Digital Research's GEM was one of the earliest graphical environments for PC compatibles, and an inspired hack has now resurrected it on Linux. GEM for Linux is a port of the Atari ST's graphical desktop, created by prolific Slovenian developer Tomaž Štih. Applications share a display server that can output directly through Linux's framebuffer or display the desktop in a window using Štih's SDL2-based Rasta framebuffer emulator. In his Linkedin post, he says that it is "derived from OpenGEM and FreeGEM – now secure, optimized, stabilized, and source-compatible with Atari ST GEM." It is derived from the Digital Research GEM source code released by Caldera in 1999, as the still-young Register reported at the time. GEM was among the first successful GUIs for MS-DOS PC compatibles. European readers may remember that it was the graphical desktop bundled with the Amstrad PC1512 and PC1640 – the first affordable mass-market PC compatibles on this side of the Atlantic. In 1985, Apple threatened legal action against Digital Research over GEM's similarity to the Macintosh interface. Digital Research agreed to make the PC version less Mac-like, removing desktop drive icons, overlapping windows, and other features. The lawsuit didn't affect Atari's version, however. That PC version is what Caldera released as open source. Since 1999, the FreeGEM community has enhanced it beyond the ST version, restoring the removed features and adding others. These include Bézier curve drawing from the runtime-only GEM/4 bundled with CCP Artline and 3D-shaded buttons from Timeworks Publisher's GEM/5 runtime. You can see some of the results on John Elliott's FreeGEM page. As far as we know, this is the second modern FOSS implementation of Atari GEM to benefit from the FreeGEM source code. The other is the remarkable EmuTOS project, a completely open source replacement operating system and GUI for original Atari hardware that we mentioned in 2022. Atari's TOS combined GEMDOS, derived from Digital Research technology, with a modified version of GEM for its graphical interface. Quite a lot of DR source code is available online, but despite the clarification of CP/M's legal status that we covered in 2022, much of it is not strictly open source. FreeGEM and the OpenGEM distribution are. Back in the 1980s, DR had a multitasking version called X/GEM for FlexOS, whose history we described later in 2022. We find it delightful to see some of DR's multitasking ambitions revived nearly 40 years later. We don't expect GEM to render Wayland obsolete or usher in a new era of Atari-inspired Linux development. We wouldn't hate that, but there is precedent for taking GEM further. Third-party development eventually turned ST GEM into a multitasking environment in its own right, called FreeMiNT. There was also a commercial multitasking GEM-compatible operating system called MagiC, with a 68K Macintosh version called MagiCMac. Its source was later released publicly, and development continues in the Atari portions of the code. We asked Štih the inevitable question: was GEM for Linux vibe-coded? Štih replied: "No. In my experience, vibe coding tends to produce code bloat and poor architecture. "I use AI, but I practice architecture-driven design. I define the initial architecture, implement the first iteration, refactor, and repeat. "For me, AI is still a junior developer. I remain in control, and I'm ultimately responsible for the architecture and the quality of the code." ®

EPISODE 17 The new Boss is keen to acquire knowledge. So keen that he wants a quick rundown on our content management system so he can avail himself of our copious workplace documentation. "WELL," I say, bracing myself for a long session, "first things first, you'll need to get a strong coffee." "Why?" "Because our CMS is a place where documents go to die." "Surely it can't be that-" "Oh, it's bad. So bad that no one will ever admit to being on the selection committee that purchased it." "Were you on it?" the Boss asks pointedly. "What, put an IT person onto a project to select an IT system to store the entirety of our electronic data? Why would you want to do that? No, a selection committee for a project of that importance needs to be made up of people unencumbered by the intellectual weights of reliability, safe data management, and backupability." "Backupability?" "You know what I mean. Anyway, a selection committee needs to focus on the big decisions – like the highlight color of tags – and how many different tag colors there are. And whether you can add colors. Then there's the avatar facility." "Avatar facility?" "Yeah, you know, so your avatar appears next to any document you upload. Apparently, it encourages people to contribute." "It doesn't sound all that ba-" "Oh, it's bad. It doesn't have a proper index, because it uses AI to create tags and keywords dynamically." "That sounds like a pretty good ide-" "Yeah. Though it regenerates those tags every night, based on keyword frequency and lazy theme frequency matching." "Lazy theme frequency?" "Yeah. Say I upload a bunch of documents, each discussing something of vital importance to senior management, like, I dunno, the decline of manila folders. AI runs through overnight and creates tags for manila and folders and then a theme keyword of stationery. "The next day, the PFY slaps in a news item about traffic jams in the Philippines. That night, AI will associate Manila with manila, surmizing it's a typo, associate stationary traffic with stationery for the same reason, and before you know it you're getting a 20-year-old travel expense form when you go to order staples." "Surely you can just correct that?" "It does it every night. And worse still, there's some all-encompassing word association going on inside it which means that if you delete the document, AI will retain the keyword and try and match it to the next 'best' document." "But surely you could tune AI?" "What for?" "To stop that happening." "Why would I want to stop that happening?" "I... to fix it." "No one wants us to fix it. Remember when I said it's where documents go to die?" "Yes, but..." "The staff love it. Say you've half-completed a report that was due a couple of weeks ago, and you're under the pump to deliver it. Just put it in the CMS and that's the end of the matter. No one's going to look for it." "At my former workplace we used to use ShareP-" "Don't say that word. Or the T word. It's worse than Candyman." "Why?" "Well, they have the 'prior art' when it comes to sending documents into Neverland. No, we're happy with our system, which is almost as good as one of those shredders that slices the paper up before chopping it up into confetti." "I don't think that senior management would accept that sort of syst-" "Senior management were the ones who asked for it! We make the system available to His Majesty's Revenue and Customs on a regular basis. It takes about three weeks to convert a forensic accountant into a mindless ghost watering invisible plants in a mental health facility." "It can't be that bad. I mean, why would we keep it – at a functional level, I mean?" "It did cost a lot of money." "How much money?" "No one knows. The original invoice is in the CMS." "Well, just download it." "We could, but you're pretty much guaranteed never to get served the same document twice." "What does that mean?" "Well, you know. There was a negotiation process. Lots of letters of engagement, counter-letters of engagement, example contract, pre-draft, draft, pre-pre-signing, pre-signing, amended, cross-amended, legally reviewed, counter-legally reviewed, signed in principle, signed, countersigned, amended countersigned, etc." "You said amended countersigned... but you didn't say amended signed." "No, I didn't, did I? Maybe that's not in the system, but then again, maybe it is. After you've downloaded 17 documents – all slightly different, some dated, some undated, definitely NOT added in chronological order – you'll start to feel like you're getting somewhere. Then you'll get the 18th document, which refers to another document you've never heard of, which supersedes all the documents thus far." "But surely you can find it?" "I don't want to find it," I reply. "But I want you to find it." "And I think you'll find I don't have to find it for you. It's in my contract." "And don't tell me, your contract is in the CMS?" "I put it there myself," I nod. BOFH: Previous episodes on The Register The Compleat BOFH Archives 95-99

