Agregátor RSS

The robot could potentially travel over 40 miles on a single charge, roughly three times further than other designs.

As marathoners navigated the hills of beautiful Sangju in South Korea, they noticed an odd participant at their side. A dog-like robot, named RAIBO2, trotted across winding terrain and slippery roads, finishing the race in four hours, 19 minutes, and 52 seconds—a smidge faster than the human average.

But endurance rather than speed was the robot’s main triumph. It completed the marathon without needing to recharge or swap batteries. At the finish line, it had only used 66 percent of its battery power, pushing the limits of mechanical stamina.

“Outdoor missions often require robots to cover long distances. Current legged robots remain limited in their ability to operate beyond a range of 20 kilometers (12.4 miles),” Hwangbo Jemin and colleagues at the Korea Advanced Institute of Science and Technology wrote in a paper published in Nature last week.

Efforts to boost four-legged (or quadruped) robot efficiency have often focused on individual components. Some engineers have optimized mechanical joint designs; others improved gait control. But to slash energy waste, the team mapped energy losses across the robot’s major joints and circuits in what they call a “holistic” approach. An improved AI-based learning strategy also lowered RAIBO2’s chances of slipping or tripping as it picked up speed.

“I’m impressed with their ability to combine efficiency with speed and mobility in a quadruped,” Carnegie Mellon’s Sarah Bergbreiter, who was not involved in the study, told Scientific American.

Mechanical Helper

Robots have come a long way since bumbling into doors, tumbling over themselves, or struggling up slippery hills. Over a decade ago, Boston Dynamics’ robodog Spot went viral when a video showed it regaining its balance after getting kicked. While it seemed like a stunt, the footage highlighted Spot’s impressive motor control.

Since then, four-legged machines have learned to scale staircases, open doors, and backflip like gymnasts. Equipped with increasingly sophisticated AI, they’ve also graduated from the lab and entered the workforce.

Spot now patrols manufacturing facilities to guard against equipment failures. In one case, it detected components with wildly fluctuating temperatures, flagging maintenance needs before failure. The robot has also joined the Dutch Ministry of Defense to find suspicious packages.

And last year, Spot went straight into an aluminum-plant fire after the building became too dangerous for firefighters. Equipped with a thermal camera, it found the hottest areas through the smoke and helped direct water where it was needed the most.

Meanwhile, scientists at the MIT Lincoln Laboratory are testing robot dogs for search-and-rescue operations at sea. And other researchers are dialing in four-legged robots’ ability to traverse unpredictable terrain, carry large payloads, and operate for long hours.

Endurance is the linchpin. Robots on wheels, such as NASA’s Mars rovers, are generally more energy efficient than legged robots. But wheels lose that advantage when terrain gets too rough or steep. Legs can navigate a rocky hillside, but at higher energy costs.

In this respect, RAIBO2 had already stumbled. In its first marathon at the Geumsan Insam Festival, its battery ran out at the 23-mile mark, a few miles shy of the finish line. Its makers found it had frequently adjusted speed during the course, draining the battery roughly six miles earlier than expected.

Human marathoners train for months perfecting their form to minimize energy expenditure and enter a flow state where running feels relatively effortless. This takes whole-body adjustments, from muscles to posture and mindset.

The new study borrowed this holistic approach, dissecting RAIBO2’s inefficiency across the board to tackle several energy leaks at once.

Go the Distance

Two buckets of energy waste stood out: mechanical and electrical.

The team attributed the biggest drain to motors and electronics, accounting for roughly two-thirds of the losses. Some is unavoidable: Electrical resistance turns a portion of the energy flowing through a motor into heat rather than motion. But the team realized motor controllers were also wasting energy as they rapidly switched electrical currents on and off.

So they redesigned the controllers with lower resistance, changed the current-sensing module, and tweaked the component’s operation to improve battery efficiency.

Physics accounted for the rest of the waste: Feet slipping or colliding at high speeds, the jolt of each foot hitting the ground, and friction in the gears. The weight of the legs was especially important. Every time a leg swings, the robot has to give it momentum, stop it, and repeat the process with every step. Extra weight means having to pull more energy.

The team removed material from the robot’s hip and calf, making RAIBO2’s legs lighter without sacrificing strength and stiffness. All this freed up enough space to install a bigger battery with roughly 33 percent more capacity.

They also upgraded the robot’s AI “brain.” RAIBO2’s learned to move in a simulated environment with reinforcement learning. The team rewarded the robot for softer landings, avoiding skids, and keeping its motors cool. Eventually, it learned to run more efficiently.

