companies

The low cost companies of the United States are already suffering from the new oil crisis

by

2.5 billion dollars. That is the figure that low-cost airlines demand from the United States Government in order to continue operating in the country. The rise in fuel prices has reached such a point that a handful of companies are beginning to see the wolf’s ears. And that wolf is called: bankruptcy. 2.5 billion dollars. The Association of Value Airlines, made up of Allegiant Air, Avelo Air, Frontier Airlines, Spirit Airlines and Sun Country (all low-cost airlines operating in the United States), have asked the United States Government to create a liquidity fund of $2.5 billion to pay for the fuel they need to offer their services. At the meeting, they assure from Reutersairline executives, Secretary of Transportation Sean Duffy and Head of the Federal Aviation Administration Bryan Bedford met. 111 dollars. It is the average ticket price offered by the low-cost airlines that attended the meeting. A figure that, they say, is impossible to maintain if the price of fuel continues to increase. And, according to his calculations, those 2.5 billion dollars It will be the increase in prices at the end of the year that they will have to assume if the market continues to be as volatile as it has been until now. According to their calculations, the rise in the price of oil has been such that it is forcing them to pay for fuel at twice the price they normally did. This puts their operations at risk to the point that, they say, the profit margin is so narrow that it puts the viability of the companies at risk. Ravine. Neither the White House nor federal aviation officials responded to questions from Reuters but by then it was already known that talks had been initiated to provide $500 million to Spirit Airlines. The airline, however, ended up bankrupt this weekend. The company, they explain in BBChad operated in the country for more than 30 years but since the hardest years of the Covid-19 pandemic, it was going through severe financial difficulties. The rise in fuel prices has been the last straw that has ended up leaving passengers on the ground. The Secretary of Transportation of the United States, Sean Duffy, has assured that the company already had serious problems before the country launched its first attacks against Iran. Now, 17,000 workers have lost their jobs overnight. It’s not the only one. Although the Spirit case has been the most striking (its business became such that in 2014 Morgan Stanley pointed it out as the airline with the greatest potential for its investors). but he withdrew his support in 2023), this airline has not been the only one in which bankruptcy due to the enormous cost of fuel has weighed on the heads of hundreds or thousands of workers. Latvia has had to rescue Air Baltic with a loan of 30 million euros and airlines such as Lufthansa or SAS have had to cancel thousands of flights to try to contain the hemorrhage. In the case of Lufthansathe company has focused on short-haul flights where profit margins are narrower, canceling more than 20,000 of them before the end of the year. For its part, SAS canceled more than 1,000 flights only last April. A warning (with buts). Michael O’Leary, CEO of Ryanair, has also not missed the opportunity to attack his rivals. In The Spanish They report that O’Leary predicts the bankruptcy of two or three European companies before the end of the year if the oil crisis continues. For the manager, WizzAir and Air Baltic would be the main candidates. However, some analysts have pointed out that they consider that the risk of reaching this point is lower among European companies. They point out that in the United States the strength of long-haul airlines is still very high and that, unlike in Europe, low-cost airlines have much less business. What they do not rule out, of course, is that flights will continue to be canceled en masse. less margin. The airline problem low cost It is similar to that of the gas stations serving cheap fuel. In both cases, very narrow profit margins are played in exchange for adding a large number of operations. However, the increase in the cost of fuel kills its business because it places its rates at the prices of its rivals. premium. In the case of airlines, as in the case of gas stations low costhave the added problem that fuel stock is usually small. Furthermore, in the case of aviation, variations in its price tend to be more damaging because its refinement and storage is so expensive and complicated that stocks are usually very small. Photo | Forsaken Films In Xataka | Ryanair asks to suspend the new EU border control system: many are missing flights due to the queues it generates

Anthropic and OpenAI know that where AI is making money is in companies. They have found a way to squeeze that strategy

