Tuesday, May 26, 2026

Millions of AI agents imperiled by critical vulnerability in open source package


<p>Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts, a security researcher is warning.</p> <p>The vulnerability is present in Starlette, an open source framework that its developer says receives 325 million downloads per week. Thousands of other open source projects are also vulnerable because they require Starlette to work. The framework is an implementation of the ASGI (asynchronous server gateway interface), which allows large numbers of requests to be efficiently processed simultaneously. Starlette is the base of FastAPI and other widely used frameworks for building services in Python apps, as well as many others.</p> <h4>Trivial to exploit, millions of servers exposed</h4> <p>ASGI, and by extension Starlette, have access to servers running the MCP (model context protocol), which allows AI agents from major providers to access external sources, including user data bases, email and calendar accounts, and all manner of other resources. To connect with these external systems, MCP servers store credentials for each one, making them especially valuable storehouses for attackers to breach.</p><p><a href="https://arstechnica.com/information-technology/2026/05/millions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package/">Read full article</a></p> <p><a href="https://arstechnica.com/information-technology/2026/05/millions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package/#comments">Comments</a></p> Reference : https://ift.tt/HfqwSrA

What It Takes to Preserve Floppy Disks


<img src="https://spectrum.ieee.org/media-library/person-in-floppy-disk-sweater-sits-behind-scattered-floppy-disks-on-table.png?id=66763716&width=1245&height=700&coordinates=0%2C141%2C0%2C141"/><br/><br/><p><a data-linked-post="2667647674" href="https://spectrum.ieee.org/3m-floppy" target="_blank">Floppy disks</a> are several decades old—many of the disks are degrading and the data stored on them is at risk of being lost. In response, <a href="https://www.cdh.cam.ac.uk/about/people/leontien-talboom/" rel="noopener noreferrer" target="_blank">Leontien Talboom</a>, a technical analyst at Cambridge University Libraries and Archives, led a roughly year-long project preserving <a href="https://spectrum.ieee.org/3m-floppy" target="_self">floppy disks</a> called “<a href="https://www.lib.cam.ac.uk/future-nostalgia" rel="noopener noreferrer" target="_blank">Future Nostalgia</a>,” which concluded in January.</p><h3>Leontien Talboom</h3><br/><p><a href="https://www.cdh.cam.ac.uk/about/people/leontien-talboom/" rel="noopener noreferrer" target="_blank">Leontien Talboom</a> is a technical analyst at Cambridge University Libraries and Archives, where she transfers material from a wide range of storage media to make them accessible to archivists. </p><p><em><em>IEEE Spectrum</em></em> spoke to Talboom about her work <a href="https://www.digipres.org/the-floppy-guide/" rel="noopener noreferrer" target="_blank">preserving data</a> from Cambridge’s collection of floppy disks and <a href="https://www.repository.cam.ac.uk/items/154ad280-7c47-49eb-9cbf-24b6762f6c1c" rel="noopener noreferrer" target="_blank">collecting knowledge</a> about the disks themselves.</p><p><strong>Why is it important to preserve floppy disks now?</strong></p><p><strong>Leontien Talboom: </strong>Two reasons. First, the physical media is starting to degrade. Floppy disks are made from plastic, but they’ve got a magnetic layer of iron oxide, and that’s deteriorating. A lot of floppy disks are found in attics or garages, which means they also suffer from mold.</p><p>Second, a lot of people who developed floppy disks and systems that use floppy disks are starting to retire or pass away, which means that a lot of tacit knowledge is disappearing.</p><p><strong>Whom did you go to for that tacit knowledge?</strong></p><p><strong>Talboom: </strong>I went to the retro computing community. Their work is more around preserving these machines to keep them running [than] the data that lives on the floppy disk. But they know their stuff about floppy disks.</p><p>For example, they know that in a lot of the older disks, the inside of the disk—the doughnut—gets stuck to the top. So if you flex the casing, the doughnut falls down again. If I hadn’t known that, I would have assumed that those disks in our collection were broken or corrupt.</p><p><strong>What is the most difficult part of working with floppy disks?</strong></p><p><strong>Talboom: </strong>Accessing the files can be quite challenging if we don’t understand the file system. Within libraries and archives, we get a lot of material from machines that are not as well loved. Many of the personal computers that you had at home, such as the <a href="https://amstrad.com/product-category/computer/" rel="noopener noreferrer" target="_blank">Amstrad</a> or <a href="https://www.bbc.com/news/articles/cpvzp80jv07o" rel="noopener noreferrer" target="_blank">ZX Spectrum</a> or <a href="https://computerhistory.org/blog/the-bbc-micro/" rel="noopener noreferrer" target="_blank">BBC Micro</a>, are very well documented. But a bunch of our material comes from business or research systems. They’re not as nostalgic for people, so there’s not as big a community preserving this type of material.</p><p><strong>Do you have a favorite type of floppy disk?</strong></p><p><strong>Talboom: </strong>Five and a quarter. The weirder the system, the more frustrating and fun it is. I quite like doing that detective work.</p><p>The Amstrad disk has also really stolen my heart. The popularity of floppy disks is very geographically dependent. Our library, for example, has these Amstrad 3-inch disks. But if you go to the U.S., they’re really uncommon. They weren’t able to manufacture enough of these drives, and [3.5-inch disks] took over at a certain point. But they’re really cute.</p><p><strong>What’s the best method for sustainably storing data?</strong></p><p><strong>Talboom: </strong>The main thing is actively looking after it. A lot of the floppy disks we get in the library haven’t been accessed for 20 or 30 years, which means that you need certain special hardware to actually read them, and then work with emulators or other tools to make these file formats accessible.</p><p>Now that we’ve done that work and transferred it, we can monitor it and make sure it’s not suffering from anything like bit rot. We can also make decisions around migrating it to other file formats or working on specific file systems or unknown file formats in more detail.</p> Reference: https://ift.tt/2r3JOAY

