ClawHub Plugin Squatting Exposes Security Gaps in AI Agent Registries
Security researchers found 23 code-executing plug-ins on ClawHub under official @openclaw and @clawhub scopes, but owned by unrelated parties, highlighting registry security gaps.
Daily fact-checked reporting on hosting, cloud, data centers, domains, and security
Microsoft attributes a supply chain attack on Mastra AI to North Korean state actor Sapphire Sleet. Over 140 npm packages were poisoned with a malicious dependency that disables TLS verification and steals cryptocurrency wallet credentials.
Security researchers found 23 code-executing plug-ins on ClawHub under official @openclaw and @clawhub scopes, but owned by unrelated parties, highlighting registry security gaps.
Google put a $3.2 billion guarantee behind a New York AI cluster using its TPU chips. The move signals a broader shift to sell chips directly and compete with Nvidia in the GPU-as-a-service market.
Texas regulators approved ERCOT's new grid connection rules for large-load users, including data centers, requiring projects of 75MW or more to enter a batch study process. The move comes as ERCOT projects demand could exceed 111GW by 2032.
Fortinet says the FortiBleed credential-harvesting campaign does not exploit new vulnerabilities. The company has identified compromised systems and is notifying customers.
Sakana AI's Fugu orchestrates multiple LLMs via a single API, matching Anthropic's Fable 5 and Mythos Preview on benchmarks. The system is available now in two variants.
A new benchmarking index from startup Autnmy AI ranks Baidu's Apollo Go as the top robotaxi globally, ahead of Waymo. Meanwhile, Waymo recalls 3,900 robotaxis after incidents involving construction zones.
NVIDIA's new AI servers can run cooling liquid at 45°C, hotter than a hot tub, enabling 100% liquid cooling with no fans and cutting water use by up to 2.6 million gallons per megawatt per year.
ATProto's decentralized identity model comes with a catch: your PDS operator holds your signing and rotation keys, enabling impersonation across all apps. Security experts call for default key backup to restore user control.
A Kapwing study found 59% of TikTok videos served to new accounts are AI slop, triple YouTube's 21% rate. Kids content leads at 57%, while Fashion and Music have under 2%.
Google and UC San Diego researchers have built a working data center cluster from 2,000 retired Pixel smartphones, demonstrating a 50% reduction in energy use and a 80% drop in e-waste compared to traditional server deployments.
Systemd 261 is out with a software TPM and cloud metadata, but a new optional birth date field in user records has sparked a fork called Liberated systemd, which reverts that change.
Cookie preferences
Each category below sets a Google Consent Mode v2 signal. Necessary cookies cannot be switched off because they keep the site working. Everything else defaults to off until you choose.
Strictly necessary
Login, session, security and load-balancing cookies. Without these the site does not work.
Analytics
Google Analytics 4 (page views, time on page, source attribution). Aggregated only, never sold.
Advertising
Google AdSense and ad measurement tags. Without this category, ads are non-personalised (cookieless).
Personalisation
Remember preferences such as theme, language, and reading position so they persist between visits.