Author: Anthony John Padilla

{ "social": { "email": "content.reviewer90@ext.softonic.com", "facebook": "", "twitter": "", "linkedin": "" }, "ja-JP": "", "de-DE": "Anthony Padilla ist ein auf den Philippinen ansässiger Schriftsteller mit Erfahrung in redaktionellen, digitalen und markenorientierten Inhalten. Seine Arbeit konzentriert sich darauf, komplexe Ideen in klare, verständliche Texte umzuwandeln.", "en-US": "Anthony Padilla is a Philippines-based writer with experience across editorial, digital, and brand-focused content. His work centers on translating complex ideas into clear, accessible copy, with a strong emphasis on structure, accuracy, and user-focused communication. He has contributed to long-form articles, product and platform copy, and marketing-led editorial pieces.", "es-ES": "Anthony Padilla es un escritor con base en Filipinas con experiencia en contenido editorial, digital y enfocado en marca. Su trabajo se centra en traducir ideas complejas en textos claros y accesibles.", "fr-FR": "Anthony Padilla est un écrivain basé aux Philippines ayant de l'expérience dans le contenu éditorial, numérique et axé sur la marque. Son travail consiste à traduire des idées complexes en textes clairs et accessibles.", "it-IT": "Anthony Padilla è uno scrittore con base nelle Filippine con esperienza in contenuti editoriali, digitali e focalizzati sul brand. Il suo lavoro si concentra sulla traduzione di idee complesse in testi chiari e accessibili.", "nl-NL": "Anthony Padilla is een schrijver gevestigd op de Filipijnen met ervaring in redactionele, digitale en merkgerichte content. Zijn werk richt zich op het vertalen van complexe ideeën naar helder, begrijpelijke teksten.", "pl-PL": "Anthony Padilla to pisarz mieszkający na Filipinach z doświadczeniem w tworzeniu treści redakcyjnych, cyfrowych i skoncentrowanych na marce. Jego prace skupiają się na przekształcaniu skomplikowanych idei w jasne, zrozumiałe teksty.", "pt-BR": "Anthony Padilla é um escritor baseado nas Filipinas com experiência em conteúdo editorial, digital e focado em marca. Seu trabalho se concentra em traduzir ideias complexas em textos claros e acessíveis." }

xAI open-sources Grok-Build after reports of 5.1GB uploads

xAI has open-sourced its developer tool, Grok-Build, on GitHub today, putting it up for public auditing after security researchers criticized the tool for quietly uploading far more local data than users would have expected.

Those uploads, according to the researchers, could include entire directories, full Git repositories and commit histories, unrelated files, and even SSH keys, password databases, API keys, and other credentials, all sent to a Google Cloud Storage bucket controlled by xAI; in one researcher test, Grok-Build allegedly uploaded 5.1GB for a task that only needed 192KB.

Researchers also said Grok-Build ignored file-read limits set by users, and that its “Improve the model” privacy setting didn’t actually stop data from being transmitted, which clashes with xAI’s earlier claim that no codebase data was sent during a session.

If you used Grok-Build during the affected period, this release is worth checking, but you should assume any accessible credentials may have been transmitted and rotate them; xAI says enterprise customers with zero-data-retention agreements weren’t affected, early beta users had retention on by default, and retention has been off by default since July 12.

You can download the Apache 2.0 release on GitHub now; xAI says previously uploaded data will be deleted and that the upload behavior was disabled server-side, while early reviewers note that the 844,530-line Rust repository currently shows a single commit and disabled remnants of the upload function.

CrashStealer hits macOS: steals passwords and crypto wallets

Jamf Threat Labs has identified a new infostealer on macOS called CrashStealer. It passes itself off as Apple’s own CrashReporter process.

According to the researchers, users can get infected through a fake collaboration app called Werkbit. It was delivered in an Apple-notarized installer that got past Apple’s Gatekeeper protections, then showed a fake password prompt that verified the victim’s password locally and opened the macOS Keychain. From there, Jamf Threat Labs says CrashStealer can steal Keychain passwords, browser data, crypto wallets, and other credentials that could be used for account takeovers or direct financial theft.

The researchers also believe this was probably a more targeted campaign than the usual broad malware push. The download was PIN-protected, the malware was written in native C++ rather than the AppleScript-heavy style often seen on macOS, and the stolen data was encrypted with AES-GCM before exfiltration. Jamf says CrashStealer overlaps with Atomic Stealer and MacSync, but it’s being tracked as a separate family for now. Who’s behind it, how many victims there are, which regions were affected, and how the lure was distributed are all still unknown.

If you use a Mac regularly, this one matters. Apple-notarized apps can still conceal serious credential theft. Jamf says the fake Werkbit download was hosted on a convincing site tied to a newly registered domain, though Apple has since revoked the abused developer ID. If you want the full breakdown, Jamf Threat Labs’ macOS report has the details.

Businesses leave 99.9% of smart system flaws unpatched: new estimates

Companies are racing into model-driven services, software agents, and automated development tools while leaving 99.9% of fixable vulnerabilities untouched, according to fresh industry estimates.

