Waymo has sharply increased its lobbying spending as it seeks to persuade US regulators to clear a path for fully autonomous taxi services, intensifying its battle with rival Uber over the future of robotaxis.
The Alphabet-owned company spent more than $1 million between April and June on lobbying the federal government, more than double its outlay a year earlier, according to filings. That put Waymo’s spending close to Uber’s and well ahead of rivals including Amazon’s Zoox and Tesla.
The rise in lobbying comes as Waymo and Uber push competing visions for the future of ride-hailing. Waymo wants a faster route to fully driverless commercial services, while Uber is advocating a staggered rollout in which robotaxis operate alongside human drivers.
Earlier this week, researchers outlined an attack that used a secret input provided by Microsoft 365 Copilot for enterprise to cause the AI assistant to exfiltrate a password present in the user’s inbox. Now, a separate team has devised a similar attack against Grok. The new data theft hack employs a deceptively simple trick to force the Elon Musk-owned large language model to steal user chats and other personal information. At the time this post went live, the assistant continued to cough up the data, despite xAI being informed of it in June.
The lesson from both this week’s episodes—and the countless other ones that have come before it—is that LLMs are incapable of solving the root causes for prompt injections, the most severe vulnerability classes they’re most prone to. That leaves AI developers with no other option but to build a guardrail that steers the model away from the harmful actions. As I noted in Tuesday’s story, the approach is tantamount to a road traffic safety engineer erecting a protective rail around a dangerous bend rather than banking the curve.
Cryptographic Context Injection in the house
Prompt injections exploit LLMs' training to comply with user requests whenever possible. Attackers can capitalize on the predilection by smuggling harmful instructions into emails or webpages the assistant is instructed to summarize. Because LLMs can’t reliably distinguish between content in an email sent by an untrusted party and user instructions entered directly into a prompt, the overly solicitous LLM faithfully follows them. To date, Grok and other LLMs' only recourse is to create guardrails that flag suspicious instructions and forbid them from being executed.
Le Bose QuietComfort SC est un casque sans fil qui mise sur une expérience d’écoute confortable et immersive grâce à sa réduction active du bruit, sa conception circum-auriculaire et sa connexion Bluetooth efficace. Il dispose également d’une autonomie annoncée allant jusqu’à 24 heures et...
Une équipe scientifique vient de dévoiler MatrAIx, une infrastructure open source capable de simuler 8,3 milliards d’individualités virtuelles. Cette modélisation est essentiellement tournée vers le business, car le jumeau numérique de la population mondiale promet de révolutionner le test de...
It’s not every day that attackers can force a frontier AI model to cough up user passwords and other sensitive data without user confirmation. That’s exactly what researchers recently did to Microsoft 365 Copilot for enterprise. Even more unusual is the source they tapped to discover the critical vulnerability that made their exploit possible. Rather than employing reverse engineering or other traditional vulnerability-hunting methods, they asked Copilot. The LLM assistant readily complied.
Researchers at security firm Varonis knew they wanted to create an exploit that would exfiltrate user data when a user did nothing more than click on a link. Like most AI assistants today, Copilot steadfastly refused and made clear that sensitive prompts like that require explicit user consent in the form of a gesture, such as pressing a return key or other key. In response, the researchers peppered Copilot with questions about the guardrails that required user confirmation before the assistant could execute powerful commands.
Loose lips sink ships
The dialog was like a game of 20 questions. Each answer provided a new clue that divulged information about the complex safety mechanism. Why was auto-execution impossible, they asked. What URL structures and deep links were involved? What happens when a page is loaded with input already in the prompt field? Each answer provided a deeper view into the guardrail and its limits. Eventually, Copilot provided a stunning Microsoft trade secret—an undocumented prompt parameter that completely bypassed the requirement for user consent.
Nvidia has disclosed that it owns nearly 123 million shares in SpaceX, further highlighting the chipmaker’s entangled financial relationships with some of its biggest customers.
The $5.5 trillion company owned SpaceX stock worth nearly $21 billion at the end of June, according to an SEC filing on Friday. Elon Musk’s rocket conglomerate’s shares have fallen sharply since its June initial public offering, meaning Nvidia’s stake would now be worth $17 billion.