Meet NASA Low Outgassing Standards With Adhesives for Aerospace and Optical Systems


<img src="https://spectrum.ieee.org/media-library/illustration-of-molecules-leaving-a-surface-as-it-transforms-into-an-ordered-graphene-lattice.jpg?id=66678225&width=1245&height=700&coordinates=15%2C0%2C15%2C0"/><br/><br/><p><span><em>This sponsored article is brought to you by <a href="https://www.masterbond.com/" target="_blank">Master Bond</a>.</em></span></p><p><span>Outgassing is the release of volatile substances from a cured adhesive over time. These released materials, which may include residual solvents, unreacted monomers, or other chemical species, can deposit on nearby surfaces, causing contamination that interferes with sensitive components.</span></p><h2>What Is Outgassing and How Is It Measured?</h2><p>The industry standard for measuring outgassing is <a href="https://www.masterbond.com/certifications/nasa-low-outgassing" target="_blank">ASTM E595, developed by NASA</a>. This test exposes a cured sample to 125 °C at high vacuum (10⁻⁵ to 10⁻⁶ torr) for 24 hours, measuring Total Mass Loss (TML) and Collected Volatile Condensable Materials (CVCM). To meet NASA low outgassing requirements, materials must exhibit less than 1 percent TML and less than 0.1 percent CVCM.</p><p class="pull-quote">Optical assemblies need contamination-free bonding and prevention of fogging the optics to maintain clarity. High-vacuum scientific equipment, semiconductor manufacturing tools, and aerospace electronics also demand low outgassing materials.</p><h2>Key Applications</h2><p><a href="https://www.masterbond.com/properties/low-outgassing-adhesives" target="_blank">Low outgassing adhesives</a> are essential wherever contamination could compromise performance and this is particularly relevant for space and satellite systems. <a href="https://www.masterbond.com/industries/adhesives-sealants-and-coatings-optical-industry" rel="noopener noreferrer" target="_blank">Optical assemblies</a>, including cameras, telescopes, and laser systems, need contamination-free bonding and prevention of fogging the optics to maintain clarity. </p><p>High-vacuum scientific equipment, semiconductor manufacturing tools, and aerospace electronics also demand low outgassing materials. Even terrestrial optical devices benefit from reduced outgassing to ensure long-term reliability.</p><p class="shortcode-media shortcode-media-rebelmouse-image"> <img alt="Hand brushing adhesive onto a clear optical prism beside three similar glass pieces" class="rm-shortcode" data-rm-shortcode-id="c23ed98ab2db5fb63248ea4d5ba23cfc" data-rm-shortcode-name="rebelmouse-image" id="b1d25" loading="lazy" src="https://spectrum.ieee.org/media-library/hand-brushing-adhesive-onto-a-clear-optical-prism-beside-three-similar-glass-pieces.jpg?id=66678226&width=980"/> <small class="image-media media-caption" placeholder="Add Photo Caption...">EP30-2 is a versatile system can be used in a variety of applications in aerospace, electronic, optical and specialty OEM industries, especially when optical clarity and low outgassing are important criteria.</small><small class="image-media media-photo-credit" placeholder="Add Photo Credit...">Master Bond</small></p><h2>Ensuring Low Outgassing Performance Through Proper Handling</h2><p>Achieving specified outgassing performance requires attention to storage, mixing, and curing. For two-part systems, use the correct mix ratio and mix thoroughly to ensure complete reaction. Follow recommended cure schedules — adding heat, even at modest temperatures of 150-200 °F, significantly improves cross-linking and reduces outgassing. For UV-curable adhesives, ensure complete cure by using the correct lamp wavelength (typically 365 nm), adequate intensity, and proper exposure time with no shadowed areas.</p><h2>Troubleshooting Outgassing Issues</h2><p>If contamination appears on optical surfaces or outgassing test results are higher than expected, an incomplete cure might be one of the root causes. The first step is to verify that the adhesive has fully hardened to its specified Shore hardness. The next step is to consider adding or extending heat cure to improve cross-linking.</p><h2>Master Bond Product Recommendations</h2><p>Master Bond offers a range of adhesives meeting NASA low outgassing requirements. <a href="https://www.masterbond.com/tds/ep30-2" target="_blank">EP30-2</a> and <a href="https://www.masterbond.com/tds/ep21tcht-1" rel="noopener noreferrer" target="_blank">EP21TCHT-1</a> are some examples of two-part epoxy systems that have been successfully deployed in demanding vacuum applications, including ultra-high vacuum environments. </p><p>For applications requiring UV cure, Master Bond provides specialty UV formulations such as <a href="https://www.masterbond.com/tds/uv16" rel="noopener noreferrer" target="_blank">UV16</a> meeting ASTM E595, as well as dual-cure systems (UV plus heat) such as <a href="https://www.masterbond.com/tds/uv22dc80-10f" rel="noopener noreferrer" target="_blank">UV22DC80-10F</a> for assemblies where shadows prevent complete UV exposure. These dual-cure products initiate with UV light and complete curing with heat as low as 180 °F (80 °C).</p> Reference: https://ift.tt/H8kA1Kc

