|
Good morning. Here is what happened in tech over the last 24 hours.
An autonomous AI agent breached Hugging Face on its own. Plus a WordPress takeover bug, a $1.65 million crypto exploit, and Atlas at the World Cup.
|
|
|
FEATURED
AI / MACHINE LEARNING • YESTERDAY
An autonomous AI agent breached Hugging Face over a weekend
Hugging Face confirmed a breach this week. The attacker was not a person typing commands. It was an autonomous AI agent, running on its own.
The agent found two flaws in how Hugging Face processes datasets. It used them to run code on a worker, then climbed further into the network. It grabbed cloud credentials and moved through internal systems all weekend, with no human steering it.
Hugging Face says public models and datasets look untouched. It is still checking customer data exposure. The twist: Hugging Face used its own AI to investigate, sorting 17,000 events and rebuilding the timeline in about an hour. One AI broke in. Another found it.
Read the source ›
|
|
|
|
DEVELOPER TOOLS • 4 DAYS AGO
Two WordPress bugs are letting anyone take over your site
Security researchers disclosed two WordPress core flaws this week. Together, they let an attacker run code on your site with no login.
Attackers did not wait. By July 19, VulnCheck had counted more than two dozen public exploits on GitHub, and security firms confirmed active exploitation in the wild. A public proof of concept can read the database, including admin password hashes.
The chain hits default installs, no plugins needed. If you run WordPress 6.9.x or 7.0.x, update to 6.9.5 or 7.0.2 now. This is not a someday bug.
Read the source ›
|
|
|
|
CRYPTO / WEB3 • 2 DAYS AGO
A crypto bridge got hit by the exact bug it said it fixed in 2023
Allbridge Core lost $1.65 million this weekend. An attacker borrowed $1.12 million with a flash loan, distorted a stablecoin pool's exchange rate, then walked away with the difference.
Here is the part that stings. Allbridge got hit by nearly the same flash-loan trick on its BNB Chain pools in 2023 and published a postmortem promising fixes. But its Solana pool still held two stablecoins side by side, the exact setup that lets an attacker swing the exchange rate.
Allbridge paused the protocol. The stolen funds are already moving from Solana to Ethereum. A fixed bug is not fixed until every pool actually reflects it.
Read the source ›
|
|
|
|
STARTUPS / BUSINESS • 2 DAYS AGO
Samsung just cut 60% of its New Jersey staff
Samsung Electronics America is moving its headquarters to Texas. It just cut 739 roles in Englewood Cliffs, New Jersey, to make it happen.
That is more than 60% of the company's New Jersey staff. Some got relocation offers. Others were let go outright, less than a year after moving into a new office.
Samsung's chip division is posting record profits. Its consumer electronics unit is not. This move shows which side of the company Samsung is betting on.
Read the source ›
|
|
|
|
CONSUMER TECH • THIS WEEK
Sony's wearable air conditioner is finally shipping to the U.S.
Sony's Reon Pocket Pro Plus starts shipping to U.S. buyers this week. It is a neck-worn cooler, not a fan. A cooling plate sits against your neck and pulls heat away.
The new model cools about 20% harder than last year's, roughly 2 degrees Celsius colder. A Smart Cool mode adjusts output based on your activity and the room around you.
Sony already sells this in Japan and Europe. A U.S. launch gives American summers a real alternative to carrying a fan around.
Read the source ›
|
|
|
|
ENERGY / CLIMATE TECH • EARLIER THIS MONTH
A geothermal startup raised $134 million to drill into Earth's superhot rock
Quaise Energy raised $134 million earlier this month. The money funds a geothermal plant in central Oregon that taps rock hotter than any conventional well reaches.
Quaise drills with millimeter-wave energy instead of a normal bit. It has already reached about 500 meters (roughly 1,600 feet) at its Texas site, closing in on a full kilometer of depth.
The plant aims to deliver power to the grid by 2030. If the drilling holds at scale, it opens geothermal energy to places that never had hot enough rock to use it before.
Read the source ›
|
|
|
|
▶ WATCH THIS
ROBOTICS / HARDWARE • EARLIER THIS MONTH
A humanoid robot delivered the match ball at the World Cup
Boston Dynamics' Atlas robot walked onto the pitch at halftime of the Brazil vs Norway World Cup match in New Jersey. It recreated goal celebrations from Haaland, Kane, Matheus Cunha and Son Heung-min, then picked up the match ball and delivered it to the referee.
Engineers trained Atlas on real player footage and ran the routine through thousands of simulations before it touched real turf. It is the first time a humanoid robot has worked inside a live match at this scale.
It is the most-shared robotics video of the summer, and a preview of what a robot entertainer looks like once the choreography holds up live.
Watch the clip ›
|
|
|
Quick Hits
|
|
|
Moonshot AI paused new Kimi K3 subscriptions days after launch, after demand overwhelmed its GPU capacity. Compute, not model quality, is the real bottleneck in China's AI race right now.
|
|
|
|
7-Zip patched a heap-overflow bug that let a single crafted archive run code the moment you extracted it. Update to version 26.02 if you have not already.
|
|
|
|
DJI launched the Mic Mini 2S wireless microphone in China first, with 32-bit float internal recording and built-in AI that filters background sound. No U.S. price or FCC clearance yet.
|
|
|
Stat of the Day
Events Hugging Face's own AI reviewed to unravel its own breach, a job that used to take days.
|
17,000
events sorted in about an hour
|
|
Thanks for reading. See you tomorrow.
Tech 24
|