by

We end users no longer matter much to the AI ​​giants. These companies are confirming that income is currently in the professional world, and they are already making moves to conquer that segment. And if they have to do it company by company, so be it, because now OpenAI and Anthropic are a little less AI companies and a little more consulting. AI is more business than ever. Anthropic and OpenAI have understood that the real business of AI is not currently in individual $20 subscriptions, but in integrating their AI models into all types of corporations. Both companies have almost simultaneously launched alliances with other companies to provide consulting services. The objective is simple: to stop being external web tools to become the “operating system” of thousands of businesses through these exclusive sales channels. Anthropic on the one hand… The company led by Dario Amodei has formed a joint venture with Blackstone, Goldman Sachs and Hellman & Friedman valued at $1.5 billion. This new firm will act as a consultancy bringing Claude directly into the operating environments of mid-sized businesses, from mid-sized banks to local manufacturers to healthcare systems. These companies have committed to provide $300 million each for AI engineers to work closely with these clients to integrate custom solutions. …and OpenAI on the other. In turn, Sam Altman’s company has not been slow to replicate that initiative with the creation of the so-called The Development Company, an entity valued at about 10,000 million dollars. It is backed by funds such as TPG, Bain Capital and SoftBank. Theoretically, OpenAI has already raised $4 billion to accelerate the adoption of its AI models in more than 2,000 companies that are already part of those investors’ portfolios. The initiative is led by Brad Lightcap, until now COO of the company, and who wants to make the GPT family models an integral part of the operations of all types of companies. Engineers on the line of fire. To promote these strategies, both companies are adopting the so-called ‘Forward Deployed Engineer’ (FDE) model, a deployment system that was already popularized by Palantir and that consulting firms traditionally use. Instead of simply selling an API, Anthropic and OpenAI will send their engineers to work with doctors, financial analysts, or IT staff so that their AI models can be seamlessly integrated into those professionals’ real-world workflows. Going public as a goal. In recent months we seem to be experiencing a race against the clock towards the IPO in both cases. With absolutely stratospheric valuations (OpenAI 852 billionAnthropic hanging around 900,000 million), the pressure to justify these figures to the public market is immense. The integration of programming tools such as Claude Code has been a clear driver of recent growth, but the real gold mine is in the automation of processes in sectors such as health or finance. If you are joint ventures fail to scale quickly, the valuation bubble could deflate before those IPOs. Conflicts of interest. When a venture capital fund invests in a technology provider and simultaneously pressures its portfolio companies to adopt that same technology, competition ceases to exist. Many companies will not have much real choice based on product quality. What is reinforced here It is that “circular economy” in which innovation is not chosenbut is imposed by financial and business interests. The customer does not buy because he needs the tool, but because his own financial owner has a stake in whoever supplies that tool. But wouldn’t AI automate everything? The dependence on the FDE model is paradoxical. Theory tells us that software must be infinitely replicable at zero marginal cost. However, these alliances show that AI is still not smart enough to operate without direct human supervision. We need someone to teach us how to use it well, the companies say, and both OpenAI and Anthropic are going to take advantage of that need even if what we really have is luxury personalized consulting. For now, AI will be more part of the services offered by a consulting firm than a truly autonomous “plug and play” tool. New Job: Deployment Engineer. Now Anthropic and OpenAI will not only be AI companies: they will also be consultancies in need of manpower. That also serves as an example that although AI theoretically will eliminate jobswill also create new ones. Here we face a growing demand for “deployment engineers” —OpenAI already requests them—, professionals who are precisely in charge of adapting these AI models to the needs of companies that want to implement them in their daily lives. And the data, what. There is another fundamental problem: medium-sized companies will not have much capacity to manage their data sovereignty. For Claude or GPT to function properly in the business, they will need access to critical workflows, medical records, or sensitive financial data. And when one cedes that control to third parties, they remain vulnerable. Not only that: the security of this data is compromised because in order to process it, it must leave and be processed in the cloud of an external provider. The AI ​​models of these companies can also probably learn from these processes, although it is reasonable to think that Zero Data Retention policies will come into play (“No data retention”). Image | TechCrunch | Wikimedia Commons In Xataka | The White House wants to review new AI models before anyone uses them: first the Pentagon, then the rest of the world

Only a handful of US companies have access to Claude Mythos: the ECB already fears for the savings of all of Europe

