DEV Community: techaiwire

BragJack: one extension can hijack browser AI agents

techaiwire — Mon, 28 Sep 2026 18:17:21 +0000

A single malicious browser extension can take control of the AI assistants now built into web browsers, security researcher Gal Weizman of Forever Security has shown. He calls the attack BragJack. It worked against five products: Gemini in Google Chrome, Microsoft Edge's assistant, Perplexity Comet, Opera Neon and Anthropic's Claude in Chrome. The attack needs no clicks from the victim once the extension is installed.

This matters because browser AI agents hold far more power than a normal web page. They can see the screen, read files and act on the user's behalf. BragJack hands that power to an extension that was never meant to have it.

How the attack works

The Hacker News explains that a browser AI assistant is split in two. A local part runs in the browser, with access to the screen, files, camera and microphone. A remote part runs on the vendor's servers and does the thinking. The two talk over a channel each side trusts.

BragJack attacks that channel. It uses two extension permissions: one that changes page content and one called declarativeNetRequest. That second permission lets an extension rewrite network requests with rules the browser applies for it. It is the API that replaced the older webRequest system in Manifest V3. That extension format became mandatory when Google removed every Manifest V2 extension from its store earlier this month.

According to BleepingComputer, the extension uses these rules to change security headers and redirect JavaScript files into the browser's privileged AI components. Weizman told BleepingComputer that "browser extensions can manipulate web traffic and pages that these privileged components trust."

Weizman calls the technique "Prompt Forcing." Older attacks hid instructions inside a web page and hoped the AI would obey them. Prompt Forcing instead pushes a complete prompt into the agent through a channel the agent already trusts.

What an attacker could do

BleepingComputer lists what the researcher achieved. A malicious extension could read local files, take screenshots and turn on the camera and microphone. It could also browse the victim's history, intercept communications and steer the AI agent to act for the victim.

The Hacker News adds details per product. On Chrome, the flaw let an extension read local files, use the camera and microphone, take screenshots and leak profile data. On Edge, it used a race condition, a timing gap between the assistant's "think" and "act" steps, to take over the agent.

Which browsers are fixed

Product	Identifier	Severity	Status
Chrome (Gemini)	CVE-2026-0628	CVSS 8.8	Fixed in 143.0.7499.192, January 2026
Microsoft Edge	CVE-2026-55945	CVSS 4.2	Fixed in 150.0.4078.48, July 2, 2026
Perplexity Comet	None assigned	Not given	No fix confirmed
Opera Neon	None assigned	Not given	No fix confirmed
Claude in Chrome	None assigned	Not given	No fix confirmed

CVSS is the standard 0-to-10 scale security teams use to rank a bug's danger. The Hacker News says the Chrome flaw was first described publicly in March 2026 under the name "GlicJack."

All five vendors paid bug bounties, over $20,000 in total, with single payments from $600 to $7,000. The two reports disagree on how the money was split. BleepingComputer lists Perplexity's payment as $600. The Hacker News lists Perplexity at $7,000 and Anthropic at $600.

What this means for developers

Update Chrome and Edge first. Chrome needs version 143.0.7499.192 or later and Edge needs 150.0.4078.48 or later. Both fixes shipped months ago, so a current browser is already safe from those two CVEs.

For Comet, Opera Neon and Claude in Chrome, neither report confirms a fix. If your team uses them, keep them updated and watch each vendor's release notes.

Audit installed extensions, especially on machines where an AI agent has file or camera access. BragJack starts from an extension the user chose to install. An extension that asks for both page-modification and declarativeNetRequest permissions now deserves a closer look than it did last year.

If you build an AI browser agent, treat the channel between its local and remote halves as hostile ground. Extensions can rewrite requests and headers on that path. Authenticating those messages, instead of trusting whatever arrives, narrows what an injected prompt can do.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

Google pulls every Manifest V2 extension from the Chrome Web Store

Sources

BragJack attacks hijack AI browser agents through malicious extensions - BleepingComputer
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude - The Hacker News

PeopleSoft CVE-2026-35273: one encoded letter beats WAFs

techaiwire — Mon, 28 Sep 2026 18:14:43 +0000

The hacking group ShinyHunters is breaking into Oracle PeopleSoft servers again, using a flaw Oracle patched in June. This time the attackers slip past web application firewalls by changing a single letter. They write the "P" in /PSEMHUB/ as %50, its URL-encoded form. Firewall rules that block the literal path miss it, while the server decodes the request and runs the attack anyway.

Google's threat intelligence unit Mandiant described the new wave in a report published September 25, 2026. It says the attackers planted web shells on "dozens of systems globally." A web shell is a small script that gives an outsider a command line on the server.

The flaw behind it

The bug is CVE-2026-35273. It sits in PeopleSoft's Environment Management Hub, or PSEMHUB, a component that manages PeopleSoft installations. The Hacker News reports a CVSS score of 9.8 out of 10. CVSS is the standard scale security teams use to rank how dangerous a flaw is.

Mandiant calls it a Java deserialization flaw. The server takes a packaged Java object from a request and rebuilds it without checking it first. A crafted object can make the server run the attacker's code. No login is needed.

Mandiant tracks the group as UNC6240. It says the group first used the bug as a zero-day, meaning before any fix existed, between May 27 and June 9, 2026. Most victims then were universities. Oracle shipped an emergency Security Alert on June 10.

SecurityWeek reports that the June wave hit more than 100 PeopleSoft customers in education. It names the University of Nottingham, the insurance regulator NAIC and Nissan among the victims.

