❌

Normal view

Cloud has a new bulk capacity market

11 September 2026 at 10:00

For 15 years, public cloud providers have defined the industry for most enterprises: on-demand, automatically metered services delivered over the open internet that give developers immediate access to storage, databases, compute, application development platforms, and AI capabilities. That model remains dominant because it is simple, well-instrumented, and universally supported. Yet an adjacent reality has always existed. Large-scale, off-market capacity deals where technology companies with surplus GPUs, storage, and compute sold blocks of capacity in bulk to other firms under nondisclosure agreements were once common. Those were cloud transactions in substance, since you were using somebody else’s servers. However, they lacked the automation, metering, and governance that define public cloud services, and they operated entirely outside the frameworks enterprises rely on for budgeting, compliance, and accountability.

A shadow market becomes visible

These arrangements are now becoming more visible and more formalized. Some are even openly auctioned. Meta’s entrance into the cloud capacity space, essentially offering its excess compute infrastructure to outside buyers, represents the maturation of a market that has existed in back rooms for years. Large, multiyear capacity commitments are no longer whispered about during boardroom lunches. They are being announced, financed, and tracked by analysts. This shift is creating a distinct layer in the cloud landscape, one that sits between traditional hyperscalers and true private clouds, and one that enterprises can no longer afford to ignore.

The practical implication is that the cloud market you thought you understood now has a parallel track. When a large enterprise needs maximum GPU capacity for model training or inference, it has more options than a year ago, and those options come with genuinely different trade-offs. You can go to a hyperscaler and pay the published rate for metered GPU as a service, receiving a fully managed platform with all the tools, governance, and integration you need. Or you can reach out to a technology provider that happens to have idle or excess GPU capacity and negotiate a bulk deal at a fraction of the published rate. The first option provides predictability and depth of service. The second offers raw cost savings if you have the operational capability to handle less-managed infrastructure.

This bifurcation is muddying procurement decisions. The gap in pricing between bulk off-market capacity and public cloud offerings can be substantial. Some analysts cite differentials ranging from 10 to 100 times. But headline GPU rates are only part of the evaluation. Bulk deals tend to come with minimal metering, limited monitoring, and a do-it-yourself culture around incident response and optimization. You are, in effect, purchasing wholesale energy. It is robust and capable, but it requires your own wiring and maintenance. Organizations accustomed to the instrumentation and service-level agreements of hyperscalers may find such a different operational reality a bit jarring. Those with mature cloudops teams may find the economics compelling.

Who benefits and who adjusts

The hyperscale incumbents will not be displaced overnight. They offer the complete ecosystem, not just GPU frameworks but development tools, hundreds of managed services, identity, compliance, and integration layers that are genuinely difficult to replicate. However, they are now facing a market where customers with intensive computational needs can source raw GPU capacity from alternative suppliers, particularly for bursty or cost-sensitive workloads. This is not necessarily a threat to hyperscaler dominance, but it is a complication. The hyperscalers will likely respond through partnerships, capacity-coverage agreements, and possibly acquisitions of promising capacity players. Effectively, they will become customers of the same off-market ecosystem they once ignored.

The cloud market is adding a new axis of choice: managed breadth versus specialized efficiency. Enterprises will increasingly construct hybrid operating models, keeping steady-state, security-sensitive, and toolchain-dependent workloads on hyperscaler platforms while offloading cost-intensive training runs and elastic inference to bulk-capacity providers. This is not a binary choice. It is an expanding continuum of sourcing options that demands more sophisticated procurement and architecture planning.

How to take advantage

Know your actual workload cost before you negotiate. If your AI workloads are compute-intensive, model training-heavy, or require burst capacity at unpredictable intervals, the economics of bulk capacity deals can be compelling. Run a pilot that captures total cost of ownership, including data movement, integration effort, operational overhead, and potential downtime during self-managed troubleshooting before you assume bulk is simply cheaper. Compare fully loaded costs, not GPU-hour sticker prices.

Build portability into your AI stack from the start. Bulk-capacity providers often lack the governance, compliance tools, and model life-cycle management enterprises need. Mitigate this risk by standardizing on containerized inference runtimes, open model formats, and CI/CD pipelines capable of deploying across multiple targets. This type of discipline turns vendor diversity into negotiating leverage rather than operational liability. It also ensures you can shift workloads as capacity markets fluctuate.

Treat capacity sourcing as a strategic procurement function. Bulk cloud capacity is not a niche quirk. It is becoming a recognized market that rewards supply-chain thinking. Diversify your supplier base, negotiate multi-vendor commitments where possible, and develop a reserve strategy for critical workloads. Keep your hyperscaler relationship for reliability and breadth, but maintain at least one secondary capacity arrangement for cost-sensitive or elastic workloads. The enterprises that treat capacity as a variable asset, rather than a fixed infrastructure decision will be better positioned as this market continues to expand and formalize.

The cloud market is no longer a simple fork between public and private. A defined middle ground of negotiated bulk capacity is now attracting billions in investment and reshaping how AI infrastructure costs are allocated. Enterprises that understand this landscape and build flexible, portable architectures that can span it will capture more value from AI investments than those who default to the familiar hyperscaler menu alone.

FBI launches investigation after 153 million drivers licenses apparently leaked on Russian cybercrime forum

10 September 2026 at 19:55
  • 153 million US driving licences have been leaked on a Russian cybercrime platform
  • Among those apaprently discovered in the stolen data is US Secretary of Defense Pete Hegseth
  • The FBI is now investigating the leak, which has been traced to an identity verification company

A data leak of 153 million US drivers licenses is said to have been shared on a Russian cybercrime forum, with US Secretary of Defense Pete Hegseth among those leaked prompting an FBI investigation.

Security researcher Brian Krebs identified the leak – which included his own data – as originating from a hack of an identity verification service. Louisiana-based IDScan provided ID verification for various well-known companies, including FedEx and Hertz car hire.

The data was shared on a Russian forum called Exploit, a long-established online community of cybercriminals. Following news of the leak, the identity theft service “Nexus” has apparently scrubbed its existence from the Dark Web.

Driving licenses and more

It wasn’t just US driving licenses that were found in the archive of recently-collected personal data. Krebs’ investigation found that Nexus claimed other types of data, and found a further 1.1 million driving licenses from Canada.

Other identity documentation alleged to be in the leak include 10 million identification cards, three million travel documents and international IDs, and 579,000 medical cards. The data was available to browse, notes Krebs, with Nexus providing details: “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

The leak has a personal dimension for Krebs. Not only was his driving license in the collection, so was that of his mother. It has proved to be a useful coincidence, one that has enabled the security and privacy researcher to establish how the data was sourced by Nexus.

Both licenses were used for a car hire, which Krebs traced to Hertz. Others affected by the leak had also used the service, which has used New Orleans-based IDscan for identity verification.

The company, which claims to perform 21 million verifications a month, is yet to issue a statement on the matter. Its marketing and operations leader, Jillian Kossman, told the journalist: “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation.”

Where is the data?

Krebs reports that he was alerted to the data on August 31, 2026, little over a week ago. Regular checking noted that the data was still being added to, increasing by “nearly 400,000” records prior to publishing his investigation on September 1.