by

He hasn’t even been with us a month and Claude Mythos Preview is terrifying the world. AND We don’t even know if there are reasons for it.because Anthropic has it tied up and muzzled: only a handful of companies have been able to access the model to test it and use it properly. The objective is that these companies can use it to find vulnerabilities before others do, but of course, a contagion effect has been created: if the model is good enough to find security flaws everywhereeveryone is threatened. And among those beginning to fear the worst are the world’s most important financial institutions. And the European Central Bank is one of them. The Project Glasswing Private Club. During the launch of Claude Mythos Preview, Anthropic selected an extremely small group of US “partners” to carry out the first fire tests of this model. Under the name of Project Glasswing, giants such as Amazon, Apple, Microsoft, Alphabet or financial entities such as JP Morgan have been the only ones authorized to evaluate the capabilities of Mythos. This access has made AI become a curious geopolitical piece. One that has left the European institutions aside. In Xataka An Anthropic worker was having a snack when he received an email he should never have received: it was Mythos The fear of zero-day. What makes Mythos a fearsome AI model is its ability to go through the code of all types of applications and software platforms and find so-called vulnerabilities.”zero day“. These flaws are not even known by the developers of these projects, and they tend to remain hidden even in highly critical infrastructures such as banking or energy companies. Until now, finding these security holes required complex work by highly specialized human experts, but Mythos is capable of detecting many of these flaws and generating the code to exploit them almost instantly. The European Central Bank, on alert. Given this panorama, the ECB has taken action on the matter calling on those responsible for risks in the main financial entities of the Eurozone. Among the participants are those responsible for Santander, BBVA, CaixaBank and Sabadell, who must – like the rest – detail their contingency plans for the possible emergence of Mythos. This is no longer about how to act in the event of increases in unemployment or economic contractions, but rather about what steps should be taken if the model falls into the hands of cybercriminals who could cause massive thefts of data… and money. A “nuclear” weapon. That only some private American companies have access to the model has strained international relations in a notable way. The White House and the US Treasury hold meetings with their banks, and meanwhile some media sympathetic to the Russian regime qualify to this model as something “worse than a nuclear bomb. Huge (theoretical) risks. The fact that a single company can unilaterally decide who has access to the most powerful cybersecurity tool on the planet (or so Anthropic claims) creates a truly delicate situation. This can put all types of entities in check, but also even developing countries with more vulnerable systems. The UK has already had access to Mythos. The British country has already managed to position itself ahead of the countries of the European Union. The AI ​​Security Institute has had access to the model and has confirmed that the model is capable of completing attacks that no previous AI could complete. Anthropic itself has indicated which will expand access to Mythos to British financial institutions. Meanwhile, EU member countries continue to wait for that same privilege. {“videoId”:”xa4n2g8″,”autoplay”:false,”title”:”An initiative to secure the world’s software ｜ Project Glasswing”, “tag”:””, “duration”:”349″} Possible cracks. While all this is happening, Anthropic itself confirmed how unauthorized users they could have accessed to a version of Mythos. If users with bad intentions gain access to a model of this type, the consequences could be important… if it really complies with the expectations that have been generated. Cybersecurity experts warn that it is a matter of time before other powers such as China develop similar capabilities. OpenAI in fact already has GPT-5-5 Cyber, a specific version of its new model that also seems to have notable capabilities in this regard. And as in the case of Anthropic with Mythos, access to this model is restricted. In Xataka |OpenAI and Anthropic have proposed the impossible: lose $85 billion in one year and survive (function() { window._JS_MODULES = window._JS_MODULES || {}; var headElement = document.getElementsByTagName(‘head’)(0); if (_JS_MODULES.instagram) { var instagramScript = document.createElement(‘script’); instagramScript.src=”https://platform.instagram.com/en_US/embeds.js”; instagramScript.async = true; instagramScript.defer = true; headElement.appendChild(instagramScript); – The news Only a handful of US companies have access to Claude Mythos: the ECB already fears for the savings of all of Europe was originally published in Xataka by Javier Pastor .