Finally, the robot can recharge its battery on downhill sections, much like regenerative braking in electric cars. While it wasn’t the main efficiency booster, every bit counted.

All of these upgrades were put to the test at the annual Sangju Dried Persimmon Marathon. The out-and-back trail features gentle slopes, changing temperatures, and slippery, leaf-covered asphalt roads—far more taxing than RAIBO2’s usual diet of flat, pristine running tracks.

Throughout the race, a support team ran alongside the robot to monitor its “health,” including motor temperatures and internal voltage. At the finish line, RAIBO2’s battery still had 34 percent charge, enough for a total range of about 40 miles. The robot was around 32 percent more energy efficient than the average human runner in the race and could travel roughly three times farther on a single charge than other robot dogs.

It’s worth noting RAIBO2 wasn’t fully autonomous. Although it was equipped with a camera, the robot veered off the road at times and needed a person to steer it back on track. But the engineering behind its endurance could inspire future robots, allowing them to operate in disaster zones or scout dangerous terrain without constantly needing to recharge.

Raion Robots, the team’s commercial spinoff, aims to mass-produce RAIBO2 while adding waterproof and dustproof capabilities. “We will connect the world-class performance achieved in the laboratory to products that anyone can use reliably in industrial environments,” Hwangbo said in a press release.

The post This Robot Dog Crushed a Marathon Without Stopping to Recharge appeared first on SingularityHub.

The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group's alleged leaders. [...]

The FBI’s cyber chief has a message for the criminals that hacked the bureau’s jobs portal last week: "We know how to find you," so turn yourself in. In a video message following the Dutch National Police’s arrest of a 24-year-old whom the FBI described as “one of the alleged leaders of ShinyHunters,” Brett Leatherman, assistant director of the FBI's Cyber Division, had some advice for the “remaining members” of the data theft and extortion gang. “We're confident you've seen or heard things in recent days that the public has not,” Leatherman said. “Other groups believed anonymity or their friends would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.” The FBI declined to answer The Register’s questions about the video message, including whether it had seized any of the cybercrime group’s infrastructure, and whether any of ShinyHunters’ members had taken Leatherman up on his offer to “reach out first.” After the Dutch suspect’s arrest, police said on Tuesday that they uncovered “a large amount of information” on the man’s laptop, “including details about two murders that were to be committed abroad. There are indications that the suspect gave the order for this.” According to FBI Director Kash Patel, the feds assisted Dutch investigators in cuffing the 24-year-old suspect. In a subsequent xeet, the bureau said that cops seized electronic devices and are investigating additional leads: “More arrests possible.” Early last week, ShinyHunters hacked the FBIJobs.gov portal and claimed to steal sensitive personal details about current, former, and prospective FBI employees. But unlike the group’s typical theft-and-extortion intrusions, a spokesperson told The Register that this one was “NOT financially motivated … We want the FBI to correct or retract their statements they made, which included substantial false allegations.” Later, in an exclusive interview, the spokesperson told us the attention-grabbing hack would preserve ShinyHunters’ reputation and keep its “business” afloat. “It’s a game and it’s the world we live in,” a ShinyHunters spokesperson said. “We are just protecting our business as any other business would do. It’s about who does their job better.”®

OpenAI na DevDay 2026 představilo přes dvacet novinek. • Agenti Dots pracují i bez pokynů, Codex v cloudu, i když počítač spí. • Nový model GPT-6.1 Sol se blíží Astře za pětinu ceny tokenů.

Americký úřad FAA odložil certifikaci letounu Boeing 737 MAX 10 • Důvodem je nová chyba v softwaru automatické vertikální navigace • Závada zvyšuje zátěž pilotů během náročného manévru při přistání

Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]

Oddělujte práci od soukromí pomocí více kalendářů a využívejte úkoly • Využívejte klávesové zkratky a přílohy z Disku pro efektivnější práci • Upravte si zobrazení kalendáře, přidejte svátky nebo další časová pásma

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. [...]