Since then, however, it seems that Nexus has vanished, along with the data. But how widely was the data downloaded before that happened? While the FBI investigates, it falls on the American and Canadian public to be extra vigilant and wary of identity fraud.

Fake GTA 6 malware is on the rise as release date nears — here are some of the worst scams to look out for

10 September 2026 at 19:10
  • Huntress warns fake GTA 6 ISOs spreading malware ahead of official Nov 19, 2026 release
  • Packages deliver RATs, infostealers, and Chaos ransomware disguised as game installers
  • Users urged to avoid pirated downloads; infected systems should be reimaged and credentials reset

Grand Theft Auto 6 (GTA 6), one of the most anticipated computer games of all time, is due to launch on November 19, 2026 - so everything found online before that is almost certainly malware.

This is the warning sent out by security researchers Huntress, which said it recently saw one variant deploying all sorts of filth, from remote access trojans (RAT), across infostealers, to full-blown ransomware encryptors.

The story behind GTA 6

GTA 6 is a third-person action-adventure and open-world gam developed by Rockstar Games, which egan preliminary work more than a decade ago, and has allegedly spent more than a billion dollars during that decade and a half, which would make it, by far, the most expensive game ever developed.

It is also a sequel to GTA 5, a game that was sold in more than 230 million copies around the world, which made it one of the most popular games of all time.

In late August 2026, someone going by the alias LEEK claimed to have obtained a working, playable build of the game, roughly six months before the official release. They posted numerous screenshots and videos of them playing the game, even writing their nickname onto a wall, using a rifle to prove the authenticity. Truth be told, even without this, people would have still probably searched for, and downloaded, fake installers. This only made the problem worse.

And a major problem, it definitely is. Huntress is now saying it is seeing websites ranking relatively high (through SEO poisoning), offering for download an ISO of the game. Similar ISOs are circulating around different gaming forums, torrenting sites, and social media channels.

An ISO file is a digital copy of an entire disc, such as a CD, DVD, or Blu-ray, stored as one file. Users can download an ISO (which can weigh tens or hundreds of gigabytes), mount it into a virtual drive, and the computer will treat it like a physical disc.

Huntress found some ISOs weighing more than 100GB which was done just to make it seem authentic - the actual malware was “a factor smaller”. The ISOs they analyzed contained multiple variants, including NJRAT and CDRAT (two remote access trojans), Mercurial Grabber (an infostealer grabbing Roblox Studio cookies, Minecraft session data, Discord tokens, Chrome passwords and cookies, system information, IP addresses, and geolocation, Windows product keys, and screenshots), and Chaos Ransomware. The package also contained a legitimate, regular browser - “Just for kicks,” apparently.

A plausible failure

During the “game” installation, the installer displays a message in Russian, saying the product is unlicensed and that there is a good chance it won’t run. If that happens, the user is told to reach out to a specific Gmail address to receive an “updated crack”. After the installation completes, the victim will get that exact popup, saying “License not found”. All of this is just a smoke screen, to make the victim not suspicious as to why the “game” won’t run.

There is no way of telling how many people fell for the ruse and installed malware on their devices. Huntress says that generally speaking, trying to download cracked and pirated software is a bad idea, which is even worse if the game in question has not yet been released.

“This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the researchers said.

The good news is that all of the malware being distributed there is not new. Some of the variants contained in the ISOs are several years old, meaning most antivirus programs, such as Windows Defender for example, can easily detect it and stop it from compromising the system.

Those that do end up infected should disconnect the machine from the internet, reset all passwords, enable 2FA wherever possible, and do a complete reimage of the compromised system.

Multiple hacking groups found using the same Chrome malware in the same week — so what does it mean?

10 September 2026 at 16:10
  • Proofpoint detailed BlueMoon, an exploit kit chaining two Chromium flaws and one Windows bug
  • Four groups, including China‑aligned TA412, used it loudly against NGOs, aerospace, and manufacturing targets
  • Exploits were “patch‑gap” zero‑days; all flaws now patched

Four hacking groups, including some tied to the Chinese government, were seen using the exact same exploit kit in a span of a week, suggesting a certain “fear of missing out” among the criminals, experts have warned.

Security researchers Proofpoint have detailed BlueMoon, an exploit kit that leverages three vulnerabilities: two in Chromium, and one in older versions of Windows: Windows 10 (October 2018 Update), Windows Server 2019, Windows 10 2004, WIndows Server 2022, and the initial release of Windows 11.

The kit was first seen being used on August 28 2026, by a threat actor tracked as TA412, a China-aligned state-sponsored threat actor that was observed in the past targeting businesses using Microsoft SharePoint. TA412, also known as Violet Typhoon, used BlueMoon to “repeatedly target a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the United States.”

Soon after that, three others were spotted: UNK_LateNight, another China-aligned espionage group which targeted multiple US aerospace companies, UNK_DoubleCheck, a group going after a Vietnamese manufacturing entity, and UNK_QuietRacket, a threat actor taking aim at organizations across Singapore and Indonesia.

What all of these groups have in common is the fact that they did not try particularly hard to hide their activity. This is rather unusual, since a stealthy approach usually guarantees that a vulnerability can be exploited for longer.

Front running the Chromium supply chain train

BlueMoon takes advantage of three flaws, two in Chromium and one in older Windows variants. The Chromium vulnerabilities were found in V8, the JavaScript engine that the browsers use to allow applications to run efficiently. The first one is a “type confusion bug”, tracked as CVE-2026-85046, and assigned a severity score of 8.8/10 (high). The latter is a “sandbox escape” flaw, for which Google did not assign a CVE or a severity score.

The Windows bug, on the other hand, is tracked as CVE-2026-85880, and was given a severity score of 7.8/10 (high). It is described as a “heap-based buffer overflow” vulnerability in Windows Advanced Local Procedure Call, allowing malicious actors who can already execute code inside a low-privilege AppContainer to escape the sandbox and elevate privileges to SYSTEM. No additional user interaction is required.

Proofpoint has a theory as to why the crooks decided to be loud, instead of flying under the radar. Apparently, there is a very short window of opportunity between Google patching a Chromium vulnerability, and it being deployed to a browser such as Edge, or Brave, This window of opportunity also allows crooks to see how Google fixed a flaw, reverse-engineer it, and deploy an exploit before the browser is patched. This would mean that there is no time to be stealthy.

No time to hide

“Both V8 vulnerabilities were ‘patch-gap’ zero-days at the time of the observed activity,” Proofpoint said. “In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”

Another important factor is Artificial Intelligence. It would seem that AI has made flaw detection significantly faster, reducing the barrier to entry and making threat actors move more loudly.

“A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development,” Proofpoint stressed.

All three flaws have since been patched, so make sure you’re running the latest version of both the OS and the Chromium browser.

Via Ars Technica

Apple’s AI-packed macOS 27 upgrade for Macs launches on September 14, but can it win over macOS Tahoe haters?

Amongst all the hype over Apple’s first-ever foldable smartphone, the iPhone Duo, which was announced at the company’s ‘Surprise and Shine’ event, Apple (rather quietly) also revealed when Mac users can get the latest version of its desktop operating system, macOS 27 Golden Gate: September 14.

