Agregátor RSS

Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. [...]

Prezident USA Donald Trump během svého projevu na valném shromáždění OSN 22. září 2026 prohlásil, že umělá inteligence 'bude dále oficiálně nazývána superinteligencí', zkráceně SI. Svůj návrh zdůvodnil takto: 'Použití slova artificial činí inteligenci falešnou. Ona falešná není, ve skutečnosti je úžasná'. Zároveň ve svém proslovu prohlásil, že Spojené státy kategoricky odmítají jakékoliv pokusy o vytvoření 'globalistického systému kontroly nad umělou inteligencí' a že 'kdo zvítězí v superinteligenci, zvítězí'. Video. O pár dní později, při uvítacím ceremoniálu čínského prezidenta Si Ťin-pchinga v Bílém domě 24. září, Trump ve svém projevu znovu použil označení 'superinteligence' když uvedl, že Spojené státy a Čína budou spolu jednat o 'bezpečnosti, technologiích a superinteligenci', bez nějakého dalšího vysvětlování tohoto pojmu.

Čínská technologická firma Xiaomi představila novou verzi 2.6 svého modelu MiMo, váhy modelů MiMo‑V2.6‑Pro‑RL a MiMo‑V2.6‑Flash‑RL jsou dostupné na HuggingFace pod licencí MIT. Výkonnější varianta Pro má přes bilion parametrů, z toho 42 miliard aktivních, úspornější Flash 309 miliard parametrů, z nichž se při generování aktivuje přibližně 15 miliard. Oba modely mají délku kontextového okna milion tokenů. Tyto MoE modely zvládají multimodální zpracování textu, obrázků, videa, hudby a zvuku, 3D modelování v Blenderu, analýzu dokumentů, programování, řešení složitých úloh a rozličnou autonomní práci prostřednictvím SI agentů.

A Linux io_uring race can let a polling thread release ring state while the CPU that published the work is still using it.

The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...]

Linux is not a standard environment. An enterprise can run many different flavors of Linux on its servers, desktops and specialized systems, each with its own set of software packages, dependencies and updates.

Corrupted ext4 metadata can direct a Linux kernel copy past the inode region that is supposed to contain inline data.

A Linux USB/IP timer can restart after device teardown has begun, leaving the kernel callback able to use a virtual controller that has already been freed.

A Linux ext4 race can corrupt a directory while the filesystem converts it from inline storage to a regular block.

A Linux eBPF security race can leave generated kernel code pointing at a BPF program after that program’s memory has been released.

Researchers say they recently found Google ads delivering a sophisticated tech support scam that freezes the screens of both Windows and Mac devices and displays messages urgently instructing them to phone a bogus call center.

The ads were displayed all over the web, including on high-traffic maps, weather, real-estate, document-hosting, and sports sites. Users who called the number were then urged to pay hefty fees, grant remote access to their devices, or divulge personal information. From August 31 to September 14, security firm Netskope observed users from 619 customer organizations click on the malicious ads, although none of them were actually scammed because Netskope blocked the content.

Roughly 62 percent of the organizations were based in the US, with Japan and Australia accounting for the Nos. 2 and 3 spots. Since the firm has visibility into only a tiny sliver of Internet activity, the number of people exposed to the ads—including those who fell victim to it—is likely much higher. Netskope tracked more than 250 Google Ads campaign IDs across at least 284 legitimate publisher sites.