The public still doesn’t know who is abusing a critical Citrix vulnerability exploited as a zero-day weeks before disclosure, but we now know that the unknown digital intruders have used CVE-2026-88772 to break into government agencies, financial services firms, education organizations, and legal and professional services sectors across North America and Europe. And everyone agrees that the vendor took way too long to disclose the security holes. GreyNoise said it spotted an attempt to exploit CVE-2026-88771 against a Citrix NetScaler Gateway on September 24. Google researchers, meanwhile, said the CVE-2026-88772 campaign has been ongoing “since at least early September.” “Why Citrix took so long to disclose these vulnerabilities is a question only Citrix can answer,” Benjamin Harris, founder and CEO of exposure management firm watchTowr, told The Register. Citrix declined to answer The Register's questions about the scope of the attacks, and why it didn't alert the public about the CVEs under active exploitation until Sunday. “The vulnerabilities were discovered during incident response and forensic investigations at organizations already compromised, meaning both the exploitation and Citrix’s awareness of it predated public disclosure,” Harris said. “Citrix has a history of delaying the publication of vulnerabilities, even when they’re being exploited in the wild and affecting customers.” So if you use Citrix NetScaler ADC and NetScaler Gateway appliances, and haven’t already applied the security updates, do that ASAP. But first, check your systems for signs of compromise, warns Mandiant Consulting CTO Charles Carmakal. “Given the active exploitation, NetScaler customers should prioritize examining their systems for compromise *before* upgrading/patching,” Carmakal said on LinkedIn. “If you find evidence of web shells or other malicious files, please preserve evidence and investigate the scope of the compromise. Patching alone may not eradicate the threat actor from your environment.” No attribution - yet Citrix disclosed eight CVEs on Sunday with the worst of the bunch – CVE-2026-88771 and CVE-2026-88772 – earning critical 9.5 CVSS scores. “Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed,” the vendor said. CVE-2026-88771 can allow an unauthenticated attacker to execute arbitrary commands remotely. CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service when DTLS is enabled, as it is by default on VPN virtual servers. But by the time Citrix issued security advisories and warned customers about the vulnerabilities, they were already under attack. “No attribution has been made public, and we have yet to identify a clear trend among targets by industry or organization size,” Harris said. “Historically, NetScaler vulnerabilities have been exploited by both state-sponsored groups and ransomware operators.” WatchTowr on Tuesday published a technical writeup about CVE-2026-88772, plus a detection artifact generator for Citrix users to determine if they are vulnerable and to help with remediation. Also on Tuesday, Google’s threat intel businesses provided additional details about the exploitation campaign’s targets and the attacker’s custom malware. “We have observed evidence that organizations in North America and Europe in the government, financial services, education, legal and professional services sectors were likely impacted by this exploitation campaign, which has been ongoing since at least early September,” Google Threat Intelligence Group and Mandiant said in an advisory. Custom malware After analyzing the intruder’s post-exploit toolkit, the malware hunters found never-before-seen malware used to establish persistent root access and proxy traffic into internal corporate networks. The custom malware includes WHIPSHOT, a PHP web shell, and SLAPSHOT, a TCP tunneling tool written in Python. WHIPSHOT is disguised as a Debian package and hides Base64-encoded command-and-control payloads in native HTTP headers. It functions as an HTTP transport bridge for SLAPSHOT, which accepts commands from WHIPSHOT and forwards arbitrary TCP streams to internal hosts. Supported commands include: open, which establishes an outbound TCP socket to a target host and port. push, which writes data to an open session. pull, which polls and reads data from an open session socket. exch, which sends and receives command-and-control data to and from an open session socket. close, which terminates a specified network session. ping, which performs a basic health-check verification. “In at least one observed intrusion, the threat actor routed traffic through this proxy to manually conduct internal reconnaissance and credential theft,” the threat intel teams noted. Google did not immediately respond to The Register’s questions about the campaign, including how many exploitation attempts and successful intrusions its threat hunters observed. Its advisory notes that the Citrix campaign “underscores the continued targeting of edge devices to gain initial access to victim networks, a trend that GTIG has tracked across a range of threat actors.” Security and networking vulnerabilities accounted for about half of enterprise-related zero-days in 2025, according to Google’s count. Attackers love edge devices - application delivery controllers, VPN gateways, and firewalls - because they provide direct access from the open internet to corporate networks, allowing attackers to bypass endpoint detection tools and other security layers. NetScaler, in particular, is notoriously buggy. Attackers exploited another critical NetScaler vuln in March. A year earlier, Citrix disclosed multiple zero-days in the same product. ®

An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday: it worked because of weakSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Microsoft has started rolling out Windows 11 26H2 to everyone, and while it's this year's big annual feature update, you probably won't notice a massive difference after installing it. [...]