Companies that made “boring” chips are riding the dollar

by

In any sports team there are starters and substitutes. The headlines are usually the big stars, who capture all the attention. The substitutes are the ones who go out to do the job when it’s time, without making so much noise. That same universe of ‘Zidanes and Pavones‘is in the world of computer components and, if the chips of Intel, Nvidia, amd either TSMC They are the Zidanes, the Pavones are, indisputably, the chips of Texas Instruments. And the accounts are coming out. Texas Instruments. It is one of the most evident cases of how profitable it is to live outside the hype. Texas Instruments is the ‘Paco Bearings’ of technology, a company that has been manufacturing chips for decades that we have in a multitude of devices, but that do not make noise with specifications. Are very specific chips to carry out very specific tasks, and if in February we already said that They were dropping their wallets to acquire companies like Silicon Labs (an American company that also makes ‘boring chips’), now we have to echo the accounts. Revenue for the first quarter of the year they reached 4.8 billion dollars, 19% more year-on-year and exceeding expectations. And, precisely, what has increased the most year after year has been the number of chips for data centers. Boring chips in AI. Think about the chips in your washing machine, but also in the refrigerator, in a smart speaker or even in wireless headphones. It also makes other types of chips: those that control power, isolate signals and manage faults. And those are the ones who are making gold in the age of AI. GPUs and CPUs are the star chips of a data center, but others are needed to do the most basic work: power, control, interfaces and protection. Texas Instruments manufactures and sells these chips, and they are what allow a GPU or CPU to run stably in racks. Putting it down, if Nvidia or AMD put the ‘brains’ in the data centers, Texas Instruments provides the nervous system. And this is tremendously profitable since, in the breakdown by segments, although Texas Instruments’ industrial chip segment increased by 30% year-on-year, that of data centers grew 90%, representing approximately 11% of the company’s income. The ARM case. Another interesting case is what processors are experiencing. AI needs are shifting from GPU power for training to CPU efficiency for efficiency. In the era of Agentic AIit is estimated that more CPUs will be needed in data centers in what has already been dubbed the ‘CPU renaissance’. Intel is adapting to it and the market is rewarding a historic processor: Arm Holdings. On March 24, presented AGI CPU, ARM’s first proprietary processor for data centers. It is optimized to precisely run large inference workloads, such as the aforementioned agentic artificial intelligence. Manufactured in a 3-nanometer TSCM process, it has 136 cores per chip and a performance that promises to be double that of conventional x86 processors. AND co-developed with Meta, one of the most interested in stopping depending on Nvidia. Market confidence is at its highest and share prices have shot up to all-time highs. In fact, the graph of ARM and Texas Instruments is extremely similar over the last five years. Those of memory, to their ball. In parallel, there are other companies that do not create the processors to ‘move’ the AI, but rather the memory for the most powerful GPUs on the market. They are invisible chips, but unlike Texas Instruments, their presence in data centers is notable for a very simple reason: they are those same memory companies that have stopped making memory for consumers, focusing almost all of their production on data centers. SK Hynix record a 405% growth in its operating profit in the first quarter of the year, something driven by HBM memories and DRAM for AI. Samsung, more of the same, earning more in three months than during all of last year. The question is the same as in recent months: how long will this growth last and whether investment in data center equipment has a ceiling. And what will happen when that ceiling is reached. Images | Victorgrigas, Raimond Spekking In Xataka | NVIDIA has so much money that it is becoming something different: the largest startup incubator in the world

forcing the same companies to comply with incompatible laws

by

The Chinese State Council has published two decrees which do not leave much room for interpretation: One on security of industrial supply chains, signed on March 31. And another on improper extraterritorial jurisdiction, published April 13. Together they form the most explicit legal arsenal the Chinese government has yet built to combat Western sanctions, and to warn foreign companies that choosing sides has consequences. Good or bad. Why is it important. For years, China has responded to pressures from across the Pacific with tools ad hoc and implicit signals. Now it does so by decree of the Council of State, the supreme executive body. It’s actually the same written strategy as before, but now black on white. The context. The first of the documents, known internally as Decree 834, is linked to the Chinese national security law and obliges ministries and local governments to identify, optimize and protect industrial supply chains considered strategic. The immediate trigger has been the war in Iran, which has interrupted the flow of sulfuric acidurea and other chemical inputs that China needs for its industry and agricultural sector. But the document comes from further afield: it is the culmination of decades of policy of self-sufficiency in resources, from rare earths to lithium. Between the lines. The most striking thing about Decree 834 is not what it regulates, but what it threatens. It includes explicit language about China’s right to investigate and take countermeasures against any foreign actor that “disrupts the normal functioning of markets” or imposes “discriminatory restrictions” on Chinese supply chains. The definition is broad on purpose. A Western company that pressures its government to sanction a Chinese competitor could find itself in the spotlight, as It already happened with Micron in 2023. The question. The second decree is even more direct. Their Regulations on Improper Extraterritorial Jurisdiction of Foreign Countries They say that if China considers foreign regulations that affect Chinese interests illegitimate, companies that comply with them are exposed to Chinese sanctions. Put another way: If the United States prohibits you from selling to China and China considers that prohibition “improper,” you will have to choose who you disobey. Possible sanctions include fines, bans on entry and exit from the territory, and export and import restrictions. The decree establishes a formal review mechanism: companies can ask the Chinese government for an exemption if they demonstrate that compliance with the foreign standard is unavoidable. This exemption can be granted or denied, which will turn the companies themselves into negotiating leverage between governments. Like Huawei in 2018. Yes, but. If a foreign government imposes a regulation that China does not want to abide by, it can announce that it is “improper,” wait for the affected companies to ask for an exemption, and use them as bargaining chips in diplomatic negotiations. It will happen because it is predictable and because that is where the incentives fit. The background. Since the 2018 trade war and semiconductor export controls, China has built a legal repertoire of response that includes Antitrust Lawthe List of Untrustworthy Entities and the Anti-Sanctions Law. These two new decrees do not open doors that no longer existed, but they do mark them with a neon sign. The message for foreign companies that do lobbying in the United States against Chinese competitors is crystal clear. Featured image | Xataka In Xataka | China has banned another AI startup from exporting talent and research: little by little, it is “nationalizing” AI

