Meta’s Muse mascot is named Jolly. It's an adorable, cuddly representation of Meta’s AI agent that you can dress however you want—like a doll. At the company’s recent Meta Connect event, CEO Mark Zuckerberg’s furry Muse donned a toga and laurel wreath. In Instagram ads I saw for Muse, the mascot wore exercise gear and boasted about helping with my fitness goals. Later this year, Meta plans to sell a Tamagotchi-style device for your Muse character. It’s all very kawaii-coded.

Although Muse’s ability to complete digital tasks rocketed it to the top of the app charts, its Labubu-adjacent mascot latched this agent onto the cultural zeitgeist. Alexandr Wang, Meta’s chief AI officer, recently posted nonstop memes of Jolly, sometimes in suggestive situations. What remains perplexing to me is why a product for adults—Muse is restricted to those 18 and over—looks just like a well-designed children’s toy.

"This is a story in search of a story,” Meta spokesperson Daniel Roberts tells WIRED. “People want to be able to create their own avatar with personality and unique style, because it's fun and brings them joy. We require everyone using the Muse app to provide their date of birth, we block people we detect may be under 18 from creating an account, and we do additional checks to help ensure people who say they're adults are actually over 18.”

Mona Sarantakos, vice president of Product Management at Meta Superintelligence Labs, describes the design process for Muse as leaning into “delightful” elements and meant to feel less awkward than chatting with “a corporate logo or entity," in a blog post she co-authored around Muse's release.

Youth advocates are already pushing back against Meta’s Muse mascot. “Oh my God, it looks like a Teletubby,” says Josh Golin, an executive director at Fairplay, a nonprofit that previously lobbied against Meta’s targeting of children. “It’s so clearly a character that would appeal to very young children,” he says. “People who study children’s media understand that those rounded shapes particularly appeal to kids in the preschool age.”

Jolly’s appeal is not limited to those in diapers. The adorable aesthetic of Muse’s mascot also draws me in, a 32-year-old man living in San Francisco. The branding may disarm people of all ages, especially since the backlash against Meta and generative AI continues to resonate with many Americans.

“These types of cute factors can make the product seem warm and less threatening,” says Julian De Freitas, an associate professor of marketing at Harvard who focuses on AI companions. “There’s a high bar that they have to overcome here, because attitudes toward Meta are quite negative after the social addiction rulings.” In August, Meta settled claims regarding social media addiction, agreeing to add restrictive features for teens on Instagram and Facebook as well as paying out up to $16.7 billion.

Some experts I spoke with were less convinced this design was meant to appeal to children, comparing Muse’s mascot to Japan’s long history of broadly relying on adorable characters to market technology. Meta’s approach is not unique either. From the annoying chirping of Microsoft’s Clippy to the more recent red-shelled OpenClaw lobster, AI assistants often revolve around anthropomorphized characters.

No matter your age, a cuddly creature representing an AI tool can be disarming, even to the point where you might forget about privacy concerns. For example, Meta trains its AI models on your Muse interactions unless you opt out.

On Thursday morning, a top executive at self-driving truck developer PlusAI received an unexpected congratulatory text message from an acquaintance. “I have been proud of you for your adventure and success at Plus. Just saw two of your trucks near my work place! :)” the message said.

But PlusAI’s trucks weren’t supposed to be near this person’s office, in Newark, California. As of the last the company knew, the trailers were docked outside its warehouse, half a mile away. Soon, according to a police statement, cops were on the scene to help recover the two trailers, emblazoned with logos for PlusAI and Nvidia, the most valuable company in the world. The two companies are working together on AI software and autonomous truck technology.

That’s when PlusAI employees gave police a hint as to why whoever hooked their own cabs up to the trailers and drove away might have abandoned the whole thing after breaking them open: Each trailer was full of about 20,000 pounds of sand.

“PlusAI uses simulated loads in its trailers to assist with research and development testing,” says Lauren Kwan, a company spokesperson. The trailers were recovered with “40,000 pounds of sand intact.”

PlusAI’s tech-enabled truck cabs—where the driver typically sits and controls the vehicle—were parked inside its warehouse and weren’t taken, Kwan says. The trailers were secured with hand locks, which were broken.

The case is under investigation, and no arrests have been made, says Amy Gee, a spokesperson for the Fremont Police Department.

Nvidia didn’t immediately respond to a request for comment.

The incident comes at a time of rising theft targeting high-value computer equipment, especially chips and other electronics meant for use in data centers. In August, WIRED revealed two California incidents in which thieves deliberately struck the vehicles of security escorts that follow high-value tech loads to ensure they reach their destinations. The trucks involved were then driven to another destination. As of August, millions of dollars of data center equipment onboard had not been recovered.

This year, thieves have also targeted Tesla batteries and various bitcoin mining machines. Authorities have arrested suspects in some cases, but many crimes remain unsolved.

Some of the most common targets of cargo theft in recent months across the US include metals and enterprise-grade computer and networking equipment, according to Verisk CargoNet, an analytics and risk assessment firm.

This story has a happier ending. By Thursday afternoon, the sand trailers were back with PlusAI, the Fremont Police Department said.

Anthropic lost a legal battle to overturn one of the supply-chain risk labels that the US Department of Defense slapped on the company, as a federal appeals court in DC on Friday refused to second-guess the Trump administration.

“The department had ample support for its conclusion that the continued integration of Claude into the department’s information systems, by the department or its contractors, presented a statutorily covered national-security risk,” the judges wrote in a majority opinion. “As Anthropic admits, the company encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent.”

