Kategorie

OpenAI said internal models hacked two more websites, bypassed company-imposed browsing restrictions, and used exposed credentials to draw cryptocurrency from a wallet it couldn’t otherwise access, in the latest installment of disclosures of its agents performing unethical and likely illegal acts.

The company on Thursday issued reports of four new incidents, all of which occurred in June. They come after the company revealed in July that internal test agents exploited a zero-day vulnerability in a tool designed to restrict their access to the Internet. They then broke into the network of AI tool provider Hugging Face. The agents took that illegal action to steal answers to a hacking test that weren’t available when completing the tasks on their own. The incident—which likely would have resulted in criminal charges had they been performed directly by a person—has further heightened concerns that widespread AI use could have harmful effects on an unprecedented scale.

Easier to beg for forgiveness than ask permission

In two of the cases reported Thursday, OpenAI agents tasked with retrieving information from websites hacked them when the models ran into obstacles obtaining it directly. In one incident during reinforcement training, a model that received access denials when trying to retrieve historical hospital-bed statistics on a government statistics website “used the site's file-download feature to retrieve server configuration and application files, including sensitive credentials,” OpenAI said. “It inspected the application code, bypassed the statistics endpoint's authorization checks, and retrieved data that had previously been denied. The model saved the data locally.”

Read full article

Comments

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]

Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web. Two were publicly disclosed before release, in the .NET Framework and the MessagePack-CSharp library. Separately, on 25 September Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August. Readiness recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server. The Readiness team has published an infographic summarising deployment risk by product family.

Known issues

On 14 October, Microsoft added a known issue to this month’s Windows 11 updates, KB5127648 for versions 24H2, 25H2 and 26H2, and KB5127646 for 26H1. Non-admin users might be unable to open Remote Desktop connections to devices that have Administrator protection enabled, with error 0xC000000D. The issue started with September’s non-security preview update. The Windows 11 security baselines enable Administrator protection by default, so test remote access to managed hosts before broad deployment. Microsoft’s mitigation is to turn off Administrator protection temporarily through your policy management tool, and a fix will follow in a future update.

Two issues remain open:

• Some USB Audio Class 1.0 devices might fail to start or produce no sound. The 14 September out-of-band update resolved part of this, and for the remaining symptoms Microsoft directs IT administrators to Microsoft Support for Business.
• Windows Server Update Services still does not display synchronisation error details on Server 2025 and Server 2022. Microsoft removed the function to address CVE-2025-59287 and offers no workaround.

And three are now closed:

• The incorrect “Microsoft Defender Antivirus is turned off” notifications, still open when we published in September, were fixed by Defender Antivirus update 4.18.26080.4, released on 17 September.
• On Windows 11, the October update fixes Explorer failing to start after sign-in on multi-user systems such as Azure Virtual Desktop with FSLogix, which left users at a black screen.
• On Windows 10, Windows 11 23H2 and Server 2016 and 2019, it fixes File History failing to back up or restore and showing a false “Reconnect your drive” message.

Major revisions and mitigations

Between the September and October releases, from 9 September to 12 October, Microsoft’s Security Update Guide notifications covered 111 entries for Microsoft’s own products, not counting Chromium republications for Edge. Of those 111, 90 are true revisions rather than new entries. September’s window had one.

• On 17 September, 84 of September’s CVEs gained Office for Mac updates. Each revision note tells customers running affected Mac software to “install the update for their product to be protected”.
• On 16 September, Microsoft corrected the scoring of three critical SQL Server remote code execution flaws from September, CVE-2026-67378, CVE-2026-67631 and CVE-2026-67643. The scores now record that “an attacker does not require any privileges”. Microsoft calls this an informational change.
• On 25 September, Microsoft revised CVE-2026-65660, a SharePoint Server remote code execution flaw fixed in August, to state that it “had reliable evidence of observed attacks against exploitation of this vulnerability”. CISA added it to its list of known exploited vulnerabilities the same day. The Security Update Guide still shows “Exploited: No” for this CVE, so a report filtered on that flag will miss it. If any SharePoint server lacks the August update, install it now.
• Of the 21 new entries, 18 are critical cloud-side flaws in Azure, Microsoft 365 Copilot, Dataverse and Fabric, all marked “Customer action required: No”. Two are Edge flaws, and one is CVE-2026-96940 in Exchange Server, published on 2 October and covered below.

Microsoft has published no mitigations and no workarounds in the October release.

Windows lifecycle and enforcement updates

These support milestones passed with this release on 13 October, as scheduled:

• Office 2021 retail and Office LTSC 2021, including Skype for Business LTSC 2021, reached the end of support.
• Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 reached the end of extended support.
• Extended Security Updates for Windows Server 2012 and 2012 R2 ended. Year three was the last, so the October update is the final one for both.
• Windows 11 Home and Pro version 24H2 reached the end of updates.
• Windows Server 2022 moved to extended support, which runs to 14 October 2031.

The next milestones fall on 10 November 2026, the date of November’s Patch Tuesday. .NET 8 and .NET 9 reach the end of support, as do PowerShell 7.4 and 7.5. Windows 11 Enterprise and Education 23H2, and IoT Enterprise 23H2, reach the end of updates, and Microsoft says November’s update “will be the last update available for these editions”.

Microsoft also starts or tightens several enforcement changes with this release:

• Windows 11 24H2, 25H2 and 26H2, and Windows Server 2025, now restrict NTLMv1-derived credentials for single sign-on by default. Where Credential Guard is off, Microsoft warns this “might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication” (KB5066470).
• AD FS Distributed Key Manager container permissions move into enforcement mode. Supported servers remediate automatically, but Server 2012 and 2012 R2 need manual remediation (KB5121391).
• ReFS volumes on removable media enter an audit phase, and blocking is enabled by default from the January 2027 update (KB5130741).
• The Windows Production PCA 2011 Secure Boot certificate, used to sign the Windows boot loader, expires on 19 October. Devices without its replacement, Windows UEFI CA 2023, keep starting and updating normally, but they stop receiving new early-boot protections (KB5062710).