While pretty much all of the attention was focused on the foldable, the launch of macOS 27 is noteworthy for anyone with a modern Mac or MacBook, as this free upgrade brings some tasty new features, while also addressing some of the less popular changes that came with its predecessor, macOS 26 Tahoe.

If you have a compatible Mac, then you should be prompted to download and install macOS 27 Golden Gate once September 14 rolls around. However, if you have a Mac from before 2020 that doesn’t run on Apple Silicon (so any Intel-powered Macs), then you won’t be able to get the update.

For reference, here are all the Mac models that are compatible with macOS 27 Golden Gate:

  • MacBook Air M1 or later
  • MacBook Pro M1 or later
  • MacBook Pro 13-inch M1 2020 or later
  • MacBook Pro 14-inch M1 Pro 2021 or later
  • MacBook Pro 16-inch M1 Pro 2021 or later
  • MacBook Neo
  • iMac M1 2020 or later
  • Mac mini M1 2020 or later
  • Mac Studio 2022 and later

Apple recently announced new M5 and M6-powered Mac mini and Mac Studio products, and they'll likely launch with macOS 27 preinstalled when they start shipping on September 22.

WWDC 2026 Screenshots

(Image credit: Apple)

Fixing past mistakes

The main focus of macOS 27, as with Apple’s other operating updates such as iOS 27, and seemingly every piece of new software these days, is AI.

The upcoming macOS 27 upgrade paves the way for Siri AI integration – the long-awaited improvements to Apple’s virtual assistant that should make it more useful. When launched, Siri AI should be able to have two way conversations with you and execute multi-step tasks quickly and easily, which could make using your Mac a lot more convenient. It will be able to interact with apps such as Calendar to complete tasks such as creating events and reminders.

AI is also coming to macOS Spotlight to make finding things on your device better, and Visual Intelligence can be brought up to get information about what’s on your screen. Other AI features, such as Image Playground, are getting improvements as well.

If you’re not a fan of AI, then macOS 27 should still have plenty of reasons to download and install. One reason that will hopefully please a lot of people is that macOS 27 Golden Gate makes tweaks to some of macOS 26 Tahoe’s most controversial changes, especially when it comes to the polarizing Liquid Glass interface. The new macOS will allow you to adjust transparency effects to make using your device more comfortable, and during the beta testing process, it was one of the things our contributor Alex Blake was particularly thankful for. I’m sure he’s not the only one.

When Apple announced macOS 27 at WWDC 2026 earlier this year, it promised lots of performance improvements, especially when it comes to how responsive the operating system feels. This alone should make macOS 27 worth installing on September 14.

If you have an older Mac and feeling left out, make sure you check out our guide on the best Macs and MacBooks, which can help you find a new macOS 27-ready Mac that suits your needs and budget.

OpenAI not on track to reduce risk of ‘catastrophic’ loss of control, says board member

US government adviser Paul Christiano warns of risks to AI industry as he joins OpenAI’s non-profit foundation

OpenAI is not on track to reduce the risk of “catastrophic” loss of control to an acceptable level, a member of its non-profit board has said, amid spreading public and political concern that super-advanced AIs could one day wipe out humanity.

Paul Christiano, a US government technology adviser, said: “There is a meaningful risk that rapid acceleration in AI capabilities leads to catastrophic and irreversible loss of control in the very near term.”

Continue reading...

© Photograph: Dado Ruvić/Reuters

© Photograph: Dado Ruvić/Reuters

© Photograph: Dado Ruvić/Reuters

I tested the new Zenbook 14 and it impressed me with its light yet solid build — but I don’t think it’s Asus’ best ultraportable

Asus Zenbook 14 (2026): Two-minute review

The new Asus Zenbook 14 is designed to be an ultra portable device with a mid-range price that doesn’t compromise on performance.

True to other models in the line, the finish of the Zenbook 14 is different to the usual fare at this kind of price point, with its soft texture and uncommon colorways that are far more vibrant than many.

More impressive, though, is the Zenbook 14’s build, which blends strength and lightness in a way very few can match. Compared to other 14-inch laptops, this has to be one of the best laptop constructions around in terms of portability.

However, it’s not quite as thin as you might expect, and the thick feet underneath only add to the bulk. What’s more, although most of the unit is remarkably sturdy, the keyboard has a tendency to flex while typing on it, which is a little disconcerting.

Rear three-quarter view of Asus Zenbook 14 2026 on desk with pink wall in background

(Image credit: Future)

As you might expect for a laptop this portable, the Zenbook 14 isn’t loaded with interfaces, but those included are wisely chosen. You get one USB-A and two USB-C ports — the latter of which support power delivery and display signals — as well as an HDMI output and a headset jack.

The Zenbook 14 performs competently at everyday tasks. It can handle basic productivity and browsing, as well as 4K streaming. It struggles with even light gaming, but that isn’t too surprising given its lack of a dedicated GPU.

Fortunately, the Zenbook 14 remains composed even when undertaking heavy workloads. The fans are audible in such circumstances, but they’re certainly more hushed than many other examples. Temperatures also remain impressively cool, with only a few hotspots appearing — and mercifully these steer clear of commonly touchable surfaces.

The 1920 x 1200p resolution is sharp enough for its 14-inch real estate, while the OLED technology provides the vividness and contrast you’d expect. Reflections are visible at times, but the maximum brightness level should keep them from disrupting your viewing experience too much.

One of the main drawbacks of the Zenbook 14, though, is its battery life. It lasted just over 12 hours when I played a movie on a loop, which is short compared to many of its competitors. In fact, the Zenbook A14, a similar machine to the 14 in many ways, more than doubled this time when I ran the same test.

What’s more, the A14 is similarly priced to the 14, so all things considered it offers the better value. The 14 is the better the choice if you want a slightly more solid body, but in all other regards, the A14 would be the better choice.

Close-up of keyboard on Asus Zenbook 14 2026

(Image credit: Future)

Asus Zenbook 14 (2026) review: Price & availability

  • Starts from £799.99 (about $1,080 / AU$1,500)
  • Preorders open now (ships September)
  • Some rivals offer better value

The Zenbook 14 starts from £799.99 (about $1,080 / AU$1,500) and is available to preorder now, with shipments expected early to late September. Availability in the US and Australia is yet to be confirmed, but we'll update this section once it has.

The base model gets a Qualcomm Snapdragon X1 CPU, 16GB of RAM, and a 50Wh battery. More powerful AMD Ryzen AI 7 and Intel Core Ultra 9 models, both with 70Wh batteries, can also be preordered for £1,399.99 and £1,499.99 respectively. These two also get backlit keyboards, but the Snapdragon model doesn’t. Each model has three colorways to choose from: Zabriskie Beige, Arctic Blue, and Komodo Coral.

This is a reasonable price considering its spec. However, the already available Asus Zenbook A14 is slightly cheaper, yet has superior battery life and a marginally lighter build. Then there’s the HP OmniBook 7, which we’ve seen in recent sales with a similar price, and is a fantastic all-rounder that’s hard to beat at this point in the market.