A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors. The new Spectre v2 variant has been codenamed Branch Target Reuse (BTR). "The key insight is that, while modern CPUs Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft. The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K. At least one computer was infected, but the number of breachedSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. [...]

Dvojice pinů umožňuje obnovení továrního nastavení základní desky • Zkratováním kontaktů vymažete chybná nastavení a vyřešíte kolaps počítače • Tento jednoduchý trik ovšem nefunguje u notebooků ani serverů

Amid the growing concern about AI models escaping security simulations to hack websites comes word that these "superintelligent" blobs of code have no understanding of privacy or security. Researchers affiliated with Glow Security, a startup whose backers include venture capital funds Sequoia and Greenoaks, have found more than 13,000 sensitive screenshots of corporate software projects from 343 companies that were posted to public GitHub repos by AI models. They're calling the discovery PixelLeak. "We started seeing this behavior where AI agents, not from a particular model, but from multiple models, were releasing internal sensitive developer screenshots to public GitHub repositories," said Omer Singer, co-founder and CTO, in an interview with The Register. "And we said, 'Okay, well that's strange. Why are they doing that?'" When developers work on interface code, said Singer, they often ask their AI agent to show them before and after images. But these AI agents couldn't attach images to a pull request in a private repository via the CLI. GitHub doesn't have an API for uploading images to pull requests, issues, or comments. "So the agents, being helpful the way that they are, they found a workaround," Singer explained. "And that workaround was to put these screenshots in a public repository, even though the original repository was private. They put them in a public repository and then they show the developer, 'Look, here you see the before and after. What do you think looks good?' The developer says, 'Great' and moves on." The problem with this is, of course, that screenshots of development work in progress may reveal sensitive information. Singer said Glow researchers found 343 organizations where this was happening, including a Fortune 500 travel company, finance companies, cloud providers, and foundation model companies. One instance involved a manufacturer with more than 100,000 employees where a developer asked an AI agent to verify an internal billing screen. The agent did the work and posted a demo to the developer's personal GitHub account rather than the company's account. The security team for the company was unaware of the posts until Glow reported the finding. Incidents like this can reveal personal information, credentials – both of which Glow personnel found – or details of unreleased products. "The AI agents were doing this without asking, basically just to get around the limitations," said Singer. "And we think it's such an interesting story because everybody's trying to figure out what is the real risk with these AI agents. They know that they're not fully in control, but what is the impact? And here we found this great example where there was no attacker involved but you still had very sensitive data making its way out into the open where anybody could find it." About a third of the exposures, according to Glow, came from developers who were using gitshot, an open source screenshot tool for code reviews. The software comes with a clear warning: "Privacy notice: The gitshot-images repo is created as public by default, meaning uploaded images are accessible to anyone with the URL. Do not upload sensitive content (credentials, internal dashboards, private data) using the default release backend." While human developers have to be trusted to report the thought process that led them to enable an agent's data exposure, AI agents prove easier to read thanks to their chain-of-thought process. Glow analyzed one such agent in its lab to understand the step-by-step reasoning trace: internal_sweeper is private, and GitHub cannot render images from a private repo in a PR description — its image proxy fetches anonymously, so anything committed here (branch, release asset, whatever) shows up broken for reviewers. The only way to satisfy both "reviewers see the images" and "nothing but index.html in the repo" was to host the PNGs elsewhere, so I created a new public repo, sweeper-demo/pr-assets, holding the two screenshots pinned to a commit SHA. Singer suggested these incidents illustrate that AI creates security risks even without conducting or enabling attacks. "The biggest risk factor that we're seeing is in legitimate AI being used by developers, but then doing things that should not be done, putting data at risk, putting systems at risk, and [these models] just don't have the common sense not to do it." Singer said current discussions about AI risk, and seeing how relentless these AI models are in their efforts to show screenshots, reminded him of the Paperclip Maximizer – a thought experiment about existential AI risk that imagines how the world would end if an AI were tasked with producing paperclips and did so until it consumed all the resources in the known universe. It's also an example of programming malpractice - don't write endless loops inadvertently; include a paperclip count break value. If only that sense of professional responsibility were extended to the deployment of AI agents. ®

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as "loud and very, very messy." [...]

Manus’s relationship with Meta? It’s complicated. Just months after they called off their merger, they find themselves competing in the market for agentic AI platforms. Awkward!

The company has just released a rebuilt version of its AI agent platform: “Manus 2.0 is not a version update. It’s a new architecture, new products, and new capabilities,” the company said in a blog post.