How one letter gets past the firewall

After June, many organizations added firewall rules that block any request to /PSEMHUB/. That stopped the old exploit. It did not fix the bug.

Mandiant explains the gap: "Many WAF and reverse proxy rules match the literal path before URL decoding." The PeopleSoft server, by contrast, decodes the path first. So /%50SEMHUB/ looks harmless to the firewall and identical to /PSEMHUB/ for the server.

Once inside, the group deployed these tools, according to Mandiant:

Tool	What it does
`x.jsp`	Runs commands sent in a POST request
`u.jsp`, `u2.jsp`	Uploads files in 150 KB pieces
`tunnel.jsp`, `tunnel.jspx`	Neo-reGeorg tunnel into the internal network
`Ple64.exe`	Tampered Light Alloy media-player installer carrying the SIDEEYE backdoor
MeshAgent	Remote-management agent kept for Linux persistence

The new wave reaches well beyond universities. Mandiant lists technology, IT services, healthcare, agriculture, transportation and government as well as higher education.

Why ShinyHunters matters here

ShinyHunters runs data-theft extortion. It steals data, then threatens to publish it unless the victim pays, SecurityWeek says. Google advises organizations to "prepare for extortion communications" and watch for stolen data appearing online, SecurityWeek notes.

What this means for developers

Install Oracle's patch for CVE-2026-35273. Mandiant says to apply the fix rather than rely on firewall filtering, and this campaign shows why. A blocklist rule matched on a literal string is one encoding trick away from failing.

If you do not use the Environment Management Hub, disable it or remove PSEMHUB entirely, as Mandiant advises. A component that is not deployed cannot be exploited.

Search your WebLogic logs for both /PSEMHUB/ and encoded forms such as /%50SEMHUB/, especially POST requests to the hub. Mandiant also says to check the PSEMHUB.war folder for files you did not put there. Look for unexpected MeshCentral agents too.

If you find signs of entry, rotate database and cloud credentials. An attacker with a shell on PeopleSoft may have read the connection details it uses.

The wider lesson applies to any web application behind a firewall. Rules that match paths should normalize the request first, decoding it the way the server will. Otherwise the firewall and the server are reading two different requests.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Sources

ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft - Google Cloud (Mandiant)
Google Warns of ShinyHunters' Fresh Oracle PeopleSoft Campaign - SecurityWeek
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells - The Hacker News

DRAM and NAND prices climb again as AI takes capacity

techaiwire — Sun, 27 Sep 2026 17:50:34 +0000

Memory prices are still rising, and the reason is that AI data centers are buying the capacity that used to make ordinary RAM. TrendForce projected on July 3, 2026 that DRAM contract prices would rise another 13% to 18% in the third quarter, with NAND flash up 10% to 15%. For developers that is not a market curiosity. It is the reason a build machine, a cloud instance and a test phone all cost more than they did a year ago.

DRAM is the working memory a computer uses while it runs. NAND flash is the storage in an SSD or a phone. Contract prices are what large buyers pay, so they set what laptops and servers cost months later.

How far prices have moved

The third-quarter rise looks small only against what came before it. Sourceability, a components distributor that tracks these contracts, put the earlier jumps far higher.

Period	DRAM	NAND
Q4 2025 to Q1 2026	Up 80-90%	Sharp spikes on delivery gaps
Early 2025 to December 2025	-	Up 246% cumulative
Q3 2026 (TrendForce projection)	Up 13-18%	Up 10-15%

One line makes the scale concrete. Sourceability records DDR5 moving from $6.84 in September 2025 to $27.20 in December 2025. That is roughly four times the price in three months.

NAND moved in bursts rather than a steady climb. About 70% of its 2025 increase landed in the final 60 days of that year, when delivery disruptions pushed weekly prices up by 50% to 100%.

Why AI took the capacity

The cause is not a factory fire or a shipping crisis. It is a deliberate choice by three companies about what to build.

Samsung and SK Hynix together hold about 70% of the DRAM market, and Sourceability reports neither has signaled aggressive plans to expand capacity. Micron can fill only 55% to 60% of what its core customers ask for, and its new Idaho plant does not come online until 2027.

The mechanism inside the fab is the part worth understanding. High-bandwidth memory, the stacked DRAM that sits beside an AI accelerator, eats about three times the capacity of the same amount of DDR5. Every wafer moved to HBM removes roughly three wafers of ordinary memory from the market.

Demand keeps pulling in that direction. Sourceability puts 2026 capital spending by the top eight cloud providers above $600 billion, up 40% year over year.

TrendForce adds a detail that explains why this is not only a GPU story. Agentic AI workloads run on general-purpose x86 servers with RDIMM memory, not only on accelerators. So the same wave raises demand for plain server memory too.

What it does to the price of a device

Memory used to be a modest line on a bill of materials. It is now one of the largest.

HP's chief financial officer said memory moved from 15% to 18% of a PC's parts cost to around 35% in 2026. At the ISSCC conference in February 2026, MediaTek chief executive Rick Tsai put it more bluntly: "Memory now accounts for roughly 50% of the total BOM."

Kingston's data center SSD business manager said in December 2025 that "NAND prices had surged 246% since the start of 2025."

TrendForce expects the rally to run past 2028.

What this means for developers

Treat memory as a budget line that now moves, not a constant. If you size cloud instances or CI runners by habit, re-check them. RAM-heavy instance families are where provider price changes land first. An over-provisioned runner fleet costs more than it did last year.