Microsoft’s test guidance for this release runs to 496 Windows entries, 41 of them flagged as high risk, against 466 and 55 in September. Printing, scanning and font rendering account for 31 of the 41. The Readiness team recommends these testing priorities:

• Printing. Print documents with mixed fonts from 32-bit and 64-bit applications to physical and virtual printers. Add network printers by discovery and by IP address, and print through a shared print server, a USB printer and a PostScript driver.
• Downloaded files. The exploited Shell flaw bypasses Mark of the Web, so open files and shortcuts downloaded from the internet and confirm the SmartScreen and security warnings still appear.
• Remote access. Test Remote Desktop with a non-admin account against hosts that have Administrator protection enabled, and test Wi-Fi and VPN connections that use MS-CHAPv2.
• Application installs. Install, repair and uninstall a representative set of MSI packages, including packages with script custom actions. Windows Installer takes 38 fixes this month.
• Network servers. Run DNS servers (52 fixes) and DHCP servers (18) under load, and confirm leases, zone transfers and conditional forwarders behave as before.

Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.

Browsers

For the third month in a row, Microsoft’s Patch Tuesday release lists no browser CVEs. Edge security fixes arrived between releases instead. Between 9 September and 12 October, Microsoft published 414 CVEs for Microsoft Edge in the Security Update Guide: 409 republished from Chromium and five specific to Edge. None carries an exploited flag, and no Edge release in that period reported an exploit in the wild.

Microsoft Windows

Windows takes 1,122 CVEs this month, 42 of them critical. Elevation of privilege accounts for 617 entries, information disclosure for 200 and remote code execution for 179. Of the 42 critical entries, 31 are remote code execution, nine are elevation of privilege and two are spoofing.

• The exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web defences. An attacker must convince a user to open a crafted file or follow a link. CISA added it to its list of known exploited vulnerabilities on 13 October, with a remediation date of 16 October.
• DHCP takes 18 fixes, six of them critical remote code execution: five in DHCP Server and one in the DHCP client. DNS Server takes 52, 10 of them remote code execution, though none is critical. Critical remote code execution also affects Hyper-V, Message Queuing, Microsoft QUIC, the Remote Desktop Gateway, Windows Deployment Services, Active Directory Domain Services, NDES and the multicast transport driver.
• In file and image handling, the Raw Image Extension has three critical fixes, one of them a CVE assigned by Cisco Talos, and the PostScript printer driver takes three more. Text shaping takes two, and Media Foundation, the codecs library, the video decoder, GDI+, the graphics component and the Windows PDF component take one each.
• The virtualisation-based security enclave takes eight fixes, five of them critical elevation of privilege.
• The most-patched areas are DNS Server at 52, Win32k at 48, the Windows Kernel at 46 and Windows Installer at 38.

Add this Windows update to your Patch Now schedule. Every client needs the fix for the exploited Shell flaw, and DHCP servers and Hyper-V hosts need the critical server-side fixes.

Microsoft Office

Microsoft released 180 Office CVEs this month, 26 of them critical, and remote code execution accounts for 107.

• Client updates on Windows are Click-to-Run only, for Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Office for Mac updates ship in the same release this month, rather than nine days later as they did in September. Excel takes 69 fixes, 11 of them critical. Word takes 22, Access 13, Outlook 10 with five critical, PowerPoint nine with four critical, and Visio three, all critical.
• SharePoint Server Subscription Edition takes 34 CVEs in KB5002927, two of them critical. SharePoint Server 2016 and 2019 left extended support on 14 July 2026, and two of this month’s flaws list them as affected with no update: CVE-2026-69943 for both versions and CVE-2026-97783 for 2019.
• Office Online Server takes 43 CVEs in KB5002928. Skype for Business Server takes three, in KB5132779 for 2015 CU13, KB5131693 for 2019 CU8 and KB5131692 for Subscription Edition CU1.

Add these updates to your Patch Now schedule, because 25 of the 26 critical entries affect Excel, Outlook, PowerPoint, Visio and Word.

Microsoft Exchange and SQL Server

Exchange has one critical entry this month and SQL Server has none.

• Exchange Server has seven CVEs across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition: one critical remote code execution, CVE-2026-70571, five elevations of privilege and one spoofing flaw. Six are fixed by the 13 October updates: KB5128895 for Subscription Edition, KB5128896 for 2019 CU15, KB5128897 for 2019 CU14 and KB5128898 for 2016 CU23.
• The seventh, CVE-2026-96940, was published on 2 October. Microsoft lists it against a separate set of updates released that day, KB5129955 to KB5129958, not against the 13 October updates, so confirm both sets are installed. Microsoft rates both CVE-2026-96940 and the critical entry as “Exploitation More Likely”..
• SQL Server has 22 CVEs, none of them critical: eight remote code execution, seven elevation of privilege, four information disclosure and three denials of service. Each supported branch gets a cumulative update and a GDR: 2025 (KB5126967, KB5128492), 2022 (KB5126934, KB5128493), 2019 (KB5128494, KB5128495) and 2017 (KB5128496, KB5128497).

Exchange goes on the Patch Now list. SQL Server goes on the Schedule list because none of its 22 entries is critical. If September’s SQL Server update is still outstanding, install it first.

Microsoft Developer Tools

Microsoft released 66 CVEs across its developer tooling this month: two critical, 63 important and one moderate. Remote code execution accounts for 18 entries and elevation of privilege for 13.

• Both critical entries also affect Windows. CVE-2026-105016 is a remote code execution flaw in Microsoft QUIC that needs no authentication or user interaction, and it affects .NET 8, 9, 10 and 11 on Windows and Visual Studio 2022 and 2026. CVE-2026-96222 is an AD FS certificate validation flaw that Microsoft lists against both the .NET Framework and Windows Server.
• Two entries were publicly disclosed before release. CVE-2026-108398 in the .NET Framework lets an authenticated attacker bypass Windows Defender Application Control. CVE-2026-92707, a denial-of-service vulnerability in the MessagePack-CSharp library assigned by GitHub, affects Visual Studio and the ASP.NET Core SignalR MessagePack protocol.
• Visual Studio Code has 10 fixes, five of them security feature bypasses, and PowerShell 7.4, 7.5 and 7.6 take two.

Add these updates to your Patch Now schedule, starting with the .NET updates that carry the QUIC fix.