Read full article

Comments

Yes, criminals have job listings too. A Telegram user recruiting callers to work in an apparent Google Security Team voice-phishing scam told applicants that they weren’t allowed to read from scripts – in the same ad that also included the exact script they had to read during these scam calls. This and other true-crime tales of criminals making fools of themselves appear in the latest installment of the Trellix Advanced Research Center’s Dark Web Roast, which uses memes and mockery to troll criminals on the dark web. It also acknowledges: “While these incidents are genuinely amusing, they represent real criminal activities causing significant harm.” One of these incidents from August involves a Telegram user identified by Trellix as Derian (@crɑick) who posted an ad in the UK Fraudsters Telegram channel. “Hiring - Female/Male Mail Callers,” the advertisement said, seeking “USA/CA (white sounding)” applicants and, in bold, “NO SCRIPT READING.” The ad then proceeded to print the exact script the callers would read: “Good afternoon, this is [name] reaching you on behalf of the Google Account Security Team on a recorded line. Am I speaking with Larry Boyles?” The Trellix threat-intel analysts note that the “‘recorded line’ flourish is a nice touch, because nothing says legitimacy like a fraudster cosplaying compliance theatre. The pretexting playbook is depressingly effective, but the recruiter’s QA process is roughly as robust as the fake Google team it impersonates.” Burn, baby, burn. The Register previously spoke with Trellix VP of threat intelligence strategy John Fokker about the Dark Web Roast, and he said the idea came from a desire to take an "almost psyops" approach to covering the criminal underground. "We don't want to glorify them, what's the opposite we can do? We're going to roast them," Fokker told us during a conversation at RSAC. "I'm trying to spark a debate, or a healthy conversation, about what we can do as an industry," he said. "Everybody's glorifying threat actors, and that's not helping our customers or organizations. These are just individuals, they just use computers, and they just want to steal your data and make money. They're not mythical. They don't have superpowers." The FBI’s Internet Crime Complaint Center (IC3) recently reported its most damaging year for internet scams, with 2025’s data pegging reported losses at $20.87 billion, and English-language social engineering is among the most in-demand skill sets on underground forums. One report by threat detection and response firm ReliaQuest found the number of job advertisements posted on criminal marketplaces mentioning this particular talent more than doubled between 2024 and 2025. Plus, according to Google, voice phishing surged last year to become the second most common method used by cybercriminals to gain initial access to their victims' IT estate – and the No. 1 tactic used when breaking into cloud environments. So when these criminals do dumb things, we’re happy to see Fokker’s team call them out.®