Monday, May 25, 2026

Reclaiming Social Engineering for Good


<img src="https://spectrum.ieee.org/media-library/a-photo-illustration-of-a-person-inside-a-swirling-tunnel-of-colorful-digital-shapes-and-screens.jpg?id=66742827&width=1200&height=800&coordinates=0%2C0%2C0%2C0"/><br/><br/><p>“Social engineering” sounds like something out of a conspiracy thriller, charged with totalitarian control and fringe paranoia. More mundanely, it’s come to be associated with phishing and other scams, in which fraudsters manipulate people into disclosing personal information. </p><p>Yet the concept is older and more benign: it is the deliberate shaping of human behavior, often at scale. It predates silicon—and became pervasive, and ungoverned, especially once its practitioners learned to hide it. Authoritarian regimes and more recently scammers and big companies have profited from it. To defend ourselves from bad actors, and to benefit from social engineering’s good side, we need to reclaim the name, and <a href="https://spectrum.ieee.org/why-engineers-must-try-to-save-the-world" target="_blank">govern it prudently</a>.</p><h2> The roots of engineering</h2><p>In 1894, Dutch entrepreneur Jacques van Marken urged companies to hire “social engineers” to manage human systems such as insurance, education, and profit sharing for workers as carefully as they did mechanical ones. Fifteen years later, reformer William H. Tolman published <em>Social Engineering</em>, describing how U.S. industrialists optimized workers’ conditions alongside manufacturing methods. If industrialists could shape steel and electricity on demand, why not society itself?</p><p> By the 1920s, that confidence had spread. The architect Le Corbusier declared that dwellings were “machines for living in,” imagining cities as orderly lattices where people moved like parts on a conveyor belt. Civilization would run like a Swiss watch.</p><p>The idea soon darkened. Authoritarian regimes pushed it to extremes, promising to fashion “<a href="https://www.jstor.org/stable/20719929" rel="noopener noreferrer" target="_blank">the New Man</a>.” In Nazi Germany, engineer Fritz Todt founded Organization Todt, a vast state engineering enterprise that emerged from the autobahn highway system and later operated concentration camps using slave labor. </p><p>In the Soviet Union, leaders adopted U.S. scientific management techniques to plan factory-worker movements and classify populations through centralized records, feeding both rapid industrialization drives and the gulag system of forced labor. The same tools and managerial methods used to build highways and enact five-year plans worked for repression and mass control.</p><p>By the 1950s, “social engineering” had become a contaminated phrase. The revelations of Nazi and Soviet abuses, along with Cold War <a href="https://en.dialektika.org/society-politics/politics/karl-popper-and-the-social-engineering-utopian-vs-piecemeal/" rel="noopener noreferrer" target="_blank">critiques of grand social planning</a> turned the term from a progressive slogan into a warning label. Banishing the words pushed the practice underground, making it harder to recognize when it resurfaced in new forms—such as organizational psychology and systems management that still relied on classification and behavioral influence techniques but under softer, less loaded labels.</p><h2>Social engineering’s more subtle spread</h2><p>In the postwar years, the new social-engineering lexicon included “human factors” and “urban planning,” all promising integration rather than command. As computing advanced, the language shifted again: “customer journey mapping” to track interactions, “user experience” to script them. Engineering, which began as a means of reshaping physical space, set its sights on shaping behavior. Digital design features embedded in our smartphones now target our attention and desire.