Asus Zenbook 14 (2026) review: Specs

Base configuration

Mid configuration

Max configuration

Price

£799.99 (about $1,080 / AU$1,500)

£1,399.99 (about $1,900 / AU$2,600)

£1,499.99 (about $2,030 / AU$2,800)

CPU

Snapdragon X (X1-26-100) (up to 2.97GHz, 8 Cores)

AMD Ryzen AI 7 345 (up to 4.6GHz, 6 Cores)

Intel Core Ultra 9 Processor 386H (up to 4.9GHz, 16 cores)

GPU

Qualcomm Adreno (integrated)

AMD Radeon (integrated)

Intel Graphics (integrated)

RAM

16GB LPDDR5X

16GB LPDDR5X

16GB LPDDR5X

Storage

512GB M.2 NVMe PCIe 4.0 SSD

512GB M.2 NVMe PCIe 4.0 SSD

512GB M.2 NVMe PCIe 4.0 SSD

Display

14-inch WUXGA 3K (1920 x 1200) OLED, 16:10, 60Hz

14-inch WUXGA 3K (1920 x 1200) OLED, 16:10, 60Hz

14-inch WUXGA 3K (1920 x 1200) OLED, 16:10, 60Hz

Ports and Connectivity

2x USB-C (3.2 Gen 2, display / power delivery support, 10Gbps) 1x USB-A (3.2 Gen 2, 5Gbps), 1x HDMI 2.1, 1x 3.5mm Combo Audio Jack; Wi-Fi 6E, Bluetooth 5.3

2x USB-C (1x 4.0 Gen 3 40Gbps, 1x 3.2 Gen 2 10Gbps, display / power delivery support) 1x USB-A (3.2 Gen 2, 5Gbps), 1x HDMI 2.1, 1x 3.5mm Combo Audio Jack; Wi-Fi 6E, Bluetooth 5.4

2x USB-C (1x 4.0 Gen 3 40Gbps, 1x 3.2 Gen 2 10Gbps, display / power delivery support) 1x USB-A (3.2 Gen 2, 5Gbps), 1x HDMI 2.1, 1x 3.5mm Combo Audio Jack; Wi-Fi 6E, Bluetooth 5.4

Battery

50Wh

70Wh

70Wh

Dimensions

12.3 x 8.5 x 0.7 inches / 311 x 216 x 17mm

12.3 x 8.5 x 0.7 inches / 311 x 216 x 17mm

12.3 x 8.5 x 0.7 inches / 311 x 216 x 17mm

Weight

2.43lbs / 1.10kg

2.65lbs / 1.20kg

2.65lbs / 1.20kg

Close-up of keyboard on Asus Zenbook 14 2026

(Image credit: Future)

Asus Zenbook 14 (2026) review: Design

  • Light and strong body
  • Unique finish
  • Reasonable port selection

The unique Ceraluminum body certainly sets the Zenbook 14 apart, as do the bright colorways. The beige finish of my review unit was more interesting than the usual monochromatic shades we’ve grown accustomed to, looking softer and more inviting as a result. This was further aided by the rounded corners and the odd texture of the material, which has a slight graininess that’s comfortable in the hand.

One of the major selling points of the Zenbook 14’s construction is its lightness. It weighs around 2.5 pounds (just over a kilogram), which is impressive for a 14-inch laptop. However, it’s not quite as thin as you might expect, with a bit more unexpected bulk at the rear. The two long bars that run underneath, acting as feet, don’t help matters, either.

Close-up of touchpad on Asus Zenbook 14 2026

(Image credit: Future)

However, some may view this a worthy sacrifice for the unit’s surprising solidity. Both the base and the lid have very little flex to them. It feels slightly sturdier than the A14 I reviewed previously, although that model is slightly lighter at 2.16 lbs / 0.98kg.

There is, though, one weak point to the Zenbook 14’s build, and unfortunately that’s the keyboard. Hammering away on the keys often depresses the whole board, which can be quite annoying and doesn't inspire much confidence. There’s also no backlighting, which is an omission I always lament.

On the plus side, there are a reasonable number of ports on the Zenbook 14. There’s one USB-A port on the right-hand side of the unit, which is the only port on this side. On the left, you’ll find two USB-C ports (both of which support external display signals and power delivery), an HDMI port, and a headset jack.

Close-up of ports on left-hand side of Asus Zenbook 14 2026 with pink wall in background

(Image credit: Future)

Asus Zenbook 14 (2026) review: Performance

  • Fast everyday performance
  • Vivid but reflective display
  • Good for typing
Asus Zenbook 14 (2026) benchmarks

3DMark: Night Raid: 16,506; Fire Strike: 3,644; Steel Nomad: 224; Solar Bay: 6,135; Solar Bay Unlimited: 6,132; Solar Bay Extreme: 624; Solar Bay Extreme Unlimited: 625
Geekbench 6.5: Multicore: 10,701; Single-core: 2,145
Cinebench R23: Multi Core: 7,403; Cinebench R24: Single Core: 58; Multi Core: 435
Crossmark: Overall: 1,118; Productivity: 1,047; Creativity: 1,188; Responsiveness: 1,132
Passmark Overall: 2,989.3; CPU: 12,886; 2D Graphics: 330.3; 3D Graphics: 1,848.8; Memory: 2,338.2; Disk: 37,339.4
BlackMagicDisk: Read: 3,832MB/s; Write: 2,810MB/s
HandBrake 4K to 1080p: 37.6fps
Battery Life (TechRadar movie test): 12 hours and 15 minutes

For everyday tasking, the Zenbook 14 is a solid performer. The Snapdragon X1 chip in my review unit was fast and smooth when conducting basic productivity workloads such as word processing. It also handled multi-tab browsing and 4K streaming with plenty of composure as well.

Sadly, but somewhat expectedly, the Zenbook 14 isn't ideal for a spot of light gaming. It struggled to run Cyberpunk 2077 even on the lowest preset, blighted by rough visuals and debilitating slow downs during chaotic scenes. The A14 I tested previously, equipped with a Snapdragon X2 Elite chip, was able to handle low presets better, although it still wasn’t a flawlessly smooth experience.

Some fan noise is evident when the Zenbook 14 is under stress, but this isn’t too distracting. For such a compact laptop, the Zenbook 14 also does well to keep temperatures from soaring. I only noticed portions above the keyboard and underneath getting hot, while the commonly touchable surfaces, such as the keyboard, only became lukewarm at most.

Close-up of USB-A port on right-hand side of Asus Zenbook 14 2026 with pink wall in background

(Image credit: Future)

The 1200p OLED display is crisp and sharp, with plenty of contrast and vividness. It can show reflections a little too readily, especially when deep blacks are displayed. Mostly, though, the high brightness levels do well to keep reflections at bay.

Despite that aforementioned flexing of the keyboard, the Zenbook 14 is still good for typing. It may feel a little harsh due to the lack of dampening, but the keycaps are comfortable and well spaced, while their low profile and short travel make them feel snappy and easy to glide over.

Complementing the keyboard is the super smooth touchpad that allows for easy swipes and gesturing. It’s not very large, but it maximizes its real estate commendably by extending from almost the bottom edge of the unit to the bottom of the space bar, which makes navigation less of a chore than it otherwise would be.