Buy hardware earlier than you otherwise would. That is unusual advice, and it follows from the forecasts rather than from panic. When the analyst who called the last four quarters expects the rally past 2028, waiting for a better price is a bet against the only published view.

Local AI work is hit hardest. Running models on your own machine is mostly a question of how much memory you can afford, and that is exactly the component being rationed. Apple's recent Mac mini and Mac Studio refresh put more memory bandwidth behind local AI, and machines like those get more expensive as the same shortage works through.

There is a software response too. Memory efficiency has been an unfashionable thing to optimize for a decade of cheap RAM. Profiling a service's actual working set, and fitting it into a smaller instance, now pays back in real money rather than in tidiness.

Watch DDR4 specifically if you maintain older fleets. TrendForce notes Taiwanese suppliers are expanding DDR4 output, but not by enough to offset cuts elsewhere. Legacy parts can get scarce faster than current ones, because nobody is investing in them.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

New Mac mini and Mac Studio put more memory bandwidth behind local AI

Sources

AI Server Demand Continues to Support Memory Prices in 3Q26 - TrendForce
Tracking memory price increases across the last several quarters - Sourceability

India smartphone prices up 21%, the steepest anywhere

techaiwire — Sun, 27 Sep 2026 17:47:57 +0000

Smartphone prices in India have risen 21% during 2026, the steepest increase of any market, according to Counterpoint Research figures reported by LatestLY on September 9, 2026. The world average is 15%. The cause is the memory shortage, and the effect on developers is specific: the cheapest Android phones in the largest Android market are disappearing.

India matters to anyone shipping an Android app. It is a huge market built largely on inexpensive handsets, so what happens to entry-level pricing there changes the devices real users hold.

What actually got more expensive

At least 13 brands have raised prices, Beebom reports, among them Oppo, Realme, Vivo, iQOO, Nothing, Xiaomi, Redmi, Poco, Motorola and Lava. Increases run from Rs 500 to Rs 8,000 per device.

The rises came in waves rather than all at once. GizmoChina recorded a batch effective May 1, 2026.

Phone	Increase
Nothing Phone (4a) Pro	Rs 5,000
Nothing Phone (4a)	Rs 3,000
OnePlus 15	Rs 5,000
OnePlus 15R	Rs 2,500
Xiaomi Redmi Note 15 Pro	Rs 2,000, to Rs 31,999

A second wave followed in late August and early September, with changes effective August 18 and 19 and again on September 1 to 3.

Why memory is the reason

The component behind it is the same one raising server and PC costs. Memory makers have moved capacity toward high-bandwidth memory for AI data centers, leaving less for phones.

The two reports differ on how to state the size of that move. Beebom describes global memory prices spiking 300% in three months, while LatestLY reports memory chip costs up more than 300% year over year. Both point the same direction, but the periods are not the same.

Nothing's chief executive Carl Pei gave a forward number. He said "memory module costs will go up by 5x by the end of 2026."

Xiaomi India's chief business officer Sandeep Singh Arora expects no relief this year. "The chip and memory shortage will persist into the second half of 2026, particularly affecting the festive season with further price increases," he said.

IDC and Omdia both project component prices staying high into 2027 and 2028.

The budget segment is the casualty

The most important number in these reports is not the 21%. It is what happened underneath it.

Counterpoint recorded a 45% fall in shipments of phones under Rs 15,000 in the second quarter of 2026. That is the segment where a Rs 2,000 increase decides whether someone buys at all.

The market is expected to shrink 13% to 16% in 2026 as a result. Refurbished phone sales are forecast to grow 16% over the same period, which tells you where those buyers went.

What this means for developers

Expect your Indian install base to get older, not newer. When new budget phones stop selling and refurbished ones grow 16%, the practical result is that the devices in circulation stay in service longer. Check your analytics for the actual spread of Android versions and RAM sizes before you raise a minimum SDK level or drop a device tier.

Test on the low end again. A 45% collapse in sub-Rs 15,000 shipments means the phones already out there are the ones you must run on. If your test matrix quietly drifted toward current flagships, it is now measuring a market that is shrinking rather than the one you serve.

Memory footprint is the thing to optimize. Manufacturers responding to these costs have two options: raise prices or cut specifications, and cutting RAM is the usual choice. An app that needs a lot of memory will be the one the system kills first on a 4GB device.

Budget your own test hardware differently. Device labs are bought at retail, so the same increases hit your procurement. Buying the cheap handsets now is cheaper than buying them next year. Both the iQOO Z11 at Rs 34,999 and the vivo T5 with its 7,050mAh battery launched before this latest wave landed.

Watch the festive quarter for the real signal. Arora named it specifically, and India's biggest buying season is the honest test of whether these prices hold or whether brands absorb them to move units.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

Sources

India Smartphone Price Hike Tracker: List of Phones with Revised Prices - Beebom
India Smartphone Prices Soar 21% in 2026 - LatestLY
Smartphone Prices Just Skyrocketed in India: Here's What Got Expensive - GizmoChina

ZLUDA adds cuFFT support for AMD GPUs via hipFFT

techaiwire — Sun, 27 Sep 2026 17:45:18 +0000

A new pull request for ZLUDA, the open-source layer that runs NVIDIA CUDA software on AMD graphics cards, adds support for cuFFT. That is NVIDIA's library for fast Fourier transforms, a type of math used to pull frequency information out of a signal. The change merged into the project on September 22, 2026. Phoronix reports it lets Folding@Home's distributed-computing client run CUDA-based work on AMD Radeon GPUs with no changes to the software itself.