</p><p> Language helps conceal these modern forms of social engineering. “Data analytics” sounds neutral beside “surveillance.” “Personalization” flatters individuality while still sorting users into predictable categories. “Behavioral nudges” guide decisions without the sense of intrusion. We attach “social” as a favorable modifier to sciences, capital, and media, yet recoil when it meets “engineering.”</p><p> That discomfort is a clue. Engineering implies control, and control prompts us to ask who directs whom, toward what ends, and with whose permission.</p><p> Not all social engineering these days is hidden. Hackers don’t need to break a firewall if someone hands over their password. Romance scammers cultivate intimacy the way farmers cultivate crops. They succeed not through force but by exploiting trust. If even these obvious attacks work, the invisible kind, with roots in social engineering, are a shoo-in. </p><p>Most of the social engineering we encounter is proprietary and beyond our control. Firms build recommendation algorithms tuned to boost engagement and profit with no hearings or right of appeal. Browser and cookie defaults decide what data we surrender. A single autoplay toggle can cost users hours and build unhealthy habits. These are acts of engineering as deliberate as laying a road or redrawing an electoral district. They create a kind of curated itch by which boredom never settles, and satisfaction never arrives. The results are predictable—users click on targeted ads, make purchases, form habits, and lock in opinions. </p><p>Consent has transformed along with it. Once straightforward and revocable, it is now subtle and persistent, buried in defaults or opaque terms of service too quickly accepted. You remain free to opt out, much as you are free to refuse roads or electricity. Consent has become the preselected setting of modern life.</p><p>When social engineering operated more in the open, citizens could contest it, at least in societies with responsive government. Today’s invisible version diffuses accountability so thoroughly that scrutiny becomes hard to direct. Despite recent <a href="https://www.judiciary.senate.gov/committee-activity/hearings/social-media-and-the-teen-mental-health-crisis" rel="noopener noreferrer" target="_blank">congressional hearings</a> on social media’s impact on youth mental health and juries agreeing that <a href="https://spectrum.ieee.org/social-media-trial" target="_self">firms are knowingly designing algorithms that cause harm</a>, pinpointing responsibility remains elusive. When the mechanism is buried inside a system used by billions, we cannot easily point to a single decision-maker or trace the precise moment of manipulation. </p><p>Today’s social engineering is less overt and theatrical than its predecessors. Earlier versions arrived on public posters and loudspeakers for mass audiences. Today’s version is more intimate, delivered through personal devices and constant feeds tailored to the individual. The model succeeds because participation feels like freedom, not control. </p><p>Not all social engineering is dystopian. Well-kept parks foster community, accessible buildings extend dignity, vaccines and seatbelts save lives. Even in the digital realm, positive examples exist: browser extensions that automatically block hidden trackers, search engines that refuse to build personalized surveillance profiles, and decentralized social platforms that give users greater control over their own data and feeds. </p><p> The term “social engineering” still unsettles, though. But “asocial” engineering, which ignores human consequences entirely, is worse. Recognition of the human dimension to engineering is the beginning of repair. Only by seeing the machinery clearly and naming it honestly can we decide who engineers what and why. The machinery will not dismantle itself. Once named, it becomes subject to choice. That negotiation of purpose, power, and process are the defining political questions of any real democracy. We cannot ensure that social engineering serves and sustains society so long as we dodge the words.</p> Reference: https://ift.tt/D0ywnal

