Normal view
- The Debrief
- “When We Build the ARC Fusion Power Plant, It Will Work”: Company Claims Nuclear Fusion Reactor Design Will Produce More Energy Than It Consumes
“When We Build the ARC Fusion Power Plant, It Will Work”: Company Claims Nuclear Fusion Reactor Design Will Produce More Energy Than It Consumes
Researchers from the private nuclear fusion energy company Commonwealth Fusion Systems have published a series of papers that they claim confirm that their flagship ARC reactor will produce more usable energy than it consumes if built as designed.
Although the company projects it will deliver the first commercial fusion plants by the early 2030s, other researchers say there are remaining challenges to overcome, and won’t declare the ARC reactor successful until an operational version is constructed to validate the research team’s theoretical predictions.
ARC Fusion Reactor ‘Will Work’ When Built
Scientists have long dreamed of capturing the nuclear fusion reaction that fuels our Sun and using it to generate clean, renewable power. Private fusion firms like CFS have received nearly $10 billion in funding over the last decade alone.
The first laboratory “net-energy” controlled fusion reaction, which fusion scientists call “ignition,” didn’t occur until 2022, when physicists at the US National Ignition Facility in Livermore, California, successfully produced more energy than was used to generate the reaction. Although brief, that moment has fueled speculation that practical fusion energy generation may be right around the corner.
Now, the Commonwealth team, which includes 58 researchers from the company and partner institutes, has published scientific papers outlining the physics of their ARC reactor, including new models that they say account for the “expected behavior” of the superhot plasma at the heart of the design.
Brandon Sorbom, the company’s chief science officer, said that the published works “confirm that when we build the ARC fusion power plant, it will work”.
Company Claims ARC Will Produce 400 Megawatts of Net Electricity
After nearly a decade of research, CFS, founded in 2018, is currently preparing its prototype for a 2027 demonstration it calls ‘SPARC.’ The company said they expect that trial run, which will demonstrate their technology’s ability to generate more energy than it needs to heat the plasma, will help them fine-tune ARC’s final design.

According to the Commonwealth-led team, ARC will generate more energy than is required to operate the entire facility, including plasma heating, resulting in a true net-positive power-generation facility. This includes producing approximately 400 megawatts of net electricity, which the team noted is enough to power 280,000 average US homes. For comparison, recent census data indicates that Boston, Massachusetts, near the company’s headquarters in Cambridge, has around 271,000 U.S. homes.
Like SPARC, the ARC reactor uses high-temperature superconducting magnets to compress the plasma, which remains suspended by the magnetic fields, preventing it from damaging the chamber walls and terminating any potential fusion reaction. Under this extreme pressure, the nuclei of heavy hydrogen trapped inside the chamber fuse to form helium, the same reaction that takes place inside the Sun.
This fusion reaction results in the release of energy, primarily high-speed neutrons. At its hottest, the donut-shaped ring of plasma reaches seven times the temperature of the Sun.
Critics Applaud Publication While Highlighting Unproven Concepts and Systems
Tony Roulstone, a nuclear engineer at the University of Cambridge, UK, conceded that the CFS team and its collaborating authors are “some of the best in the fusion business” and noted the company’s ARC reactor concept is the result of “good work over many years.” However, Roulstone also warned of the pressure on researchers in privately funded companies to “claim things before the evidence is fully in place.”
David Hammer, a nuclear engineer at Cornell University in Ithaca, New York, said it is a good sign that the team is publishing at a high volume, but also warned that published papers will not guarantee that the built device will work as intended.
Their modeling “has to be proven correct by a fusion reactor that works as designed”, he adds. If the firm can get SPARC operating successfully next year, “it will be an important step forward”, he says.
Hamner also noted that several of the design’s subsystems require further development before it can be declared complete. This includes addressing how plasma will behave in the real world when it becomes unstable versus its modeled behavior, proving out the process for extracting usable energy from the generated heat, and demonstrating that the reactor is robust enough to operate for long periods.
The scientists also noted the challenges in sourcing tritium, the isotopic fuel the reactor requires to operate. Although CFS has outlined its tritium generation process, Hamner noted that the series of published papers neither details the process nor demonstrates its viability.
“There are candidate blanket materials and blanket designs, but there are many engineering person-years needed” to bring a functional ARC-style plant to fruition, he explained.
“We certainly have to build more on top of that foundation laid out in these papers,” a company spokesperson said, adding that they will “be able to produce tritium for operations and for future power plants.”
The following articles were published by the CFS-led team: “Overview of the physics basis for the ARC fusion power plant“; “ARC disruption physics and strategy“; “Performance and Transport in the ARC Tokamak“; “Power and particle exhaust for the ARC fusion power plant“; “ARC Physics Basis-Magnetohydrodynamics.”
Editor’s Note: This article was updated to correct a previous version that described neutrinos, rather than fast-neutrons, in the context of the reporting, and to clarify that the first achievement of a “net-energy” controlled fusion reaction (ignition) occurred in 2022.
Christopher Plain is a Science Fiction and Fantasy novelist and Head Science Writer at The Debrief. Follow and connect with him on X, learn about his books at plainfiction.com, or email him directly at christopher@thedebrief.org.