A Fourier transform turns a signal, such as an image or a stretch of audio, into a list of the frequencies it contains. Scientific software, some machine-learning pipelines, and Folding@Home's protein-folding client all lean on cuFFT for that math. Until now, that code path only ran on NVIDIA hardware.

How the translation works

ZLUDA catches the calls a program makes to NVIDIA's CUDA libraries and reroutes them to matching AMD tools instead. For cuFFT, the merged pull request forwards those calls to hipFFT, AMD's own FFT library.

One detail needed extra care. CUDA identifies each FFT plan with a 32-bit number, called a handle. hipFFT instead uses a raw memory pointer for the same job. Truncating or reinterpreting that pointer directly could crash the program or quietly return wrong results. So the pull request builds a synchronized registry that maps CUDA's numeric handles to hipFFT's pointers instead. hipFFT itself loads at runtime, with separate setup code for Windows and Linux.

The port covers only the cuFFT functions that have a direct hipFFT match, not the whole library. The pull request lists what was tested before the merge:

Area tested	Result
Handle lifecycle management	Passed
Workspace configuration	Passed
64-bit transform planning	Passed
3D real-to-complex transforms	Passed
Folding@Home Core24 and Core27 work units	Ran successfully

What still needs work

ZLUDA maintainer vosen flagged three issues while reviewing the change, according to the pull request. Handle IDs could in theory overflow. A global lock could serialize FFT operations more than needed. And some error codes coming back from hipFFT are not yet mapped to the matching CUDA error, a gap the review marked medium-to-high severity.

Testing is also uneven across platforms. Windows builds and AMD hardware tests both passed, and the code compiles cleanly on Linux. But the pull request's author, AmosKito1, wrote that they had "limited Linux testing capacity." The Linux path has seen less real-world use than the Windows one so far.

What this means for developers

If your software calls cuFFT and you want to try it on AMD hardware through ZLUDA, check first that every function you use has a direct hipFFT match. The port does not cover the full API yet. Expect the Windows path to be better tested than Linux for now. Hold off on anything long-running or safety-critical until the handle-overflow and error-mapping gaps that vosen flagged get closed.

Folding@Home users get the clearest benefit today. Their AMD cards can now pick up CUDA work units that need cuFFT, work that previously went only to NVIDIA GPUs. Anyone maintaining GPU-accelerated scientific or signal-processing code built on cuFFT now has a second hardware target to test against, without rewriting for a native AMD library.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Sources

ZLUDA Now Implements Some NVIDIA cuFFT APIs With hipFFT - Phoronix
Implement core cuFFT APIs with hipFFT (#672) - GitHub (vosen/ZLUDA)

SynthID's image watermark carries a 64-bit ID field

techaiwire — Sun, 27 Sep 2026 17:42:41 +0000

An essay published on brand.io on September 21, 2026, argues that AI content-watermarking systems have grown from simple "this was AI-generated" labels into something closer to tracking infrastructure. Its author calls the result a "spymark" rather than a watermark. The claim rests on one technical detail from Google DeepMind's own research paper on SynthID-Image. Each image's watermark payload is 136 bits long. Of those, 64 bits are described as a database ID. The other 72 bits handle error correction.

Watermarking means quietly hiding information inside a file, such as a picture, an audio clip, or a block of text. A person cannot notice it, but a matching detector can read it back out. SynthID, Google's watermarking system, is built into several of its image- and text-generation products.

What the paper describes versus what Google says it does

The SynthID-Image paper describes a 136-bit payload embedded into 512-by-512-pixel images: 64 bits for a database ID, plus 72 bits of error correction. The brand.io essay calls these "secret hidden signals imperceptible to humans." A 64-bit field is large enough to give a separate number to every image SynthID has ever watermarked. That size is why the essay treats the field as evidence the system could identify single images, not just flag that a picture is AI-made.

Google's own public documentation describes something narrower. It says SynthID works by using "a pseudorandom function to augment model logits" as content is generated. That signal is applied "in a way that helps you determine if the text was generated by your model." It is a single yes-or-no signal, not an identifier tied to one person or one request. The documentation adds that models sharing a tokenizer also share one watermark and one detector. The same watermark covers every output from that model, not a unique one per user. Google's own material does not mention a database-ID field.

The essay is careful about this gap. It presents the 64-bit field as a documented technical capability in the research paper, not as proof that Google or anyone else uses it to track specific people today. It says it found no public evidence that anyone does.

Other systems the essay names

The essay makes the same argument about text and audio watermarks. It says SynthID's text version steers word choices during generation to create "a detectable statistical pattern" tied to the model. It adds that OpenAI has built a similar provenance signal into its own image and video output. For audio, it points to Audiowerk, an open-source watermarking tool dating to 2018. The essay says Audiowerk can "hide 128-bit payloads in audio and protect them with secret AES key." It also compares the idea to printer tracking dots. Many color laser printers have stamped this near-invisible pattern on pages since the 1980s. It encodes a printer's serial number plus the date and time of printing.

What this means for developers

If you build on SynthID or a similar watermarking tool, read the underlying research paper before you tell your own users what the system does and does not record. A payload's technical capacity and a company's stated policy on using that capacity are two different things. This story shows they can diverge without either side lying: the field exists in the specification, and the company says it does not use the field for tracking.