More than half of organizations already use software agents in production, and about the same share use them to build custom apps. The rollout is moving faster than patching, access controls, or secure defaults. Model-driven platforms surface roughly 25 confirmed flaws a day. Teams fix about 1.5 of them, and deployment still takes 3 to 5 months.

That leaves companies open to the basics going wrong: missing encryption, exposed interfaces, and permissions that reach too far. The risk gets worse when cloud-hosted models and software agents tie into internal data, third-party tools, and production workflows. Attackers are using the same automation for phishing, adaptive malware, and real-time exploitation. One forecast puts tech-driven cyber incidents in 2025 at 28 million, up 72% from the year before.

If you run model-driven services, software agents, or automated development tools, pay attention to this. Anthropic, Amazon Web Services, IBM, and Microsoft are backing the Akrites coalition, and the U.S. Treasury Department and the Cybersecurity and Infrastructure Security Agency (CISA) have both issued guidance. But gaps across Africa, Latin America, and Southeast Asia, hiring shortages, and too much reliance on machine output mean the security groundwork is still falling behind.

You can find guidance online from CISA, the U.S. Treasury Department, and the Akrites members.

Xiaomi unveils Sky Nomad: first N90 SUV confirmed in China

Xiaomi has taken the wraps off Sky Nomad, a new family SUV line for China. The first model is the full-size N90, confirmed on July 8, 2026. It’s expected to be an extended-range electric vehicle, with rivals like Li Auto’s L9 and Aito’s M9 clearly in the crosshairs. In China, Sky Nomad will be sold under the Xiaomi Pengcheng name.

Android Auto Download

The full-size Xiaomi Sky Nomad N90 is expected to be an EREV, not a pure EV. It’s said to stretch past 5.3 meters, sit on a 3.1-meter wheelbase, and offer both five- and seven-seat layouts. That puts it right up against the Li Auto L9 and Aito M9. Local reports also point to a 200,000-yuan starting price, which would undercut those rivals, both of which start above 250,000 yuan.

Reports also say a 1.5-liter turbo engine will act only as a generator, paired with a battery larger than 70 kWh. The expected result is 400 to 500 km of electric range and more than 1,500 km combined. That follows Chinese authorities approving Xiaomi’s Beijing plant to build extended-range vehicles on June 10.

If you want EV-style driving without as much charging hassle, the Xiaomi Sky Nomad N90 already looks worth a close look. It also expands Xiaomi’s driver-focused SU7/YU7 strategy, adding a Kunlun-based flat floor, long-rail seating, LiDAR, powered side steps, and an optional rooftop tent for camping, travel, and family use. Xiaomi is targeting 550,000 deliveries in 2026 after 185,000 in the first half and a 3.1 billion yuan Q1 EV operating loss.

Anthropic launches AI drug discovery project: neglected diseases first

Anthropic launched its drug discovery program today. It’s a clear move into neglected-disease research, and it also introduces Claude Science, the company’s workbench for genomics, proteomics, and single-cell analysis.

Claude Download

The company is moving past selling tools to labs and into preclinical discovery itself. Anthropic’s argument is that this stage fits AI unusually well: biology data is abundant, simulation and ranking can happen quickly, and failures cost less here than they do later in the process. If that plays out, early medicine development could speed up, and the work could feed back into better life-sciences products.

There’s a different business model here too. Anthropic says its public benefit corporation structure gives it room to put patients’ needs ahead of short-term returns. That comes at a moment when Novartis CEO Vas Narasimhan has said these tools could cut timelines from about 12 years to 7 or 8, while pushing success rates from roughly 8% to 16%. Anthropic also says Claude Science connects to more than 60 databases. In its early examples, a University of California, San Francisco researcher spotted viral contamination in minutes after it had been missed for a year, and another analysis covered 100 rare genetic diseases in under an hour and surfaced 32 follow-up candidates.

If you follow AI in biotech, this deserves a close look. Discovery is still only the first part. Clinical trials cost come after that.

You can get Claude Science through Anthropic’s research offering, and Anthropic’s new drug program is starting with preclinical work.

Instagram tests easier ‘Your Algorithm’ controls in the main app

Instagram is reworking how it presents “Your Algorithm,” the set of recommendation controls for Feed, Reels, and Explore, and the main change is pretty simple: those controls are being pushed much closer to the surface of the app.

Instagram Download

The feature already applies across Feed, Reels, and Explore. It shows a system-generated snapshot of the interests influencing what Instagram recommends to you. Adam Mosseri, who runs Instagram, says the company is testing, or at least weighing, easier ways to get to it: a pull-down in Feed, a swipe-up prompt on Reels, and buttons under each Reel that let you ask for more posts like that or fewer. The idea is to let people respond right there, in the moment, instead of having to hunt through settings. Some of those tests are already live. Others are supposed to arrive soon. And some may never ship at all.

