Amid horrific threats from United States president Donald Trump as the US and Iran negotiated a ceasefire, the US government warned this week that Iran-linked hackers were carrying out attacks against US energy and water infrastructure targets. With nearly one in five people in Lebanon displaced by Israeli attacks, the government is attempting to manage the crisis without modern digital infrastructure and an emergency system that is barely hanging on. Plus, a WIRED analysis looked at Syrian government account hijacks in March and the inadequacies they expose in Syria’s baseline cybersecurity defenses.

Amid rising fears of political violence, a WIRED investigation found that US political candidates are spending more on security, including purchasing equipment like home alarms and bulletproof vests. And recent research looking at Telegram groups found that men are sharing thousands of nonconsensual images of women and girls, purchasing spyware to use against their wives and friends, and engaging in doxing and sexual abuse. Meanwhile, as governments scramble to address growing industrial scamming originating from Southeast Asia, China has emerged as the biggest enforcer, but also a selective one, resulting in crime syndicates shifting their focus abroad to avoid Chinese targets.

Anthropic formally announced its new Claude Mythos Preview model this week and said that for now it will only make the model available to a select group of a few dozen leading tech and financial organizations, including Apple, Microsoft, Google, and the Linux Foundation. The consortium, dubbed Project Glasswing, will explore Mythos Preview’s advanced hacking and other cybersecurity capabilities and assess the best ways to improve software and hardware defenses before capabilities like the ones in Mythos Preview proliferate more broadly across other models and inevitably end up in the hands of attackers. The announcements sparked controversy about whether Mythos Preview and similar capabilities will truly be as consequential for cybersecurity as Anthropic says. Experts told WIRED that while it may not be a dramatic catastrophe, it is important for defenders to come together and use their early access to make changes in how software is developed and how organizations around the world invest in patching.

Finally, a WIRED investigation found that nonprofit groups linked to Customs and Border Protection facilities were selling challenge coins that celebrated the Trump administration’s immigration raids, including one coin that depicted Charlotte’s Web characters in riot gear.

And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

The FBI recently got its hands on copies of encrypted Signal messages being sent to a defendant’s iPhone because the contents of those messages were included in push notifications, 404 Media reports. Even though Signal had been removed from the phone prior to it being seized by the FBI, the notifications still lived on in the phone’s internal memory.

The issue affects all apps that send push notifications, not just Signal, but users of that app can adjust their settings to not show the content of a message or the name of the sender in push notifications. To adjust your settings for notifications going forward, open Signal and go to Settings, then Notifications, and change the option to Name Only or No Name or Content.

Despite the tenuous and contested ceasefire enacted in the US-Israel war with Iran, tens of millions of ordinary Iranians are still without regular and reliable internet connectivity. The regime-imposed internet blackout, which started during the first hours of the war on February 28, is now reaching the 1,000 hour point, according to internet monitoring group NetBlocks. In recent weeks, the internet shutdown has become the longest in Iranian history and one of the longest worldwide—depriving Iranians of accurate news about the war, stopping them contacting family and loved ones, and causing further economic harm to the nation. US-based Iranian digital rights project Filter Watch has detailed how the Iranian regime, while being bombarded during the conflict, has labeled anti-censorship tools as “malicious” and claimed to have arrested individuals using Starlink internet connections to get around the block.

The FBI’s annual internet crime report typically paints a bleak picture: year-on-year, the number of cybercrime reports increases and the amount of money lost by Americans shoots up. Unfortunately, 2025 was no different. Last year, according to the FBI’s annual report, losses reported to the Internet Crime Complaint Center topped $20 billion—an increase of 26 percent compared to 2024. More than half of these reported losses ($11.3 billion) were linked to cryptocurrency scams, often through fraudulent investment schemes, according to the FBI. Business email compromise, tech and customer support scams, personal data breaches, and confidence or romance scams, make up the other most common crime reports. Crimes mentioning AI led to $893 million in losses.

Google this week expanded Gmail’s end-to-end encryption to its Android and iOS apps, allowing enterprise users to compose and read E2EE messages natively on mobile for the first time without separate apps or mail portals required. Encrypted emails appear as standard threads in the Gmail app for recipients using Gmail, while those on other providers can access them via a secure browser view. This rollout builds on the client-side encryption model introduced to Google Workspace web users in April 2025, where messages are encrypted with customer-controlled keys, preventing Google from accessing their contents. The approach is particularly appealing for organizations with strict compliance requirements, including HIPAA, export controls, and data sovereignty regulations.

Access, however, remains limited: The feature is available only to Google Workspace Enterprise Plus customers with the Assured Controls or Assured Controls Plus add-on, and is not supported for personal Gmail accounts. Administrators must also explicitly enable the Android and iOS clients in the admin interface before eligible users can access the feature, which is off by default. End users then toggle encryption per-message by tapping the lock icon and selecting “Additional encryption,” mirroring the web workflow. The rollout is available immediately to both Rapid Release and Scheduled Release domains.

There’s a long history of devices originally used for communication being made into computers, with relay switching circuits, vacuum tubes, and transistors being some well-known examples. In a smaller way, pneumatic tubes likewise deserve a place on the list; [soiboi soft], for example, has used pneumatic systems to build actuators, logic systems, and displays, including this latching seven-segment display.