US companies continue to pursue larger and larger AI models. Those from China continue to demonstrate that it is not necessary

by

Until now, Alibaba had a great open model for programming. It is based on Qwen3.5-397B-A17B, but the problem is that it was gigantic with its 397 billion parameters and 807 GB of disk (and memory) size. The Chinese company has done something surprising and has announced these days the Qwen3.6-27B modelwhich in its quantized version weighs less than 17 GB. You would think that at that size he would be much worse than his older brother. But you would be wrong. It is proof that it is possible to give for much less. A dense model. Most large weight models open in 2026 use Mixture-of-Experts architecture (MoE): They have many parameters in total, but only activate a fraction of them when we use them. For example, the Qwen3.5-397B-A17B model precisely indicated that in its name: of the 397,000 million parameters, it only activated 17,000 million (hence the A17B) when using it. With Qwen3.6-27B we have what is called a dense model: the 27 billion parameters are activated in each inference. Although it is somewhat less efficient, it has clear practical advantages. For example, there is no need to configure an expert router, and quantization is more predictable and compact. The idea has worked, and the results prove it. The performance of this “small” AI model is even higher than a much larger previous version. Benchmarks don’t lie (too much). In SWE-bench Verifiedthe most popular benchmark for real programming tasks, Qwen3.6-27B achieves 77.2% score compared to 76.2% for the 397B model. In Terminal-Bench 2.0, which measures how well the model executes tasks in the command console, it achieved 59.3% compared to 2.5% for its rival. But in this test it achieves exactly the same score as Claude Opus 4.5, one of the best recent Anthropic models. That an “Open Source” model that can be easily used locally achieves something like this is unusual, but we must be cautious: the benchmarks are from Alibaba itself, and there is currently no independent verification, although who are wearing they seem be really satisfied with the. Even Alibaba is surprised. What is striking about this launch is that the company that launched it is promoting it above its most ambitious model until recently. Let them compare both versions themselves and recognize that the “small” is the most powerful It is significant. It’s like saying from the rooftops that the largest AI models have no competition, when they have just proven that this is not the case and that models like Qwen3.6-27B can be truly remarkable in behavior. 24 GB of VRAM is “enough”. Thanks to its small size, it is possible to use this model on relatively accessible machines. Thus, the 24 GB of video memory of the RTX 3090 makes these graphics cards a perfect alternative to install and use Qwen3.6-27B with excellent performance. Dense models do not do so well on MacBook or Mac mini with unified memory, and although logically not everyone has access to graphics cards with 24 GB of RAM, access to really capable local models continues to improve. The best essences, in small bottles. Alibaba is a steamroller of “small” AI models, and it demonstrated this in early March when launched several that ranged from 0.8B to 9B. Fortunately there are varied alternatives in that segment of “Small Language Models” (SLMs) and here we have reference examples like Gemma 4just released by Google. Microsoft with Phi-4 (which needs an update, like gpt-oss-20b/120b) or Mistral with Devstral 2 They are examples that Western companies are also making moves in this interesting field. But. According to benchmarks, Qwen3.6-27b is comparable in some benchmarks to Claude Opus 4.5, Anthropic’s most advanced model when it was launched in November 2025. That is surprising and confirms that open weight models from Chinese companies are, as Demis Hassabis saidbetween 6 and 12 months behind the most advanced models from Anthropic, OpenAI or Google. But to execute them a significant investment is still necessary, and although local AI models are very interesting in terms of privacy, if today one wants maximum speed and performance it still depends on commercial models in the cloud. In Xataka | Google will invest up to $40 billion in Anthropic because the new normal for AI is investing in your enemy

They believed they had found jobs in large companies. In reality they were being deceived: this is how the trap works

