Sentenced To Death In Major Drug Trafficking Case In Cairo
Strong Password Policy and Password Manager Guide
Intel Stock Jumps 9% on Chip Price Hike Report, US Stake Gains $36 Billion
What went right this week: an ‘historic’ fall in violent crime, plus more
Big Brother Spoilers: Dee SPINS & HUSTLES Votes – Yash Questions the Pact
Ballon d’Or 2026 Nominees: Lionel Messi In, Cristiano Ronaldo Out; Erling Haaland Included In Top 30
ServiceTitan, Inc. (TTAN) Q2 2027 Earnings Call Transcript
Google’s revived nuclear power plant gets $1.9B loan from US government
Meta debuts its Muse AI agent. Will consumers trust it?
Pump Fun and Kraken delete Hunter Biden $LAPTOP promotion
You must be logged in to post a comment Login