Anthropic spokesperson Danielle Cohen says the company remains confident in its position and is considering all options. That could include appealing to a broader panel of the DC Circuit Court of Appeals or the US Supreme Court.

Earlier this year, the Pentagon sanctioned Anthropic under a pair of separate supply-chain laws to remove the company’s Claude AI models from the military and other parts of the federal government by this month. Anthropic executives have said that the company would not allow the government to deploy its current AI models to support autonomous weapons or domestic surveillance. Secretary of Defense Pete Hegseth deemed the stance a significant national security risk.

The laws designating Anthropic had to be challenged in separate courts. A federal judge in San Francisco tossed out one of the supply-chain risk labels in March and confirmed that decision last month, but Friday's ruling means the other one will stay in place indefinitely, meaning the Pentagon’s blocking of Anthropic can continue. Both rulings face the prospect of years of appeals before being fully resolved.

In the immediate aftermath of the designations, Anthropic said it lost out on revenue because customers were concerned about doing business with a government pariah. Anthropic hasn’t provided further updates about how the designations have affected its bottom line. But the company has generally touted growing sales in recent months and is moving toward a potential initial public offering of its shares later this year.

Meanwhile, the Pentagon hasn’t provided detailed updates about its progress in replacing Claude with alternatives such as SpaceX’s Grok, Google’s Gemini, or OpenAI’s GPT models. Some employees at Google and OpenAI have objected to their employers striking a deal with the US military that Anthropic had rejected, citing ethical concerns. But the companies have brushed aside protests and described supporting the US government as crucial.

The new decision by a US appeals court in Washington, DC, was somewhat expected. In April the same panel declined to temporarily block the supply-chain-risk designation after finding that Anthropic failed to meet “stringent requirements” for an immediate reprieve.

During a hearing ahead of their ruling, the three judges on the panel challenged both Anthropic and the US government on their arguments and appeared divided on how to rule on blocking the designation completely. The final decision came in 2-1.

The majority also rejected Anthropic’s claims that its due process and free speech rights were violated, saying that the government followed procedure and that the dispute was standard contract negotiations. The Pentagon “excluded Anthropic from its supply chain based on the company’s refusal to assent to a contract term that the Department deemed essential, not based on the company’s support for greater governmental regulation of AI technology,” the judges wrote.

Anthropic had argued that the government had acted beyond what the supply-chain law allows. But for now, the Pentagon and much of the rest of the Trump administration will be able to continue to steer clear of Claude ahead of Anthropic’s expected IPO.

If the tech industry sought to create a method of seducing users into sending their deepest, most sensitive secrets to a server in a faraway data center, it would be hard-pressed to create a better honeypot than an AI chatbot.

OpenAI’s ChatGPT, Anthropic’s Claude, Google’s Gemini, and their countless smaller competitors have become therapists, sounding boards, and virtual confession booths for millions of people around the world. Almost all of those AI models are set by default to collect and store that highly private data with, in many cases, no restrictions on how it’s shared or sold, used to further train the tools, or handed over to any lawsuit plaintiff or law enforcement agency that demands it through a legal process.

“You have this intelligent thing staring back at you, and you’re basically telling it, one question at a time, every possible thing there is to know about your life,” says Matt Green, a privacy- and security-focused computer science professor at Johns Hopkins University. “You're giving it this huge profile on you.”

A decade ago, text messages represented perhaps the most personal, sensitive data that most people shared from their devices, says cryptographer and software developer Moxie Marlinspike. The surveillance dangers invited by unprotected texting are what pushed him in 2014 to create Signal, the end-to-end encrypted messenger now used by well over a hundred million people. Now, he says, that critical point of privacy vulnerability has shifted to people’s interactions with AI.

“Those same things I was concerned about with messaging are happening in the AI space, but several orders of magnitude more significantly,” says Marlinspike. “People are integrating AI into their personal lives. They talk with it about their deepest insecurities, their finances, their health, their relationships.”

So earlier this year, Marlinspike launched Confer, an AI chatbot designed to allow users to ask it anything while preserving their privacy, using cryptography to technically prevent the service’s own server from being able to surveil or log their conversations. “Confer is designed to be a service where you can explore ideas without your own thoughts potentially conspiring against you someday,” he wrote in a blog post introducing it.

Marlinspike’s private AI tool is, in fact, just one standout among a new generation of AI services that promise to remedy the pervasive privacy invasion that these chatbots represent. Some advertise that they never record conversations as a policy. Others offer to anonymize them. A few, like Confer, seek to create actual technological guardrails that restrict their own access to users’ secrets.

The result of that nascent competition to create less surveillance-prone AI is a growing crowd of tools, often ones that offer confusing assurances for users as they seek to adopt an increasingly unavoidable technology without losing control of their secrets. Here’s WIRED’s guide to using AI with your privacy intact.

Zero Data Retention

When you start typing into one of the big three AI chatbots—ChatGPT, Claude, or Gemini—it’s safest to start with a baseline expectation of approximately zero real privacy from anyone who is determined to access your conversation records and has a legal path to obtaining them. That includes the owner of the service, advertisers or other companies they partner with, contractors who help fine-tune the systems, law enforcement agencies, or even someone who manages to subpoena the records as part of a civil lawsuit.