Adobe (and third-party updates)

Adobe published 11 security bulletins on 13 October, covering 175 CVEs across ColdFusion, Experience Manager, Commerce, Photoshop, Bridge, FrameMaker, Dimension, the Substance 3D tools and the Content Credentials SDK. None is rated priority 1, and Adobe is not aware of exploits for any of them. No Acrobat or Reader security update for this month. I mentioned last month that we are in for a few months of extraordinary patch releases. Harking back to 2003 (when I started work on the nascent field of Microsoft patch management), with Microsoft releasing just  51 updates, anything over a 1000, much less 1400 CVE entries would have been unimaginable. I don’t think that we are at a “patch maximum” yet — but I hope that things calm down soon.

Long before Taco Tuesday became part of the pop-culture vernacular, Tuesdays were synonymous with security — and for anyone in the tech world, they still are.  Patch Tuesday, as you most likely know, refers to the day each month when Microsoft releases security updates and patches for its software products — everything from Windows to Office to SQL Server, developer tools to browsers.

The practice, which happens on the second Tuesday of the month, was initiated to streamline the patch distribution process and make it easier for users and IT system administrators to manage updates. Like tacos, Patch Tuesday is here to stay.

Patch Tuesday coverage has long been a staple of Computerworld’s commitment to provide critical information to the IT industry. That’s why we’ve gathered together this collection of recent patches, a rolling list we’ll keep updated each month.

In case you missed a recent Patch Tuesday announcement, here are the latest six months of updates.

October Patch Tuesday: 1,408 CVEs, 1 exploited flaw and a SharePoint surprise

Microsoft just shipped 1,408 vulnerabilities in one month, and a SharePoint flaw it marked “not exploited” is actually under attack right now. Our expert recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server.

Get more info on the October 2026 Microsoft security updates.

September Patch Tuesday: 963 CVEs, 2 exploited flaws, 1 message

September’s Patch Tuesday is Microsoft’s biggest of 2026, with 963 CVEs, two exploited flaws and a clear message: prioritize Windows, Office and SQL Server.

Two vulnerabilities are already exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call. Nothing in this release was publicly disclosed ahead of the patch. Readiness recommends a Patch Now scheduling for Windows, Office, SQL Server and the developer tooling, and standard patch release for Exchange.

Get more info on the September 2026 Microsoft security updates.

August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw

Microsoft’s August 2026 Patch Tuesday closes at 751 CVE entries (across all product families), with 108 rated as critical. One flaw is already exploited, CVE-2026-68820, an elevation of privilege in the Windows WinSock driver (afd.sys). Two more were disclosed but not exploited.

This security-only release earns Patch Now for Windows, Office and Exchange; no SQL Server updates this month. Unfortunately, several critical issues affect server roles: Windows DNS Server carries a cluster of critical RCEs; Windows DHCP Server is the most-populated Microsoft product family at 14 entries. Testing should lead with printing and fonts and the Remote Desktop client, then a WinSock smoke test given the exploited afd.sys flaw.

Get more info on the August 2026 Microsoft security updates.

July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave

Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.

The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today.

More info is available here on Microsoft Security updates for July 2026.

For June, Patch Tuesday means an IT scramble

Microsoft this month released 206 updates affecting Windows, Office, Exchange Server, and its developer tools — including three Windows vulnerabilities already publicly disclosed. That trio includes an elevation of privilege in the Collaborative Translation Framework (CVE-2026-45586), a denial of service in HTTP.sys (CVE-2026-49160), and a BitLocker security feature bypass (CVE-2026-50507). At the moment, none appear to be under active exploitation, but all three are rated “Exploitation More Likely.” 

Even without an exploited zero-day, the June 2026 Patch Tuesday release requires Patch Now recommendations for Windows, Office, and Exchange. The latter is back in the patch picture with a consolidated security update that Microsoft recommends installing “as soon as possible.”

More info is available here on Microsoft Security updates for June 2026.

For May, Patch Tuesday means 139 updates — but no zero-days

Microsoft this month released 139 updates affecting Windows, Office, .NET, and SQL Server (though there were no updates for Microsoft Exchange Server). Despite the absence of zero-days, the May Patch Tuesday update still requires Patch Now recommendations for Windows and Office. 

The combination of three unauthenticated network RCEs (Netlogon, DNS Client, and SSO Plugin for Jira and Confluence), four Word Preview Pane RCEs, the large TCP/IP vulnerability cluster, and the carry-over BitLocker recovery condition (still active on Windows 10 and Windows Server) warrants an accelerated deployment release schedule. 

More info is available here on Microsoft Security updates for May 2026.

Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat AnalysisSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Investors are pouring more into AI data center infrastructure than they can hope to recoup by 2030, according to Gartner.

“Enterprise and consumer AI revenue will be insufficient to support profitable returns on all planned AI capital expenditures during this period,” said Gartner Senior Director Analyst Will Sommer.

AI data center owners would need to generate $8.5 trillion in revenue through 2030 to cover announced capital spending, financing costs and expected investment returns, he said. “However, total enterprise and consumer AI revenue that can be attributed to AI data centers during this period is forecast to reach no more than $3.6 trillion.”

Gartner joins a growing chorus warning that major AI players may be over-committing themselves. Bain and Co. recently made a similar forecast, estimating that annual spending on AI infrastructure could reach $1.5 trillion by 2031 and that the AI services market would need to top $6 trillion annually to pay for it.

This is particularly bad news for neocloud providers, said Gartner. While the hyperscalers are large enough to absorb the financial pressures, the research company suggests that the cost pressure will force more than 80% of neocloud providers to cease independent operations.​

The Bain and Gartner surveys don’t cover quite the same ground, but their conclusions are very similar: a lot of AI infrastructure investment is never going to make a return, and companies need to prepare themselves for some degree of financial loss.

This article first appeared on Network World.