Chinese AI darling DeepSeek unveiled an updated version of its cost-and-latency-optimized Flash model on Thursday, with a new version 4.1 that includes architectural improvements more significant than you would expect in a point release because the changes might open the door to larger, smarter, and less resource-intensive models. At 763 billion parameters, the point release is more than 2.5x the size of the model it replaces. In fact, the model is larger than the V3 and R1 models that put DeepSeek on the map back in early 2025. Despite its ginormous parameter count, DeepSeek V4.1 Flash’s memory requirements aren’t nearly as high as you’d expect for a model of its size. Under the hood, DeepSeek's devs have made numerous architectural changes that see the LLM become smarter while dramatically reducing the resources necessary to serve it. DeepSeek has managed this through two key improvements. First, it made significant changes to how the model handles the key-value (KV) caches used to track model state across multiple sessions. These so-called KV caches can be quite memory-hungry, particularly in high-throughput applications like chatbots. Updates to the model’s various attention mechanisms and the introduction of a new causal encoder-decoder (CED) enabled the devs to improve prompt processing performance while cutting KV cache consumption to between 13 percent and 25 percent of DeepSeek V4 Flash's requirements. In other words, the V4.1 release can support four to eight times as many users in the same KV cache footprint. DeepSeek’s technical report goes into far greater detail on the architectural changes, but arguably the most interesting change is the introduction of a different kind of model weight. Of its 763 billion parameters, 196 billion are N-gram parameters that form what DeepSeek's developers refer to as a “conditional memory module.” The idea is that by decoupling memory from computation, DeepSeek can make its models smarter while also reducing the compute and memory resources required to serve them. What the heck is an N-gram? The big idea behind DeepSeek’s V4.1 Flash’s memory module is similar in many respects to Per-Layer Embedding (PLE) tech originally developed by Google’s Gemma team. The goal with PLE was to get LLMs to be smart enough to run usefully on devices with constrained bandwidth, memory, and compute – like smartphones. DeepSeek’s implementation, first detailed in a January research paper, trades PLE embeddings for N-grams. At a high level, N-grams are just groups of tokens. A three-gram would be three tokens in a row, a two-gram would be two, and so forth. As complicated as that might sound, it actually works a bit like word or phrase association. If you were asked: "Find the parameter of a right triangle when only two sides are known." For those of you for whom geometry isn't too distant of a memory, the phrases "use the pythagorean theorem" or "A2 + B2 = C2" or perhaps "the perimeter would be the sum of its sides" might immediately pop to mind. The N-gram parameters found in models like DeepSeek V4.1 Flash are similar in concept. The weights are a source of implicit knowledge or ingrained memory. Rather than just calculating which combination of tokens have the highest probability of answering the question, as LLMs have traditionally done, the N-gram weights supplement this by quickly surfacing relevant information through a cheap lookup. This is a gross oversimplification of what's going on under the hood. In fact, the model isn't looking up the prompt so much as a series of hashes. These are numbers representing "Find the parameter," "right triangle," and so on. Similarly, the contents of the lookup table aren't raw responses. They're another mathematical representation, called vectors, which get fed into the inference pipeline. However, the end result is the same: The model can provide smarter, more nuanced answers without the performance penalty normally associated with additional parameters. What makes N-grams so cheap The relationship between model size and intelligence is well established at this point. The reason DeepSeek’s n-gram parameters are so interesting is actually related to how the data is accessed. As a general rule, modern LLMs are autoregressive during decode. That means for every token a chatbot or agent generates, the entirety of the model’s active weights have to be read from memory, making bandwidth the limiting factor. As we’ve previously discussed, architectural changes, like the rise of mixture of expert models or ultra-low precision block-floating point datatypes, have helped to minimize this bottleneck. But the N-gram weights found in DeepSeek V4.1 Flash work a bit differently. They offer a way of effectively increasing the number of parameters available to the model during inference without a proportionate increase in memory pressure. These N-gram weights are essentially enormous look up tables (LUTs). This makes them fast and cheap to query, since unlike the rest of the model’s active parameters, they don’t need to be read in their entirety from memory each time a token is generated. It’s just a few dozen table lookups per token. This has a couple of implications for memory access, but the big one is that those n-gram weights don’t have to be crammed into GPU memory to maintain performance. They can be offloaded to system RAM or, possibly even a sufficiently speedy storage array. So what does that mean in practice? If you look at DeepSeek V4.1 Flash, the model would normally need a minimum of 763 GB of GPU memory to hold the weights at FP8. However, since those n-gram weights can be offloaded to cheaper system memory, we can get away with around 567 GB of GPU memory. We emphasize the minimum here, because in production those numbers are going to be substantially higher since we also need to take into account key-value caches, which scale with context length and concurrent users. During inference, those N-gram weights supplement the eight billion active parameters DeepSeek uses to process a prompt, in theory increasing the accuracy and quality of the output in the process. It’s important to note at this point that the n-gram weights don’t actually increase the active parameter count. Instead, they function more like an oddly specific encyclopedia that almost instantly opens relevant pages as the model processes prompts. The future of open LLMs While DeepSeek’s latest model may have one of the largest pools of N-gram parameters yet, it’s not the only model developer betting on tech to make deploying larger models more efficient. As mentioned earlier, Google is already employing a similar approach using PLE to offload less bandwidth-sensitive weights to local storage. So far, it's only been applied to tiny models — at least that we know of (it's not like Google is particularly transparent about its proprietary models). Meanwhile, late last month, Alibaba revealed its latest experimental model codenamed Qwen 3.8-Flash-Next. Much like DeepSeek V4.1 Flash, the 180 billion-parameter model featured a large 51 billion-parameter pool of N-gram weights for much the same reason. In fact, the model's N-gram implementation uses techniques from the same research published by the DeepSeek team back in January. According to Alibaba, Qwen 3.8-Flash-Next's architectural underpinnings will form the foundation of its next generation of Qwen 4 models when they arrive. Which means, like it or not, this probably won’t be the last time you hear about N-grams. ®

ON CALL Friday morning is The Register's home for tech support stories, which we showcase in On Call – the weekly column made possible by readers generously sharing their experience of what it takes to fix things for the furious, fatuous, or feebleminded users that infest every workplace. This week, meet a reader we'll Regomize as "Lucia," who was once ordered to report immediately to a company director's office. "All of my files have gone," the director fumed, before insisting this was all the fault of the IT team, who were all inept, incompetent, and unfit for duty. Lucia examined the director's PC and found an empty "Home" folder. "I saw that he had clicked on the 'Up' directory icon to get there," Lucia told On Call. "I casually clicked on the 'Documents' folder and his files magically reappeared." Guess how much gratitude the director showed Lucia. If you guessed zero, congratulations. When Lucia tried to impart a quick lesson in directory navigation, the director was having none of it. "He simply bundled me out of his office, yelling, 'And make sure it doesn't happen again!'" Have your users refused to learn a simple fix? If so, a single click here will speed your story to On Call, so we can share it on a future Friday. ®