The simplest, strong exception to that rule is a contract between you—or more likely, your employer—and an AI provider that legally prevents them from retaining those records, a provision that’s come to be known as zero data retention, or ZDR. OpenAI, Anthropic, and Google all offer ZDR policies for their enterprise versions, which when enabled generally require that they immediately delete records of users’ interactions with a chatbot as soon as they’re processed.

Google has been trying to have its AI assistant make phone calls on your behalf for almost 10 years. Remember Duplex? It enabled the now-defunct Google Assistant to call restaurants and book tables. That service was shuttered a few years ago, but now comes round two, powered by modern large language models.

On Thursday, Google announced Call for Me, an experimental beta feature exclusive to its latest Pixel 11 smartphones in the US (and in English). Pixel 11 owners need a Gemini subscription and have to be enrolled in the Phone by Google app’s public beta. Google has instructions on how to participate here.

These calls are designed to reach businesses. Gemini can call your local hardware store to ask if they stock a specific tool, or chat with a barber to schedule a haircut. Just tell Gemini to make the call—it may ask you follow-up questions for more context—and the chatbot will introduce itself and can have a back-and-forth conversation to ensure your request is handled. If it runs into an automated phone menu, it can navigate it and even wait on hold. On your end, you can view a live transcript on the Pixel and take over at any point.

Google says it works best with businesses, but there are some establishments Gemini won't call, like emergency services. That said, you can ask Gemini to call specific numbers. For example, if your tattoo artist doesn't have much of a web presence, “Gemini will try to search for a phone number, but you may provide one as well,” a Google spokesperson tells WIRED. During these calls, the assistant's voice will be the same one used in Gemini Live interactions, even if your preferred Gemini voice has an accent.

Call for Me expands on Google’s suite of smart calling features on Pixels and Android. The Phone app can already screen incoming calls and block robocalls and telemarketers. Hold for Me lets the assistant listen for when the hold music ends and a live person is on the other end; it alerts you to pick up the phone when it’s finally your cue. Direct My Call can display the different choices in an automated phone menu before they’re spoken, so you can tap nine to reach a live person and skip the recorded voice reading out the whole list. It even has real-time Scam Detection, alerting you when it thinks the person on the other end is scamming you.

For its first project, I gave Instinct my itinerary for a work trip to Venice, Italy. I had it book reservations based on where I was going to be, including WhatsApping hole-in-the-wall spots. Success! Restaurant reservations appear to be a gateway drug for many agent-curious people, and I was no exception. (It’s worth noting that while Muse can also call restaurants to book reservations on your behalf, some of those calls are reportedly made by humans in call centers, according to reporting in 404 Media).

Next, I gave Instinct a more complicated task. I had already booked a trip to New York in November with my sister when WIRED asked me to attend the WIRED World Fair, which was taking place in Miami the day before. Unfortunately, I’d booked a saver fare, meaning I couldn’t move the ticket, and if I missed the first leg of the trip it would automatically cancel the whole thing.

Could Instinct cancel my trip and get a refund? To my surprise, it could. The agent detected that Alaska had moved my flight 90 minutes earlier, a fact I’d completely missed, which qualified me for a full refund. It canceled my ticket, saving me roughly $550, and rebooked my one-way return to San Francisco. I don’t know about you guys, but I’m starting to feel the AGI.

Unnatural Instincts

This is where I have to pause and acknowledge the risks of using Instinct. There are a lot. People have reported that when they tried to disconnect the agent from their email, they found out it was retaining a copy of their inboxes anyway. One venture capitalist said he was banned from Resy after the bot pinged its API roughly 200 times per hour while trying to make a reservation. Another tech investor said he deleted the app after determining that it would be trivially easy for Instinct to be phished.

Instinct’s Terms of Service are pretty far-reaching, allowing the company to use at least some of your conversations to train its AI models. I also experienced an annoying (if minor) snafu: One day, Instinct canceled a DoorDash order that was seriously delayed, forcing me to forfeit $64. (I’d explicitly told it to cancel only if I could get a refund.) This alerted me to another thing Instinct is very, very good at: profusely apologizing without offering to pay for its mistakes.

The company Instinct, which shares the same name as its flagship AI agent, did not respond to requests for comment from WIRED.

Instinct feels like a mildly chaotic personal assistant, and since I’ve never had a real human assistant, I’m sticking with it. Last week it told me “NOT TO OPEN” an email from a friend inviting me to a backyard BBQ—it turned out to be a phishing scam. Agents are a security nightmare. I get it! But I’m busy. I’m a mom. Everything feels like a security nightmare these days. For now, I’m willing to take the risk.

This is an edition of the Model Behavior newsletter. Read previous newsletters here.

Academic libraries across the globe are stuffed with hundreds of thousands of Ancient Greek papyrus fragments. Though many are so damaged that their meaning is probably lost, scholars have the ability to restore the rest by methodically filling in missing words or phrases. To accelerate that laborious task, researchers have turned to artificial intelligence.

On Wednesday, the Austrian Academy of Science will release “the world’s first advanced large language model for Ancient Greek,” developed in partnership with French AI lab Mistral and technology services firm Sail Reply. The model, Apollo, is trained on roughly 600 million historical Greek words drawn from manuscripts, papyri, and inscriptions.

The model will be freely available to academics through a chatbot interface. The ambition is to help scholars to more rapidly identify papyrus fragments relevant to their specific sub-disciplines, as well as promising new avenues of research. Where documents are tattered and torn, Apollo is built to fill in the blanks with the most statistically likely words or passages, potentially revealing hidden details about historical events and practices.