Each segment in the display is made of a cavity behind a silicone sheet; when a vacuum is applied, the front sheet is pulled into the cavity. A vacuum-controlled switch (much like a transistor, as we’ve covered before) connects to the cavity, so that each segment can be latched open or closed. Each segment has two control lines: one to pressurize or depressurize the cavity, and one to control the switch. The overall display has four seven-segment digits, with seven common data lines and four control lines, one for each digit.

The display is built in five layers: the front display membrane, a frame to clamp this in place, the chamber bodies, the membrane which forms the switches, and the control channels. The membranes were cast in silicone using 3D-printed molds, and the other parts were 3D-printed on a glass build plate to get a sufficiently smooth, leak-free surface. As it was, the display used a truly intimidating number of fasteners to ensure airtight connections between the different layers. [soiboi soft] used the display for a clock, so it sits at the front of a 3D-printed enclosure containing an Arduino, a small vacuum pump, and solenoid valves.

This capacity for latching and switching, combined with pneumatic actuators, raises the interesting possibility of purely air-powered robots. It’s even possible to 3D-print pneumatic channels by using a custom nozzle.

Thanks to [Norbert Mezei] for the tip!

Early in March, X (formerly Twitter) started testing a dedicated app called XChat among thousands of beta testers. It appears that the test phase is over and the app is ready for its public rollout. The Elon Musk-owned company has announced that XChat is now listed on the App Store, with a wide launch lined up in the coming days. 

What’s the big play? 

The chat app’s listing page on the App Store mentions a release date of April 17, and it will be available simultaneously for iPhone and iPad. As far as features go, the XChat app is advertising end-to-end encryption as one of its highlight features. For the unaware, E2E is currently deemed the safest security protocol to ensure that your messages are private, and no middleman or third-party (including the company that built the platform) can read your conversations. 

WhatsApp and Signal, for example, implement it by default. On Instagram and Telegram, there’s a dedicated private chats feature that relies on end-to-end encryption to protect your messages.

Circling back to XChat, it will also enable screenshot blocking, which means no participant in the conversation can take a screengrab of the chats. The app will let users edit or delete sent messages, and will also let them send disappearing messages. Calling and group chats will also be a part of the package.

AI models now surpass most humans at finding and exploiting software vulnerabilities, said Anthropic.

A new Anthropic project will see global companies use Claude as part of their defence security systems.

‘Project Glasswing’ gives partnering companies access to Anthropic’s unreleased Claude Mythos, which, according to the AI giant, has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. Mythos was launched in preview yesterday (7 April).

Anthropic’s Mythos preview is significantly more capable at generating exploits. In its research, the company noted that Mythos developed working exploits 181 times out of the several hundred attempts, while Opus 4.6 had a near 0pc success rate.

“We did not explicitly train Mythos preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning and autonomy,” the company noted. Publications, including the New York Times and the Register have warned against the negative consequences of models such as Mythos falling into the hands of bad actors.

Fortunately, Anthropic has chosen not to release the model. Instead, the company is bringing together leading businesses, including Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JP Morgan Chase, the Linux Foundation, Microsoft, Nvidia and Palo Alto Networks, allowing them to access Mythos preview to boost their cyber defences.

The company has extended Mythos access to a group of more than 40 organisations that build or maintain critical software infrastructure.

“AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities,” said Anthropic.

Anthropic has promised to share learnings from Project Glasswing to benefit the wider industry. The company has also made a commitment of up to $100m in usage credits for Mythos preview across the project, as well as $4m in direct donations to open-source security organisations.

The Claude-maker has also hired Eric Boyd, the long-term president of AI platforms at Microsoft, to lead as the company’s head of infrastructure.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Specialized’s proprietary, 700-watt motor feels natural—sometimes to an annoying extent, as the bike is designed for you to pedal and you won’t get faster than 10 mph just by using the throttle. Also, there’s no option for a dual battery. Still, the battery well exceeded Specialized’s estimated 60-mile range. Granted, I am a small person, but I was usually hauling at least one other person on the bike with me at all times, so I still found this remarkable.

It’s easily adjustable—both my 5’10” husband and my 5’2″ self were able to switch off riding, which is important if this is your family’s all-purpose hauler. The display is intuitive, and the buttons are well-spaced apart so you don’t get confused or end up button-mashing. Also, Specialized’s accessories go a long way toward making this bike so much more useful. Yes, you could jerry-rig some Home Depot buckets to the front of your bike and drill holes in the bottoms for them to drain, but the Coolcave panniers ($90) are so much more attractive, easy to use, and helpful for carting everything from kid dioramas to a dozen tiny soccer balls.

Best Value

The vast majority of people I know who buy a cargo ebike with their own money choose the Lectric XPedition2. There is just no better value for a dual-battery long-tail cargo ebike. Out of the box, Lectric has also gone above and beyond to make its bikes and accessories easy to assemble and use. You even pop the pedals in, instead of using regular screw-on pedals.

This bike’s specs are also wild for the price. It has a 1,310-watt rear hub motor, twice as powerful as the already-powerful Globe Haul. (It has a throttle and is a Class 2 ebike out of the box, though you can use the display to unlock its Class 3 capabilities and assist up to 28 mph.) It has hydraulic disc brakes, front suspension, an incredibly large and bright LCD color display, integrated lights, and fenders.