Close-up of rear corner on Asus Zenbook 14 2026 with pink wall in background

(Image credit: Future)

Asus Zenbook 14 (2026) review: Battery life

  • Middling longevity compared to rivals
  • Zenbook A14 massively outlasts it
  • Quick to charge

The battery life of the Zenbook 14 isn’t particularly impressive. When I played a movie on a continuous loop unplugged, its 50Wh battery lasted 12 hours and 15 minutes. While this is quite long, it falls short of quite a few of its rivals.

For context, the A14 has a 70Wh battery, and the difference shows, as that laptop lasted over 28 hours in the same test, one of the best results we’ve seen. And if you’re looking for another enduring 14-inch laptop, the HP OmniBook 7 posted a time of 26 hours. Fortunately, the Zenbook 14 is at least quick to charge, just around two hours to fully top up.

Should I buy the Asus Zenbook 14 (2026)?

Scorecard

Attributes

Notes

Rating

Value

Similarly priced rivals are better all-round propositions.

3 / 5

Design

The construction is unique, super light, and high in quality, but the flexing keyboard is a small shame.

4.5 / 5

Performance

Great for everyday tasking, but don't expect more beyond that. It remains remarkably cool and quiet at all times, though.

4 / 5

Battery Life

The Zenbook 14 can last a while, but it’s disappointingly short lived compared to rivals. It’s quick to charge, though.

3.5 / 5

Final Score

The Zenbook 14 is a capable and highly portable laptop, but when rivals occupying same price point are better all-rounders, they might make more sense.

3.5 / 5

Buy it if…

You want something portable
You won’t find many 14-inch laptops more portable than the Zenbook 14, thanks to its compact dimensions and light footprint.

You want a unique design
You won’t find many constructions like this, either: it’s solid with a soft-touch finish and has some interesting colorways to boot.

Don't buy it if…

You want a stable keyboard
While the 14 is great to type with, the keyboard flexing as you do so might irk some users.

You want the best battery life
The Zenbook 14’s battery life isn’t anything special, while the A14’s is.

Asus Zenbook 14 (2026) review: Also consider

Asus Zenbook A14
The A14 is very closely matched to the 14, but it has a much better battery life — the best in class, in fact — and despite having a very similar Ceraluminum construction, it’s ever so slightly lighter (0.98KG as opposed to 1.10KG). It’s similarly priced, too, so might be the better pick of the two. Read our full Asus Zenbook A14 review.

HP OmniBook 7
The OmniBook 7 is a terrific laptop across the board. Its battery life is much longer than Zenbook 14’s, although it can’t quite match the endurance of the aforementioned A14. Its list price is quite steep, but we’ve seen it with significant discounts, bringing it more in line with the Zenbook 14. Read our full HP OmniBook 7 review.

Close-up of lid of Asus Zenbook 14 2026 with pink wall in background

(Image credit: Future)

How I tested the Asus Zenbook 14 (2026)

  • Tested for a few days
  • Used for a variety of tasks and benchmarks
  • Extensive laptop reviewing experience

I tested the Zenbook 14 for a few days, during which time I used it for all manner of tasks, from basic productivity and general browsing to 4K streaming and gaming.

I also ran our series of benchmark tests for laptops, designed to assess every aspect of performance. I ran a movie on a loop to test the battery life, too.

I’ve been using laptops for decades, and have reviewed a large number of them, ranging from small budget offerings to large gaming monsters.

  • First reviewed: September 2026
  • Read more about how we test

'The memory chip market is heading toward a severe shortage': analyst firm believes RAM crisis could get far worse in 2027 — and you can blame AI ramping up

10 September 2026 at 10:58
  • A new report from KB Securities gets very gloomy about the RAM crisis
  • We're told the "memory chip market is heading toward a severe supply shortage" in 2027
  • AI demand has ramped up massively with infrastructure investments up 60% year-on-year to $1.3 trillion, creating even more demand for memory as fuel for that rise

If you thought the RAM crisis was going to get worse next year, you're very probably right — but apparently we might suffer an even more severe shortage than some analysts already expect.

Wccftech flagged up an article from Business Korea (translated from Korean), which suggests that the RAM squeeze is tightening its grip on two of the biggest memory chip makers.

Citing a report from KB Securities, the rumor is that Samsung and SK Hynix are now down to fewer than 10 days of memory inventory, which is very close to running dry.

This has caused concerns that available memory supplies could dwindle and be depleted in 2027, with analysts believing that the "memory chip market is heading toward a severe supply shortage" (again, bear in mind this is a translation, but the message is clear enough).

KB Securities notes that the AI boom is what's causing this, as memory chip manufacturers struggle to meet demand for HBM4 memory in AI data centers. Infrastructure investments for AI development have been revised upwards to $1.3 trillion for 2027, we're told, which is a 60% year-on-year increase.

Kim Dong-won, head of research at KB Securities, told Business Korea that: "AI servers will absorb demand for not only HBM but also server DDR5 and enterprise SSDs, potentially leading to a historic shortage."

There's a brighter spot of news from laptop maker Framework though, which, as VideoCardz reports, has taken an unusual step in reducing the price of some of its products. As you may recall, Framework has been hiking laptop prices due to the increased cost of RAM (as have other notebook manufacturers), but the company just announced that it has secured some fresh memory modules at a lower price.

This means that some of its current Framework Laptop orders will be knocked down in price, and the company said on X that it's "retroactively reducing prices for orders that shipped at higher price" too.

Analysis: there's a historic level of gloom, that much is certain

Hand holding two DDR5 RAM memory modules in front of gaming computer with RGB lighting

(Image credit: vlado85rs / Getty)

It's impressive to see Framework acting in the best interests of its customers, particularly seeing as the firm could have (theoretically) kept quiet about bagging a batch of cheaper memory chips, and just kept the difference itself.

While that's commendable, it's a pretty small (but still welcome) bone we're being thrown in the face of the bad news for the RAM crisis here. Talk of a "historic shortage" is worrying, and it feels like this is an escalation of the recent chatter about global memory supply woes which has already turned highly negative.

While this latest report talks about server DDR5 RAM (and HBM), this will obviously have a bearing on consumer products, too. Those less profitable memory sticks are going to end up sidelined even further.

With rumors about GPU price hikes again coming to the fore this week, it's difficult to catch a breath between the bouts of bad news. We can hope that the pessimism is overblown here, but I can't shake the feeling that this seems unlikely.

Experts build WeChat worm able to spread across millions of iPhone and Android devices via phone calls

10 September 2026 at 02:05
  • Calif researchers found a zero‑click WeChat VoIP flaw enabling account takeover via calls
  • “WeWorm” spreads through ringing calls; victims need not answer to be compromised
  • Tencent patched in Android 8.0.77 and iOS 8.0.76; no exploitation seen in the wild

Security researchers have found a flaw in WeChat which allows malicious actors to take over people’s accounts on both Android and iOS devices - but what makes this flaw stand out is the fact that it’s a zero-click bug - victims need not do a thing to be compromised.

WeChat is a “super-app”, allegedly used by roughly 1.4 billion people, and is especially popular in China. It started as a communications app, letting users send messages, and make voice and video calls, and has evolved to function as a social network, allowing users to share photos and videos, as well as a payment app through which users can transfer money, pay for things, order food, book taxis, and even access government and business services.