ShinyHunters, the data theft and extortion crew that has stolen sensitive information belonging to millions of cancer patients, university and K-12 students, and Carnival cruisers, wanted to preserve their reputation and keep their “business” afloat. So it hacked the FBI to make a statement, the group told The Register. “It’s a game and it’s the world we live in,” a ShinyHunters spokesperson told us. “We are just protecting our business as any other business would do. It’s about who does their job better.” On Friday, the FBI confirmed the breach to The Register, after earlier in the week saying the bureau was investigating ShinyHunters’ claims. "The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” an FBI spokesperson told The Register. "While the point of breach is still undetermined - whether a third-party or the FBI’s enterprise - we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk." On Tuesday, the criminals told us that they broke into the bureau via yet another Oracle PeopleSoft zero-day flaw in the FBIJobs.gov portal, which remains down as of Friday. Then, they breached the FBI’s managed servers on AWS GovCloud and swiped thousands of personnel files belonging to current, former, and prospective FBI employees. “We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job,” the group claimed in a message posted online and addressed to FBI Director Kash Patel and Brett Leatherman, assistant director of the FBI’s Cyber Division. Sample files reviewed by journalists and security researchers appear to contain agents’ home addresses, phone numbers, email addresses, Social Security numbers, job titles, assigned field office, and emergency contact information. 'We refuted the misinformation disseminated by the FBI' According to a spokesperson for ShinyHunters, the FBI hack isn’t about the money, and the crew did not demand a multimillion-dollar extortion payment to not leak the agents’ personal details. “Our breach of the FBI was executed specifically to contest the allegations made against ShinyHunters in their May 2026 FLASH report,” a spokesperson told The Register. The FBI bulletin, published soon after the group breached ed-tech giant Instructure's Canvas platform and claimed to have stolen data tied to hundreds of millions of students, teachers, and staff, said ShinyHunters uses “harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting.” The criminals, it continued, “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.” ShinyHunters contends this is all false. By hacking the FBI and releasing its statement about the hack, “we demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers,” the spokesperson told us in an interview. “This was fundamentally a public relations and marketing initiative for our business,” they said. 'Results-driven professionals' or criminals? ShinyHunters said it believes that “future corporate partners we engage with for payment will review this documentation, reinforcing our reputation as serious, results-driven professionals focused solely on transaction and resolution.” Most people call these "future corporate partners" victim organizations, breached by the digital thieves, and threatened with data leaks unless they pay an extortion demand. The FBI intrusion “establishes our credibility, technical superiority and excellence, and capability with future corporate stakeholders, positioning us as a professional and predictable entity focused on concluding negotiations efficiently,” the spokesperson said. It also puts a huge target on the crew, and we’d bet that the FBI, already gunning to arrest ShinyHunters members, is now doubling down on those efforts. The spokesperson said they and others in the crew started off as GnosticPlayers before rebranding as ShinyHunters in 2020, and that they have since seen the “majority” of GnosticPlayers members arrested. This business, however, is a criminal operation. We asked them why they believe people will trust the words of criminals over those of law enforcement. They said it’s due to ShinyHunters’ “unique and exceptional reputation along with over five years of history in the space…We are in a unique position and due to our vast capabilities and resources, victims are more likely to resolve the situation quickly and cheaper with us instead of going down the full disclosure route.” Think of the children We also questioned how they justify doing what they do in this “business” - breaking into IT systems, stealing data, extorting victims - considering the personal toll it takes on people, especially when the stolen files contain sensitive information about children as they did in the Canvas intrusion. ShinyHunters claims that they “don't attack human beings. We attack the corporate structure. The Business. Not human beings. The money comes out of insurance pocket. Not people’s or businesses' own. Full coverage by insurance. No personal harm is being done, only business harm that they recover from within a quarter considering the type of attack.” Ransomware and other disruptive attacks are “substantially worse and costly,” they said. “There are times in the work we do sometimes we have to push the corporate to the absolute limit to get them on the table,” they continued, noting that there was an “initial issue” with the Canvas intrusion “that we cannot comment on, but it highly relates to the misinformation we are combating. It takes a lot of convincing to bring a corporate to the table to negotiate if they think you are not trustworthy and bluffing/exaggerating what you have.” While we don’t know for sure what this issue was, ShinyHunters switched to school-by-school extortion after compromising Instructure, the company that owns the Canvas online learning platform, in late April and after the initial pay-or-leak deadline passed on May 6. They injected a ransom message into about 330 Canvas school login portals, causing Instructure to take the platform offline for a day - during final exams and Advanced Placement testing for many. Meanwhile, that PeopleSoft 0day The ed-tech company ultimately “reached an agreement” with ShinyHunters, which is corporate-speak for they paid the extortion demand. Alliance Risk CEO David Vainer previously told The Register he estimates the figure sits somewhere between $5 million and $30 million. According to ShinyHunters, the PeopleSoft preauth vulnerability that they exploited in the FBI attack still doesn’t have a patch. Oracle hasn’t responded to The Register’s questions about the zero-day, or any plans for a patch. Shiny had “no comment” about whether the gang has abused the PeopleSoft bug to compromise other organizations. But they added: “the zero-day would allow us to access similar HR/Employee personal information for other corporations who are vulnerable.” They wouldn’t put a dollar amount on how much they earn from extorting businesses, but boasted: “our revenue performance significantly outperforms both our counterparts and legitimate real life businesses. We have reason to believe in a few months or soon an upcoming financial analysis or reports tracking our earnings will reflect substantial revenue growth.” And they would not comment when asked if they worried about getting arrested and criminally charged for their digital intrusions and extortion attacks. ®

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]

It’s cheap to set yourself up as a hacker these days using AI. Someone attacked 105 online retailers over a period of five days, compromising 27 of them — all for an average of $25 per attack, according to research by Israeli security company Gambit.