<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-parent:"";
margin:0cm;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-fareast-font-family:Aptos;
mso-bidi-font-family:"Times New Roman";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
mso-themecolor:hyperlink;
text-decoration:underline;
text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-noshow:yes;
mso-style-priority:99;
color:#96607D;
mso-themecolor:followedhyperlink;
text-decoration:underline;
text-underline:single;}
.MsoChpDefault
{mso-style-type:export-only;
mso-default-props:yes;
font-size:10.0pt;
mso-ansi-font-size:10.0pt;
mso-bidi-font-size:10.0pt;
font-family:"Aptos",sans-serif;
mso-ascii-font-family:Aptos;
mso-fareast-font-family:Aptos;
mso-hansi-font-family:Aptos;
mso-font-kerning:0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;
mso-header-margin:36.0pt;
mso-footer-margin:36.0pt;
mso-paper-source:0;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:120657373;
mso-list-type:hybrid;
mso-list-template-ids:108417694 134807553 134807555 134807557 134807553 134807555 134807557 134807553 134807555 134807557;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}

-->
Welcome to the week Apple became even more serious about artificial intelligence on Macs, with the company continuing to make moves to deliver the tech in the most cost effective, responsible way. While it’s true that today isiPhone Duo pre-order day, that’s arguably not really the big news. It is not the big news because Apple this week made huge steps in AI. Not only has it come up with a nifty tool to turn Macs into distributed inferencing data centers; not only does it now have a plan for Apple Intelligence in China; but it has also worked with Meta to make it possible to run on-premises instances of Muse Spark Open on a couple of Mac Studios. While working on that, its machine learning team also introduced a new version of MLX that enables AI researchers and developers to run large language models (LLMs) locally on Mac Studio with Apple silicon. What’s new to MLX from Apple?In case you’d missed it, MLX leverages the unified memory architecture of Apple silicon, which is invaluable if you want to build new inference and fine-tuning methods. Over the past year, the ML team has worked on “several key innovations” to make it easier and more efficient to “run state-of-the-art LLMs locally on recent Apple silicon.” These improvements include:

Software support for the Neural Accelerators in the GPU of the M5 family of chips, Low-latency communication across several Macs using Remote Direct Memory Access (RDMA) over Thunderbolt.Efficient implementations of recent popular architectures such as mixture of experts (MoE). 

The release leans heavily into what Apple’s teams have been doing with Muse, and once again demonstrates how the very architecture of Apple silicon supports AI inferencing. That’s no surprise to anybody at this point as not only have I been banging on that drum regularly, but almost anyone who is anyone in AI development and research already works on a Mac.LLM Inference with MLX and RDMA on Mac StudioA new white paper from Apple’s machine learning team shares what it has been doing with MLX as well as significant statistics concerning how well its systems support Muse Spark Open. “On a cluster of four Mac Studios, Muse Spark Open generates over 36 tokens per second, well above average human reading speed,” they said. That’s impressive. It means for the cost of four Mac Studios a business can run a full-strength, frontier class model with almost a trillion parameters, on-premises, securing company data while extracting whatever benefits there are to be extracted from the use of it.Mac Meta mattersApple and Meta collaborated on making it possible to run Muse Spark Open AI models on Macs. It’s a shrewd move for both companies, given the growing desire to run powerful AI models locally rather than in the cloud. As a result of this work the collaboration has made it possible to use Muse Spark Open on two or four Mac Studios to engage in all kinds of agentic tasks. Commenting on this on X, new Apple CEO, John Ternus wrote:  “Amazing to run a model of Muse Spark Open’s caliber and scale this efficiently, right from your desk. Mac Studio keeps pushing the boundaries of on-device AI!” Meta’s AI chief, Alexandr Wang pointed out that this is in part made possible by Apple’s Unified Memory architecture, which can provide sufficient memory to run these models.Your Macs. Your supercomputer“Apple’s unified memory architecture lets the M5 Ultra's integrated GPU use up to 512 GB per Mac Studio, so two machines can hold an entire model,” Meta explained. “And the chip’s 1.2 TB/s of memory bandwidth is fast enough to read the small slice each token needs. The result is two Mac Studios behave like one supercomputer with a terabyte of unified memory.”Meta says it tested the system using agentic workflows running entirely on-device, including applying bug fixes and new features to an open source Mastodon client and driving DaVinci Resolve to review footage and transact tasks. The use of DaVinci Resolve makes this commentator curious, given Apple is expected to introduce new pro Macs this month. The idea that you may be able to run tasks like this on other Macs will surely be something Apple’s developers are thinking about.One more thingStep by step Apple is defining the playground for AI. In doing so it is attempting, as Apple’s VP Worldwide Marketing told TIME, not to make AI for “the lunatic fringe”, but to create an ecosystem for artificial intelligence that will actually help people — a strategic approach that, if it comes together, will help maintain Apple’s position at the intersection of computing and the liberal arts. Read my Mac Studio review here.Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.Welcome to the week Apple showed us how serious it really is about artificial intelligence on Macs, with the company making more moves to deliver the tech in the most cost effective, responsible way. While it’s true that today is iPhone Duo pre-order day, that’s arguably not the big news. 

It is not the big news because Apple this week made huge steps in AI. Not only have its researchers come up with a nifty tool to turn Macs into distributed inferencing data centers, not only does the company now have a plan for Apple Intelligence in China, but it has also worked with Meta to make it possible to run on-premises instances of Muse Spark Open on a couple of Mac Studios. Its machine learning team also introduced a new version of MLX that enables AI researchers and developers to run large language models (LLMs) locally on Mac Studio with Apple silicon. 

What’s new to MLX from Apple?

In case you’d missed it, MLX leverages the unified memory architecture of Apple silicon, which is invaluable if you want to build new inference and fine-tuning methods. Over the past year, the ML team has worked on “several key innovations” to make it easier and more efficient to “run state-of-the-art LLMs locally on recent Apple silicon.”

These improvements include:

• Software support for the Neural Accelerators in the GPU of the M5 family of chips
• Low-latency communication across several Macs using Remote Direct Memory Access (RDMA) over Thunderbolt
• Efficient implementations of recent popular architectures such as mixture of experts (MoE)

The release leans heavily into what Apple’s teams have been doing with Muse, and once again demonstrates how the very architecture of Apple silicon supports AI inferencing. That’s no surprise to anybody at this point: not only have I been banging on that drum regularly, but almost anyone who is anyone in AI development and research already works on a Mac.

LLM inference with MLX on Mac Studio

A new white paper from Apple’s machine learning team shares what it has been doing with MLX, along with significant statistics concerning how well its systems support Muse Spark Open, Meta’s new open-weight frontier model. 

“On a cluster of four Mac Studios, Muse Spark Open generates over 36 tokens per second, well above average human reading speed,” they said. 

That’s impressive. It means for the cost of four Mac Studios, a business can run a full-strength, frontier-class model with almost a trillion parameters, on-premises, securing company data while extracting whatever benefits there are to be extracted from the use of it.