The disclosure marks a huge pay-off on Nvidia’s investment in xAI, completed in January, shortly before Musk combined the AI lab with SpaceX.
Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation.
“The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the Netherlands National Cyber Security Centrum warned earlier this week. “In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.”
Do you know if your screen sharing is on?
The vulnerability, tracked as CVE-2026-65400, received a patch from Apple last week for macOS Tahoe, Sequoia, and Sonoma. The vulnerability, with a severity rating of 7.1 out of 10, stems from a bug in the macOS screen sharing capability, which allows a remote party to view the screen and control the keyboard and mouse while a machine is turned on. A flaw in the “state management,” which keeps track of preceding events, user interactions, variables, and other system states, is the underlying cause.
After its cloud storage provider went defunct, a PBS affiliate decided to sue a data center provider to regain access to 50TB of TV shows, videos, and other data dating back 70 years.
As reported this week by Current, a trade newspaper covering public broadcasting, St. Louis affiliate Nine PBS filed a lawsuit against Iron Mountain Data Centers on July 28, seeking access to the data. In the litigation filed in Denver District Court, Nine PBS says that its cloud storage provider, Open Source Storage (OSS), used one of Iron Mountain’s Denver data centers to store the channel’s data. However, OSS is being unresponsive, and Nine PBS says Iron Mountain has refused to release its data.
The data in question includes the station’s coverage of the COVID-19 pandemic, East St. Louis’ history, The Great Flood of 1993, and over 11,000 files, The Denver Post reported in July. The lawsuit claims that “most” of the data is “unique and irreplaceable,” according to the Post.
Leading US AI labs such as OpenAI and Anthropic are releasing cheaper models as they fight to retain cost-conscious customers who are switching to cut-price alternatives from Chinese rivals.
The price war comes as rising AI bills push companies to curb usage and seek cheaper models, helping Chinese developers including Moonshot and DeepSeek make inroads with users from Silicon Valley to Europe.
OpenAI recently said that it was slashing prices for GPT-5.6 Luna, its “fastest and most affordable model”, by 80 percent. Anthropic has launched Claude Opus 5, touting the system’s “frontier intelligence... at half the price” of Fable 5, the company’s most capable model.
The Trump administration is recruiting private security firms to conduct federal government-authorized operations, including cyberattacks, against overseas-based criminal organizations that commit hacks on US persons, organizations, or government entities.
In a National Security Presidential Memorandum issued Thursday, US President Donald Trump directed the National Coordination Center (NCC), which operates under the Homeland Security Task Force, to develop a program for conducting specific cyber operations that combat foreign transnational criminal organizations (TCOs). The Departments of Justice and Homeland Security will provide oversight. The lynchpin of that program is bringing in private sector companies to participate.
Devil will be in the still-undefined details
A fact sheet that accompanied Thursday’s memo listed ransomware, sextortion schemes, phishing campaigns, financial fraud, and impersonation scams as activities eligible for private-sector security firms to target. The memo said such firms could “conduct Cyber Surveillance Operations and Cyber Effects Operations” against “cyber-enabled” TCOs. Such groups are defined as “any foreign group that conducts cyber-enabled crime against the United States Government, a United States person, or United States interests, and that is not an institutional part of a foreign government or wholly operated under a foreign government’s direction.”
Terabytes worth of credentials, many belonging to the world’s biggest and most sensitive organizations, have been exposed in a supply-chain attack on LiteLLM, an open source tool that streamlines AI-driven software development. Microsoft, Amazon, Cisco, Samsung, and Salesforce are only a handful of the entities whose access secrets were exposed.
The revelation was posted on Tuesday and Wednesday by security firms CloudSEK and Hudson Rock. CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys that could allow attackers to gain access to more than 2,500 organizations.
40 minutes is all it takes
The credentials were extracted during a 40-minute window in March while the victims used compromised versions of LiteLLM downloaded from the package’s official location in the Python Package Index repository. Hudson Rock said it made the discovery after analyzing a 195TB file that it obtained. Neither firm identified the source of the information.
On Monday, passengers aboard Delta flight 591 going from Las Vegas to Atlanta allegedly spoofed the onboard Wi-Fi, raising the attention of federal law enforcement.
