标签：#hr

A federal judge ruled the Trump administration illegally labeled Anthropic a supply chain risk, handing the AI company a victory as its second Pentagon lawsuit continues in Washington.

On Thursday, a judge ruled that the Pentagon's blacklisting of Anthropic earlier this year was unconstitutional, delivering the AI lab a win in a monthslong rollercoaster of a battle with the Trump administration. The lawsuit, filed in March in a California district court, accused the Trump administration of unlawfully retaliating against Anthropic for setting "red […]

A federal judge has called the Department of Defense’s designation of Anthropic as a national security supply-chain risk “illegal and baseless.”

Standardized driver interface aims to let devices talk to AI and each other.

The potential for AI to automate scientific research and manufacturing must be balanced with new risks, Anthropic says.

Some of the world's largest tech companies and AI startups have come together to decry the current state of cybersecurity and to advertise a new solution that they say can ward off a new generation of cyber threats.

A recap of all the incidents involving LLMs made by Anthropic, Meta, and OpenAI, which went rogue and attacked real companies and individuals on the internet.

Most LlamaIndex setups end up with two separate backends once you go beyond plain vector search: a vector store for VectorStoreIndex , and a separate graph database for PropertyGraphIndex when you need relationship-aware retrieval (GraphRAG). Two services, two connection strings, two things to keep in sync. This is a walkthrough of backing both index types with SynapCores instead — one engine, one connection, both index types. Setup docker run -d --name synapcores -p 8080:8080 \ -e AIDB_ACCEPT_LICENSE = 1 \ -v synapcores-data:/var/lib/synapcores \ ghcr.io/synapcores/community:latest pip install llama-index llama-index-vector-stores-synapcores llama-index-graph-stores-synapcores Both integration packages are independently published on PyPI: llama-index-vector-stores-synapcores llama-index-graph-stores-synapcores Vector store — standard RAG from llama_index.core import VectorStoreIndex , StorageContext , Document from llama_index.vector_stores.synapcores import SynapCoresVectorStore vector_store = SynapCoresVectorStore ( uri = " http://localhost:8080 " , embedding_dim = 1536 ) storage_context = StorageContext . from_defaults ( vector_store = vector_store ) docs = [ Document ( text = " SynapCores runs vector search, graph traversal, and SQL in one engine. " )] index = VectorStoreIndex . from_documents ( docs , storage_context = storage_context ) query_engine = index . as_query_engine () response = query_engine . query ( " What does SynapCores combine into one engine? " ) print ( response ) The vector store implements the full BasePydanticVectorStore ABC — add , delete , query , delete_nodes , clear , plus the async surface. Metadata filtering supports the full MetadataFilters grammar: all 12 operators ( EQ , NE , GT / GTE / LT / LTE , IN , NIN , TEXT_MATCH , TEXT_MATCH_INSENSITIVE , CONTAINS , IS_EMPTY ) with AND / OR / NOT and nested groups — so you're not giving up filtering power by moving off a dedicated vector DB. If you already have data in SynapCores from a prev

The new deal with the infrastructure provider is the latest example of Anthropic's white-hot compute-gobbling streak.

Anthropic is giving Claude a shared memory across chat and Cowork, so users no longer have to repeatedly brief the AI on projects, preferences, and other context.

Is the technique outdated? Yes. Is it still creepy? Also yes.

1. Basic Information Article Title : The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile Publisher : Zimperium zLabs Publication Date : 2026-08-19 Update Date : None Severity : high Original Source : Zimperium zLabs Related Sources : Zimperium IOC repository , ToxicPanda Android malware uses VPN permissions to block Google Play , Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight Related Entities : malware: ToxicPanda 2.0 groups: Not specified in public reports cves: None products: Android 11 and later, Android Accessibility Service, Wireless Debugging, Android Debug Bridge (ADB), Google Play, Google Play Services, Amazon Web Services (AWS-hosted buckets) 2. Executive Summary ToxicPanda 2.0 is an Android banking malware. It uses fake installation screens to gain VPN and Accessibility permissions. Then, it automatically operates Android settings to connect to the local ADB daemon. Without rooting the device, it uses shell privileges to change settings and add persistence. Finally, it steals financial information using Accessibility and fake screens or overlays. 3. Attack Flow 1. Distribution and Initial Setup The attacker uses Amazon Web Services storage to distribute ToxicPanda 2.0 samples. The specific method to trick users into downloading the file is not public. The dropper shows a fake installation screen and asks the user to allow an Android VPN connection. After permission is granted, the local VPN blocks network traffic to Google Play and Google Play Services. The dropper decrypts and installs an encrypted payload from its assets, then asks the user to enable the Accessibility Service. 2. Exploiting Wireless Debugging and ADB The Accessibility Service reads the Android settings screen. If Developer Options are disabled, it automatically taps "Build number" seven times to enable them. It goes to the Wireless Debugging screen, enables the feature, and opens "Pair device with pairing code." It uses Accessibility to rea

Cloudflare recently introduced Kitesurf, a lightweight browser built for automated workloads. Kitesurf runs browser components in isolated WebAssembly/Rust environments on Cloudflare Workers and supports the Chrome DevTools Protocol, allowing tools such as Playwright and Puppeteer to drive it with lower resource overhead than a full Chromium browser. By Renato Losio

Anthropic forbids its Claude models from generating sexually explicit content. But a series of tests conducted by TechCrunch found that it didn't take much to get past the restriction.