by

Looking for a job is already hard enough without having to be suspicious of every message that arrives in your inbox. And yet, that is exactly what the campaign that has warned about proposes. NordVPN: a trap set up to look like a real opportunity. We are not talking about a clumsy email or a sloppy website, but rather something much more refined, with names like Meta, Disney, Coca-Cola or Spotify as a claim. That’s the key to everything: they play with the illusion of those who believe they may be on the verge of an interview or a new job, when in reality they are entering into a fraud. The investigation alerts of a campaign of phishing specifically aimed at job seekers. The attackers have set up an attack chain in several phases that impersonates large brands and seeks to take the victim to a very specific point: a false login screen with which they intend to keep their Facebook credentials. Let’s see in detail the strategy of these cybercriminals. The mechanics behind fraud that imitates real selection processes It all starts with cold recruitment emails, carefully written and with a professional tone that seeks to resemble real human resources communications. It is not a minor detail that some of these shipments are made through legitimate services such as Google AppSheetbecause not only can that help you avoid spam filters, it also helps make the scene more believable to the person on the other end. The trap, at least at the beginning, is not presented in a crude way, but with a very careful appearance. From there, one of the most peculiar pieces of the entire chain appears: the so-called “HUB” domains. According to the investigation, these are pages that do not show their most sensitive content to anyone who enters directly. If a security analyst or an automated system visits that domain without coming from the specific link included in the email, what they find is a generic website, with hardly any visible activity. The truly important part is only activated when the visit arrives from that specific reference, which acts as a key and reveals the next step of the deception. The next move of the campaign is to give the victim exactly what they expect to see after a convincing recruitment email: a website that looks like a job portal. The research explains that, after that first access, the user lands on a intermediate domain which simulates a legitimate job offer portal and where you can consult positions that seem real and associated with the company whose identity they are impersonating. The more the scene resembles a normal job search, the easier it is for the person to interpret everything that comes after as a logical part of the same process. Campaign replicates legitimate job pages and uses Facebook login as hook The decisive moment comes when the victim clicks on “Request” or “Send request”. That click does not open a job form or a next phase of the supposed selection process, but rather a phishing page that asks you to log in with Facebook to continue. That’s where the trap stops insinuating itself and begins to execute its true purpose. All of the above was designed to lead to that exact point, one in which the request may seem like another simple verification within the application, when in reality what is being delivered are the account credentials. The supposed job opportunity was nothing more than the decoration of an operation with a much more specific purpose. According to the research, the final objective is steal Facebook credentials and thus obtain access to the victim’s account, with the possibility of also compromising other services connected to it. That’s why it’s a good idea to stick with a practical idea: before entering any credential, you should check the URL carefully, check that you are on the official domain, and be wary of any strange login. Images | Xataka with Grok | NordVPN In Xataka | AI is crucial for the US military. So he’s naming OpenAI and Palantir leaders as lieutenant generals

Mythos will be the most dangerous AI model, but companies are already taking note of its security tips

by

Top AI companies are in the race to create the best artificial intelligence model. That race has been won by Anthropic with Mythos. At least, That’s what they claim (of course)with phrases like it is so powerful that they cannot make it public. There is reasons to take Anthropic’s words with a grain of salt, but what is evident is that Mythos is already working. Although the company has not released it, has already given access to certain technology partners. The decision is based on the company’s fear that the model will be used maliciously. They themselves have described as a threat to cybersecurity based on the number of zero-day vulnerabilities that Mythos would have found in both the main operating systems on the market and in browsers. And, just when the model is arousing opinions from some and others, Mozilla arrives to affirm that the latest version of Firefox 150 It has security fixes for 271 vulnerabilities that have been discovered thanks to this preliminary version of Claude Mythos. For its part, OpenAI does not believe anything at all. “Just as capable as a human” Mozilla it details in one of the latest posts on his blog. The company had been collaborating with Anthropic for some time and using the Claude Opus 4.6 model to find errors. In January, it found 22 vulnerabilities in a couple of weeks, 14 of them rated very serious. Of those 22 found by Opos 4.6, which is already a powerful model, we move on to the 271 discovered by Mythos. It is a huge leap and Mozilla wanted to continue investigating to see to what extent the new model surpasses Opus. Analyzing Firefox 147, Mythos generated 181 functional exploits. Opus 4.6? Just two. 90 times less. Those results have led Mozilla to write that Mythos Preview is “just as capable as the best human cybersecurity researchers”adding that they have not found any categories that humans can detect that Mythos cannot. This has another reading since, as the company itself states, seeing that the model is capable of finding so many errors in such a short time makes them wonder if it is possible to stay up to date in cybersecurity work when alternatives to Mythos are developed that do fall into hands not controlled by those responsible. There is always the fact that Mythos has not found any errors that Mozilla’s human ‘watchmen’ have not detected and that a tool like this will help to have a more secure system. All of this, in the end, pushing that narrative that Mythos is practically a technological miracle. a nuclear bomb The other side of the coin is that Sam Altman, head of OpenAI, doesn’t believe anything. Taking advantage of his recent participation in a podcast, he has qualified The entire Anthropic movement as a fear-based marketing ploy. He accuses Dario Amodei’s company (Altman’s public enemy) of wanting to restrict AI to a small number of people in a strategy that he has compared to having an atomic bomb, threatening to release it and making a living by selling bunkers to protect themselves from that same bomb. “It is evident that this is an extraordinarily powerful marketing strategy. We have created a bomb and we are going to drop it. You can buy a bunker from us for 100 million dollars” It is one more point in that historical rivalry in which both companies (and managers) have been involved for some time, but it comes just when Anthropic is having a greater role and OpenAI is being forced to release ballast in the form of services like Sora. Altman is not the only one who thinks that Anthropic is repeatedly using this discourse of “We have something so powerful that we cannot make it public” because it is a good strategy to obtain financing. There are already voices that they point that Mythos is not that big of a deal and, in fact, other models have proven to be able to do the same, finding the same errors and problems detected by Anthropic. But, above all, we must remember that, in 2019, someone already said that a model was too dangerous for public release. Who? OpenAI itself with GPT-2. Obviously, it wasn’t that dangerous. In Xataka | OpenAI and Anthropic have proposed the impossible: lose $85 billion in one year and survive