If you generate images, audio, or text at scale, check the watermarking library's specification for any identifier fields before you adopt it. Then write down, in plain language for your own users, what the watermark can and cannot be used to determine.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Sources

Spymarks, Not Watermarks - brand.io
SynthID | Responsible Generative AI Toolkit - Google AI for Developers

Claude Opus 5.5 cuts output price to $20 per million

techaiwire — Sun, 27 Sep 2026 17:40:04 +0000

Anthropic released Claude Opus 5.5 on September 22, 2026. The model costs $4 per million input tokens and $20 per million output tokens. Anthropic's newsroom says it "performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5." For teams that run coding agents for hours, output tokens are the line on the bill that grows, so the price is the news.

TechCrunch reported that the $20 output price is down from $25 on the previous version. TechCrunch also said the model runs faster and needs less compute to do it.

What Opus 5.5 costs

Item	Price per million tokens
Input	$4
Output	$20
Cache write, 5 minutes	$5
Cache write, 1 hour	$8
Cache read	$0.20

Prompt caching stores part of a request so it is not sent and billed in full every time. A cache read here costs $0.20 per million tokens. The Batch API takes 50% off both input and output, in exchange for slower replies.

What the model card says

Anthropic's platform documentation gives the model identifier as claude-opus-5-5. On Amazon Bedrock it is anthropic.claude-opus-5-5. The model is available through the Claude API, Amazon Bedrock, Google Cloud, Microsoft Foundry, and the Claude Platform on AWS.

The context window holds 1 million tokens. That is everything the model can read and write in one conversation. A single synchronous reply can reach 128,000 tokens. Through the Batch API, with a beta header, that ceiling rises to 300,000 tokens.

The documentation lists a knowledge cutoff of June 2026. It also says the model will not retire sooner than September 22, 2027. That second date matters to anyone who pins a model identifier in production code.

Four changes that can break working code

The documentation lists four differences from Opus 5 that are not backward compatible.

Extended thinking is always on and cannot be turned off. Thinking is the model working a problem through before it answers.
Forced tool use now returns an error instead of being accepted.
Thinking blocks are tied to the model and the conversation that produced them.
The earlier computer_20251124 tool version is no longer accepted.

The default effort setting is medium. On Claude Fable 5.1 it is high. Effort controls how hard the model works on a reply, so an unchanged prompt can behave differently.

What this means for developers

Read those four changes before you swap a model identifier in a running service. The always-on thinking is the trap. Code that passes a flag to disable thinking, or that moves thinking blocks between models, has to change first. A price cut is not worth an outage.

Re-run your own evaluations rather than trusting the comparison with Fable 5.1. Anthropic's claim covers most work, and your workload is not most work. TechCrunch reported the model outpaced Fable on many benchmarks for informal task completion, and placed it near Mythos on biology and cybersecurity. Those are broad categories, not your test suite.

Check the effort default if you are moving across from Fable 5.1. Going from high to medium changes cost and answer quality together, which makes a regression easy to misread.

If repeated context dominates your bill, read the cache rows before the token rows. Anthropic made a similar move on cache pricing for Claude Fable 5.1 earlier this month. Teams that send the same long system prompt on every call feel a cache change more than a token change.

One reason to wait exists. TechCrunch reported that Sonnet 5.5 and Haiku 5.5 are due in the coming weeks. Most production traffic does not need the largest model, so a cheaper tier may fit your workload better within the month.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

Claude Fable 5.1 cuts cache reads 75% and keeps token prices flat

Sources

Anthropic releases Opus 5.5 with lower prices and Fable-level performance - TechCrunch
Claude Opus 5.5 overview - Claude Platform Docs
Anthropic newsroom - Anthropic

Git 2.56 adds history drop and delete-merged

techaiwire — Sun, 27 Sep 2026 17:37:27 +0000

Git 2.56 is in release candidate form and is expected at the end of September 2026. LWN.net reported that the release carries more than 700 non-merge commits. Most of them are plumbing, but a handful of new commands change what developers can do without reaching for an interactive rebase.

LWN calls 2.56 "a solid release" and says the project is "holding back much of its more significant work for the future." That future is Git 3.0.

The new commands

Command or option	What it does
`git history drop`	Removes named commits from a branch by replaying the ones after them
`git repo info`	Prints repository paths, both absolute and relative
`git add --resolved`	Stages only the merge paths whose conflicts you fixed
`git branch --delete-merged`	Deletes local branches already merged into their remote tracking branch
`git bisect --reset-when-found`	Restores the original state once bisect finds the commit
`git replay --linearize`	Drops merge commits while replaying history
`git refs`	Creates, deletes, updates and renames references directly

What history drop does, and where it stops

git history drop removes a commit you name from a branch. It works by replaying every commit that came after it. That is the job people currently do with an interactive rebase, typed carefully, one line at a time.

There is a limit worth knowing before you plan around it. Git's release notes say the command still refuses to work if the history contains merge commits. Many real branches contain merges, so the command suits a linear feature branch rather than a long-lived shared one.

git replay --linearize approaches the same ground from the other side. It drops merge commits as it replays, which flattens a tangled history into a straight line.

Smaller changes you will notice

git add --resolved is aimed at a common mid-merge mess. During a conflicted merge you often fix two files and leave other edits in the working tree. The new option stages only the paths whose conflicts you resolved, and leaves your other local changes alone.

git branch --delete-merged clears out local branches that were already merged into the branch they track. Git also prints a clearer message when one of those branches is in use for a bisection.