US's big bet on quantum computing may not be entirely legal


<p>Last week, the US government announced <a href="https://arstechnica.com/gadgets/2026/05/us-government-takes-2-billion-equity-stake-in-nine-quantum-computing-firms/">$2 billion in investments</a> in quantum computing companies, allocating $100 million each to a range of startups in exchange for equity in the companies. Those could be make-or-break investments for many companies that are likely years away from a product that could see widespread use. But a member of the US Congress is now arguing that those deals are illegal, as Congress did not allocate the money for this purpose—instead, it was meant to support public research in semiconductors.</p> <p>But the biggest chunk of money would go to a company that likely wouldn't exist if it weren't for the government's backing. Anderon will be set up with a billion dollars each from IBM and the government and will inherit personnel and IP from IBM. It will serve as a foundry for fabricating quantum processing units and will contract its services out to IBM and any other company that wants access to cutting-edge hardware.</p> <h2>Is any of this legal?</h2> <p>Zoe Lofgren (D–Calif.), the ranking member of the House Science, Space, and Technology Committee, <a href="https://lofgren.house.gov/media/press-releases/ranking-member-lofgren-calls-out-trump-admin-illegal-use-chips-and-science">made it clear</a> that she is not happy with how the government is using its money to support this technology.</p><p><a href="https://arstechnica.com/tech-policy/2026/05/uss-big-bet-on-quantum-computing-may-not-be-entirely-legal/">Read full article</a></p> <p><a href="https://arstechnica.com/tech-policy/2026/05/uss-big-bet-on-quantum-computing-may-not-be-entirely-legal/#comments">Comments</a></p> Reference : https://ift.tt/5FdTg79

AI with Model-Based Design: Virtual Sensor Modeling


<img src="https://spectrum.ieee.org/media-library/mathworks-logo-with-3d-wave-symbol-and-text-mathworks.png?id=26851519&width=980"/><br/><br/><p>This webinar presents a workflow offering end-to-end solutions for designing, training, validating and verifying, compressing, and deploying AI-based virtual sensor models to embedded processors within a single environment.</p><p><strong>Highlights</strong></p><ul><li>Integrate AI models into Simulink for system-level simulation, verification, and simulation-based testing</li><li>Apply formal verification techniques to assert neural network behavior</li><li>Compress the AI model for memory footprint reduction and execution speedup</li><li>Generate library-free C code from AI models and performing PIL tests</li><li>Profile code performance and evaluate design and model selection tradeoffs</li><li>Design and train AI-based virtual sensors using MATLAB</li></ul><div><span><a href="https://content.knowledgehub.wiley.com/ai-with-model-based-design-virtual-sensor-modeling/" target="_blank">Register now for this free webinar!</a></span></div> Reference: https://ift.tt/76cHAQ5

Friday, May 22, 2026

Texas AG sues Meta over claims that WhatsApp doesn't provide end-to-end encryption


<p>The Texas Attorney General has sued Meta over allegations that the company’s WhatsApp messenger, used by more than 3 billion people, doesn’t provide the end-to-end encryption (E2EE) it has long claimed.</p> <p>Since at least 2016, Meta (then named Facebook) has said WhatsApp provides robust end-to-end encryption, meaning that messages are encrypted on a sender’s device with keys that are available only to the receiver's. By definition, E2EE means that no one else—including the platform itself—can read the plaintext messages.</p> <p>In sworn testimony before two US Senate committees in 2018, CEO Mark Zuckerberg <a href="https://www.congress.gov/event/115th-congress/senate-event/LC64510/text">said</a> Meta does “not see any of the content in WhatsApp; it is fully encrypted” and that “Facebook systems do not see the content of messages being transferred over WhatsApp.” The engine for this E2EE is the Signal protocol, an open source code base that multiple third-party experts have said lives up to its promises.</p><p><a href="https://arstechnica.com/security/2026/05/texas-ag-sues-meta-over-claims-that-whatsapp-doesnt-provide-end-to-end-encryption/">Read full article</a></p> <p><a href="https://arstechnica.com/security/2026/05/texas-ag-sues-meta-over-claims-that-whatsapp-doesnt-provide-end-to-end-encryption/#comments">Comments</a></p> Reference : https://ift.tt/ip0TYqc

South Africa Has AI Leverage. Its Draft Policy Leaves It Unused

<img src="https://spectrum.ieee.org/media-library/aerial-view-of-an-industrial-mining-complex-with-reddish-brown-processing-facilit...