They have kidnapped agents from Anthropic, Google and Microsoft for the sake of science. The three companies ended up paying

by

In some development teams it is already becoming common to rely on artificial intelligence agents to review incidents, analyze code changes and move through tasks that were previously left in human hands. The problem appears when these systems not only read information that may come from outside, but also operate in spaces where they coexist. sensitive keys, tokens and permissions. That is what recent research puts on the table: we are not simply facing a useful tool that can make mistakes, but rather an architecture that can also become dangerous if it is deployed without very clear limits. The alarm has been turned on Aonan Guan and Johns Hopkins researchers Zhengyu Liu and Gavin Zhong after demonstrating attacks against three agents deployed on the aforementioned platform: Claude Code Security Review, from Anthropic, Gemini CLI Action, from Google, and GitHub Copilot Agent, a GitHub tool under Microsoft. According to your documentation, The failures were communicated in a coordinated manner and ended in financial rewards paid by the companies, but what is relevant is that they point to a broader problem. This is how they managed to twist the agents from within The name that Guan gives to the discovery helps a lot to understand what this is all about: “Comment and Control.” The idea is simple to explain, although the substance is not so simple. Instead of setting up an external infrastructure to direct the attack, GitHub itself acts as an entry and exit channel: the attacker leave the instruction in a titlean incident or a comment, the agent processes it as if it were part of normal work and the result ends up reappearing within that same environment. Everything stays at home, and that is precisely the key to the problem. And that “everything stays at home” is not a minor detail, but the basis of what the research describes. The three agents share a very similar logic: they read normal content from GitHub, incorporate it as a work context, and from there, execute actions within automated flows. The clash appears because that same space not only contains text sent by third parties, but also tools, permissions and secrets that the agent needs to operate. The first case Guan details concerns Claude Code Security Review, an Anthropic GitHub action designed to review code changes and look for possible security flaws. Up to this point, everything is within what was expected. The problem, as the researcher explains, is that it was enough to introduce malicious instructions in the title of a pull requestwhich is the request that someone sends to propose changes to a project, so that the agent will execute commands and return the result as if it were part of your review. The team then managed to go a step further and demonstrate that it could also extract credentials from the environment. The interesting thing is that the same scheme also appeared in the other two services, although with nuances. At Google, Gemini CLI Action could be pushed to reveal the GEMINI_API_KEY from instructions snuck into an issue and its comments; In GitHub Copilot Agent, the variant was even more worrying, because the attack was hidden in an HTML comment that a person did not see on the screen, but the agent did process when another person assigned it to the case. In both scenarios, the background was the same again: apparently normal content that ended up twisting the behavior of the system until exposing credentials or sensitive information within GitHub itself. Guan assures that the pattern made it possible to leak API keys, GitHub tokens and other secrets exposed in the environment where the agent ran, that is, just the credentials that can later open the door to much more delicate actions. Who does this affect? Especially to repositories that run agents in GitHub Actions on content sent by untrustworthy collaborators and, in addition, give them access to secrets or powerful tools. The researcher himself clarifies that the risk depends a lot on the configuration: by default GitHub does not expose secrets to pull requests from forksbut there are deployments that open that door. And here another layer of the matter appears, less technical but just as important. As published by The RegisterAnthropic, Google, and GitHub ended up paying bounties for the findings, but none of the three had published public notices or assigned CVE at the time of that information. Guan was quite clear about this: he said he knew “for certain” that some users were still stuck on vulnerable versions and warned that, without visible communication, many may never know that they were exposed or even being attacked. So although there were mitigations and changes in documentation or in the internal treatment of reports, there was no equivalent public notice for all those potentially affected. Anthropic settled the case on November 25, 2025 and paid $100 Google rewarded the discovery on January 20, 2026 with $1,337 GitHub closed the case on March 9, 2026 with a payment of $500 What makes this case especially delicate is that GitHub does not seem like the end of the road, but rather the first visible showcase. Guan argues that the same pattern can probably be reproduced in other agents who work with tools and secrets within automatic flows, and there he mentions from Slack-connected bots to Jira agentsmail or deployment automation. The logic is the same again: if the system has to read external content to do its job and also has enough access to act, the field is fertile for someone to try to twist it from within. The conclusion that Guan reaches is not about selling a magic solution, but about returning to a fairly classic idea in security: giving each system only what is essential to do its job. If an agent reviews code, they shouldn’t have access to tools or secrets they don’t need; If you’re just summarizing issues, it wouldn’t make sense for you to write to GitHub or touch sensitive credentials. That … Read more

