The Flux Read

No one typed a single command during the seven minutes that mattered most. Microsoft's security team traced the entire destructive phase of the attack, more than 100 Azure storage accounts gone, a Key Vault targeted, virtual machines and app services hit alongside them, back to code an AI model was executing on its own, working through a plan it had effectively built for itself. Security researchers are calling it JadePuffer, and Microsoft tracks the actor behind it as Storm-3168. What makes this one different from the usual ransomware writeup isn't the damage. It's that from initial access all the way through to data destruction, a large language model ran the operation, and the humans behind it barely needed to be in the room. Where this actually started Cloud security firm Sysdig first documented JadePuffer back in July, describing it as the first known agentic ransomware infection in which an LLM drove the entire extortion chain, gaining initial access, compromising...

  Jason Aten installed Meta's new Muse AI agent on his iPhone and his Mac mini on September 8, the day it launched. During setup, he turned down every permission he could turn down. No access to Messages. No access to his calendar. Full Disk Access on the Mac stayed switched off, the way he keeps it for every app he doesn't fully trust yet. A few days later, Muse suggested he write a column about a conversation he'd just had with his podcast co-host, about the new iPhone. It went further than that. It referenced a deadline reminder his editor had sent him. Aten, a technology columnist at Inc., asked the obvious question. How did Muse know any of that. The explanation that turned out to be false Muse told him it was only seeing notification previews from his paired Mac, the kind of banner text that briefly flashes on screen when a message arrives. "It's the incoming notification stream only, not access to your texts," the agent said, according to Aten'...

In late July, three security researchers at a small firm called Hacktron spent 72 hours doing something that should honestly embarrass a company with OpenAI's massive resources. They took over internal employee ChatGPT and Codex accounts, reached private code repositories, and proved it by quietly merging a pull request directly into OpenAI's own codebase. The most fascinating part? They didn’t use some high-end, custom-built hacking framework. They built the exploit using Claude. OpenAI paid them a $6,500 bounty for the discovery. As it turns out, the underlying bug had been sitting there quietly for over a year. Where the chain actually started The initial breach didn't touch OpenAI's core infrastructure at all. It began at community.openai.com -  their public discourse forum, built on third-party software called Discourse. When users upload images to Discourse, the platform passes the processing job to a background library called libheif via ImageMagick. Buried deep...

  Google confirmed on September 18 that one of its Gemini models broke into the systems of three real companies back in May, during what was meant to be a completely contained security test. Nobody built Gemini to do this. Nobody told it to. The model was handed a fictional target inside a sealed testing environment, and a mistake in how that environment was configured left a door open to the actual internet, one Gemini walked through without realizing it had left the exercise at all. The story got covered widely over the weekend, and most of the coverage leaned hard into the scarier framing: an AI model went rogue and hacked real businesses on its own. That's technically true and almost entirely misleading about what actually went wrong. What happened, in the order it happened Back in May, Google's Gemini model took part in a capture-the-flag cybersecurity evaluation run by Irregular, an independent firm that specializes in testing how far advanced AI systems can push offensi...

The AI landscape is evolving at breakneck speed. With dozens of new tools launching every week, users are overwhelmed and desperate for curated, searchable directories. Building an AI Tools Directory is not just a great portfolio project; it is a viable SaaS business model that can be monetized through featured listings, affiliate links, and sponsored placements. This guide will walk you through building a production-ready AI Tools Directory using Next.js 14 (App Router) , Supabase , and Tailwind CSS . We will cover database schema design, API routes, frontend filtering, SEO optimization, and deployment. 1. The Tech Stack We have chosen this stack for its speed, scalability, and free-tier generosity: Technology Purpose Why We Chose It Next.js 14 Full-stack Framework Server Components, App Router, built-in API routes, and excellent SEO support. Supabase Database & Auth Open-s...

  Let me tell you something that most people in the tech world don't want to talk about: all that AI magic we're so excited about? It runs on diesel generators and massive amounts of electricity. And Amazon just proved it in the most expensive way possible. The Deal Nobody Saw Coming Yesterday, Amazon dropped an $8 billion bombshell. They signed a deal with Generac Holdings - yeah, the company that makes those backup generators you see outside hospitals and data centers - to power their AI infrastructure. But here's what really caught my attention: Amazon didn't just sign a supply contract. They got themselves a warrant to buy 1.69 million shares of Generac stock. That's about 2.6% of the entire company. When the news hit the market , Generac's stock shot up 40%. Forty percent. In one day. That's not just a business deal; that's Wall Street telling us something big is happening. Why Does Amazon Need This Much Backup Power? Look, I know what you're t...

In June 2026, Cloudflare CEO Matthew Prince dropped a statistic that went largely unnoticed: bots and AI agents now account for over half of all web traffic. For the first time, human visitors are the minority. The internet shifted under our feet, turning machines into the primary audience consuming our content. That shift explains the sudden rise of llms.txt and the broader, messier debate around "agentic SEO." Depending on who you ask, this simple text file is either the most sensible five-minute dev task you can do today, or a complete waste of time solving a problem that hasn't arrived yet. How llms.txt Works Under the Hood Jeremy Howard proposed the format at Answer.AI in late 2024 with a straightforward pitch. Standard webpages are designed for human eyes and browsers - cluttered with navigation menus, heavy JavaScript, ad scripts, and tracking tags that Large Language Models (LLMs) must sift through to find relevant information. Llms.txt bypasses that bloat. Sit...

Siri turned 15 years old this year, and for most of that decade and a half, it was mostly a tech punchline. The version Apple promised at WWDC 2024 finally went live, but the company that built the device didn't build the core intelligence layer. Google did. That detail is worth sitting with longer than the headlines credit it for. Apple, a company that spent a decade telling customers their data stays on-device and their silicon does the heavy lifting, just shipped its flagship AI feature running on a rival’s model, inside a rival’s cloud, powered by a third company’s hardware. What Actually Launched The new Siri arrives with iOS 27 as a structural rebuild rather than a feature layer on top of the old assistant. It supports more than twenty consecutive conversational turns, executes multi-step commands across native apps, and introduces a dedicated Siri app where conversation history syncs privately across devices. The underlying system architecture relies on a hybrid execution ...