The history of tsunami-causing earthquakes in Japan
In 2011, miles of rock shifted deep underwater in the Japan Trench, causing an earthquake that deformed the seafloor and caused a devastating tsunami. Off the Eastern Coast of the Tōhoku region in Japan, a huge piece of the Earth’s crust carrying the Pacific Ocean, known as a tectonic plate, is forcing itself beneath Japan and into the Earth’s interior. Researchers think rock from this plate pushed against rock far beneath Japan, building pressure until it became too great. The lower plate slipped, spreading energy from the slip site and causing the earthquake.
Plate slip can cause 2 types of outcomes. The first occurs kilometers deep in the Earth’s crust, causing earthquakes too small to trigger tsunamis. The second type causes extreme slip events that begin deep in the crust, like the 2011 event that extended into the Japan Trench and warped the seafloor. The moving seafloor displaces seawater, causing a tsunami. These events are referred to as slip-to-the-trench style earthquakes.
Researchers think this phenomenon is not unique to 2011, as Japan has a long history of tsunami-causing earthquakes. Charlotte Pizer and colleagues investigated sediment from the Japan Trench to unearth the geologic history of slip-to-the-trench style earthquakes.
In between earthquakes, Japanese islands continuously shed sediment that fills the trench, forming horizontal layers. Slip-to-the-trench earthquakes bend and fold these layers. The team hypothesized that if they found these folds in the Japan Trench and dated them, they could catalogue the record of slip-to-the-trench style earthquakes in the area.
Earthquakes like these occur repeatedly, meaning that younger ones can erase folds caused by older ones. To account for this overprinting, the researchers chose a study site within the Japan Trench about 100 kilometers (60 miles) north of where the most severe earthquakes occur. This site is only mildly deformed by slip-to-the-trench earthquakes since it’s so far from their source, making it easier for the team to identify individual events.
Pizer and her group pieced together data collected from this site by previous researchers to reconstruct Japan’s earthquake history. They compiled 3 main types of data. Two of these were images of sediment layers in the trench constructed from reflections of vibrations sent into the ground, called seismic profiles.
The first seismic profile captured the full trench, over 1 kilometer deep (about 0.6 miles), at 5-meter (16-feet) resolution. Using this method, any layers smaller than 5 meters thick won’t appear in the image. The second seismic profile captured only the top 40 meters (130 feet) of sediment, but could detect layers as thin as 10 centimeters (4 inches).
The final type of data they used came from a 36-meter (120-foot) long cylinder of sediment extracted from the bottom of the trench, called a sediment core. Researchers in the past tied layers within this sediment core to historic earthquake events. They showed that it recorded 2 specific earthquakes in the area, the Kyotoku earthquake of 1454 CE, and the Jogan earthquake of 869 CE, both of which likely caused tsunamis.
Pizer’s team could observe the depth of the Kyotoku and Jogan earthquake layers taken from the sediment core in their high-resolution seismic profile of the trench. In these high-resolution data, they noticed that deformation occurred in the sediment up to the layer marking the Jogan earthquake, but not above it, meaning deformation of the trench happened during this 869 CE event.
The high-resolution data were only able to image sediments from recent earthquakes since 869 CE, but the low-resolution profile, which imaged the full trench, was able to capture the deeper, older record. When they looked deeper into the trench sediment, the researchers noticed that deformation from the 869 CE event had spread from where the tectonic plate is colliding with Japan. They saw at least 6 more similarly deformed layers, implying each was its own slip-to-the-trench event, although the dates of these events are unknown.
Pizer and colleagues concluded that slip-to-the-trench earthquakes are long-standing, common events in the Japan Trench. They hope future scientists will continue to research this site to better assess tsunami risks in Japan.
The post The history of tsunami-causing earthquakes in Japan appeared first on Sciworthy.
GitHub finally pulls the plug on automatic install script execution for npm
The ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it.
In V12, default settings are changing, GitHub said in its changelog, noting, “it turns an npm install behavior that runs automatically today into one you explicitly opt into.”
Specifically, the post said, “allowScripts defaults to off: npm install will no longer execute preinstall, install or postinstall scripts from dependencies unless they are explicitly allowed in your project. This includes native node-gyp builds; a package with a binding.gyp and no explicit install script still gets blocked, because npm runs an implicit node-gyp rebuild for it. Prepare scripts from git, file, and link dependencies are blocked the same way.”
Analysts, consultants, and users generally applauded the change, but said that it would only narrow the exposure to supply chain attacks instead of eliminating it.
Attacks likely to move elsewhere
Sonu Kapoor, maintainer for CVE Lite CLI in the OWASP Incubator Project, said that this change is likely to force the supply chain attacks that leveraged the automatic execution to move elsewhere.
“This does not eliminate npm supply chain risk, it removes a major automatic execution path,” Kapoor said. “Attackers can still move to other paths: malicious package code that runs at application runtime, compromised maintainer accounts, dependency confusion, typo-squatting, poisoned GitHub Actions workflows, malicious transitive dependencies, or stolen publishing tokens. This closes one very dangerous door, but it does not secure the whole house.”