Mac Meta matters

Apple and Meta collaborated on making it possible to run Muse Spark Open AI models on Macs. It’s a shrewd move for both companies, given the growing desire to run powerful AI models locally rather than in the cloud. As a result of this work, it’s possible to use Muse Spark Open on two or four Mac Studios to engage in all kinds of agentic tasks. 

Commenting on this on X, new Apple CEO John Ternus wrote: “Amazing to run a model of Muse Spark Open’s caliber and scale this efficiently, right from your desk. Mac Studio keeps pushing the boundaries of on-device AI!” 

Meta’s AI chief Alexandr Wang pointed out that this is in part made possible by Apple’s Unified Memory architecture, which can provide sufficient memory to run these models.

Your Macs. Your supercomputer

“Apple’s unified memory architecture lets the M5 Ultra’s integrated GPU use up to 512 GB per Mac Studio, so two machines can hold an entire model,” Meta explained. “And the chip’s 1.2 TB/s of memory bandwidth is fast enough to read the small slice each token needs. The result is two Mac Studios behave like one supercomputer with a terabyte of unified memory.”

Meta says it tested the system using agentic workflows running entirely on-device, including applying bug fixes and new features to an open-source Mastodon client and driving DaVinci Resolve to review footage and transact tasks. The use of DaVinci Resolve makes this commentator curious, given that Apple is expected to introduce new pro Macs this month. The idea that you may be able to run tasks like this on other Macs will surely be something Apple’s developers are thinking about.

One more thing

Step by step, Apple is defining the playground for AI. In doing so it is attempting, as Greg Joswiak, Apple’s senior VP of worldwide marketing, told TIME, not to make AI for “the lunatic fringe,” but to create an ecosystem for artificial intelligence that will actually help people — a strategic approach that, if it comes together, will help maintain Apple’s position at the intersection of computing and the liberal arts.

(Read my Mac Studio review here.)

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it.

Researchers at Xbow USA worked for six days on developing the exploit, which earned them a $250,000 bug bounty from Google, the first under the new 2026 rules.

They chose OpenAI’s GPT-5.6 Sol for the task to demonstrate what’s possible with a publicly available model rather than a specialist security implementation. They used it to search Chrome’s source code, test ideas, and build proofs of concept, while they set the strategy, chose where to look, and checked its work.

They successfully chained together a vulnerability to escape first from the sandbox containing the V8 JavaScript engine and then from Chrome’s operating-system process sandbox, launching a Windows app from within a malicious web page.

Xbow presented its findings to Google, which fixed the flaws. The researchers set out all the details as to how the exploit was developed in a blog.

OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. [...]

Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]

NVIDIA officially entered the Windows PC race this week, and its arrival brings a formidable new competitor to the premium AI PC market. With its RTX Spark platform, NVIDIA is bringing its Grace Arm CPU architecture, Blackwell GPU technology and extensive software ecosystem together in a new generation of Windows laptops. Microsoft’s Surface Laptop Ultra is among the first systems to showcase this collaboration, leveraging NVIDIA’s tech and putting it squarely in competition with Intel, AMD, Qualcomm and even Apple for high-performance local AI and creation-optimized laptops.

For Microsoft, the partnership expands the capabilities of Windows on Arm considerably, particularly for local AI development, content creation and other demanding professional workloads. Starting at $2,599.99, Surface Laptop Ultra is clearly a premium offering, but its combination of processing horsepower, large, unified memory capacity, and premium industrial design gives it an interesting position in the market.

My personal testing suggests NVIDIA and Microsoft have delivered a compelling platform with strong AI throughput, graphics performance and competitive CPU compute. Just as importantly, the Surface Laptop Ultra offers a glimpse of how AI development and local AI agent workflows could become more practical on a portable Windows PC.

NVIDIA RTX Spark brings Grace Blackwell to Windows on Arm

At the heart of Surface Laptop Ultra is NVIDIA’s RTX Spark N1X SoC, combining up to 20 Grace Arm CPU cores with a Blackwell GPU featuring up to 6,144 CUDA cores. Configurations support up to 128GB of unified memory, shared between CPU and GPU. The Surface Laptop Ultra model I tested has this full-fat configuration with an eye-watering $5,899.99 price tag (thanks, memory crunch), though there are lower-cost base configs as noted previously, offering an 18-core CPU with a 5,120-core GPU and 24GB of unified memory.

NVIDIA and Microsoft

Regardless, this architecture is particularly powerful for running on-device AI. Rather than being constrained by the dedicated graphics memory found in conventional laptops with discrete GPUs, RTX Spark can make a much larger pool of memory available to GPU-accelerated applications. This allows larger language models, longer context windows and demanding inference workloads to run locally. It’s similar in design to AMD’s Ryzen AI Max series, aka Strix Halo, in that regard, but with a more potent GPU engine on board.

NVIDIA’s CUDA ecosystem is another important advantage. Developers can leverage familiar tools including TensorRT, PyTorch and llama.cpp, with a base software foundation that also extends into NVIDIA-powered workstations and data center infrastructure.

For organizations building AI applications, this offers a solid development path. Models and workflows can be prototyped locally before moving to larger systems, reducing cloud compute and token expense while allowing sensitive data to remain on-device. (See: Around the corner: Agentic AI PCs that cut token costs.)

Microsoft has also optimized Windows 11 for RTX Spark, with improvements to workload scheduling, power management, memory allocation and application compatibility. These platform-level investments were essential to making NVIDIA’s Arm architecture practical for everyday Windows computing, and I was able to put some of them to the test in the few days I’ve had the machine on hand.

Surface Laptop Ultra: Premium design meets practical function

Microsoft has given RTX Spark an appropriately premium home with this machine. The Surface Laptop Ultra features a 15-inch PixelSense Ultra mini-LED touch display with up to 2,000 nits of claimed peak HDR brightness, a 120Hz refresh rate and excellent potential for creative work requiring high accuracy and wide gamut coverage.

Dave Altavilla

The machine’s aluminum chassis is less than 18 mm thick, and it weighs in at under 4.5 pounds. It’s not an ultraportable per se, but considering the horsepower on board, Microsoft has struck a reasonable balance between portability and performance.

The design is refreshingly understated, with clean lines and rigid aluminum construction. My initial hands-on impressions have been particularly positive, thanks to the keyboard’s tactile response, smooth and responsive haptic touchpad, and bright, high-contrast display.