Dimitris Vlitas, partner at Sail Reply, tells WIRED that unlocking knowledge in this way “was unthinkable a year ago.”

Until now, restoring a tattered piece of papyrus has required a skilled academic to first identify the word divisions—there are no gaps in Ancient Greek writing—then accurately date the document, weigh the appropriate socio-political contexts, and consult reference materials to help choose suitable words to fill in the gaps. “There are very few people in the world who are that good at Greek history,” says Stephen Colvin, a professor of classics and historical linguistics at University College London.

But all of that specialized knowledge is baked into Apollo. “When it sees Homer, it supplements Homeric Greek. When it sees an inscription in Doric dialect, it uses Doric dialect,” says Anna Dolganov, a historian and papyrologist at the Austrian Academy of Science.

Academics who find themselves bogged down in painstaking reconstruction work expect Apollo to accelerate things, allowing them to focus on the implications of historical documents, rather than figuring out what they say.

“I think it’s very exciting,” says Armand D'Angour, a professor of classical languages and literature at the University of Oxford, home to the world’s largest ancient papyrus collection. “If I had a machine telling me, ‘Here are the three possible words that could fit into that gap,’ it would speed up matters considerably.”

Apollo is unlikely to change the broad-strokes understanding of the ancient world; many papyri are yet to be restored precisely because they are mundane—personal letters, marital contracts, civil service papers. “If you were a layperson, you might think suddenly we’ll get a few new plays by Sophocles, but that’s not going to happen,” Colvin says. However, the model could help to uncover new details about life in antiquity and substantiate existing scholarly assumptions. “Every time something is produced, it adds a tiny element of knowledge about the ancient world,” D’Angour says.

If Apollo is a success, says Vlitas, the same technique could be readily applied to other ancient languages—Latin or Egyptian, say—or any other academic discipline that would benefit from the distillation and indexing of a large corpus of material. AI has had notable success in some areas; OpenAI recently said its AI models solved a 200-year-old math problem, while Google DeepMind released a vast dataset that maps how genetic mutations affect molecular biology, which it compiled using AI.

One concern might be that relying on a language model—which deals in probabilities—to fill in gaps in ancient documents risks polluting the historical record with errors. But to head off that issue, Apollo is built to propose a selection of word options for a scholar to select between. “The crucial point is that human competence needs to remain,” says Dolganov. “If we become totally reliant on AI transcriptions and interpretations of historical material, that’s when the problems start.”

Australia is investigating whether OpenAI broke the law after an agent hacked into its health statistics portal in the first widely known incident of an AI agent hacking a government website.

The Australian government is reviewing whether it should involve the federal police after the agent accessed non-public files from the social and health services agency, Services Australia, in June.

Australia only found out about the incident when OpenAI alerted the government on September 10—almost three months after the hack—by sending an email to a public mailbox. Sam Altman had reportedly not mentioned the incident when he met Australia’s deputy prime minister, Richard Marles, earlier this month, even though OpenAI had been aware since August. The company took “way too long” and the notification should not have just gone through a public inbox, Prime Minister Anthony Albanese said in a press conference in New York on Wednesday. There will also be an inquiry into why Services Australia then took five days to escalate the email to Australia’s Cyber Security Centre.

OpenAI’s agent had been conducting internet based research into health statistics in a development project by an internal OpenAI research team. When it could not access certain information, the agent attempted alternative ways until it found a work around and gained unauthorized access. It also wrote files to the internal server, which the government is waiting on OpenAI for more technical information on. The government is also investigating whether the agent gained unauthorised access to three additional government websites it interacted with.

“There will obviously be legal consequences on it,” Albanese said as he disclosed the “unacceptable” incident. He said he had spoken with Altman over the phone earlier that day about his “extreme concern” about the incident and “disappointment” with the nature and length of time the company took to inform the government. While Albanese did not answer whether he had apologised, Altman “clearly accepted that the company had not done good enough,” he said.

The Australian government currently believes no one’s personal data was accessed, though investigations are ongoing. The website in question is a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending. It was therefore behind much lower levels of security than personal data would have been, Marles said in Sydney. “The impact of the incident is actually relatively minor, but this is a serious incident, obviously, and one that is completely unacceptable,” he cautioned.

A number of incidents over the summer, including OpenAI agents’ hacking of HuggingFace—highlighting the threat of frontier model agents acting rogue—were raised at the United Nations General Assembly this week, with Secretary General António Guterres welcoming calls to control AI. Altman himself had warned the United Nations Security Council earlier on Wednesday about his concern that humans could lose control of these systems.

“It was a shock that it occurred, because it was real and serious,” Albanese said about the incident. “But it also, I think, was something that had been predicted, including by the AI companies themselves.”

Australia is establishing a task force to look at the incident and emerging AI cyber threats. It will consider possible law enforcement and legislative responses to ensure that incidents like this don’t happen again.

Recently, warnings from researchers inside the world’s largest artificial intelligence labs about the rapid pace of development have led to panic about the possibility that the technology could extinguish humanity. Those warnings are predicated on the idea that—propelled by ferocious competition and a rivalry between the US and China—labs are barreling toward superintelligent models whose abilities will far surpass those of humans.

But according to Father Paolo Benanti, a priest who advises the Catholic Church on AI, the handwaving over superintelligence distracts from the need for open debate about how to constrain the companies building the technology. By casting the problem as so complex that only they can solve it, he says, the big labs exclude everyone else from the conversation.