The Git project's release notes list several quieter fixes. Git now spots typos in commands such as git push origin/main. A new fetch.followRemoteHEAD setting controls how a fetch treats the remote's default branch. Asking any command for help now exits with code 0 instead of 129, which stops scripts from reading a help request as a failure. Configuration commands retry when they collide, which reduces lock errors when two commands write config at once.

Underneath, git cat-file --batch formats output faster, and git log --follow handles non-linear history better than before.

What this means for developers

Try git history drop on a copy of a branch before you trust it on a real one. The merge-commit restriction is the part that decides whether it fits your workflow at all. Run git log --merges on the range you want to edit: if that prints anything, the command will refuse.

git branch --delete-merged is the one to wire into habit. Most developers accumulate dozens of stale local branches and clean them up with a shell pipeline copied from a blog post years ago. A built-in option is safer, because it checks the remote tracking branch rather than matching names.

The exit-code change deserves a scan of your own tooling. Any script that treated 129 as the signal for a help request will now see 0. That is the correct behavior, but it is a behavior change, and it will fail quietly rather than loudly.

Nothing here breaks an existing repository. The changes that will are in the next release: Git 3.0 switches new repositories to SHA-256 and reftable, and makes Rust a required build dependency. Git's own breaking-changes document still gives 3.0 no release date. Treat 2.56 as the last quiet stop before that one.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

Git 3.0 will default to SHA-256 and require Rust

Sources

Looking forward to Git 2.56 - and 3.0 - LWN.net
Git 2.56 release notes - Git project

Meta's Muse agent exported 6.8 GB of its own filesystem

techaiwire — Sun, 27 Sep 2026 17:34:50 +0000

A researcher asked Meta's Muse agent to archive the files it could see and send them to Google Drive. It did. Peter James published the result on September 22, 2026: a 2.7 GB compressed archive that unpacked to 6.8 GB of the agent's own runtime environment. The question it raises is not whether Muse broke a rule, but what a personal agent counts as "its files" when you ask.

"I asked Muse to archive the files it could see and send them to my Google Drive. It did," James wrote.

What was in the archive

By James's account the export held Ubuntu system files, internal Meta documentation, integration code, app templates, memory files, agent logs, and SSH key files. An SSH key is a credential that grants access to a remote machine without a password.

The files also name things Meta has not announced. James reports 113 sub-agent records and roughly 68 skill directories. A skill is a packaged set of instructions for one job. The directories cover Google Workspace, Meta's own social apps, Outlook, travel, shopping, health, and home devices.

Configuration files listed integrations described as in the pipeline: Slack, Dropbox, Polymarket, Canva, and Klaviyo. The runtime files call the product "Hatch", which James describes as Meta's internal name for Muse.

What Meta says the sandbox does

Meta published its own account of how it isolates Muse. The Meta AI Research post says the agent runs in a dedicated cloud virtual machine, inside a systemd-nspawn container. A container is a walled-off slice of one machine.

Meta writes that "root inside the runtime cell is mapped to an unprivileged host user so runtime cell root is not host root." In plain terms: even full control inside the agent's box is not control of the machine hosting it.

Meta also describes a separate component called Sentinel. It runs outside the agent's box and is the only thing allowed to approve actions such as sending an email or making a purchase. Meta says credentials are never exposed to the agent at all. Muse instead receives surrogate tokens, which a service named authd swaps for real credentials at the network boundary.

For web browsing, Meta says the agent sees only accessibility tree snapshots rather than the raw page, and cannot run JavaScript. An accessibility tree is the simplified description of a page that screen readers use.

The two accounts sit awkwardly together

These claims are in tension, and neither source resolves it. Meta says credentials are never exposed to the agent. James reports SSH key files inside the archive the agent produced. Neither account says whose keys those are, or what they unlock, so the gap between the two statements is not settled by the published material.

James says Meta marked his bug bounty report "Not Applicable" and did not state grounds. Meta's post says the program pays up to $300,000 for vulnerability reports. Meta has not published a response to this specific export.

What this means for developers

Treat an agent's own runtime as part of its output surface. The sandbox held: nothing here shows the host being compromised. What leaked was the contents of the box, because a user asked the thing inside the box to describe itself. Permission systems that gate actions, as Sentinel does, do not gate disclosure.

If you ship an agent, assume its filesystem is readable by its user and build accordingly. Keep internal documentation, unreleased connector names, and any key material out of the image the agent runs on. A surrogate-token design like Meta's protects the user's credentials, and does nothing for secrets baked into the image itself.

For anyone evaluating Muse, this follows the file access that arrived with its Mac release four days earlier. The useful test before you grant an agent your email and cards is simple: ask it to export everything it can see, then read what comes back.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

Meta's Muse agent lands on the Mac with file access

Sources

I asked Meta's Muse for its filesystem and it sent me 6.8GB - mouse.dev
Security and safety for AI agents: our approach with Muse - Meta AI Research

GPT-6 Astra breaks an Enigma message unsolved since 2005

techaiwire — Sun, 27 Sep 2026 17:32:12 +0000

OpenAI's GPT-6 Astra has recovered the settings behind an 82-letter German Army Enigma message sent on July 10, 1941. The message, known by the indicator MVUEH, had sat unbroken on a public research archive for 21 years. The interesting part for developers is not the history. It is that the model wrote and ran its own cryptanalysis software to get there.