Europe thinks that it is the one who wants to become independent from US technology companies. It’s actually the other way around.

by

We are going to have to make a dictionary when we talk about artificial intelligence. Yes generative artificial intelligence, general artificial intelligence, AI agents and Google has its Personal Intelligence. This service has been available for a few months in the United States and is now expanding to the rest of the world for users of the company’s suite. To all? Well no, not everyone, and Google leaves out the entire European economic area, Switzerland and the United Kingdom. What does this do. First of all, Gemini Personal Intelligence is like an ‘entity’ that has an eye on all the Google applications that we use with our account. It is a connection between the entire ecosystem which has access to all the information from YouTube, Maps, Calendar, Drive, Gmail, Docs or Photos. The idea is that they know everything about you to help you with day-to-day requests. Google itself gives an example: Since I connected my apps through Personal Intelligence, my daily life has become easier. For example, two weeks ago we needed new tires for our 2019 Honda minivan. While waiting at the store, I realized I didn’t know the size of the tires, so I asked Gemini. Nowadays, any chatbot can find these tire specifications, but Gemini went further. He suggested two options: one for daily driving and one for all-weather conditions, with references to our family road trips to Oklahoma that I found on Google Photos. Then, he neatly extracted the ratings and prices of each one. When I got to the counter, they asked me for my license plate. Instead of looking for it or losing my spot in line to get back to the parking lot, I asked Gemini. It extracted the seven-digit number from an image in Photos and also helped me identify the specific model of the truck by searching Gmail. Just like that, we had everything ready. Everyone can appreciate how useful this is, of course. Because, furthermore, it is not free: you need to be on an AI Pro or Ultra payment plan. Europe, you are excluded, beautiful. But if you think that life can be solved for you like the person in the example and you live in Europe, you should know that you cannot access it. Google has made it very clear that the feature is not available in the European Union, the United Kingdom and Switzerland due to the strict privacy regulations that are found within the General Data Protection Regulation. It is one more service that does not reach European users due to these stricter privacy conditions and, in addition, they have not detailed any deadline so that we Europeans know more or less when it will be available in the region. If you read us from a Latin American country and you are interested in this software, good news, is available. Privacy. Regarding privacy, being something that we should take very seriously, it is curious how in the age of AI that privacy is eroded because the models have more and more data. We give a lot to this software and we don’t really know who’s watchingand Google wanted comment What is the privacy approach of your Personal Intelligence. According to the company, we can link and unlink applications from the ecosystem according to our preferences, but once we connect Photos, for example, you will have access to everything. They say that the photos in the gallery will not be used to train the model (here it is extremely sensitive because we each have personal photos on our mobile) and they take “measures to filter or hide personal data from the conversation.” They point out that “we do not train our systems to learn your license plate number, but to understand that, when you ask for it, we can find it.” Regarding health, a sensitive topic that is topical due to what El Salvador has done, they assure that “Gemini tries to avoid making proactive assumptions about sensitive data such as your health, although it will analyze that data if you ask it.” ¿Pressure? In any case, and what Google’s Personal Intelligence has to offer draws more or less attention, it is evident that carrying out a global launch of this magnitude without waiting to ‘sort the papers’ to launch it in Europe is also a declaration of intent. Europe is at a time when it is seeking its military sovereignty, aerospace and technologicalareas in which depends largely on the United States. We are building our infrastructure and systems, and not launching something like this in Europe is one more way of putting pressure on the organizations that, very actively, sand have positioned about the treatment of our data by these large companies. Image | Google (edited) In Xataka | Sometimes erotic AIs are AIs. And sometimes, they are a man from Kenya who charges two dollars an hour

Log In

Forgot password?

Forgot password?

Enter your account data and we will send you a link to reset your password.

Your password reset link appears to be invalid or expired.

Log in

Privacy Policy

Add to Collection

No Collections

Here you'll find all collections you've created before.