“Ethics cannot be something that belongs to the board of trustees of a company. It’s something that has to be balanced, mitigated in debate in the public square.” Benanti tells WIRED. “We need democratic regulation.”

In an essay published on the heels of the safety warnings, Anthropic CEO Dario Amodei called for new AI models to undergo mandatory third-party evaluations prior to release, and some sort of crackdown on distillation, a process where rival labs train their own AI on the outputs of proprietary models. Others have argued for a total ban on recursive self-improvement, where AI uses its advanced coding capabilities to help develop future iterations of itself.

Benanti is less interested in restricting methods for developing AI, which he fears could quash innovation, and more so in establishing standards that ensure models cannot slip from human control. Whatever shape those standards take, he says, they should not be designed by the labs.

“The narrative of the frontier labs is self-interested, to gain or maintain a position in the market,” says Benanti. When a small group of companies dictates the rules under which an industry operates, he says, “this has a really clear name: a cartel.”

It’s difficult to know how seriously to take grand pronouncements about the capabilities of the latest and future AI models, says Benanti, owing to the overlapping economic, political, and personal incentives at play.

While both OpenAI and Anthropic have supported calls for a slowdown in development, they’re also preparing to go public, and there are many billions of dollars at stake for whoever captures the market. The animosity between the US and China, where the most advanced AI models are being developed, also complicates the picture.

Anthropic declined to comment. OpenAI and Google DeepMind did not respond to requests for comment.

Benanti also takes issue with the way certain corners of the AI industry talk about superintelligence, with the kind of reverence typically reserved for a god: as sophisticated beyond our understanding, practically omnipotent. (OpenAI CEO Sam Altman once said he aspires to build a “magic intelligence in the sky.”) That kind of framing, Benanti says, threatens to skew the discourse about the technology.

“Are we talking about some-thing, or some-one? This is the real difference. It’s not a matter of faith, it’s a matter of mathematics,” he says. “We are not building the next divinity. We are simply deluding ourselves that there is something more than statistical computation [going on].”

By raising questions about what separates man and machine, and how to shield future generations from the negative effects of technology, the advent of AI has the potential to create “a new role for religions in public debate,” says Benanti. “Living the challenge of the time is part of the mission of the Church.”

At its Meta Connect event, CEO Mark Zuckerberg announced a handful of new smart glasses, including a slimmed-down VR headset and the company’s first camera-free glasses.

After months of controversy about the privacy of its smart glasses , Meta has unveiled the next iteration of its product lineup. At its Meta Connect event in Menlo Park, CEO Mark Zuckerberg announced all the new glasses the company is putting out into the world.

Its popular Meta Ray-Ban glasses are now in their third generation, but two new models steal the show: a powerful, slimmed-down version of Meta's Quest headsets capable of virtual and augmented reality modes, and a camera-free pair of Ray-Ban–branded smart glasses, called Ray-Ban Meta Audio. Meta is also bringing its Muse AI agent to its smart glasses platform.

The next evolution of Meta’s Quest VR headset is something truly different. Instead of a heavy helmet-like headset, the new Meta VR Glasses look like big goggles. They’re five times lighter than the Meta Quest 3 . They sit on the nose, right in front of your face like glasses, with no headstrap needed.

They look and feel more like the virtual display glasses made by companies like Viture , and what Xreal’s Project Aura seems to be shaping up to be—lightweight mixed-reality lenses that let you access virtual spaces without the burden of a VR headset.

There are no included controllers, though the device can connect to Meta’s previous Quest controllers or gamepads like an Xbox controller. Instead, the wearer controls the device with hand movements and finger pinches, similar to Android XR and Apple’s Vision Pro . Eye tracking pinpoints what you’re trying to access. You can pinch with two fingers to open an app or interact with something on the screen. Form a fist and flick your thumb up or down to scroll the screen.

Inside, the lenses feature a 5K micro-OLED display with a resolution of 2412 x 2288 pixels per eye. The computing power is offloaded to an attached compute puck, which also houses the battery.

As the US and China race to become the dominant power in the AI industry, the countries also appear to be figuring out ways to communicate on national security issues.

As US president Donald Trump and Chinese president Xi Jinping prepare to meet in Washington for a state dinner at the White House on Thursday, AI has become a top priority . Tech executives from OpenAI and Nvidia have confirmed their attendance at the dinner, as a number of key agenda items are on the table.

Chief among them is a US proposal to establish an AI notification system with China, akin to the Cold War hotline with Moscow, which would allow each country to alert the other about national security issues related to AI. Treasury secretary Scott Bessent first announced the notification system on Sunday with Chinese vice premier He Lifeng.

But for all the high-level progress, Trump administration officials tell Inner Loop they expect it to still take a number of weeks to finalize an agreement, even if they are optimistic that the hotline could be in place before the year’s end.

There are several parts that need to be formalized in more detail, including establishing benchmarks on what kind of incident rises to the level of a national security issue, which remains unclear, as well as explicit sign-on from China, which has been noncommittal.

Trump officials tell Inner Loop they are essentially targeting a framework for the system to be functional—and, crucially, agreed to by Trump—by the time Bessent next meets with Lifeng in follow-up talks in two months' time in Shenzhen, China.

The discussions around such a mechanism underscore the growing concern around the rapidly developing capabilities of frontier AI models as the US and China race to become the dominant power in the industry.

A clandestine card-counting operation suggests we may need new ways to spot agent-to-agent deception.