Still, attacks leveraging the setting have been regularly used in supply chain attacks.
However Alan Parkinson, director of secure medical device firm Threat Detective, said more sophisticated attackers have already moved beyond this hole.
“The install script attack vector has been known for years,” Parkinson said. “Most security teams marked it as low risk and moved on to higher risk threats. What raised its profile wasn’t the technical exploitability changing, it was a run of high-profile victims and some threat actors openly chasing notoriety.”
He added, “the pre and post install scripts was never a clever attack vector to begin with. Running code from an install hook is crude and noisy, which is why it caused such visible damage. The more capable actors are already moving to other methods, so v12 mainly shuts the door on less sophisticated threat actors.”
Although GitHub declined an interview, Zach Steindler, a GitHub principal engineer, answered InfoWorld’s questions by email. He said the volume and pace of supply chain attacks forced the default settings change.
“We’ve seen attackers target these capabilities to quickly propagate attacks from one compromised package to many. Years of security and usability research have shown that it’s not enough to make secure functionality available; the secure path has to be the default in order for it to be widely adopted,” Steindler said.
He added, “we believe that these changes are a great way to provide high impact secure defaults while still providing the option for some users to fall back on functionality they might need in some circumstances.”
Change overdue
Sanchit Vir Gogia, chief analyst at Greyhound Research, said that GitHub was the last of the repositories to make the setting default change. “Rivals moved first: Yarn, pnpm and Bun all block third party install scripts by default in their own ways,” Gogia said. “Npm is not inventing a new doctrine. It is finally adopting one.”
Steindler didn’t dispute Gogia’s comment.
“It’s not easy being the stewards of the largest package repository in the world. Community consensus on what security capabilities should be standard, and when it’s okay to make breaking changes shifts over time. From our continual conversations with the community, it was clear it was time to make this change,” Steindler said.
“The recent attacks are alarming,” he noted, “but stewarding these package repositories is a multi-decade effort, not just a moment in time. As attacks evolve, so will our defensive security capabilities. We’re in this for the long haul.”
Gogia said that the change, although overdue, is a good one.
“Npm is removing one of the most comfortable hiding places for software supply chain risk: code that executes the moment a developer types install,” Gogia said. “With npm v12, execution becomes something that must be approved, recorded in the project, and committed for review. That is not a design adjustment. It is a change in control philosophy.”
Bad defaults become infrastructure
Gogia had his own take on why GitHub waited so long.
“Npm waited because its risky default acquired a constituency. As far back as 2016, npm’s own position was that the convenience of install scripts outweighed the worm risk, with an opt-out flag for the cautious. The trade-off was a documented product decision, not an oversight,” he said.
“The trouble with bad defaults is that they become infrastructure,” he added. “Native module builds, browser installers such as Playwright and Cypress, Electron download flows and Husky hooks all grew around automatic execution. Turning it off became less a technical adjustment and more a constitutional reform.”
Liability changed hands
The real pressure for the change, however, came from regulators.
“The deeper answer is that the liability changed hands. Once regulation such as the EU Cyber Resilience Act and securities disclosure rules placed supply chain failure on corporate balance sheets, a documented unsafe default became indefensible,” Gogia said.
Kapoor agreed that long-used procedures enabled this security hole to survive longer than it should have.
“The reason this likely was not done long ago is compatibility,” he said. “Install scripts are not only used by attackers. Many legitimate packages use them to compile native modules, download platform-specific binaries, generate files, or complete setup steps. Changing the default breaks assumptions that have existed in the npm ecosystem for years. That is why these security changes often arrive slowly. The safer default is obvious from a security perspective, but painful from an ecosystem compatibility perspective.”
In addition, he noted, “the bigger point is that package managers are moving from implicit trust to explicit trust. That is the right direction. Developers should have to approve which dependencies are allowed to execute code during install. But approval cannot become a blind checkbox. Teams need visibility into which package wants to run a script, whether it is direct or transitive, why it is there, and whether it belongs in the project at all.”
Kapoor added that this change matters because install-time execution often happens in privileged environments with access to tokens, secrets, internal registries, build artifacts, or deployment paths. “Even if the script does not compromise production directly, it may be able to steal enough context to support the next stage of an attack,” he said.
Value in the pain
Cybersecurity consultant Brian Levine, executive director of FormerGov, agreed that the closing of this security hole is a very good thing.
“It seems like virtually every major supply chain attack of the last decade has had the same original sin: code that ran automatically because the ecosystem let it. Npm finally closing that door by default is overdue, but it’s genuinely significant. This is the package manager for hundreds of billions of downloads a month,” Levine said.
“When npm changes its defaults, it changes the security posture of practically every enterprise dev environment on the planet. It may have been the last large code repository to still allow this kind of automated execution.”
Levine added that this change might not merely stop a security hole, but the new process may meaningfully improve security.
“There’s actually something valuable buried in this migration pain. Having developers explicitly approve which packages can run code and commit that list to source control is a form of software supply chain governance that many organizations never had,” Levine said. “It creates an auditable record which is meaningful, especially for regulated industries.”