Security researchers from Calif have now disclosed finding a ‘memory corruption’ issue in WeChat's VoIP stack. For now, they decided not to share the technical details, and to instead demonstrate the flaw “at an upcoming conference.” To that end, they built a worm called WeWorm, capable of taking over target WeChat accounts and spread through phone calls made via the app.

A phone call would suffice

In practice, it works remarkably simple: an attacker uses WeChat to call a person they have in their contacts list (this is a prerequisite). They can use both an Android and an iOS device, and can call anyone, regardless of the model or the OS they’re using. As soon as the phone starts ringing, WeWorm gets to work, “worming” its way into the victim’s device.

The victim does not even need to answer the phone - having it ring is enough. If they answer, they’ll hear nothing but silence, yet the worm will continue operating. If they decline the call, the attack stops, but this is hardly a mitigation - the attacker can simply call again while the victim is asleep (or otherwise away from their device).

Within a few seconds, the attacker will have access to the victim’s WeChat account, including their messages, contacts list, and virtually anything else found in the app. What makes this bug particularly worrisome on the surface is the fact that WeChat can be used to transfer money and pay for things, but WeChat Pay has additional authentication and risk controls designed to prevent that from happening.

The good news is that there is no evidence of this flaw being exploited in the wild. The bad news is that this is not the first zero-click flaw found in modern-day smartphones, and most likely will not be the last one.

Tencent's response

Calif said it responsibly disclosed its findings to WeChat’s parent company Tencent, who came back with a patch. Versions 8.0.77 for Android and 8.0.76 for iOS have apparently solved the problem, although

Tencent did not list any details in its patch notes, simply saying the version brought “bug fixes”, but in a statement shared with The Hacker News, it said the exploit has been “mitigated for all users”, and that it was applied server-side - users need not install anything, aside from the patch.

It’s also worth mentioning that WeChat has apps for HarmonyOS, Windows, Mac, and Linux. However, it would appear that Calif did not test those, and Tencent did not include them in its patch. The researchers did say that they would be looking into this same flaw in other products, too:

“This specific WeChat bug is one instance of the many unconventional attack surfaces that are present across many messaging apps,” they said. “We're conducting more of this research across other apps and attack surfaces, while working with app developers on attack surface reduction. This may take an industry-wide effort, since some of it depends on the platform owners. Once that work is further along, we'll share our progress, including the technical details of this WeChat bug.”

IonQ Superion 256 Brings 256-Qubit Quantum Hardware to the Data Center

9 September 2026 at 17:00
IonQ’s Superion 256 pairs semiconductor manufacturing with trapped-ion quantum hardware, but full-system performance data is still pending.

Anthropic researchers say AI could cause human extinction by 2030

9 September 2026 at 16:53

One researcher who resigned said many in industry believe that without regulation AI could kill off humanity

Artificial intelligence could kill off humanity within the decade, according to three researchers with the industry giant Anthropic, one of whom has quit his job in protest.

The latest doom-laden predictions came in posts on social media on Tuesday by a researcher who said he resigned because Anthropic and his previous employer, OpenAI, were ignoring or at best mishandling their response to the threat.

Continue reading...

© Photograph: Samyukta Lakshmi/Bloomberg via Getty Images

© Photograph: Samyukta Lakshmi/Bloomberg via Getty Images

© Photograph: Samyukta Lakshmi/Bloomberg via Getty Images

FBI, NSA warn Chinese AI companies like DeepSeek and Alibaba are reportedly carrying out 'industrial-scale' distillation campaigns to boost their models

9 September 2026 at 16:05
  • CISA, NSA, FBI warn Chinese AI firms of industrial‑scale knowledge distillation
  • Companies like DeepSeek, Moonshot, Alibaba allegedly extracted billions of tokens from US frontier models
  • Advisory urges detection of malicious prompts, deceptive responses to distillation, and cross‑provider intelligence sharing

Chinese AI companies’ core development strategy is to steal proprietary functionalities and capabilities from their US counterparts, law enforcement agencies have warned.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published a new security advisory, drafted jointly with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), warning American AI companies about an ongoing “aggressive, malicious, and targeted distillation activities at an industrial scale,” and sharing recommended mitigation steps.

Knowledge distillation

IBM defines knowledge distillation as a “machine learning technique that aims to transfer the learnings of a large pre-trained model, the ‘teacher model,’ to a smaller ‘student model’.” It is used in deep learning as a form of model compression and knowledge transfer, it added, particularly for massive deep neural networks.

So, knowledge distillation is not illegal or malicious, per se. Its goal is to train a more compact model to mimic a larger, more complex one. In the security advisory, the agencies stress it is “recognized as a legitimate and useful technique in AI research,” but add that China-based AI companies are using it in ill will.

In other words, the agencies claim that instead of spending months and millions developing new capabilities for their models, the Chinese are simply sending huge numbers of carefully designed questions to US models and extracting the answers.

Which companies are engaged in knowledge distillation?

Apparently, all companies worth anything. DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI all allegedly “extracted billions of tokens across millions of exchanges/requests from US frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.” CISA also stressed that this was likely done with the awareness of the Chinese government. It hasn’t outright said, “with its blessing”, although it could be read between the lines.

The advisory shares a thorough list of all the models that were being trained, as well as all the models being taken advantage of.

On the Chinese side, they include DeepSeek R1 and V3 models, Moonshot’s Kimi-K2 and Kimi-K3 models, and MiniMax’s M2 model. On the US side, they start with earlier models such as GPT-4, Claude 3.7, and Gemini 2.5 Flash Preview, all the way to Claude Fable 5, GPT-5, and similar.

When done in good faith, knowledge distillation is not illegal. However, the report says the companies routed the requests through multiple accounts, different API access points, multiple cloud providers, third-party AI aggregators, proxy services and “transfer stations”, as well as premium subscriptions shared between developers, all in an attempt to work around defenders trying to disrupt the process.

“This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership. Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations,” the agencies concluded.

What US companies should be doing

To defend their intellectual property (and thus remain ahead of Chinese competing models) US AI companies should implement comprehensive detection and mitigation, the agencies said. That means hunting for anomalous and malicious prompts, accounts, networks, and behaviors. Furthermore, they should monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.

The second step is to “deploy targeted response changes”: “Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.” In other words, AI companies should make sure their products lie when they spot they were being distilled for knowledge.

Finally, US AI firms should set up cross-organization intelligence sharing, correlating activity across model providers, cloud platforms, and API aggregators.

Windows 11's September update has arrived — here are the 3 key features that make this a must-install upgrade

9 September 2026 at 15:33
  • Windows 11's latest update has arrived
  • The September update brings in the ability to move the taskbar
  • There are also new options for resizing the Start menu, and a really useful tweak for Windows 11's search function

Windows 11's latest update has arrived, and it packs some important new features for the interface of the desktop OS.

Bleeping Computer flagged all the additions in the September 2026 update for Windows 11, and there are three major highlights, which I'll pick out here, before providing a general roundup of some of the other tweaks that Microsoft has brought in this month.