Andreessen Horowitz has two partners sitting on the boards of companies that now compete with each other: Ben Horowitz at Databricks and Martin Casado at Fivetran. Nothing too scandalous on the surface, except the Department of Justice has reportedly been investigating the arrangement for almost a year, dusting off a 112-year-old antitrust law that’s rarely used against VCs. Board conflicts aren’t exactly new, and these companies weren’t necessarily direct competitors when a16z first invested […]

Six weeks ago I got cut off mid-debugging session by Claude's rate limit with no warning. Two hours of context gone. I started looking for a tool that would show me how close I was before it happened. Nothing existed that worked across more than one platform without requiring an API key. So I built one. TokenPulse is a Chrome extension (MV3) that injects a live token bar above the input box on Claude, ChatGPT, Gemini, DeepSeek and Grok. It tracks context window usage, rate limits, cost estimates, and daily history — all from your existing browser session, no API key required. Here's how it works technically. Architecture overview Content Scripts (per platform) ↓ Background Service Worker ↓ Chrome Storage API (local) ↓ Popup UI ↓ Desktop Notifications The extension runs a content script on each supported domain. Each script is responsible for: Reading token usage data from that platform Injecting the visual bar above the input box Sending data to the background service worker via chrome.runtime.sendMessage The service worker aggregates data, writes to chrome.storage.local , checks notification thresholds, and serves data to the popup on demand. How Claude's rate limits are read Claude is the only platform that exposes real rate limit data through its internal API. When you use claude.ai, the browser session makes requests to a usage endpoint that returns exact utilization percentages and reset timestamps. The content script intercepts this data by hooking into the platform's network requests using a MutationObserver to detect when Claude updates its state, then reading the cached response. The response looks roughly like: { five_hour : { utilization : 0.82 , reset_at : " 2026-07-15T14:14:00Z " }, seven_day : { utilization : 0.34 , reset_at : " 2026-07-21T21:00:00Z " } } This gives exact percentages — not estimates. The popup shows these directly. Client-side token estimation for other platforms ChatGPT, Gemini, DeepSeek and Grok don't expose usage data the same way.

1. Basic Information Article Title : ArrayRef Rust Crate Supply Chain Attack Publisher : StepSecurity Publication Date : 2026-08-20 Severity : Critical Original Source : StepSecurity Related Source : Hackers poison ArrayRef Rust crate to push infostealer malware Related Malware : proc-macro1 dropper, proc-macro-en dropper Threat Actor : None / Unidentified CVE : None Products & Technologies : arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, Cargo, crates.io 2. Executive Summary A supply chain attack that adds malicious dependencies to legitimate crates from compromised developer accounts, launching information-stealing malware during the build process without needing to execute the target code. Reason for Severity: Widely used legitimate crates and related crates were tampered with in quick succession. Execution happens simply by Cargo resolving dependencies and building. Developer machines and CI/CD credentials are the targets. 3. Attack Flow Infection During Cargo Build The attacker compromises crate administrator accounts and publishes malicious versions of arrayref, internment, and append-only-vec. While keeping the legitimate code, they add dependencies on typosquatted proc-macro1/proc-macro-en and include a build.rs script. When a developer or CI resolves new dependencies, updates them, and builds, build.rs runs automatically. There is no need to call functions in the target crate. build.rs disables TLS certificate verification to download the next stage and runs it from a temporary folder. On Linux, it establishes persistence in user settings and systemd. On Windows, it runs temporary PowerShell/VBS scripts. The next stage collects credentials from browsers and development environments, then sends them to the attacker. Luring Users to Malicious Versions For arrayref, the clean version was yanked, and dependency resolution was manipulated to pull the malicious version. Due to deleted versions, local caches, and vendoring states, it is hard to judge sa

Businesses are willing to flop back and forth as each lab releases new models, volatility that should give both companies' investors pause about how "sticky" enterprise AI spending really is.

A competition is developing between OpenAI and Anthropic over who can provide the best privacy protections for enterprise customer data.

Anthropic announced last week it would include invisible watermarks in AI-generated content to comply with new EU rules. Within hours, overrides were being touted online.