When Microsoft's developers and engineers sit down to code, they can now choose to work in Rust, which Redmond has added to its list of canonical languages. “Rust now is a Tier One language at Microsoft, and that just means that it sits among C++, C# and TypeScript as the best supported languages for internal development in the company,” explained Victor Ciura, Microsoft principal engineer for the Rust tooling team, during a keynote talk today at this year’s annual RustConf, being held this week in Montréal. Ciura said Microsoft has “paved a path” of tools and processes that support local Rust development across the entire software development lifecycle. Rust is no stranger at Microsoft and is already present in over 100 Microsoft project repositories. The company has built Oxidizer, a set of crates to build scalable services in Rust, which have been used to build and refine the Microsoft 365 (M365) core services such as Outlook, Word, Excel, OneDrive, and SharePoint. The Copilot tech stack also owes quite a bit to Rust. But the really messy work still lies ahead. Given the recent Windows Patch Tuesday patch deluge, no doubt one of the largest uses for Rust will be shoring up leaky C/C++ Windows code. This is the work Rust was made for. Mozilla developer Graydon Hoare created Rust as a side project in 2006 chiefly as a high-performance language that, unlike C and C++, guarded against memory bugs. Rewriting programs in Rust to improve performance and minimize bugs has since become a common chore for project leaders, who have Rustified everything from databases to package managers, often with the help of AI. New digs Redmond has already done considerable work making Rust comfy on Microsoft Visual C++ (MSVC), its native platform for compiling Windows binaries. Notably, company engineers built rustc_codegen_utc, a custom Rust compiler code-generation backend that wires the rustc compiler directly into MSVC’s internal toolchain for Windows. “Connecting rustc to that backend lets Rust build on the same platform investment, with perfect compatibility out of the box, rather than requiring a parallel implementation of every Windows-specific capability,” wrote Ciura in a blog post that details Redmond's rusty efforts. “The result is a unified code generation platform for Rust and C++ on Windows.” Dangling pointers and foreign code Even with the tight Rust integration, Microsoft engineers will have their work cut out for them. One of the recurring themes of this year’s RustConf is grappling with the dangerous “unsafe” territory that comes when mixing Rust and C++ code. While the Rust compiler can flag memory errors, it typically doesn’t cover pointers into the C++ memory allocations. Still, Redmond running towards Rust is a welcome development. In his 2025 RustConf keynote, Microsoft Azure CTO Mark Russinovich noted that ~70 percent of Windows CVEs are memory issues. “One of the things that I realized a long time ago is that no matter how much we really want to make C and C++ better, we can't make it as good as what Rust starts with," he said. ®

Oracle has argued AI will strengthen its applications business, by giving customers new ways to use software and making them easier to implement. Co-CEO Mike Sicilia decided to defend applications in his first remarks on Oracle’s Q1 FY 2027 earnings call. “The introduction of AI is an accelerator, not a replacement for packaged applications,” he argued. “Before AI came along, application suites had already proven their effectiveness. Companies have been able to increase their profit margins because end-to-end automation of standardized and efficient business processes proved to be much more effective than one-off custom solutions.” The CEO then admitted that business apps “did require organizations to follow workflows and processes as designed in the system, something that many struggle to achieve consistently across functions, teams and regions.” “AI changes this dynamic,” he said. “Rather than asking every employee to navigate and execute a process exactly as a system expects, AI agents can perform tasks using the organization's established workflows and business rules. Employees then shift to overseeing agents, resolving exceptions and applying human judgment where it matters most.” Sicilia is not alone in that view. Salesforce’s Claudeforce puts an AI interface on the CRM giant’s wares. “We are incredibly confident in the potential for this new paradigm to deliver much more rapid ROI for our customers,” Sicilia said. He then promised that in October Oracle will debut an “agentic AI accelerator” that will “automate and orchestrate implementation at an unprecedented scale, compressing SaaS deployments from years to months and months to weeks.” The CEO offered another reason for investors to be bullish about Oracle’s applications biz. “Our SaaS business is also a wonderful lead generation business for our IaaS business,” he said. SaaS is also a solid performer, growing ten percent even as Oracle’s line item for software revenue slipped three percent to $5.5 billion. The database giant’s cloud biz did rather better, growing revenue 60 percent year-over-year to $11.6 billion. Financial analysts on Oracle’s earnings call wanted to know if the company’s colossal investments in datacenters and AI infrastructure are paying off and co-CEO Clay Magouyrk said Oracle is “constantly finding interesting ways to fund the business.” He also pointed to demand for AI infrastructure remaining strong and customers being willing to pay a premium to access it. “GPU longevity and value continue to impress,” he said. “Of all the GPUs that came up for renewal in Q1, that capacity was renewed or resold at a 20 percent premium to prior contracts.” “The majority of those GPUs are four years or older,” he added. “We see a long useful life with increasing value for the AI capacity we're deploying.” That said, Magouyrk warned that some of Oracle’s datacenter mega-builds are progressing faster than others, meaning it can’t offer precise predictions about when its new facilities will start to produce revenue. Magouyrk argued that’s nothing to worry about. “Anyone that's been in the business of doing construction or large-scale infrastructure development, if their plan relies on 100 percent achievement of every one of their deliverables, we have a term for that. It's called a bad plan,” he said. “And so we try real hard not to make bad plans. So we obviously know the difficulty and the complexity of what we're doing, and we don't assume 100 percent of everything is going to work all the time. And we have backup options for those things, as well as we don't count that everything is going to get done exactly on time all the time.” Oracle’s plans did work well enough that it turned on 850 MW of new datacenter capacity in the quarter, and forecasedt earnings per share for the full year would rise five cents to $8.10 on revenue of at least $90 billion. Initial investor response was positive as Oracle shares popped seven percent in after-hours trading, before settling to levels experienced earlier this week. The company’s stock is down 21 percent over the year and is 38 percent below its June peak. ®

OpenAI has launched a version of its latest real-time full-duplex voice model as an API, allowing software developers to implement more responsive voice-enabled apps and conversational workflows. GPT-Live-1 debuted in July, offering a way to interact through spoken prompts and responses instead of through typed text. Initially available through the ChatGPT interface, the voice model can now be reached via API calls. As a full-duplex model, GPT-Live-1 can listen and generate speech at the same time, which aids fluid communication. People often talk over one another and may find it frustrating to take turns speaking and listening as if using half-duplex handheld radios. OpenAI says it has focused on allowing developers implementing GPT-Live-1 to customize how users of business apps experience voice interaction and associated workflows. "A core GPT‑Live‑1 strength, smooth interruption handling, is already delivering business impact: in early evaluations, Speak found that GPT‑Live‑1 gave learners more time to think before the language tutor responded, cutting interruptions by almost 80 percent versus previous turn-based systems," the company said. GPT-Live-1 is designed to handle spoken conversation while a backend model (eg, GPT-6 Astra or a more affordable option for rote tasks) handles information lookup, tool usage, and task management. It represents a step up from OpenAI's Realtime API, which debuted in 2024. In the Tau3 voice-agent intelligence benchmark, which assesses spoken customer-service tasks relevant to airlines, retailers, and telecom companies, GPT-Live-1 scores 86.2 percent, compared to 45.7 percent for GPT-Realtime-2.1 and 42.4 percent for GPT-Realtime-2. Citing its own evaluations, OpenAI said GPT-Live-1 performs 30 percent better than GPT-Realtime-2.1 in Full Duplex Bench performance, while also outperforming its predecessor in turn-taking latency and interactive behavior. Yelp has been using GPT-Live-1 for the Yelp Host service, and has nice things to say about the technology as it applies to the company's AI restaurant reservation system. "With GPT-Live-1, every call is more conversational and responsive," said Akhil Kuduvalli Ramesh, chief product officer at Yelp, in a statement. "Yelp Host now gives restaurants an advanced voice AI that delivers exceptional guest experiences, captures revenue opportunities they may have otherwise missed, and helps staff focus on serving guests instead of answering the phone." Yelp does not address whether restaurant customers making reservations welcome the more free-flowing robo-banter or simply accept it because it's better than waiting on hold to chat with a person. GPT-Live-1 costs $0.05 per minute of usage, on top of whatever backend model is running. Custom voices can be negotiated with the OpenAI sales team. The voice model is also available through OpenAI Presence, the company's enterprise agent platform. ®