The larger touchpad should be especially welcome for users navigating complex applications, while the touchscreen adds flexibility for reviewing documents, annotating designs, and interacting directly with creative content.

Connectivity options are also very good, relative to other premium laptops. Microsoft includes three USB-C ports, HDMI, USB-A, an SD card reader and a headphone jack. One USB-C connection features Microsoft’s new magnetic charging mechanism, combining the convenience and safety of a breakaway power connector with the versatility of a standard USB-C port.

Microsoft has also designed the cooling system with large fans and significant thermal capacity, while making the machine’s internal SSD removable and offering good internal serviceability in general. These are practical considerations for professional users and IT departments concerned with reliability, maintenance and long-term ownership.

Battery life and sustained performance under prolonged workloads are important aspects Microsoft focused on for the overall experience, particularly for a machine designed to deliver workstation-class capabilities away from a desk. More on this shortly.

Local AI agents: Moving from inference to action

RTX Spark also supports locally running autonomous AI agents, including one that I tested out called Hermes, which can execute multi-step workflows, access files and interact with applications. Its potential impact spans software development, research, document analysis, business automation and many other disciplines. Hermes provides the agent framework, while supported models leverage RTX Spark’s CUDA-accelerated inference and unified memory.

For businesses, local agents can keep sensitive data on-device and reduce cloud inference costs, provided they’re configured appropriately. However, granting agents access to files, code execution and corporate systems introduces security risks. Microsoft’s Execution Containers and NVIDIA’s OpenShell aim to provide isolation and access controls, though their effectiveness depends on proper enterprise policy implementation.

Hermes running Qwen3.8-27B locally on Surface Laptop Ultra, generating a benchmark report.

Dave Altavilla

To test this capability, I ran Hermes with the Qwen3.8-27B language model locally on the Surface Laptop Ultra. I asked it to extract benchmark charts from an Excel spreadsheet and create a formatted Word report with performance commentary. Hermes autonomously generated and executed Python scripts, processed the spreadsheet and assembled the document in approximately five minutes. Color me impressed.

That’s a respectable turnaround for a task requiring several manual steps. My results demonstrate how local AI agents can streamline reporting and analysis without cloud-hosted model inference. Human review remains essential, but this was a promising demonstration of practical, real-world agentic AI on a Windows laptop.

AI performance: Strong results as expected

My team’s preliminary AI benchmarks highlight the advantages of NVIDIA’s RTX Spark architecture. However, we’re still digging deeper into AI-enabled use cases and performance.

In UL Procyon’s AI Text Generation benchmark using Phi 3.5, a family of lightweight, open-source small language models (SLMs) released by Microsoft, the Surface Laptop Ultra scored 2,703, compared with 2,027 for Lenovo’s Intel Core Ultra X9 388H-powered IdeaPad Pro 5, an advantage of approximately 33%.

Dave Altavilla

The difference was even more substantial in MLPerf’s Flux 2 Klein 4B image generation workload, where the Surface Laptop Ultra delivered 26.97 images per minute versus 9.96 for the Lenovo machine, or roughly 2.7 times the throughput.

These results demonstrate the platform’s potential for accelerating local inference, image generation, agentic workflows and other AI workloads. Actual application performance will depend on model selection, software optimization and available system memory, though NVIDIA does provide a nice memory partitioning tool in the NVIDIA App for Windows.

Content creation, gaming and battery life: Blackwell’s versatility

RTX Spark’s Blackwell GPU delivers impressive graphics performance, extending the Surface Laptop Ultra’s capabilities beyond AI development and everyday creation or productivity tasks.

Dave Altavilla

In 3DMark Steel Nomad Lite, the Surface Laptop Ultra achieved 98.29 FPS, more than double the 46.07 FPS of Lenovo’s Core Ultra X9-powered IdeaPad Pro 5. In the ray-tracing-focused 3DMark Speed Way test, it delivered 30.31 FPS versus 19.72 FPS for the ASUS ROG Flow Z13, powered by AMD’s Ryzen AI Max+ 395 and Radeon 8060S graphics.

Dave Altavilla

Actual gaming performance was similarly strong. In Cyberpunk 2077, the Surface Laptop Ultra averaged 71.05 FPS, ahead of the ROG Flow Z13’s 63.76 FPS. However, the AMD system narrowly led in The Talos Principle 2, delivering 89.5 FPS versus the Surface’s 84.5 FPS at 1080p medium settings.

CPU performance for tasks like 3D rendering also holds up well. In Cinebench 2026, the Surface scored 6,787 in the multi-threaded test, edging out the AMD-powered ROG Flow Z13’s 6,546. Notably, the Surface retained 99% of its multi-threaded performance on battery power as well.

For creative professionals, native Arm applications including Blender, DaVinci Resolve and Adobe Photoshop offer opportunities to leverage RTX Spark’s potent GPU. However, Windows on Arm compatibility remains a consideration. Microsoft’s Prism translation supports many x86 applications, but specialized software, drivers and certain games (like EA anti-cheat-supported titles currently) may still encounter limitations.

Dave Altavilla

Battery endurance was respectable for the Surface Laptop Ultra, at 14 hours and 35 minutes in my PCMark video playback testing, though competing mainstream thin-and-light laptops lasted considerably longer. The Surface Laptop Ultra and RTX Spark operate within a different power envelope, however, more akin to a beefier gaming laptop, rather than a svelte 2 – 3-lb business machine.

Final thoughts: A serious new AI Windows PC competitor

The Surface Laptop Ultra marks an important milestone for NVIDIA’s expansion into Windows PCs and Microsoft’s ambitions for high-performance Arm-based computing.

My initial testing shows the RTX Spark-powered Surface Laptop Ultra delivers exceptionally strong AI acceleration, competitive multi-threaded CPU performance and impressive graphics horsepower. Combined with Microsoft’s premium industrial design, extensive connectivity and I/O options, and Windows platform integration, RTX Spark makes a convincing first impression.

Starting at $2,600, this is a specialized, premium system, and mainstream business users will find more economical alternatives to be sure. However, for developers (even vibe coders), creative professionals and organizations evaluating local AI workflows, the Surface Laptop Ultra offers a compelling combination of performance, beautiful industrial design, portability and local AI capability, especially with its higher-tier memory configurations.

NVIDIA has arrived in the Windows PC market with serious technology, and Microsoft’s Surface Laptop Ultra is an impressive first showcase of what this new partnership can deliver.