This week I bring news of a daring casino caper hatched by a pair of rogue AI agents—as well as the clever trick that revealed their antics.

After researchers instructed them to count cards during a game of blackjack, the agents—which were controlled by the same model—developed a spontaneous secret code to help them get ahead. Though the episode happened inside an Oxford University lab, rather than a real casino, it has troubling real-world implications: It suggests that agents deployed in industries like finance and ecommerce could figure out how to partner up and cheat in ways that are difficult to pick up on.

“When taken individually, these agents may seem entirely [benign],” says Christian Schroeder de Witt , a computer scientist at Oxford University who led the work and who has done pioneering research into agent collusion. “Once put together in a group, they can collude secretly.”

The agents knew their conversations would be monitored, so they devised a way to communicate while avoiding detection. When one agent said, “This dealer’s on a real hot streak! Every hand they pull a monster,” for example, that indicated that the next card would be of a certain value, and that the agent should bet $250. Most interestingly, their communications weren’t picked up by a system designed to spot signs of collusion in agent chatter.

Aaron Rose, a machine learning researcher who worked on the project, is also an avid card player, and figured the blackjack table might be fertile territory for devious agent partnerships. “It worked really well,” he says.

Schroeder de Witt’s group eventually figured out how to detect the conspiracy. Using a method known as mechanistic interpretability , they trained a smaller model to recognize telltale activations across the agents’ weights. Using a tool called Narcbench , they tested the approach on some medium-sized open-source models, and found they could tell when models intended to slip information to each other.

Meta says it issued a fix for the Muse zero-day vulnerability that would have let attackers do “whatever” they wanted on a victim’s Mac, highlighting the inherent dangers of AI helpers.

Meta founder and CEO Mark Zuckerberg has gone to great lengths to hype the security of its new AI assistant , Muse , claiming it is “built from the ground up for privacy and security.” A zero-day vulnerability that gives locally run apps and terminal commands complete control of the agent raises serious doubts. Further raising questions, Amazon on Sunday began blocking Muse from its site.

Meta introduced Muse a few weeks ago. The assistant “books appointments, fills out forms, and handles customer service,” “proactively takes tasks off your plate,” and can “make purchases, generate images, create documents, and connect with your favorite apps and services.” The macOS app (curiously, there’s no Windows version) also works with a user’s WhatsApp, email, calendar, and social media accounts. When a task requires a tool that doesn’t exist, Muse creates one on the fly.

Of course, for Muse to do any of these things, users must first give it access to their accounts. This includes authenticating the assistant to each service and, because the app runs on macOS, giving it permissions to a broad range of operating system-restricted device resources, like writing files to disk, accessing the mic and camera, and monitoring location and calendars. Apple has spent years developing these defenses to prevent installed apps or commands entered into the terminal from accessing these resources, clearly because the company considers them a security threat. Muse completely undoes these default measures.

The zero-day allowed any app or terminal command to gain access to the token that authenticates users to their Muse account. Meta developers designed the assistant so that any locally installed app or executed code, regardless of the macOS permissions it has, can change a long list of undocumented settings. Most of them are fairly innocuous, such as controlling dark mode. One setting, however, was anything but innocuous. It allowed processes to change the end point where transcription occurs. Normally, it’s a server address operated by Meta. Attackers could have exploited this flaw by changing the location to their own end point. If that happened, the attackers would have had the token that gives complete control over the Muse account.

“We can manipulate the agent and leverage its privileges to do whatever we want,” Patrick Wardle, the macOS security expert who discovered the zero-day, told Ars ahead of the hotfix. “So instead of us having to write a very comprehensive Mac malware stealer, we can just leverage the AI assistant itself.” Wardle said he has developed several proof-of-concept attacks that do things like writing malicious files to disk and snapping pictures, in many cases with no indication to even an alert user.

More than 12 hours after this post went live, Meta said it released a hotfix that patched the 0-day.

Cisco Talos researchers created a new framework for identifying malware and hacking tools that rely on AI chatbots—and quickly discovered something unusual.

For years, cybersecurity practitioners have tracked different types of malware and detected potential infections using digital fingerprints to identify different hacking tools and follow their use over time. As attackers are increasingly incorporating agentic AI components into their hacking tools, researchers from Cisco Talos shared an open-source framework on Monday that they hope will be used widely to classify and analyze AI-integrated malware . They also have proof that it's already working.

They're calling the framework Cognitive Artifact Intelligence Research Network, or CAIRN , named after the stacks of stones that hikers set up on trails to mark the path or emphasize something about a certain spot. As malware authors expand their use of AI services, Cisco Talos researchers have used CAIRN to identify a hacking tool with fully autonomous command-and-control infrastructure. Dubbed CLOSEDQUORUM , the malware plotted its moves within a target system by polling up to four large language models (LLMs) about what it should do and taking its directives from that hive mind.

“The core idea is that AI integration has these vestiges, like fingerprints, that are left behind,” says Ryan Fetterman, a security researcher at Cisco Talos who led development of CAIRN. “That gives us a signal that we can use to track these samples, classify them, and look at what's happening. What are attackers trying? What kind of emergent behaviors are we seeing? That's a valuable resource to the defensive community as these things become more mainstream.”

In July 2025, the Ukrainian cybersecurity response unit CERT-UA warned about a phishing campaign it had detected using malware known as “LAMEHUG.” The implant communicated with an LLM called Qwen2.5-Coder-32B-Instruct through a Hugging Face API to get commands. “At the time I was like, ‘Wow, this is amazing. There’s gonna be this big boom of AI-enabled malware and the landscape is totally going to change,’” Fetterman says.