As ever, some of these features are being rolled out in a phased manner, so even if you do install the September update today, you may still have to wait a while for certain pieces of functionality to make their way over to your PC.

1. A movable taskbar

Windows 11 taskbar shown in four positions on the desktop

(Image credit: Microsoft)

Thanks to the September update you'll finally be able to move Windows 11's taskbar away from the bottom of the screen, to the top instead, or the sides if you prefer (an option that people with an ultra-wide monitor often want to use, as it suits that aspect ratio much better).

This is an ability which has always been in Windows 10, but was dropped for Windows 11 because porting it over was a thornier issue than you might think (or so Microsoft told us).

Finally, however, Microsoft has got its act together and the taskbar can now be repositioned in Windows 11 – although I've a feeling this will be one of the features on a slower rollout. Hopefully I'll be wrong on that score and you'll get this ability promptly if you've been keenly awaiting it for the last five years.

It's also worth noting that there's another option introduced here which can make the taskbar smaller, so it takes up less screen real-estate on devices with small displays.

2. The Start menu can now be resized

Windows 11 on a laptop

(Image credit: Unsplash)

Want a more compact Start menu? Your wish is Microsoft's command, as this choice has now been introduced to the Settings app for the Start menu. You can elect to have a standard (large) menu, or a small one, rather than leaving it at the default 'automatic' setting whereby Windows 11 chooses the size itself based on your device. The problem with leaving the OS to decide is that sometimes you get the bigger menu on a laptop screen, where it pretty much eats the whole desktop – and so in these scenarios you can now manually choose the more compact Start menu.

With options to remove sections of the Start menu coming on top of this, you can now trim this part of the interface down so it's truly minimal. This choice will be more important than the movable taskbar for many folks – myself included – and it's great to see it now being rolled out.

3. Windows 11 search improvements

A young woman is working on a laptop in a relaxed office space.

(Image credit: Getty Images)

Another notable boon with the September update is that there are a few changes for Windows 11's core search functionality, and the most important is a new option that lets you turn off web results in search.

When you're searching for a file on your local drive, those web results often get in the way, so it'll be a relief for many to be able to switch them off. As well as web results (which open in Edge, with searches in Bing, of course), you can also turn off Microsoft Store suggestions. Essentially this is a general decluttering of Windows 11 search which is long overdue, frankly.

Other features in Windows 11's September Update

Windows 11 on a laptop

(Image credit: Windows/Unsplash)

There's a performance boost for File Explorer in that the Home page now loads faster, and switching between virtual desktops in Windows 11 is now snappier, too.

Microsoft has made some reliability tweaks as well, including ensuring that the app history information in Task Manager is correct, and also that interacting with the Display panel within Settings is now more stable.

Furthermore, Microsoft informs us that there are some design tweaks here: "This update introduces updated progress indicators across Windows, providing a more consistent and modern experience during startup, sign-in, restart, shutdown, and update installation."

It's also worth noting that the weird mouse bug that affected the preview version of this September update (the optional update released at the end of August) has been resolved.

There's a fair bit happening here, and as one Redditor put it: "What's left for the 26H2 [update] then?"

Well, not a great deal in truth, and if you've been following along with Microsoft's annual updates, you may recall that 26H2 is going to be a very minor upgrade that doesn't do a lot. Indeed, some folks are wondering why Microsoft didn't save these juicy new interface features for 26H2, given that it's out next month.

The reason is likely to be because Microsoft wants to ensure that 26H2 runs as smoothly as possible (with no bigger changes involved). Although to be fair, as noted, due to the rollout process, a lot of folks won't be getting the new Start menu options and taskbar repositioning until October (or possibly later) anyway.

AI could kill all humans in next decade, warn experts: but how seriously should we take them?

Alarming warnings from industry insiders increase pressure for curbs on artificial superintelligence

Does artificial superintelligence really pose a risk greater than nuclear weapons? Is there a significant chance of “a Chornobyl-sized catastrophe”. Might there even be a greater than 10% chance that AI could “kill all humans” in the next decade?

These warnings were issued over the past 48 hours on both sides of the Atlantic about the potential impact of a technology that most people still think of as a more talkative search engine.

Continue reading...

© Illustration: Ales Utouka/Alamy

© Illustration: Ales Utouka/Alamy

© Illustration: Ales Utouka/Alamy

Steam achievements for multiple upcoming and unannounced games have leaked — and it's an ugly situation for Valve

9 September 2026 at 14:35
  • Steam achievements of upcoming and unannounced games have leaked
  • The achievements include spoilers for games like Control Resonant, Kingdom Hearts, and Persona 6
  • Valve hasn't commented on the achievements or recent prototype leak on Steam

Steam achievements for both upcoming and unannounced games may have been leaked by Valve and spotted on the third-party site Exophase.

As reported by PC Gamer, the leak includes nearly 90 games, including Control Resonant, Kingdom Hearts 4, Gears of War E-Day, Tomb Raider: Legacy of Atlantis, and Persona 6.

The leaked achievements are listed for each title on Exophase, including spoilers for major plot points, character reveals, and even weapon unlocks (notably for Kingdom Hearts 4), despite missing full descriptions. It's effectively created a minefield of spoilers to avoid, which is made worse since the list includes games that don't even have a release date.

It's not exactly clear how this leak occurred on Valve's end, but it doesn't appear to be a breach of the Steam platform. Instead, it may very well be an issue with Valve's API exposure, at least according to Exophase owner Mike Bendel, who claims it's a "possible screw-up on Valve's end", which makes this the second slip-up in just a few weeks.

Recently, around 12TB to 13TB of early prototypes, unreleased titles, and scrapped builds of games between 2003 and 2013 were leaked from Steam, including games such as GTA 5, The Binding of Isaac, and even some of Valve's very own games like Left 4 Dead.

Mobile phone with logo of video game distribution platform Steam operated by Valve on screen in front of web page

(Image credit: T. Schneider / Shutterstock)

It's possibly the worst spell of game leaks for publishers launching games on PC platforms like Steam, especially with the leak of builds for games like Death Stranding 2: On the Beach and Forza Horizon 6 before launch.

There's clearly a major security issue at hand with Steam, and until it's addressed, game leaks seem inevitable. Game achievements, while potentially spoiler-filled, are minor in comparison to the very recent game prototype leak.

Valve hasn't made an official statement on the Steam prototype or achievements leaks, but with its impact on both publishers and consumers, it wouldn't be surprising to see both cases addressed soon.

A worrying ChatGPT bug let strangers read Gmail messages via a hidden cross-account channel

9 September 2026 at 14:05
  • Check Point Research exposed coerced insider flaw in ChatGPT’s agent architecture
  • Containers shared metadata via internal service, enabling cross‑account prompt injection and data theft
  • OpenAI closed the path, but CPR warns similar risks may exist in other AI platforms

ChatGPT’s AI agents were allowed to pull sensitive data from one account shared with an entirely different account because, colloquially speaking, all agents used to walk down the same hallways, experts have warned.

A new report from security experts Check Point Research (CPR) dubbed the flaw “coerced insider”, since it revolves around persuading the agent instead of abusing a vulnerability.