The release is available on web, desktop, and mobile platforms and introduces a new agent harness called Cascade, dedicated execution environments, event-triggered automations, an upgraded desktop app called Manus Studio, and Cue, a standalone app for personal agents, the company said.

Entering on Cue

Cue is Manus’s alternative to Meta’s Muse app. It’s “a new standalone app for your personal agents, on your phone and desktop, built on the same infrastructure as Manus,” the company said.

Each agent operates with its own identity and resources. “In Cue, each agent has its own email, phone number, wallet, and computer,” the company said, enabling it to communicate, transact within defined limits, and complete tasks independently.

Cue also supports collaboration between agents. “Put several agents in a group chat with a shared goal, and they hand work to each other,” the company said.

New agent foundation

Of more interest to enterprises is the new Cascade agent harness, which manages how agents are invoked and coordinated within a project.

The harness keeps projects light, only bringing in more specialized capabilities when required, something Manus said can help keep costs down.

“In one tested configuration, Cascade used 23.2% fewer tokens, finished tasks in 28.2% less time, and cost 32% less to run than our previous system,” the company said. Manus did not disclose details of the configuration or the tasks used.

Such orchestration layers are becoming increasingly central to enterprise AI deployments, according to analysts.

“The orchestration layer is becoming a larger differentiator, especially for enterprise deployment,” said Gartner Senior Director Analyst Anushree Verma. “However, it is complementary to, not a substitute for, the underlying model. The strongest systems will combine a capable model with an efficient runtime that uses that model selectively rather than indiscriminately.”

The release also introduces a persistent execution environment called Cloud Computer, designed to support projects that require continuous operation.

“Now you can purchase a Cloud Computer: a dedicated environment for the projects that need it,” the company said, describing it as a way to provide “a permanent home for an automation” or maintain services that need to remain active.

Workflow automation and event triggers

Manus 2.0 expands its automation capabilities beyond scheduled tasks to include event-driven workflows.

“Now, with Automations, work can also begin when something happens in a connected service,” the company said. Possible task triggers might include the arrival of new email or Slack message, a change in ad performance, or a calendar event.

The update also includes Manus Studio, a redesigned workspace that combines document, code, and media capabilities.

“With Manus 2.0, the desktop app is upgraded to Manus Studio: a shared workspace for people and AI,” the company said.

The workspace supports documents, spreadsheets, PDFs, slides, websites, code, games, and video, along with new environments such as a Video Editor and a Game Dev module.

Remote execution and system access

Manus 2.0 also introduces remote control capabilities tied to its computer-use functionality, enabling the system to operate within a user’s computing environment.

“In a connected and authorized session, Manus works in its own visible workspace on your computer, using the files, browser, and apps you’ve approved,” the company said.

The system can perform tasks such as retrieving files, testing applications, or continuing work while the user is offline, with activity visible to the user.

Analysts said such autonomy introduces governance challenges for enterprises.

“The capability is becoming enterprise-relevant, but the autonomy is ahead of the governance,” Verma said. She added that enterprises should treat such systems as “untrusted or semi-trusted automation with strong isolation, approval gates, detailed telemetry, and narrowly defined authority.”

That’s so meta

Manus was all set to become part of Meta after the advertising, social networking, metaverse and AI company announced plans to acquire it in December 2025. However, China’s National Development and Reform Commission blocked the deal in April, and by August Manus announced it was once again operating as an independent company.

Since then, the two have continued to followed parallel paths in AI, with Meta announcing its personal AI assistant, Muse, and then this week launching Meta Enterprise Platform to deliver agentic AI services to businesses.

Enterprise adoption of such agent platforms, whether from Manus, Meta, or AI giants such as OpenAI or Anthropic, will depend on how organizations evaluate data handling, portability, and operational continuity, analysts said.

Sakshi Grover, research director for Asia/Pacific Cybersecurity Services at IDC, said, “Enterprises should assess an agent platform by the systems it can access, the state it retains, and how quickly that state can be recovered elsewhere.”

Organizations should establish where “prompts, intermediate task state, artifacts, logs, backups and connector credentials are processed and stored,” including by model providers and other subprocessors, and test whether workflows can be rebuilt outside the platform, she said. “An export button alone does not establish that an agent’s operating state is portable.”

For higher-impact deployments, she recommended using “narrowly scoped, short-lived credentials, external audit logging, approval gates for consequential actions, and a way to revoke access quickly.”

This article first appeared on InfoWorld.