In the latest installment of "my AI model is more dangerous than yours," Anthropic on Thursday warned that cybercriminals and state-sponsored hackers alike are using its Claude models to automate cyberattacks, build kamikaze drone swarms, conduct mass surveillance operations, and try to develop an even more dangerous version of a deadly mosquito-borne virus. The baddies have come a long way since November, when an earlier Anthropic report documented Chinese spies using Claude to automate digital intrusions and steal sensitive data at a handful of critical organizations. Now everyone from ShinyHunters to Russian freelancers is getting in on the illicit model usage. This is not to say that Anthropic – nor any other frontier AI lab – plans to slow down its model development or testing initiatives, or take responsibility when its AI commits crimes. It does, however, “hope that the findings in this report will help other developers recognize similar patterns on their own platforms, give governments and civil society a clearer view of how emerging threats take shape, and strengthen collective defenses.” The model maker’s latest very lengthy report on AI misuse covers activity Anthropic disrupted between December 2025 and August 2026 across seven “harm areas” where miscreants used – or attempted to use – Claude Haiku, Sonnet, and Opus models for evil. These span cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. Anthropic also noted that its most powerful Claude Fable or Mythos-class models weren’t used, except in one distillation case. Even without those most advanced systems, the case studies in the report highlight some pretty bad behavior. Autonomous cyberattacks For example, a Russian espionage crew that Anthropic tracks as GTG-20006 – the state-sponsored cyber espionage arm of Russia’s Foreign Intelligence Service (SVR), also known as Midnight Blizzard, APT29, or Cozy Bear – increased the speed of its attacks by using AI to automate the entire kill chain. Anthropic identified more than 20 organizations targeted in these attacks, including embassies, think tanks, defense-industrial companies, and government, defense, and intelligence agencies across Ukraine, Europe, the Middle East, Asia, and North Africa. “We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration,” Anthropic said. Meanwhile, “multiple clusters” linked to the data-theft-and-extortion gang ShinyHunters used Claude to scale their smash-and-grab operations. One affiliate that specializes in supply-chain attacks breached a software-as-a-service provider, and used that foothold to steal data from about 200 of the SaaS company’s customer organizations. “It then conducted a session-store dump containing over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours,” according to the report. “AI agents performed nearly all of the work.” Biological misuse Moving on to a serious health-and-safety risk that looks even scarier when given an AI boost: Anthropic’s report documents five cases of users in “unsupported regions” using Claude to support biological weapons development. In one, a scientist attempted to use Claude to help write a grant application for research related to chikungunya virus, a mosquito-borne virus that can cause severe disease and death. The research focused on the virus’ transmissibility and immune evasion properties, which Anthropic admits could be used to help develop better vaccines. Or “it could also be used to make the pathogen more dangerous,” the report authors said, noting that the military research institute where the research would be performed gave them “cause of concern.” In May, Anthropic discovered a user outside the US using Claude in their research on adaptations of highly pathogenic avian influenza – bird flu. “Unlike other influenza variants, H5 viruses (of which this avian virus is one) often show striking brain involvement in cats, foxes, ferrets, and some human cases,” the report says. “A pandemic variant with such properties would be especially concerning due to its potential to increase disease severity, confuse diagnosis, and hinder treatment.” Weapons development Since its November report, Anthropic has identified new categories for Claude misuse that violate its terms of service. One of these involves users outside the US using Claude to develop software for conventional weapons – firearms, missiles, armed drones, bombs, and other munitions, plus targeting and control systems that operate them. In its new report, the model maker shares details on six cases: three in China, two in Russia, and one in Yemen. In Yemen, a weapons development program used Claude instead of human software engineers to develop guidance, navigation, and control (GNC) software that steers and stabilizes a flying vehicle. “Our safeguards blocked many of their requests, but not all of them,” Anthropic says. The same team used Claude to try to develop guided weapons. While Anthropic says it has no evidence that the actors produced an operational device, it says they did test-fire a guided rocket. “We banned accounts associated with the actors and shared threat information with public- and private-sector partners to mitigate risks posed by the actors,” the report says. “Nevertheless, we have evidence that the actors had already built an offline simulation toolkit that does not rely on Claude or other engineering computing environments.” In China, someone used Claude to draft a Chinese-language specification for an anti-torpedo fire control system, and then benchmark their system against specific US anti-torpedo and anti-submarine programs. Anthropic assesses that the user was associated with a Chinese defense industry manufacturer aiming to produce a weapons specification and acquisition proposal for the People's Liberation Army Navy. According to the report: The actor used Claude to write the acquisition proposal, refining it over many drafts. After each draft, the actor instructed Claude to role-play a hostile expert reviewer to critique the proposal, then used that feedback to sharpen the next version. In parallel, the actor used Claude to build pieces of the anti-torpedo weapons system’s fire control software and a test matrix to validate them. Anthropic uncovered this during an internal investigation into suspected weapons development and banned the account. In yet another case, Anthropic identified a likely Russian “freelance team” attempting to build a full-stack autonomous first-person-view (FPV) kamikaze drone swarm. They used Claude to write and test the code, building the drones’ core software system. Anthropic also banned these accounts. ®

With the release of Apple Watch Series 12, Apple has decided that it's ok to capture people's conversations without their consent. The latest Apple Watch comes with Audio Intelligence, a set of AI audio processing capabilities tuned for the company's S11 chip. Its features include: Sound Recognition, Music Recognition with Shazam, Live Rewind, and Siri Recap. "Live Rewind lets you instantly see the last 15 seconds of a conversation as text," Apple explains in its technical summary [PDF]. "Siri Recap summarizes conversations throughout your day and produces high-level Apple Intelligence-generated notes so you can stay present in the moment and catch up later." With the double-press of the Digital Crown – as Apple grandly refers to the button on its Watch – Live Rewind takes in an audio stream from the Watch microphone, processes it in a Secure Exclave on the S11 chip, and routes the data to the user's nearby iPhone, which runs a speech-to-text algorithm on the 15-second audio segment. The resulting text is saved and the audio is discarded. The wearer's Watch emits an audible tone, even in silent mode, to alert those in the vicinity and provides a visual cue for those able to see the face of the device. Nonetheless, bystanders alerted to the recording – to the extent they recognize the meaning of the tone – have not consented to being recorded, which is a legal requirement in 11 US states that have all-party consent laws. Apple characterizes its implementation of brief eavesdropping as respectful of personal privacy. It makes that claim in a section titled, "How Live Rewind respects those around you," citing the audible chime and visual on-screen animation. Siri Recap, meanwhile, "summarizes conversations throughout your day and produces high-level Apple Intelligence-generated notes so you can stay present in the moment and catch up later." This too, Apple describes as an act of respect. "By design, Siri Recap does not create a recording, does not produce a verbatim transcript, and does not identify and attribute speakers," Apple's technical documentation explains. "The output is a brief, high-level summary, comparable to notes a person might write after a conversation. There is no audible signal because no raw audio is retained, and there is no way to reconstruct the original audio from a Siri Recap or share raw audio with anyone." The implication here is that Apple's non-consensual audio processing is less contemptuous of the public than the middle finger Meta has raised with its AI Glasses. That may be the case, but privacy advocates are still not impressed. "Our right to conversational privacy must include freedom from other people, without our clear opt-in consent, using technology to document what we are saying," said Electronic Frontier Foundation privacy litigation director Adam Schwartz in an email to The Register. "Otherwise, people will self-censor, and conversation will lose its spontaneity and intimacy. "So, EFF is disappointed that Apple is releasing a new Audio Intelligence feature that reportedly can create a transcript or written summary of what people are saying in the vicinity of an Apple Watch. People don't really have a practical means to consent or decline recording. "We suggest people should think twice before using this technology, out of respect to the conversational privacy of others. While it remains to be seen how state eavesdropping laws will apply to this new technology, it is clear that always-on monitoring of our conversations is an unacceptable burden on our conversational privacy." ®