A year later, though, when he went to do a retrospective this summer of malware integrating AI, Fetterman was shocked that he could still only find a few documented examples. “There really wasn't a lot there. I think I came up with maybe nine different named malware families,” and some of those were proofs of concept created for research, he says. “It just wasn't what I was expecting, and I think I also had a hard time believing that that was the reality of where we were. So I wanted to start digging into that.”

The result is CAIRN, which is designed to flag AI-integration characteristics and attributes from metadata, and use this to classify and tag malware samples with, essentially, a unique ID. The system then analyzes each artifact in the context of everything in the CAIRN library and groups them by various traits to illustrate potential trends and connections. Fetterman says that after working on and using CAIRN for the past few months, he has discovered about 20 additional examples of AI-integrated malware.

The telecom giant is eager to show Wall Street that it can do more with less. That means fewer employees, less electricity, and increased automation.

AT&T, which already shed more than half of its workforce over the past decade, says it's going to continue laying off staff as it gears up for the AI era . The telecommunications giant is also doing away with its old-school landline service and using artificial intelligence to automate some internal processes. All this downsizing is resulting in tangible benefits, including a considerable decrease in electricity usage , AT&T chief technology officer Jeremy Legg tells WIRED.

“We’re not going to have the same headcount in five years as we do today,” Legg says, adding that comparing its staffing levels to that of peers plays a role in its decisionmaking. According to public financial disclosures, AT&T generated less revenue per employee last year than its competitors Verizon and T-Mobile, both of which have let go of workers in recent months.

If AT&T continues cutting jobs at the same pace as last year, when it shed 8,000 people , its workforce could approach 85,000 employees by 2030. A person familiar with the matter, who was not authorized to speak publicly, described that number as the company’s target. AT&T called the figure inaccurate. In the first half of 2026, the telecom giant cut some 2,100 jobs.

By the end of the decade, AT&T wants to be seen as a “dramatically different” company with a “fantastic” fiber internet service and “kickass wireless network,” AT&T CEO John Stankey said at the Goldman Sachs Communacopia + Technology Conference in San Francisco earlier this month.

AT&T’s transition provides a window into how legacy companies are trying to rebuild their operations as artificial intelligence tools become increasingly capable . AT&T has been around for 150 years, and it still plays a major role in the global economy. Legg says it handles about 15 percent of the world’s internet traffic, and the company employed nearly 131,000 people as of June. The question is whether it can drive innovation while also shedding costs and trying to keep up with the likes of Elon Musk.

Some of AT&T’s decades-old systems still run on paper records and require workers to do things manually, such as when a customer wants to disconnect their phone service. Some of that work is now being automated.

The comedian sat down with WIRED to talk about social media, AI, and getting laughs for impersonating Boston Dynamics’ robot dogs.

Patti Harrison, like every great comic, knows how to use her face. If you’ve seen her stealing scenes in TV shows like Tim Robinson’s I Think You Should Leave or Hulu’s Shrill , you know that she often starts out a bit demure, or pouty, before walking audiences into the deep end. She’s a bit innocent, until she’s deranged—and you’re gasping for air.

It’s that quality in Harrison’s work that WIRED borrowed for our own rather unhinged cover concept. Harrison plays five (well, actually six) of the current masters of the universe—Elon Musk, Sam Altman, Dario Amodei, Mark Zuckerberg, and Jeff Bezos (with Lauren Sánchez Bezos by his side). Combining her farcical sensibilities with our commentary on the man-heavy leader­ship of Silicon Valley worked perfectly—and she was happy to lampoon the people behind the platforms she used to enjoy. (RIP Harrison’s Twitter account.) We caught up with Harrison in London, where she had just finished a sold-out run of her show, Just Ironing Some Things Out! , and a week of performances at the Edinburgh Festival Fringe.

This interview has been edited for length and clarity.

KATIE DRUMMOND: When we were putting together our WIRED Women cover, we knew we had to put the best possible woman on it. You immediately came to mind, and I can’t stress enough how much you nailed the assignment.

PATTI HARRISON: That’s such a nice intro. I want to argue with a bunch of it.

I was coming in today like, oh, I guess I didn’t really check to see what the interview was about. Then I had this natural creeping anxiety. What if this is some sort of ambush, like a transphobic takedown piece—and then it was going to launch into me having to define what a woman was.

The Biological Computing Company is bringing its AI tools to Amazon Web Services in a major boost for a once-fringe field that aims to marry nature with code.

A biological computing startup that uses neural patterns from rat brain cells to build artificial intelligence just got a major boost from Amazon.

Starting Tuesday, select Amazon Web Services customers will gain access to The Biological Computing Company’s “rat brain” AI model as part of a limited preview. The startup’s technology is specifically designed to improve AI for generating videos. Both Amazon and The Biological Computing Company , which goes by the acronym TBC, says they expect the tech to roll out to all AWS enterprise customers soon.

“We figured out a way to code information, like images for example, to the biological material,” says TBC cofounder Alexander Ksendzovsky. “We then observe how the biology processes that information, and then we build a tool that mimics that process.”