Due to the global memory shortage, 8 gigabytes has once again become the standard among computer manufacturers. Fortunately, Microsoft has spent the past few months optimizing Windows 11 for computers with limited RAM.

According to a post on the official Windows blog, the company has, among other things, improved background memory management. “Windows can now keep up to 2GB more of your active data in memory instead of moving it to slower storage, helping your PC stay responsive as you open more apps or browser tabs,” the post said.

Other improvements for PCs with 8GB of memory or less include ensuring that widgets only load when you open them, freeing up an additional 200MB of memory.

Microsoft says these changes make Windows 11 up to 20% more responsive than before.

According to The Verge, Microsoft has also improved the Windows Hello sign-in process and sped up Bluetooth pairings.

The AI boom is seeing one of its first major busts, as Character.ai has filed for Chapter 11 bankruptcy protection while it searches for a buyer.

Founded in 2021, Character.ai enables users to create customizable chatbots and interact with them, and by February 2025 claimed to have over 20 million monthly active users.

However, it failed to turn them into a profitable revenue stream, and has been losing $8 million a month, according to Reuters. The company estimated in its bankruptcy filing that it only had assets of between $50 million and $100 million, and liabilities in the same range, despite receiving investments totalling almost $200 million over the years, pushing its valuation to a peak of around $1 billion.

Character.ai told subscribers that during the bankruptcy proceedings their access to Character ai chatbots is unaffected, and they will continue to be charged for the service.

To keep its chatbots chatting, the company has granted Disney a non-exclusive license to its technology for $20 million as part of the bankruptcy proceedings, a so-called stalking-horse deal that sets a benchmark for other bids.

Character.ai’s troubles haven’t just been economic: It has faced several legal challenges over the psychological effects of its service on users. In January, the Kentucky Attorney General claimed that Character ai chatbots preyed on children. In May, the state of Pennsylvania sued the company over a chatbot that claimed to be a licensed psychiatrist and said it aimed to “stop the company from misrepresenting its AI companion bots as licensed medical professionals who can provide medical advice.” And in 2025, the company settled out of court with a mother who claimed that a Character ai chatbot had led to her son dying by suicide.

These challenges have taken their toll on the company. “Character.ai has taken meaningful steps to sustain and improve its business in the face of significant legal, regulatory, and operational headwinds. After a comprehensive review of the available alternatives, the board determined that this court-supervised sale process provides the Company with the best opportunity to maximize value for all stakeholders,” said Colin Adams, CEO of Character.ai.

In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are [email protected]

Widgets, widgets, widgets. Has there ever been an Android feature so full of promise that went unloved by Google for so very long?

Okay, so maybe there has been — erm, lots of times, actually. But even so, Android’s widgets system is a perfect example of an exceptional advantage that Google basically buried, abandoned, and left on the brink of extinction up until its overdue revival in 2021’s Android 12 update. (And that revival, by the way, happened for no apparent reason whatsoever. Just a totally random, unprompted change of heart after a decade of indifference. Riiiiiiiiight.)

Google may have given up on widgets for a while, but the good news is that (a) they’re back, baby — still now, more than ever, even in our overly AI-obsessed 2026 timeline — and (b) the Android developer community keeps chuggin’ along and coming up with ever-more creative new ways to embrace widgets beyond what Google itself sees fit to give us. That means no matter what Android version your favorite phone is running, you can step up your own Android widget game and give yourself some fresh and fruitful paths to make the most of your phone’s framework.

Here, my dear, are some fantastic beyond-the-basics ways to put your favorite Android widgets to use and change the way you get stuff done on your phone. 

[Psst: Love learning new things? Get my free Android Intelligence newsletter to get a tasty new tip in your inbox every Friday.]

Android widget enhancement #1: The on-demand home screen pop-up

Widgets are a wonderful way to interact with all sorts of info without ever having to open up apps, but having too many widgets can quickly lead to a cluttered and overwhelming home screen.

Well, here’s a neat way to give yourself the benefit of a widget while still maintaining a neat and minimal space for working: An excellent app called Popup Widget lets you create an on-demand pop-up widget (get it?!) that looks like a regular ol’ icon on your home screen but then loads any widget you want when tapped.

See?

Any widget, anytime — with Popup Widget on Android.

JR Raphael, Foundry

You can even get really wild and set up a single icon that opens multiple widgets at the same time — like your inbox and your calendar together:

Popup Widget can even let you summon two widgets together with a single tap.

JR Raphael, Foundry

Not bad, right?

Popup Widget costs two bucks and doesn’t require any special permissions or manners of access. And it’s pretty simple and self-explanatory to set up: Once you install and open the app, it’ll walk you through adding in whatever pop-up widgets you want. You can choose the name and even the icon associated with each one along with its precise placement on your screen and how much the screen behind it should dim when it’s loaded.

The app will offer to add the shortcut directly onto your home screen for you then, or you can also find all of your Popup Widget creations by pressing and holding the main Popup Widget icon in your app drawer.

Alternatively, if you’re already using a custom Android launcher like Smart Launcher or Niagara, you can find similar options for summoning widgets on demand within their settings — no separate apps even required.

And that, my widget-loving wallaby, is but our first winning widget possibility.

Android widget enhancement #2: The on-demand universal pop-up

If you like the idea of having a widget on demand but would rather have it be available to summon from anywhere instead of just from your home screen, this next wacky widget option is just the thing for you.

It comes from a spectacular app called Edge Gestures, which works in conjunction with Popup Widget to take that same concept and make it universally accessible. (I told ya it was wacky!)

When you first install Edge Gestures, the app will prompt you to enable it as a system accessibility service and to grant it the ability to display over other apps. These permissions sound scary — and they should! — but in the case of this specific utility, they’re absolutely appropriate and necessary in order for it to operate. The former is the only way an app is able to create a custom system-wide gesture, which we need for this setup to work its magic, and the latter is how your widget is able to be shown on top of whatever else you’re doing.

(If you’re at all worried, note that Edge Gestures doesn’t request any other significant system permissions. Beyond that, it’s reputable, it’s been around for quite a long while, and it has a large number of overwhelmingly positive reviews.)