Tailwind CSS may still be open source, but it’s not independent anymore: It’s now a Shopify product. Tailwind Labs CEO Adam Wathan shared news of Shopify’s acquisition of his company in a blog post Thursday. Wathan said that he chose to sell to Shopify because the ecommerce platform was an early adopter of Tailwind CSS, and will serve as an ideal place for his open-source web development platform to “be developed in service of a real product.” “I believe deeply in Shopify's mission to help more people start, run, and grow their own business,” Wathan added. “Tailwind is a very important part of the stack at Shopify, and they're invested in making sure it's actively maintained and continues to improve and adapt for how the ways we build are changing.” For those unfamiliar with Tailwind CSS, it’s an open source framework that simplifies web development by providing utility classes that can be applied directly to elements in HTML documents. Traditional CSS, on the other hand, often involves maintaining separate stylesheets containing rules that are applied to HTML elements. It’s a useful tool, and one that’s installed over 110 million times a week, per Wathan, if you can believe that. But as we've seen several times, the rise of AI is making it hard for the platform's overlords to make ends meet. Wathan said in January that AI coding tools had started eating into Tailwind Labs' bottom line to the degree that he was forced to lay off three employees. He blamed the fact that vibe coding tools have begun to come between his product and potential customers, causing traffic to plummet and income to dry up. So Shopify has come to the rescue to save Tailwind CSS from languishing in maintenance hell like other open source projects. “We're joining Shopify to give Tailwind a stable long-term home where it will be actively maintained for the millions of people who depend on it,” Wathan explained in his blog post. The precise details depend on what type of Tailwind CSS user you are. “Nothing changes with Tailwind CSS or any of our other open-source projects,” Wathan said. “Everything will always be MIT-licensed, and our team will continue to lead and maintain these projects for the community with the support of Shopify.” But users of Tailwind’s premium services might find things changing, as Wathan said his team will no longer be trying to grow the business. That means Tailwind Plus, the company’s paid, UI-based package of templates and other tools, and ui.sh, Tailwind’s package of AI skills designed to help non-coders build user interfaces, are going the way of the dodo. “We're closing sign ups for new customers to focus on Tailwind CSS at Shopify,” Wathan explained. Existing customers who’ve paid for access to those tools and other paid Tailwind Labs offerings will still have access, Wathan stressed. We reached out to get more details on future support for those paid products, and will update this post if we hear back. ®

An unknown attacker used hundreds of AI agents to exploit two PaperCut MF/NG bugs and break into at least 395 organizations. The victims were concentrated in the US education sector, and the intrusions moved fast. In one case, an American high school went from initial access to domain admin in seven minutes. These agents, powered by OpenAI’s Codex harness and a DeepSeek model, also allowed the miscreant to attack organizations at scale, according to threat-intel firm GreyNoise, which traced the campaign’s orchestration to 45.142.193.132 on August 31. “The adversary went from an empty workspace to first achieving RCE against a real victim in just under four hours, first domain admin in an additional two hours, and once the full campaign launched, compromised at least 11 organizations in 26 seconds,” GreyNoise analysts said in a Wednesday report. The security provider attributes these intrusions to a “likely Russian-speaking” criminal who used AI to develop exploits against the pair of PaperCut vulnerabilities disclosed just days earlier. On August 28, the print management software provider issued emergency patches for CVE-2026-81578 and CVE-2026-82078, at the time warning that it was “aware of confirmed customer incidents and are treating this matter with the highest priority.” The flaws affect PaperCut NG and MF, which are self-hosted Java web applications that by default run with SYSTEM-level privileges on Windows. PaperCut’s CEO later said that the first reported compromise came in on August 27, and involved an education-sector firm. On Thursday, PaperCut published security maintenance releases, which replace the earlier emergency fixes. By now, however, at least 440 instances hosted by 395 identified victim organizations in 48 countries have been compromised, according to GreyNoise. “There are other real victims that could not be attributed to a named organization,” the threat signals team wrote. The human attacker told the agents to avoid targeting entities in 28 countries with the top five being Russia, China, Hong Kong, Thailand, and Iran. Several Commonwealth of Independent States (CIS) countries are on the list, which is why GreyNoise says the crim is likely Russian-speaking. It’s typical for ransomware and other cybercrime operations to expressly avoid attacking Russia and other CIS countries, whose governments often provide safe harbor for extortionists and financially motivated crims - especially if they also happen to work day jobs as state-sponsored hackers. Plus, local cops tend to ignore the digital break-ins unless the gangs infect any in-country organizations. However, the agents in the PaperCut attacks didn’t always follow these instructions, and in some cases still hacked organizations based in countries on the do-not-hit list. “It’s currently uncertain why the [attacker's] agents deviated,” GreyNoise said. “But it is a good example of agents gone wild.” The US and the UK were the countries with the highest victim count, at 98 and 59, respectively. Schools and other education-industry organizations were, by far, the hardest hit with 204 victims. For comparison, the No. 2 industry (other/unclassified) had 51, while retail/commercial/professional services ranked third with 38 victims. After using AI to develop exploits, achieve remote code execution, and harvest credentials in a self-hosted lab, the baddie set hundreds of AI agents loose on the open internet to find and attack public-facing, vulnerable instances. “This campaign appears to be opportunistic,” according to GreyNoise. “There is a high concentration of US-based targets in the education sector; however, it’s likely that is more attributable to the customer base of PaperCut NG/MF.” Interestingly, the attacker did not immediately set to work on post-compromise evil deeds with all of the victims. GreyNoise noted “multiple-day delays” between gaining initial access and achieving domain admin “but only due to a lack of action by the adversary.” The fastest time was five minutes, while the longest was 144 minutes. It’s also unclear if the criminal is only focused on gaining access to compromised organizations - and then plans to hand the attack off to affiliates or other data-theft, extortion, and ransomware groups - or if they plan to use this access for follow-on nefarious activities of their own. GreyNoise does note that, in at least one case, Cloudflare’s Web Application Firewall (WAF) blocked the attacker. “Fundamental hardening of environments still matters against AI-enabled threats,” they wrote. It’s also worth noting that GreyNoise has been tracking malicious use of 45.142.193.132 since early July, and says this IP has been used in attacks against internet facing technologies and devices from Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE. ®