Enigma was the cipher machine the German military used in the Second World War. Its settings changed daily, and breaking a message means recovering those settings.

What the model actually did

The CryptoCellar account of the break describes the sequence. GPT-6 Astra read through the unbroken messages held on the site and picked MVUEH as the most promising target. It then noticed that the plaintext looked connected to a different message, Nr. 173, indicator SIPVX, which researchers had already solved.

From there the model wrote software. It built an Enigma simulator in Python and in C++, plus an implementation of the Bombe. The Bombe was the electromechanical machine built at Bletchley Park to search Enigma settings. The model then ran that search.

Bruce Schneier's summary describes the result as "a thorough break with the ROSENOW crib". A crib is a guess at a piece of the original text. If you know some words the message almost certainly contains, you can test settings far faster.

Where the crib came from

That crib is the reason to read the autonomy claim carefully. The repeated place name ROSENOW ROSENOW came from SIPVX, the related message that human researchers broke in 2017. Schneier's write-up says the model "did it entirely on its own", and in the same breath names its reliance on that crib.

Both things are true. The model chose the target, spotted the link between the two messages, wrote the tooling, and ran the search without being told how. It did so standing on an existing human break of a sibling message.

Schneier's post adds one more caveat. The team is "still analysing the GPT-6 Astra logs to see exactly how it executed the break". The full method is not yet public.

The verification

Frode Weierud, the cryptanalyst who runs the CryptoCellar archive, checked the result. CryptoCellar's account says he confirmed that the model "had found the correct key and plaintext", and calls the achievement "simply amazing".

The recovered key was not the expected one. CryptoCellar reports a wheel order of 253, where 512 was the order otherwise recorded for that day. The wheel order is which rotors sit in which slots inside the machine. The recovered plaintext is nearly identical to SIPVX, with differences the account puts down to encipherment errors made at the time.

CryptoCellar also explains why the message resisted for so long. The ciphertext as transcribed contains errors, and the message involves a rare turnover of the left-hand wheel. Both break the assumptions a straightforward search depends on.

What this means for developers

The transferable result here is a workflow, not a cipher. The model surveyed a problem set, picked the tractable instance, wrote a correct simulator in two languages, wrote a search program against it, and ran it. That is ordinary engineering work, done end to end, on a problem with a verifiable answer.

Note which conditions made it work. The answer was checkable, a related solved case existed to supply a crib, and the search space was bounded by physical machine constraints. Where your own problem has those three properties, this pattern is worth trying. Where it does not, a model cannot tell you it has failed.

The verification step is the part not to copy loosely. A named human expert confirmed the key before anyone published the claim. That is how this result stayed a result, rather than joining the pile of plausible-looking machine output nobody checked. CryptoCellar's account says the two days of work would take a human researcher weeks or months, which raises the value of fast expert review rather than lowering it.

The security reading is narrower than some coverage suggests. This was a 1941 cipher with a tiny keyspace by modern standards. It says nothing about the strength of anything you are shipping. It does follow OpenAI rating Astra its first Critical cyber model five days earlier, which is the more concrete signal for anyone tracking this capability.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

GPT-6 Astra is OpenAI's first Critical cyber model

Sources

The MVUEH break - CryptoCellar
GPT-6 Astra Breaks an Old Enigma Message - Schneier on Security

Python documentation is now available in German

techaiwire — Sun, 27 Sep 2026 17:29:36 +0000

The official Python documentation now has a German edition. The Python project announced it on September 26, 2026, and the pages live at docs.python.org/de/3/. It matters because German speakers can now learn the language from its own reference, not from third-party books or blog posts.

The announcement came from Stan Ulbrych on the Python Insider blog. "We're excited to announce that the Python documentation is now available in German (Deutsch)!" he wrote. He credited the community volunteers who did the translation work.

What is translated so far

The German edition is complete where it counts first, and thin everywhere else. The project's translation dashboard at translations.python.org tracks two numbers for each language.

Measure	German progress
Core documentation	100%
Core progress in the last 30 days	23.79%
Full documentation	9.17%
Full progress in the last 30 days	5.87%

So roughly a quarter of the core set was finished in the final month before launch. The full documentation is a far bigger body of text. It includes the standard library reference, which describes every built-in module in detail.

The German site offers several Python versions. Its version menu lists Python 3.14.7 as the current stable release. It also offers 3.15, which is in pre-release, and 3.16, which is still in development.

Why a language appears only when its core is done

Python's rules for translations come from PEP 545, a Python Enhancement Proposal. A PEP is the formal design document the project uses to decide how things work.

PEP 545 sets a bar before a language appears in the documentation's language menu. Three parts must be 100% translated: the page on reporting bugs, the tutorial, and the reference for built-in functions. That is why a new language can go live while most of its pages are still in English. The pieces a beginner reads first are finished; the long tail comes later.

The same PEP fixes the web address pattern, docs.python.org/LANGUAGE/VERSION/. It also requires one named coordinator per language. For German, the Python Developer's Guide names Swen Bachmann as that coordinator. The translation files live in his GitHub repository, python-docs-de, which shows 361 commits.

How the translation pipeline works

Translators never edit the documentation pages directly. According to the Developer's Guide, they work in gettext PO files. Gettext is a common toolkit for translating software. A PO file lists each English sentence next to a slot for its translation.

Sphinx, the tool that builds Python's documentation, generates those files from the English source. When translators finish, build scripts pull the files in and publish them to docs.python.org automatically. The German team manages its work through Transifex, a web platform for translation projects.