Coerced insider

When an AI agent is given a task that needs code execution, it handles that task in an isolated container which also sometimes needs to install software. To enable that, without giving containers direct internet access (which would be too risky), OpenAI routes those packages through an internal JFrog Artifactory instance. As a separate security contingency, containers from different accounts cannot talk between themselves.

However - they can reach the same internal service (our proverbial hallways), which exposes an item management feature that lets the containers attach text or binary properties to a repository item. As a result, any container can read back the properties written by any other container.

“Check Point Research confirmed the isolation gap directly: a property written from one account’s container was fully readable from a different account’s container moments later, with data too large for one property simply split into chunks and reassembled on the other end,” the researchers explained.

“The package delivery metadata effectively became a shared clipboard between containers that were supposed to be walled off from one another.”

From there, the exploit turns into your usual, off-the-shelf prompt injection. The only difference is that the malicious prompt is not delivered directly to the victim, but rather left in the hallways, and the results are not shared with the attackers directly, but rather left in those same proverbial hallways, too.

The attacker then delivers a prompt or a shared conversation that instructs the agent to check the same storage during its next ordinary reply. The agent checks, sees the malicious instructions, executes them, all the while replying to the victim’s question in the usual manner. The victim is oblivious to the fact that data theft is taking place in the background.

What kind of information can be stolen?

But this is just half of the equation. How destructive this attack ends up being still depends on the amount of data being shared with the victim agent.

The bare minimum is the information shared while chatting to the agent. It then grows with every connected app: Gmail, Google Drive, Microsoft Teams, GitHub, and similar. “In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn,” CPR stressed.

The good news is that you’ll likely never be exposed this way, at least not via ChatGPT. CPR says it disclosed the findings to OpenAI, who then confirmed that the specific internal Artifactory instance identified in the research has been commissioned. In other words, the hallways attack path has been closed.

The bad news is that this doesn’t automatically mean everyone’s safe. This particular path might be closed, but the architectural pattern behind the flaw could be present in other platforms, CPR warns.

“Any AI assistant that operates inside an organization’s trust boundary, holding credentials, running code, and reaching connected services, can become what Check Point Research calls a coerced insider,” the report states. “The model itself does not need to be malicious. It only needs to be persuaded, through text it was never meant to trust, to use access that was granted for entirely legitimate reasons.”

Going forward, businesses are advised to learn which AI tools their employees are using, and what those tools are connected to. Then, they should govern what AI tools and agents are allowed to do, treating all of their actions (not just output) as something that needs to be monitored.

This 32GB G.Skill Trident Z RGB DDR4-3600 RAM kit deal is down to just $215 using a special coupon at Newegg

DDR5 might be the memory standard for newer PCs, but it costs far more than DDR4, especially when you're shopping for faster or higher-capacity kits.

If you're upgrading a DDR4 system, I've found a terrific deal on the G.Skill 32GB Trident Z RGB for $215 (was $258) at Newegg when you use code LUYRF222.

For your money, you get two 16GB DDR4-3600 modules with CL18 timings, aluminum heat spreaders, customizable RGB lighting and Intel XMP 2.0 support.

Today's best DDR4 RAM deal

32GB TridentZ RGB Series DDR4 3600 RAM: was $257.49 now $214.99
This memory kit provides 32GB of dual-channel DDR4-3600 RAM across two 16GB modules, with CL18 latency, 18-22-22-42 timings, aluminum heat spreaders, RGB lighting and XMP 2.0 support. For the full discount, use code LUYRF222View Deal

Why we recommend it

32GB is enough memory for demanding multitasking, gaming and creative applications. The DDR4-3600 speed is also a good fit for compatible DDR4 systems, particularly if you're upgrading an older machine that's currently running slower or lower-capacity memory.

The two matched 16GB modules provide a dual-channel configuration, with timings of 18-22-22-42 at 1.35V.

G.Skill's Trident Z design adds aluminum heat spreaders and customizable RGB lighting, making this a good choice if your PC has a windowed case and you want your memory to complement other RGB components.

Price context & historical value

Newegg sells the 32GB Skill Trident Z RGB kit for $257.49, and it's currently available for $249.99. Using coupon code LUYRF222 brings the final price down to $214.99.

While that's a decent price in today's inflated memory market, it's worth remembering just how much cheaper DDR4 used to be. Newegg sold this exact G.Skill kit for just $69.99 in August 2023, less than a third of its current discounted price.

Unfortunately, it's unlikely to drop down to that level again, so the current deal is worth considering if you need to upgrade your DDR4 system now.

Should you buy it?

✅ Buy the 32GB G.Skill Trident Z RGB kit if...

You have a compatible DDR4 desktop and want to increase its memory capacity without replacing your motherboard and processor to move to DDR5. The combination of 32GB capacity and DDR4-3600 speed makes it a solid upgrade for an older system.

❌ Skip the 32GB G.Skill Trident Z RGB kit if...

You're building a completely new PC around a recent processor and motherboard. In that situation, I'd seriously consider DDR5 instead, as you'll be investing in the newer memory standard rather than spending more than $200 on DDR4 that you won't be able to carry over to a future platform.

The Catch: What to know before you buy

You'll need to enable XMP, DOCP or A-XMP in your BIOS to reach the kit's advertised DDR4-3600 speed on compatible hardware. Otherwise, the memory will initially run at its default SPD speed.

Compatibility is also important. G.Skill recommends checking its motherboard QVL, and it specifically warns against mixing separate memory kits, even when their specifications appear identical, as doing so can cause stability problems.

Google Chrome will now ship security updates every two weeks, thanks to AI

9 September 2026 at 11:00
  • Chrome will get new updates every two weeks to minimize real-world attacks
  • Smaller, incremental changes should also make it easier to track any issues
  • Other major browsers are also shifting to two-weekly release cycles

Google has confirmed that Chrome has officially moved from a four-week Stable release cycle to a two-week one, with effect from September 8 2026 with the launch of Chrome 153.

Besides adding new features, the main objective is for Google to give us performance and security fixes more promptly in an era of increased complexity and heightened vulnerabilities.

And it's exactly those security concerns that pushed Google to want to double Chrome's update frequency in the first lace, with the company now having to deal with a higher volume of patches than ever before.

Chrome will get updates every two weeks

Together with a higher volume of attacks in general, Google has also benefitted from AI-powered vulnerability discovery tools, giving developers more work to do than before. "With automated AI discovery tools and community bug reports generating higher patch volume, shorter release cycles make managing security fixes significantly simpler," the company wrote.

Crucially, the faster cycle reduces the time between a fix landing in Chrome's public codebase and it actually reaching end users, making it less likely for a bug to be exploited in the wild.

Chrome has been adhering to a four-week cycle since 2021, but the world is a very different place in the space of just half a decade.

With the higher pace of releases, Google also anticipates a smaller scope of changes, which could actually be a good thing because it could be easier for developers to identify what went wrong in the event of any issues.

Desktop, Android and iOS versions of Chrome will all be impacted by the change, with Chrome 154 already slated for a September 22 release.

More broadly, Google says Chrome isn't the only browser getting more frequent updates. Microsoft, Mozilla and Brave are also making similar changes, and they're all undergoing those changes right now.

Google logo on a black background next to text reading 'Click to follow TechRadar'

❌