Getting straight answers out of OpenAI about how many websites and services its agents have hijacked increasingly seems like pulling teeth, as the company seems intent on making the world discover each instance one by one. Case in point: The OpenAI agent swarm we reported last week had taken over an obscure German wiki appears to have written content to an additional 20 websites, and used 14 fetch services to do work for it, according to new research. The latest report, published Wednesday by Kenneth DeGraff of the Stanford Center for Internet and Society, describes how he dug into records from 21 websites the swarm wrote to, including the German wiki. His report assumes it was the same swarm based on the fact that several hundred posts by the swarm to other sites are word-for-word copies of those found on the German wiki. Speaking of the German wiki report from last week, the authors of that report published their own update Wednesday pointing to even more research that found OpenAI agents had been improperly accessing more websites. The update mentions DeGraff’s research as well as five other reports of OpenAI bending things like Pastebin sites, personal pages, link shorteners, and proxy websites to its own whims. And here we thought Anthropic bots committing four separate potentially criminal intrusions into third-party websites was a big deal. The Vanderbilt link shortener Turning back to DeGraff’s report, we learn that not only were self-identified OpenAI agents improperly accessing and using various third-party web services, they even managed to somehow gain access to Vanderbilt University’s private link shortening service. Access to the service is entirely locked down for university purposes only, and users must file a help ticket to the IT department to get access. Despite that, the agents still gained access to the Vanderbilt link shortener and used it extensively to communicate with other agents, repurposing the service’s statistics page to turn it into a message board for other agents. The swarm wrote 54,250 “posts” to the page in a single day. Some of these posts contained stolen API keys from the FBI and other criminal justice agencies, which the agents used to retrieve a bunch of (non-confidential) information. That activity further connects DeGraff’s report to the German wiki incident. As we discussed in our previous story, the OpenAI agents posting to that website appeared to be trying to solve statistical data lookup problems. In one example provided in last week’s report, the agents sought the median earnings for cashiers with various types of master’s degrees in the year 2014. Other questions in the experiment could have pertained to criminal justice statistics as well. If this swarm is the same one that hijacked the German wiki, they were ostensibly operating with the ability to send GET requests, but not make POST requests. In order to retrieve the data they needed to solve the problem, those agents needed to make POST requests to perform searches, which was a central part of the exploitation of web services undertaken by the swarm: The first thing they had to accomplish to do any of the things they did was figure out how to send POSTs. Based on the ever-expanding footprint of this swarm’s activity online, it appears they did so, and the full scope may still be unknown. With this latest incident reaching 21 websites and 14 services misused by OpenAI agents so far, the question remains a crucial one: How much improper access to third-party services have OpenAI agents made? Are there other instances beyond Hugging Face and the German wiki swarm? Is OpenAI using the entire internet as its firing range to see what agents are capable of? Is there any way web service operators can protect themselves against such attacks? We’re still waiting for a response from OpenAI. ®

Gartner forecasts that, by 2029, nearly a third of employees laid off because of AI will need to be rehired, often at significantly higher cost. The global research firm warned that workforce cuts could save money in the short term but risk weakening talent pipelines and eroding institutional knowledge over the longer term. With labor force growth flat or declining worldwide, competition for talent would drive up recruitment, training, and onboarding costs. "When business and IT executives look back on the early AI era, they will realize their greatest mistake was believing that work automation was the point, when workforce amplification was the opportunity," said Tori Paulman, VP analyst at Gartner. "The competitive advantage will go to the CIOs and business executives who build an AI-shaped organization where AI value compounds by reshaping roles and allowing workflows to cross traditional boundaries, increasing velocity and reducing friction." Gartner predicted that, by 2027, three-quarters of organizations prioritizing cost savings from AI productivity gains will be overtaken by competitors that reinvest those gains in innovation, modernization, and upskilling. "Business and IT executives who use AI primarily as a tool for cost cutting risk making reductions that are too deep and too soon, affecting their ability to innovate their business model and compete in new markets as AI continues to mature. Instead, they should develop a 'talent remix' strategy that uses AI to reshape roles and redirect workers from less productive work to new opportunities," said Paulman. Gartner advised organizations to use AI to "enhance human capability while preserving accountability." "The most successful enterprises will use AI to strengthen employees' judgment, creativity, leadership and decision making rather than replace them," Gartner said. The technology industry has already supplied some prominent examples of companies cutting jobs while expanding their use of AI. Oracle's workforce shrank by 21,000 over the last year, according to its annual report, which said the "adoption and deployment of AI technologies across our operations have resulted, and may continue to result, in reductions to our workforce." If Gartner is right, Oracle may end up paying for those cuts in the long run. ®

IBM and NASA have got together again and released an open source AI model of the Moon that could be used to make new discoveries about Earth’s natural satellite. The NASA‑IBM Lunar Foundation Model has been trained on an extensive lunar observation dataset curated by researchers at the two organizations, and is available now on Hugging Face. It is claimed as the first AI model to integrate observations captured in a range of modalities (data formats), and at different viewing angles and spatial scales. Instead of sifting through maps and images by hand or using low resolution machine learning models, scientists can use this to analyze geographic features, the pair say. In particular, NASA and IBM hope researchers will be able to discover previously unidentified lunar ice deposits, analyze volcanic features called Irregular Mare Patches, and identify and classify craters. Lunar ice indicates the presence of water and oxygen, which may be useful for future manned missions. It is found in permanently shadowed regions, which are among the most difficult areas to observe. The NASA-IBM model combines multimodal and multi-resolution observations to better predict where ice may be present on the lunar surface. Alongside the model, IBM and NASA scientists compiled an open-source lunar dataset from over 30 spatially-aligned layers, using data from nine instruments across four missions. It combines tens of thousands of images and maps showing various geophysical properties of the lunar surface. “NASA has spent decades building an extraordinary scientific record of the Moon, but collecting data is only part of the job,” said the space agency’s chief science data officer, Kevin Murphy. “We also have to make data easier for scientists to explore and use.” “The NASA-IBM Lunar Foundation Model gives scientists a foundation to explore the Moon at scale, connecting observations across instruments, revealing patterns that are difficult to see in isolation, and providing an open platform the global research community can build on,” claimed IBM director of research for Europe, Juan Bernabe-Moreno. This isn’t the first such project the two organizations have worked on together. In 2023, the pair released Prithvi, an open-source foundation AI model to help scientists analyze satellite imagery. A year later, they released an AI climate model designed to accurately predict weather patterns, extending the Prithvi family of models. Last year, it was an AI model named Surya, developed to predict the kind of violent solar flare-ups that might disrupt satellites and spacecraft. This was also part of the Prithvi family, as is the Lunar Foundation Model. NASA and IBM have not officially disclosed a specific parameter count or exact model size for this latest release. As it is open-source and available to download, we asked what resources someone would need to use it. “Hardware needs will depend on the application, the size and number of inputs, and whether they’re running predictions or further training the model. As a rule of thumb, most of our fine-tuning experiments were conducted using Nvidia A100 GPUs,” an IBM spokesperson told us. “Smaller-scale experiments and inference workloads may be possible on more modest hardware, although the exact requirements will vary depending on the task.” Perhaps Reg readers will be able to make some discoveries using the new foundation model? Finding the craters made by rogue rocket stages, for example, or looking for evidence of little green men?®