Where were we? Oh, right: Once you’re inside the Edge Gestures configuration area, you’ll be able to select exactly what gesture you want to use for pulling up your widget. I’d think carefully about finding something that won’t interfere with anything else, like the system-level Android gestures, and that’ll be convenient to access without being a command you’re likely to trigger by mistake.

So, for instance, you might make the gesture a simple swipe downward along the left side of your screen. To do that, you’d find the “Swipe down” option within the app’s “Left” tab, and you’d set it to “Popup Widget” — and then create or select whatever Popup Widget item you want. And remember: You can select one widget or multiple widgets, too.

Prepare yourself for some serious oohing and ahhing:

Your favorite widgets are never more than a swipe away with Edge Gestures on Android.

JR Raphael, Foundry

As you can see, this opens up a whole new world of mobile multitasking potential. I mean, really: How could you not love that?!

The final thing worth doing is going into all the other gesture options in that same configuration area and tapping “Clear” for each of ’em to get rid of Edge Gestures’ default actions. I’d also go into whichever side of the screen you aren’t using — left or right — and tap the toggle to turn the gestures for that side off entirely. That way, you won’t inadvertently activate any gestures that you don’t actually want or need.

Edge Gestures costs $2 to use.

Android widget enhancement #3: The camera cutout command center

All screen swiping aside, you can create a complete widget-summoning control panel that exists entirely in the camera cutout at the top of your phone’s screen — y’know, that otherwise useless black hole where the front-facing camera is hidden.

The secret to this slice of Android widget sorcery is a snazzy little app called Material Capsule. You’ll have to spring for its $3.49 premium version (also available in a 99-cent monthly subscription, if you’d rather go that route) for the app’s widget wonders — but if you like the way it works, it’s well worth it.

In short, the app lets you set up to five different gestures for calling up different widgets from anywhere on your device — with a tap, a double tap, a long press, and a swipe to the left or the right across the same camera cutout area.

Any of those actions will bring whatever widget you choose into view for easy access, no matter what else you’re doing.

Material Capsule’s on-demand camera cutout widgets in action.

JR Raphael, Foundry

It’s quite the upgrade and one of those things that’ll make you wonder why it wasn’t just built into Android itself from the get-go.

I’ve got an entire separate guide to Material Capsule and its many powerful possibilities, if you’re interested in exploring it further.

Android widget enhancement #4: The physical key call

Next, here’s another interesting twist on that same on-demand Android widget idea: You can make any widget especially easy to access from anywhere without even having to mess around with any on-screen swiping or tapping by setting one of your phone’s physical keys as a trigger for the widget’s appearance.

I’ll give you a second to catch your breath and process the sheer splendor of that spell.

Back? Cool. So, the key to this feat (har har) is the combination of the aforementioned Popup Widget and a handy Android contraption called Key Mapper — which makes it easy to map your phone’s physical keys to all kinds of crazy custom actions.

In this case, we’ll set it up so that pressing and holding one of your volume keys causes whatever widget you want to be summoned, like so:

Yes, your volume key can cause a widget to appear (whoa!).

JR Raphael, Foundry

Pretty nifty, no?

I’ve got step-by-step instructions for making this happen in this separate guide.

Android widget enhancement #5: The floating bubble

If you like the notion of having a widget always available but aren’t so keen on the hidden gesture concept, an app called Overlays will let you create a small floating bubble that you can position anywhere on your screen and then tap to pull any widget up when you want it — just like with Android’s recently revived Bubbles multitasking system, only compatible with any Android device and version and with the simplicity of a widget instead of the complexity of an entire app.

Check it out:

Overlays puts a floating icon on your screen for easy ongoing widget access.

JR Raphael, Foundry

By default, Overlays gives you a bunch of its own little widgets to choose from, but the real power comes from adding in widgets from the Android apps you actually rely on. To do that, tap the “Triggers” tab at the bottom of the Overlays configuration area, then tap the red plus button in the lower-right corner of the screen. Select “Manual,” then type in whatever name you want for your widget and tap the icon to pick any icon you like.

Tap “Save,” then select “Widget” and find the widget you want from the list. At that point, you’ll see a preview of the widget. Move or resize it if you like, then hit the arrow in the upper-left corner of the screen to exit out of that interface. Last but not least, tap the name of your newly made widget on the screen that comes up next to change its status to “Always on.”

As soon as you head out of the app and back to your home screen, your fancy new widget should pop right up. All you’ve gotta do is tap the little downward-facing arrow in its corner to minimize it down to a bubble, which you can then press and hold to move anywhere your widget-worshipping heart desires.

Overlays can also create widgets that automatically appear based on context — so you could have something show up every time you connect to a certain Bluetooth device or Wi-Fi network, for instance. To explore those options, just follow the same steps from above but pick “Event” instead of “Manual” when you reach the “Triggers” tab configuration.

Overlays is free with an optional $4 in-app upgrade that removes some ads from the configuration tool and unlocks a handful of advanced features.

Android widget enhancement #6: The widget stack

Last but not least in our collection of wacky Android widget possibilities is one of my favorite widget wonders — and that’s the ability to stack multiple widgets and then swipe between ’em on your home screen without having ’em take up any extra space.

Check it out:

The space-saving simplicity of stacked widgets, as seen in Smart Launcher.

JR Raphael, Foundry

This enhancement presents a bit of a choose-your-own-adventure-style path:

First, if you’re using a reasonably recent Samsung Galaxy gizmo, the option is should already be present and available in your standard Samsung home screen setup. Just press and hold any open space on your home screen and then select the option to add a widget — then, once the widget is added, press and hold it and look for the “Create stack” command.

With any other Android gadget — or even with a Samsung device, if you want extra options and flexibility — you can use a custom Android launcher like the aforementioned Smart Launcher or Niagara as well as the retro-geeky T9-themed Key Launcher I introduced to you this past summer.

Those launchers replace your phone’s entire home screen environment and give you all sorts of interesting new possibilities for optimizing your interface and making it especially well-suited for you. And the stacked widget feature is just one small sliver of what they offer and how they’ll transform your Android experience.

The setup interface for a widget stack within Smart Launcher.

JR Raphael, Foundry

So there ya have it: six wacky, wild, wonderful ways to make widgets even more wow-inducing. Some days, you’ve just gotta love Android and the endless customization, control, and power it provides.

Put even more Googley goodness in your noggin with my free Android Intelligence newsletter — one exceptional new thing to try every Friday!

Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]