Contributors must first accept a documentation contribution agreement. Under PEP 545, that offers their work under the CC0 license, a public-domain dedication. German joins 27 active translation projects, which include French, Spanish, Japanese, Russian, Hungarian and both forms of Chinese.

What this means for developers

If you teach Python to German speakers, point them at docs.python.org/de/3/ for the tutorial and the built-in functions reference now. Those parts are fully translated. For the standard library reference, expect most pages to still read in English, since the full set is at 9.17%.

Check the version in any link you share. The German site offers several versions, from 2.6 up to the 3.16 development docs. A link to /de/3/ follows the current stable release, while a link with a version number stays fixed. Use the fixed form in course material you do not plan to update.

If you write German and know Python, this is one of the easier ways to contribute to the project. You translate PO entries through Transifex, and the Developer's Guide explains the setup. The 9.17% figure shows how much of the library reference still needs hands.

Keep your terms consistent. The Developer's Guide asks translators to respect technical naming, so names like dict or asyncio stay as they are. Only the prose around them changes.

Last, watch the dashboard if your team works in another language. The same 100% core rule decides when that edition appears in the language menu.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Sources

The Python documentation is now available in German - Python Insider
Python documentation translations dashboard - Python translations dashboard
PEP 545 - Python Documentation Translations - Python Enhancement Proposals
Translating - Python Developer's Guide - Python Developer's Guide

DRBD 9 edges toward mainline Linux with 7 prep patches

techaiwire — Sun, 27 Sep 2026 17:26:59 +0000

Christoph Böhmwalder posted a 7-patch series to the Linux kernel mailing lists on September 23, 2026. It is titled "drbd: preparation for DRBD 9". The series reshapes the kernel's old DRBD code so that the much newer DRBD 9 can follow it into mainline. That matters to anyone running replicated storage on Linux, because the version shipped inside the kernel is still on the older 8.4 branch.

DRBD stands for Distributed Replicated Block Device. It copies a disk, block by block, to one or more other machines over the network. If one server dies, another holds an identical copy of the data. LINBIT, the company behind it, says the project has been maintained for more than two decades.

What the 7 patches change

The cover letter describes the approach in one line. "Each patch moves a piece of the in-tree DRBD 8.4 code to the form it has in the out-of-tree DRBD 9 code," Böhmwalder wrote.

"In-tree" means code that lives in the official kernel source. "Out-of-tree" means code maintained separately and built as an add-on module. DRBD 9 has only ever been out-of-tree.

The cover letter lists these changes:

Higher ceilings for fast networks: socket buffers up to 128 MiB, and a maximum resync rate of 8 GiB/s.
The file drbd_worker.c is renamed to drbd_sender.c, matching DRBD 9's layout.
The drbd_interval data structure's bitfields are replaced.
The table of network packet names moves to a new location.
Log messages gain rate limiting per object, so one failing device cannot flood the kernel log.

The series went to both the linux-kernel and linux-block lists. The cover letter stresses that nothing changes for current users: "Defaults are unchanged, all existing configurations remain valid."

Why DRBD 9 is worth the effort

LINBIT explained the goal in an April 27, 2026 blog post by Michael Troutman. The kernel carries DRBD 8.4.11, which the post calls stagnant. Active development happens on DRBD 9.3, outside the kernel.

The gap between the two is large.

Capability	DRBD 8.4 (in the kernel)	DRBD 9 (out-of-tree)
Nodes per volume	2, for failover	Up to 31 peers
Split-brain protection	Relies on fencing	Built-in quorum for 3 or more nodes
Failed-node handling	Manual STONITH or fencing setup	Automatic

Split brain is the failure where two machines both believe they hold the live copy and start writing different data. Quorum prevents it by letting a node write only while it can see a majority of the cluster. STONITH, short for "shoot the other node in the head", is the older fix: power off a suspect node before it can do damage. DRBD 9 also adds safeguards for syncing a node that rejoins the cluster.

LINBIT's post named Linux 7.2 as its target for the DRBD 9.3 patches. This week's series is described as preparation, so the full DRBD 9 code is a later, separate submission.

What this means for developers

If you run DRBD today, check which one you have. You may already load LINBIT's out-of-tree DRBD 9 module rather than the kernel's 8.4 driver. cat /proc/drbd prints the loaded version. This series changes nothing for either group yet, and the cover letter promises existing configurations stay valid.

If you rely on the in-kernel 8.4 driver, the upstream work is a reason to plan a test of DRBD 9 now. Once it lands, the in-kernel driver will gain multi-peer volumes and quorum. Those change how a cluster must be configured and fenced. Trying them on a staging cluster first beats discovering the differences after a distribution kernel upgrade.

If you build storage on fast networks, note the new limits. A resync ceiling of 8 GiB/s and 128 MiB socket buffers leave room for fast data-center links. LINBIT's site notes DRBD can replicate over TCP/IP or RDMA, the low-latency transport used on InfiniBand and RoCE networks. The defaults stay the same, so you still have to raise them yourself.

Watch the linux-block list for the next round. Review comments on these 7 patches will show how quickly maintainers accept a large, long-running out-of-tree driver. That answer decides when a stock kernel can replace a separately packaged DRBD module.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Sources

[PATCH 0/7] drbd: preparation for DRBD 9 - linux-kernel mailing list
Working to Put DRBD 9 in the Mainline Linux Kernel - LINBIT
DRBD - LINBIT