But the attacks have been going on for much longer. Whoever is responsible used open-source AI harnesses to mount the attack. Gambit has identified three of these: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign. The attacks have proved to be highly lucrative, with 600,000 active credit card details taken from just two businesses, the installation of card skimmer scripts at five more, and some level of access to an unspecified number of major companies.

It has been a highly efficient attack, most access taking just a few hours and at a minimal cost. OpenRouter was used for AI model access. The capture of the account balance on August 25 showed the attacker spent just $7,005 over a four-week period. This worked out at roughly $25 per attack, with costs ranging from $3.13 for the cheapest target to $79.31 for the most expensive.

Gambit has contacted all the companies concerned, but warned that the intensity of the attacks shows how AI is transforming cyber criminals’ activities by providing a level of sophistication that humans would find more challenging to muster. We are already seeing a new level of incursions to businesses and can expect to see more in the future.

This article first appeared on CSO.

You work in your company's human resources department and use HR software to check employee information, benefits, and payroll. So, when you see a downloadable Windows version promising a faster alternative to the usual web interface, you grab it. Unfortunately, the app isn't what it claims to be. Instead, it silently installs ConnectWise's legitimate ScreenConnect software, giving the operator persistent remote access to your PC. Cybersecurity outfit Allure Security reported the discovery of the campaign Thursday, describing it as the latest evolution in a trend of abusing ScreenConnect and other remote monitoring and management software. This time, the main giveaway is knowing what the vendors actually sell: None offers the Windows app being advertised. According to Allure, the campaign impersonates three unnamed US-based HR and payroll platforms by offering fake desktop clients for those providers’ software. In all three cases, those companies don’t offer a desktop client, meaning all it takes is an unaware HR or payroll clerk tricked by promises of superior performance to potentially expose some incredibly sensitive company data. Allure said that it’s not sure how potential victims are being targeted by the campaign either, but those who have been targeted may not pick up on anything being wrong. Clicking through to the website offering the fake app brings up a legitimate-looking site built using AI app builder Lovable and hosted on Vercel. The site is hidden behind the cloud host’s bot challenge page, meaning scrapers haven’t been able to index it and expose the scam. Further obscuring the malicious nature of the campaign, the downloads are hosted on a GitHub Releases page, meaning they point to a trusted domain. Once downloaded and executed, the installer presents the victim with an actual Microsoft installer to make it appear like a legitimate piece of software. It actually installs the Microsoft .NET Desktop Runtime 8.0.26, so it goes through the entire process and shows that an installation completes, but nothing ever pops up, leaving the victim unclear as to where their desktop app went. That’s not all the installer is doing, of course: It’s also running a quiet, no-interface installer to drop the ScreenConnect client on the victim’s machine. “The [ScreenConnect] access mode is set to unattended,” Allure notes. “The victim-facing indicators are turned off: no ‘your machine is being controlled’ banner, no system-tray icon, no connection balloon.” The silent install is also configured to launch on boot, and stay connected across various user sessions, giving the attacker “a quiet, persistent, interactive foothold,” says Allure. “Nothing in this chain is malware in the usual sense,” the infosec outfit said. “The page was generated by a legitimate AI builder and served by a legitimate host. The download came from a legitimate code platform. The one window the victim saw belonged to Microsoft. The thing that was installed is a legitimate RMM product, doing what it was designed to do, for someone who was never supposed to have it.” In other words, security teams have some work to do before they even check the indicators of compromise that Allure included in its report: Check with HR and payroll vendors to see if they offer a desktop app, and if not alert all members of those teams to this campaign. For those hoping they haven’t fallen victim, the actual number of victims remains unknown. Allure said the GitHub download counts across the three fake downloads totaled 291 as of its report. Some of those came from Allure’s researchers, and possibly other researchers and sandboxes too, so the download count can’t be used to determine how many victims there are. ®

Here’s an interesting concept: an AI company that fires people for using AI. It sounds like a strange way to run a company but there’s a real reason behind it.