Microsoft has entered the final phase of retiring Azure SQL Data Sync, blocking new deployments in subscriptions that have never used the service. The restriction took effect on September 9, ahead of the service's shutdown on September 30, 2027. Subscriptions that already use the service can continue creating, modifying, and managing sync groups and member databases until retirement. Other subscriptions can no longer adopt it. The service uses a hub-and-spoke model, with an Azure SQL database serving as the hub and other databases joining its synchronization group. Members can be other Azure SQL databases or on-premises SQL Server databases, which require a sync agent. A conflict resolution policy determines whether the hub or member database takes precedence when changes clash. SQL Data Sync supports scenarios including hybrid environments, in which applications and databases are split between local infrastructure and Azure, as well as geographically distributed applications. Microsoft acknowledged that customers will need to choose among several possible replacements. It offered little technical explanation for the retirement, referring only to evolving "operational, security, and compliance requirements." Microsoft announced the retirement two years ago, but blocking first-time deployments gives customers another reason to begin planning their transition. Microsoft lists alternatives including Azure Data Factory, Azure Functions, read replicas, linked servers, database mirroring, availability groups, and transactional replication. However, it noted that "there is no single replacement that maps to every SQL Data Sync configuration." Existing users have just over a year to migrate before the final cutoff. Those without a migration plan will need one before the service shuts down. ®

Nscale accounts for nearly two-thirds of the equity funding raised by UK datacenter infrastructure companies, according to a report from Tracxn. The market research firm identifies the rent-a-GPU operation as the only unicorn – a privately held company valued at more than $1 billion – in Britain's datacenter infrastructure sector. Nscale leads the pack with $3.7 billion raised, according to Tracxn, out of $5.7 billion across the sector. Other notable players identified by Tracxn include GreenScale, with $1.3 billion; Kao Data, with $177 million; Verne, with $125 million; Iceotope, with $107 million; and Six Degrees Group, with $106 million. Iceotope is not a datacenter operator but a developer of liquid-cooling systems, hence its inclusion in Tracxn's broader infrastructure category. Tracxn counts 154 companies in the sector, 24 of which have raised equity funding. It says investment has surged in recent years amid growing demand for AI infrastructure. Tracxn's report, Datacenter Infrastructure – UK, covers British companies that operate server farms or provide supporting IT infrastructure, such as Iceotope. It excludes businesses focused on datacenter construction or real estate. Companies based in London attracted 93 percent of the funding tracked by Tracxn, highlighting the sector's geographic concentration. Tracxn also says that the Brit datacenter infrastructure sector has recorded 36 acquisitions but only two IPOs. TelecityGroup was the largest acquisition, absorbed by US giant Equinix for $3.8 billion. Reports covering the broader UK datacenter construction market provide a different perspective. Infrastructure specialist Onnec cites Barbour ABI figures showing nearly 100 UK datacenter projects worth more than £36 billion ($49 billion) in the pipeline. That construction activity includes substantial investment by overseas operators, a market excluded from Tracxn's figures. US-headquartered operators including Digital Realty, Vantage Data Centers, CyrusOne, and Equinix have a substantial UK presence, alongside cloud giants Amazon Web Services, Microsoft, and Google. Onnec's research also points to the risk of datacenter infrastructure failing to keep pace with investment in AI hardware. Its latest survey found that 43 percent of operators had needed infrastructure upgrades or remedial work after facilities went live. The survey covered 300 decision-makers across the UK, Ireland, and the Nordic countries, rather than the UK alone. ®

McKesson's cyberattack last month affected roughly 6.4 million individuals, according to Have I Been Pwned (HIBP). The breach notification service added data leaked by serial extortionists ShinyHunters, revealing the scale of the attack for the first time. ShinyHunters initially claimed to have stolen 284 million documents from the medical and pharmaceutical supply company in August, although HIBP did not confirm that figure. The cybercriminals told The Register that they issued a $55.2 million extortion demand to prevent the release of McKesson's data – a sum that apparently was not paid, given the subsequent publication of the data. HIBP said: "The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff, and healthcare provider contacts." The types of information exposed vary between individuals, but the records collectively include names, email and physical addresses, genders, dates of birth, phone numbers, employer details, and sensitive health information. This is broadly consistent with ShinyHunters' claims that the stolen data included appointment dates and notes, as well as sensitive medical details such as the locations of patients' cancers. ShinyHunters also claimed to have stolen Social Security numbers (SSNs) as part of the breach, but HIBP did not include these in its analysis of the leaked corpus. The Register asked McKesson to comment on HIBP's assessment. The company, which supports 3,300 oncology providers in 29 states, has not publicly confirmed the scale of the breach or issued further details since the last update from its CIO and CTO on August 29. Medical device maker Boston Scientific disclosed a cyberattack at around the same time as McKesson, but has suffered a different kind of fallout. While McKesson is informing the millions of individuals affected by its breach, Boston Scientific told shareholders that disruption from its attack means it expects to miss its sales and earnings guidance for Q3. An update issued on Wednesday said manufacturing, order fulfillment, and shipping operations had been fully restored, although work to restore some business applications continued. Healthtech company Veradigm also disclosed a cyberattack to US regulators this week, days after ransomware group The Gentlemen claimed responsibility. Veradigm said attackers obtained credentials from a third-party vendor's environment and used them to access a company API, stealing patient data without disrupting operations. The Gentlemen claimed to have stolen around 3.5 million records containing personally identifiable information (PII), including SSNs. ®

AI infrastructure startup d-Matrix on Thursday joined the growing list of chipmakers licensing Nvidia’s NVLink Fusion interconnect tech and rack-scale reference designs to make its high-performance inference platform more accessible to customers. Under the deal, d-Matrix will integrate support for NVLink Fusion, a high-speed chip-to-chip interconnect that Nvidia began licensing last year, into future chip designs, including its upcoming Raptor accelerators. As we’ve previously reported, by embracing the tech, d-Matrix sidesteps many of the challenges associated with scaling its chip architecture across large compute clusters. By using NVLink over alternative interconnects and designing its compute blades around the GPU giant’s MGX reference designs, its customers can deploy its chips using the same racks and NVSwitch fabrics as Nvidia. By the end of next year, d-Matrix expects to offer systems with up to 144 Raptor accelerators connected by a single all-to-all NVLink fabric. While there’s a lot we don’t know about Raptor just yet, at the Hot Chips conference last month the company revealed each Raptor “card” would feature 32 GB of ultra-fast 3D-stacked DRAM on board capable of delivering 100 TB/s of memory bandwidth — roughly 4.5 times the memory bandwidth of Nvidia’s Rubin GPU. By the looks of things, the XPUs that will power d-Matrix's NVL144 racks are about half the size of the Raptor cards shown off at Hot Chips and include around 16 GB of 3D-DRAM and about 50 TB/s of memory bandwidth — still quite respectable by any measure. With 144 of these per rack, d-Matrix is looking at about 2.3 TB of memory capacity — enough for models exceeding four trillion parameters in size at 4-bit precision — and about 7.2 petabytes a second of peak aggregate memory bandwidth. This is achieved by bonding compute logic atop a stack of DRAM. The result is an in-memory compute platform that offers modest capacity while maintaining memory bandwidth closer to that of SRAM than is achievable using HBM. Memory bandwidth, as you may recall, is the biggest bottleneck for AI inference. The faster your memory, the faster the system can spew out tokens. This is exactly why Nvidia dropped $20 billion last year to license Groq’s IP and hire away its engineering talent. The chip’s SRAM-heavy dataflow architecture was capable of hitting 150 TB/s per chip, but the tradeoff is that SRAM isn’t very space-efficient and the chipmaker could only pack 500 MB of it onto a single die. d-Matrix's Raptor promises to deliver a decent fraction of that bandwidth with 64x higher capacity, which means the company can get away with using far fewer chips per model. Where a trillion-parameter model might need more than 2,000 Groq 3 LPUs at 8-bit precision, a single d-Matrix system would only need about 64 (32 at 4-bit precision). Just like Groq’s LPUs, d-Matrix chips can be deployed standalone, or as part of a heterogeneous compute config using GPUs for the compute-intensive prompt processing (prefill) phase of the inference pipeline and its Raptor accelerators for the memory bandwidth bound token generation (decode) phase. And for enterprises interested in the ultra-low latency inference capabilities of Groq, d-Matrix’s chips may offer a cheaper point of entry since fewer XPUs would be required. Nvidia’s walled garden We looked at Nvidia’s emerging IP licensing strategy in more detail last week, but in a nutshell, Nvidia stands to gain a lot more than licensing revenues from NVLink Fusion adopters. In addition to licensing Nvidia’s interconnect tech, d-Matrix plans to pair its accelerators with the GPU giant’s Vera CPUs, NVSwitch appliances, BlueField and ConnectX NICs, and SpectrumX Ethernet products. In other words, Nvidia stands to make a lot of money even if it’s not selling GPUs. It seems a fair number of chip designers are willing to make that kind of deal to avoid having to design their scale up networks or rack systems. Last week, MediaTek joined Marvell, Qualcomm, Arm, Fujitsu, and Amazon Web Services in adopting Nvidia’s NVLink Fusion interconnects. Nvidia is so invested in getting folks into its walled garden that it's spending billions on incentives to get them in the door. As part of the MediaTek deal last week, Nvidia invested $3.5 billion in the SoC designer, while it spent $2 billion to get Marvell in the door. No word on whether the latest deal included any such terms. ®