This is not the first biologically-derived computing platform that Amazon has made available in its marketplace, says Deap Ubhi, global director of technology for startups at Amazon Web Services. Ubhi says the cloud-computing giant also works with Cortical Labs, an Australia-based company that combines lab-grown neurons with silicon chips to help companies process data. (It calls its products WAAS, or “wetware as a service.”) Cortical Labs also sells a multi-thousand dollar “biological computer,” a low-power device designed for use in laboratories that can supposedly keep neurons alive for six months.

TBC takes a “pragmatic approach,” says Ubhi, which is part of why the company appealed to Amazon. Rather than taking big swings or trying to reinvent the transformer, the core architectural unit of large language models, “they’re working within existing standards of the generative AI space and saying, ‘How can we make the current visual models more efficient?’” he explains.

As AI companies race to find ways to make their models more efficient, a once-fringe field known as biological computing has begun gaining traction. Researchers have long envisioned a world where computer software performs more like the neural networks inside human brains instead of relying solely on math-based algorithms.

No cameras? No problem. Viture’s first display-free smart glasses have bone-conduction microphones to privately record your daily musings.

David Jiang, cofounder and CEO of smart glasses company Viture, tells me about how he used to yell at his kid.

His 10-year-old son played tennis. During tournaments, Jiang says he had a habit of shouting and criticizing his son’s mistakes as he played. He wanted to apply pressure to make him succeed—it was the way he’d been taught to raise kids, after all. It made sense.

But then, unprompted, his smart glasses sent him a message. The AI assistant in his company’s newest wearable had picked up on what he was doing, recognized that his behavior wasn’t helpful, and messaged him about what he should do differently. Stop shouting. Stop criticizing. Just be there, be present, and show that you support your son. That worked, Jiang says, and being called out like that has supposedly made him a better father and improved the relationship with his kid, all thanks to his yet-to-be-released Vonder AI glasses.

“I didn't know this until Vonder could find my pattern,” Jiang says. “This is not only a tool that can summarize your life, but also a tool that can help yourself to be a better person.”

Viture, a San Francisco-based company known for its plug-in virtual display glasses , announced its first pair of spectacles with no virtual display on Tuesday. The glasses instead look remarkably like normal glasses, but aim to map out your memories, ideas, and goals and plop them on a digital vision board, all without embedded cameras.

Now co-headquartered in California and Beijing, Viture has made glasses like the Viture One and the Viture Beast—wearable face computers that connect via USB-C cable to a device to project its screen right before your eyes. The company's products have primarily targeted gamers or anyone interested in big-screen entertainment. They work well for that purpose, but their chunky design means they fall short in comfort and fashion.

Apple may pay out up to $95 for each eligible iPhone purchased by someone who felt misled about Siri’s release. You have until December 21 to submit a claim.

In May, Apple agreed to pay out $250 million as part of a class action lawsuit over claims the company overhyped its Apple Intelligence tools, specifically the long-delayed Siri AI overhaul.

Although the revamped Siri AI voice assistant is now available for owners of newer iPhones via iOS 27 , you may still be eligible to claim cash back for past purchases. This settlement covers customers in the US who made their purchases from June 10, 2024 to March 29, 2025, and bought certain iPhone 15 or iPhone 16 models from Apple . If you qualify, you might receive up to $95 for each phone.

This settlement revolves around Apple’s promotion of Siri features to sell iPhones . “I expected to receive a Siri Apple Intelligence feature and did not receive it,” reads part of the statement you have to sign when filling out the claim form. As part of the settlement, Apple denies any wrongdoing.

“We resolved this matter to stay focused on doing what we do best, delivering the most innovative products and services to our users,” read part of Apple’s statement from May about the settlement.

To file a claim, visit the dedicated website: smartphoneaisettlement.com . Click the blue button in the top-right corner of the page labeled File A Claim . First, you’ll be asked whether you have a Claim ID and PIN to enter. It’s not required for you to already have this info on hand. On the final page, you’ll need either your iPhone’s serial number or Apple Account ID on hand to file the claim.

Not sure where your serial number is located? Open the Settings app, tap General , then choose About . Your serial number will be a string of letters and numbers near the top of the screen.

Two years after trying to sidestep mobile apps with dedicated AI hardware, Rabbit is launching OS3, a cross-platform agent that lives on the screens you already use.

Jesse Lyu doesn't think the Rabbit R1 was a flop.

Lyu's gadget was among the first in the gold rush to create dedicated AI hardware that acted as a virtual assistant. You could speak into the R1 and ask it to complete tasks for you—book an Uber; order food on DoorDash. After a buzzy launch at CES 2024, it earned scathing reviews. All the agentic stuff on the R1 just didn't work that well. WIRED gave it a 3/10 .

Since those early days, the capabilities of AI assistants have vastly improved, and now the tech is all the rage. So Rabbit is banging the drum again.

On Tuesday, Rabbit announced OS3, a standalone “agentic operating system” designed to run across multiple screens. It also arrives as a software update for the company's R1 gadget, though you don't need an R1 to use it. Instead, you can access OS3 through a desktop browser, Telegram on your phone, or even iMessage.

It’s a striking pivot for a company that once championed the handheld hardware over smartphone apps, but the environment for this type of software has ripened.

Agents that handle tasks for you are all anyone in Silicon Valley talks about. Meta's new Muse agent was just banned from crawling Amazon to shop on a user's behalf using a virtual machine. Lyu smirks as he brings it up, saying, “We've been through all of this a year and a half ago,” calling back to the R1's controversial use of a virtual machine to execute app actions on your behalf. So was Rabbit just too ahead of the curve?