OpenAI has been hiring contractors who have been tasked with reading ChatGPT users’ prompts to help improve responses by providing some real human input.

Unfortunately for OpenAI, it found many of them were using AI to train the AI, so not providing a human touch at all, according to a report in 404 Media. The company has subsequently fired many of the contractors, although 404 Media didn’t reveal the number.

None of them can say they weren’t warned, however. The terms for the contractors are set out in their working conditions. “Do not use AI detection tools, or AI yourself. Do not use GPTZero or any other AI detection tool. They are not reliable. Reviewers may not use AI either, including Grammarly and AI translation, to review, write feedback, or write comments.”

Despite this stark warning, many of the contractors turned to AI to assist in the work. OpenAI is very keen to avoid “model collapse,” a phenomenon in which AI models trained on text written by previous generations of AI models perform worse than their predecessors. It’s a form of digital inbreeding that industry observers have previously warned about, and which could have a deleterious impact on business.

One contractor told 404 Media that it was a common practise. “It’s pretty much the one thing that will get you kicked off ASAP. In a group of thousands, there are tons that have been caught.”

It will be hard to ascertain just how widespread the practise is as OpenAI declined to comment on the situation.

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]

The CEO of crypto exchange Bitget has confirmed that a cyberattack with all the hallmarks of a North Korean operation resulted in approximately $387.5 million worth of digital assets being stolen from the exchange’s wallets. Bitget initially estimated the loss at $351.6 million, but later revised the figure to $387.5 million after identifying additional affected assets on Zcash and TRON that were not included in the initial estimate. Blockchain intelligence company Arkham published its preliminary observations of the attack, estimating at the time that roughly $350 million was stolen and that $228 million left Bitget’s wallets in 18 minutes, between 18:58 and 19:16 UTC. Arkham said $153 million worth of XRP was taken from a wallet it identified as a Bitget cold wallet, while the stolen assets also included $66.2 million of ETH, $34.8 million of USDT, $12.9 million of USDC, and $12.8 million of Tether Gold on Ethereum. Other affected networks included Arbitrum, Optimism, BNB Smart Chain, Avalanche, and Base. However, Chen said Bitget's cold wallets and customer balances remained unaffected, while its User Protection Fund held more than $464 million worth of assets. “To be transparent about our financial position: beyond the $464M+ Protection Fund – all held in publicly verifiable wallets – Bitget holds over $1 billion in its own assets,” Chen said. “User funds are covered on a 1:1 basis.” Chen also explained that Bitget Wallet, the company’s self-custody product, operates on infrastructure separate from its exchange, and Bitget users can still make deposits and trade their tokens, despite withdrawals being temporarily suspended while additional security checks are completed. Bitget said it also engaged incident response giant Mandiant and blockchain security outfit SlowMist to help with the investigation into the attack. Chiefs at fellow exchanges rallied around Bitget in support. “MEXC stands ready to support Bitget in any way we can,” said CEO Vugar Usi. “In moments like this, the industry is stronger when we stand together.” Binance co-CEO Richard Teng also pledged Binance's support for Bitget, saying it had shared intelligence and helped trace the stolen funds. Ben Zhou, CEO of Bybit, said his company was on standby to “help in any way we can,” noting that Bitget helped it out following the $1.5 billion Bybit theft the FBI attributed to North Korea in February 2025. How and who Root cause analyses typically take some time, although according to Chen, Bitget's security team has already identified the wallet service's backend system as the source of the unauthorized transfers. “Hackers breached a key backend system of the wallet service and exploited it to forge transfer information and invoke the authorization signing process, thereby transferring funds out,” she said. “The possibility of private key leakage can be ruled out – this means a more severe risk scenario has been eliminated. Damage control has been confirmed as complete, and there is no risk of further fund outflows from the platform. “The specific intrusion methods used by the hackers are still under technical investigation, and a full report will be released upon completion of the investigation.” Chen did not go into too much detail about the alleged links to North Korean state-sponsored attackers having a hand in the attack, but said “IP behavioral patterns and on-chain signatures” suggest it was Kim’s cronies at work. It would come as little surprise if North Korea was indeed the culprit behind the attack. The regime has a knack for hacking crypto exchanges. The aforementioned hit on Bybit was perhaps North Korea’s biggest crypto haul, although similar lucrative ventures attributed to North Korean attackers have come at the expense of DMM Bitcoin and WazirX, among others. Bitget was founded in 2018, registered in the Seychelles in 2022, and operates through regional hubs across the world. Some netizens have speculated that the timing was especially inconvenient, with the transfers detected at 18:31 UTC – 02:31 on September 25 in Singapore and China, the first day of China’s three-day Mid-Autumn Festival holiday. The festival is also widely celebrated in Singapore, although it is not a public holiday there. The Register asked Bitget whether this played a role in the attack and its remediation but it did not respond. As of Friday, Bitget is offering bounties to those who help freeze or recover the stolen funds. It said eligible participants could receive 5 percent of the funds their efforts successfully freeze or recover.®