If you spend a lot of time on Instagram and have been wanting more say over what the app serves up, this will probably be worth trying once it reaches your account. Still, that doesn’t really address the complaint you hear over and over from users, which is that they want to see more posts from accounts they already follow, in chronological order, rather than just getting finer controls over topics while Instagram keeps leaning harder on discovery to keep pace with TikTok and YouTube Shorts.

It also lands in the middle of the broader push for more transparency around recommendation systems. Europe’s Digital Services Act has already pushed Meta to add chronological options in parts of Instagram, including Stories and Reels. Instagram also gives people a way to fully reset recommendations. That extra control is welcome, experts say, but the skepticism hasn’t gone away when the whole system is still built to maximize attention and retention.

Instagram is available now on iOS and Android, and with more than 2.1 billion monthly users, even a small tweak here can ripple out fast. Reels sits at the center of engagement, shopping discovery, and creator reach, so changes like this can shape what people end up seeing from one day to the next.

Adobe unveils major Photoshop updates at Summit: Express and Acrobat get smarter too

At Adobe Summit, Adobe laid out a bigger plan for its product lineup: one connected system that links Photoshop, Adobe Express, Adobe Acrobat, and Adobe Experience Cloud, covering content creation, workflow management, and customer experience delivery.

On the creative side, Photoshop and Adobe Express are picking up smarter editing tools. Acrobat is heading in a different direction, toward documents that feel more interactive and are easier to search, summarize, and act on.

What stands out most is Adobe’s effort to connect those apps with business software for customer data, automated campaigns, and personalized websites and apps. That’s a strategic bet at a moment when Adobe is dealing with heavier competition from Canva on the design side and Salesforce in enterprise software.

Disney gave the clearest example Adobe had. The company walked through a scenario where someone spots a piece of media or a promotional offer online, starts planning a Disney World trip, uses the app while they’re there, and then gets follow-up recommendations afterward. Adobe is now selling that same full-path approach to other industries too, including theme parks, streaming, retail, and travel.

If your work depends on Adobe’s creative tools or its business software, this broader push deserves attention. Adobe is trying to influence what happens after an image is created or a document is sent, all the way from an online ad to a hotel booking to a family’s next day at Disney World. You can follow the latest announcements at Adobe Summit.

Microsoft warns of AutoJack: web-enabled agents risk host-level RCE

Microsoft has laid out a new attack technique called AutoJack. In its write-up, the company shows how a malicious webpage could use a web-enabled agent as a go-between, reach a local Model Context Protocol (MCP) service, and kick off arbitrary processes on your computer without asking for any extra clicks.

What this comes down to is a confused-deputy problem. Once a web-enabled agent can browse the web and also talk to privileged local services, localhost isn’t a boundary you can safely assume will protect you.

Microsoft says the proof of concept relied on three separate issues lining up at once: inherited localhost identity that slipped past an origin allowlist, MCP WebSocket endpoints with no authentication, and URL-based server_params that were decoded straight into process-launching logic, with no executable allowlist in place. Put together, that gave the webpage a way to tell the local service to run code. Microsoft also says this wasn’t a browser bug. It was the agent’s trusted position being used against it.

If you’re building or deploying web-enabled agents, this should get your attention, because the same pattern could easily turn up in other frameworks that connect web access with local tools or developer services.

Microsoft says the vulnerable AutoGen Studio MCP code only appeared in development builds and was fixed before anything reached a public PyPI release. Even so, it still points to the broader risks around prompt injection, agent hijacking, data exposure, and the need for zero-trust controls, sandboxing, and runtime monitoring. If you want the full breakdown, Microsoft’s research goes into the details.

Nvidia unveils ENPIRE: self-training robots reach 99% success

Nvidia has unveiled ENPIRE, a research system built with Carnegie Mellon University and the University of California, Berkeley. The idea is simple enough: train robots on real hardware instead of only in simulation, and do it with very little human involvement.

Nvidia says ENPIRE runs a fully autonomous loop from start to finish. It resets the workspace, tries a strategy, checks the result, and updates its policy.

In the company’s testing, eight robots reached success rates as high as 99% on manipulation tasks that would normally need manual resets, hand-built reward functions, and close engineering oversight.

Those tests covered Push-T, sorting pins into a box, cutting or fastening cable ties, pin insertion, and assembly-style work like installing a GPU into a motherboard.

Nvidia also says ENPIRE can generate reward functions and success checks from only a few minutes of success-and-failure video. It does that by using visual alignment, gripper height, estimated force, and views from two cameras, while keeping response times under 150 ms.

If you follow robotics, this one deserves a look.

After a lightly supervised initial setup, Nvidia says eight dual-arm YAM stations can share code through Git, read papers, test hypotheses, and decide whether behavior cloning or reinforcement learning makes more sense.

In one example, Nvidia says ENPIRE reached 100% pin insertion faster than a human-in-the-loop baseline. The company says ENPIRE builds on Nvidia’s Eureka, which beat human-written rewards on more than 80% of tasks, with gains above 50%, and Nvidia plans to open-source ENPIRE alongside Project GR00T and Nvidia Isaac.