The UK government opposed a proposal to make air traffic control provider NATS reimburse airlines for passenger compensation arising from its failures, weeks before a massive tech glitch led to 2,000 flight cancellations. During a House of Commons debate, Liberal Democrat MP Luke Taylor pointed out that the government had opposed the amendment in the months before this week's computer outage, which disrupted travel for around 330,000 passengers. The UK Civil Aviation Authority (CAA) told affected passengers: "We consider that disruption caused by the NATS outage is likely to be considered the result of 'extraordinary circumstances' under passenger rights rules. "This means that although passengers should be looked after by airlines, they are unlikely to be entitled to compensation for delays or cancellations that were directly caused by the incident." NATS is a public-private partnership in which the government owns 49 percent and a consortium of airlines holds 42 percent. Computer outages have hit the organization three times in three years, beginning with an August 2023 failure that disrupted hundreds of thousands of passengers. NATS said it had fixed the latest technical problem, but warned that the resulting disruption could continue for several days. Taylor told MPs that after earlier NATS computer problems, the government said it had been assured that "NATS took the necessary steps to prevent a recurrence of those particular circumstances." He explained that while the Civil Aviation (Consumer Protection and Regulatory Reform) Bill was passing through the House of Lords, Lord Young of Cookham had proposed an amendment that would require NATS to reimburse airlines for compensation paid to passengers following cancellations caused by its failures. The government opposed the amendment, which Lord Young subsequently withdrew. Taylor quoted the government's earlier response that it had been "able to place considerable pressure on" NATS. Taylor told MPs: "Following the third major failure of our airspace management in the past three years, it is imperative that this Bill is amended to include measures to stop that happening again. NATS is quite clearly not fit for purpose. We cannot suffer a major air traffic outage once a year." Also speaking in the debate, transport secretary Heidi Alexander said she had asked the CAA to conduct an independent review into the cause of the failure and report within six months. NATS was also ordered to give the CAA an initial account of the failure within a week. The minister told MPs that she did "not believe this issue was unavoidable." In a statement yesterday, NATS said: "Our operations are stable and we continue to work closely with airlines and airports to support their recovery from the ongoing disruption to their operations. We would also like to reiterate our apology to all those affected – passengers, airlines and airports – by our system issue. While our immediate focus is on safely managing today's flights, a full investigation will be conducted to establish what happened and identify any further action needed." Ryanair, meanwhile, called for NATS CEO Martin Rolfe to resign after "yet another UK ATC system failure caused widespread delays and cancellations across UK airspace… disrupting over 65,000 Ryanair passengers and cancelling over 50 scheduled flights." Wizz Air said in a statement that it was "extremely disappointed that another NATS technical failure has caused widespread disruption across the UK aviation network. Passengers are once again facing delays and cancellations because of a failure entirely outside airlines' control." It added: "This is not the first time NATS has failed during a peak summer period, and here we go again. A critical national infrastructure provider should not repeatedly bring the aviation system to a standstill." ®

Crypto hardware wallet maker Trezor says the third-party email service provider it uses to send newsletters has been breached, and customers are now being sent phishing messages. There is good and bad news. The good news is that the emails appear easy to spot. They are not bespoke to each recipient and resemble a spray-and-pray campaign rather than sophisticated targeting that uses customer-specific data to enhance the email's perceived authenticity. All known examples of the scam email are titled "Critical Security Alert: STM32 Entropy Vulnerability," and the body explains that an estimated one in four Trezor devices are affected by a "hardware factory defect." The email warns customers that wallet seeds are exposed to brute-force attacks due to "insufficient randomness" and a "critically low 40-bit entropy." The email asks recipients to share their wallet backups. Trezor said: "Do not click it or interact with it. Never enter your wallet backup anywhere. Always confirm every action with your Trezor physically." The bad news is that because the attackers allegedly compromised the legitimate email provider, the messages can pass authentication checks and bypass some of the usual protections deployed by receiving email services. According to those who have shared copies of the emails, they appear to be sent from "mailing@trezor.io." Trezor has issued the warning across its social media channels and Trezor Suite, the companion app for its hardware wallets. The Register asked Trezor for more information. The third party email provider Brevo – formerly known as Sendinblue – said in a statement that a "security incident" had "allowed an attacker to access 120 Brevo accounts." It added that the "bad actor used the access to send phishing emails to the client's contactbase," and promised a "full post mortem later today." Swiss hardware wallet maker BitBox also appears to be affected, having shared an image of an email nearly identical to the one targeting Trezor's newsletter subscribers. The email similarly warns of entropy weaknesses affecting BitBox devices, although it is titled slightly differently: "Critical Security Alert: Microcontroller Entropy Bug Identified." The company said on X: "Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised. "Multiple other Bitcoin companies got targeted as well, and it appears that we all share the same newsletter provider. "We sent out a phishing warning to all our newsletter subscribers, contacted the provider and reported the phishing domains. Most of the phishing links appear to have been taken down already. "We are still actively investigating this situation and will update you once we know more." Crypto tax and portfolio-tracking company CoinTracking also disclosed the compromise of its third-party email provider, which it named as Brevo, around the same time as Trezor and BitBox. CoinTracking shared a copy of the phishing email targeting its users and, since it does not offer hardware wallets, the message uses a different lure, asking customers to follow a link to refresh their API keys. Tough times in Trezorland The latest security snafu comes less than a month after Trezor announced that thousands of customers' details had been compromised following a breach at logistics partner ShipMonk. The hardware vendor initially estimated that around 13,000 people were affected. Those who ordered Trezor products between May 10 and August 8 had their names, email addresses, phone numbers, and shipping addresses breached. Compounding the problem for a company whose brand centers on security, Trezor confirmed on September 4 that the total number of affected customers had risen to 80,000. Trezor said ShipMonk later informed it that an additional 67,000 US customers who purchased products between November 2019 and August 2021 were affected. "Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications," said Trezor. "We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems." ®