Microsoft’s Copilot “super app” has arrived, two months after CEO Satya Nadella confirmed it was in development. It combines conversational Chat, the autonomous Cowork agent, a redesigned coding environment named Code, and Autopilot, the persistent agent formerly known as Scout, into a single Copilot experience.

The idea is to make those capabilities look less like separate tools and more like different ways of getting work done through a unified experience. The end goal is to enable users to describe what they want to accomplish without choosing a mode themselves, and with Copilot routing the task to Chat, Cowork, Code or another capability, Microsoft said.

The individual pieces of this experience are not entirely new, and build on launches and consolidation moves that Microsoft has made over the past several months.

Nadella first described the unified Copilot architecture during an earnings call in July. He said it would bring chat, agents, and business workflows into a single AI workspace while separating the orchestration layer, context, and memory from any one AI model. Microsoft subsequently began unifying its consumer and Microsoft 365 Copilot apps ahead of the broader overhaul.

But Microsoft laid much of the groundwork in the period after its November 2025 Ignite conference, with the launch of Cowork for delegated multistep work, Scout for persistent agentic tasks, and natural-language app-building capabilities that have now evolved into Code.

The broader change goes beyond bringing those Copilot experiences together. With Friday’s updates, Microsoft is also adding components and infrastructure aimed at turning Copilot from an AI assistant embedded across Microsoft 365 into a broader orchestration layer for enterprise work.

These include Fabric IQ and Work IQ for enterprise context, Copilot Managed Runtime for running AI-built applications, a unified plugin registry for connecting capabilities, and usage-based billing and FinOps controls for managing agentic workloads and AI spending.

More enterprise context could boost productivity

The inclusion of Fabric IQ in Chat and Cowork, along with Work IQ’s access to data and workflows in Dynamics 365 and Power Platform, will make Copilot more effective for enterprise tasks by giving it a broader understanding of an organization’s data and workflows, potentially reducing hallucinations and improving productivity, said Abhishek Satapathy, principal analyst at Avasant.

“The practical shift is from AI that knows information to AI that can connect what happened, why it happened and what needs to happen next. For example, a business insight can increasingly become the starting point for analysis and follow-up action rather than requiring the user to manually move that context between reports, documents, conversations and business systems,” said Satapathy. “This is particularly relevant for analysts, managers and operations teams working across functions.”

Fabric IQ’s integration with Chat and Cowork is now generally available. Microsoft plans to integrate it with Code soon through its Frontier program. Work IQ will enter public preview over the next month, it said.

Redesigned Code expands the scope of software creation

Productivity is also the focus of Microsoft’s redesigned Code environment.

It “broadens the audience for software creation” by addressing the middle ground between traditional development and simple automation, bringing more use cases into the scope of what business users can build, including those that may be too narrow for a formal development project but too complex for basic automation, Satapathy said.

That means more internal applications, dashboards and workflow tools can potentially be built without going through a traditional development project, while developers can use the same environment to accelerate application creation and focus on more complex engineering and production requirements, he added.

Alongside Code, Microsoft is introducing Copilot Managed Runtime, a governed hosting environment for applications built with Code, Cowork, and Copilot Studio. The runtime allows those applications to run within an organization’s Microsoft 365 environment while giving IT control over security, governance and access to live data, Microsoft said.

For enterprise developers and IT teams, the runtime could provide a common production layer for AI-created applications, helping enterprises move applications from experimentation and prototyping into production without having to create a separate operating model for each one, Satapathy said.

It could also help IT teams and CIOs curb shadow IT and application sprawl, said Manoj Chandra Jha, principal analyst at Nord-IQ Research. In its governed environment, IT departments can manage applications and agents created by employees consistently for security, identity, policies, lifecycle management, observability, and deployment.

The new Copilot Managed Runtime is currently in public preview and will also be accessible inside the redesigned Code experience, Microsoft said. That experience will roll out to Microsoft’s Frontier program at the end of the month, with broad availability in the coming weeks, it added.

New FinOps tools could help CIOs judge business value

Beyond productivity, faster scaling of AI applications and curbing application sprawl, Microsoft is also giving enterprises more tools to manage the cost of agentic AI by expanding its cost-management capabilities in Agent 365 to include Code and Copilot Managed Runtime.

These capabilities will allow administrators to manage AI spending policies at scale, control access to model families and route credit requests through existing approval workflows, while giving visibility into the outcomes generated by agentic workloads to decide where to sustain, expand or optimize usage, the company said.

End users will also be able to view their credit usage, remaining balances and usage history directly in Copilot, helping them manage their AI usage, it added.

For Bhupendra Chopra, chief revenue officer at IT consulting firm Kanerika, the expanded FinOps capabilities will be critical for CIOs, particularly for understanding if agentic workloads and automation are delivering sufficient business value and if they need to be reworked.

“These capabilities can reveal correction rates for agents. If employees regularly have to undo an agent’s work, that can indicate stale context, poor business rules or an unreliable data foundation before it shows up as a larger operational problem,” Chopra said.

“These capabilities can reveal another insight: whether the time supposedly saved by automation actually translates into a measurable business outcome. Enterprises can automate 20 minutes of work but simply spend that time elsewhere, meaning the productivity gain only matters when it produces a measurable result,” he added.

Usage-based billing extended

Alongside these FinOps capabilities, Microsoft is also extending usage-based billing to more of the capabilities being brought together under Copilot. The model is not new to the platform, having been introduced for Cowork when the agent became generally available in June.

While Cowork, Code and Autopilot, along with new long-running agentic capabilities and frontier models, will use usage-based billing, Chat and Copilot across Microsoft 365 will remain covered by the user subscription license, the company said.

That distinction could require CIOs to think about AI spending differently from traditional productivity software, Satapathy said.

Instead of budgeting primarily around the number of users with Copilot licenses, CIOs may need to consider what work is being delegated to agents, how much that work consumes and what business value it produces, he added.

“Two employees with the same Copilot license, for instance, could generate very different AI costs depending on whether one uses Copilot for assistance while the other delegates longer-running work to agents,” he further said.

However, that might still be some way off, with several of the key capabilities still in preview or yet to roll out.

Home, the new starting point in Copilot where Chat and Cowork come together, will begin rolling out through Microsoft’s Frontier program in the coming weeks, while Autopilot is expanding to private preview at the end of the month, Microsoft said.