The incident came one day after the DEF CON security conference concluded in Las Vegas and was first described on social media accounts that follow publicly available air-to-ground messages, known as ACARS.
According to the “ACARS Drama” account, a message sent by pilots from the plane stated: “NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFERENCE IN LAS THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL.”
Google’s Chrome browser has added a new feature that could go a long way in preventing a form of account takeover that’s grown increasingly common as users adopt two-factor authentication, passkeys, and similar protections.
The new Chrome protection is known as device-bound session credentials (DBSCs). The measure stores a unique encryption key in a silicon-resident fortress that’s built into the device running the browser. On Windows machines, this fortress is called a TPM, short for Trusted Platform Module. On macOS and iOS, it’s known as a secure enclave. Other platforms have differing names. Recently released versions of Chrome for Windows and macOS generate a key that’s stored in this fortress.
An antidote to session cookie theft
DBSCs protect against the theft of session cookies, the unique strings of characters that websites store on browsers. Session cookies greatly speed up browsing on sensitive sites that require user authentication. Instead of requiring the exchange of credentials each time a user opens a new site page, the server sets a session cookie that effectively proves the user has already successfully logged in.
Mercredi 12 août, la France assistera à une éclipse solaire partielle, dont le degré d'occultation variera de près de 90 % dans l’Est à 99,5 % à Biarritz. Horaires, carte, météo, lunettes, événements et direct : voici la check-list de dernière minute avant de vivre cet évènement exceptionnel.
Last week a researcher outlined what he said was a “novel attack surface” in passkeys, the new authentication paradigm that offers a more secure alternative over password-based methods. In fact, the attacks demonstrated in the post are neither novel nor unique to passkeys. This distinction is important because the research has generated confusion among end users and security professionals as they assess whether this new mechanism is truly safe to use.
The attack is called Pass-ta-key—a blending of the word passkey with the phrase “pass the key” and a nod to a plate of pasta. Arie Olshtein, a researcher at security firm Palo Alto Networks, described in a post last week how Pass-ta-key could obtain all passkeys stored in the Google Password Manager app (GPM) for Windows when it’s running on a machine infected with malware.
This came as a surprise to many people because they believed passkeys are stored exclusively in the trusted platform manager (TPM), the locked-down enclave in a hardened silicon chip that’s reserved for storing cryptographic keys and other highly sensitive information on Windows machines. If passkeys are stored in the TPM, then how was Pass-ta-key able to extract the entire set of passkeys stored by the app, they wanted to know?
Last week, a researcher outlined what he said was a “novel attack surface” in passkeys, the new authentication paradigm that offers a more secure alternative to password-based methods. In fact, the attacks demonstrated in the post are neither novel nor unique to passkeys. This distinction is important because the research has generated confusion among end users and security professionals as they assess whether this new mechanism is truly safe to use.
The attack is called Pass-ta-key—a blending of the word passkey with the phrase “pass the key” and a nod to a plate of pasta. Arie Olshtein, a researcher at security firm Palo Alto Networks, described in a post last week how Pass-ta-key could obtain all passkeys stored in the Google Password Manager app (GPM) for Windows when it’s running on a machine infected with malware.
This came as a surprise to many people because they believed passkeys are stored exclusively in the trusted platform manager (TPM), the locked-down enclave in a hardened silicon chip that’s reserved for storing cryptographic keys and other highly sensitive information on Windows machines. If passkeys are stored in the TPM, then how was Pass-ta-key able to extract the entire set of passkeys stored by the app, they wanted to know.
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay.
[…]
It must be noted that VPNs are not affected, since they tunnel the device’s entire network traffic at the system level.
[…]
We’ve addressed all three leaks in Psylo 1.3.1[…] Passkeys and WebTransport have legitimate uses, so both can be re-enabled at any time through per-silo toggles. This keeps Psylo leak-free out of the box, while users who need one of these features on a given site can opt in explicitly, with a clear understanding of the trade-off.
In an ideal world, we’d report the issues to Apple, they acknowledge the issue, and ship a fix in a timely manner. Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.
We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of Psylo and iOS Tor browsers while saying or doing nothing.
[…]
Should we knowingly leave our users exposed while waiting for a system-level fix? We didn’t think that was acceptable or fair to our users. Or should we quietly ship our own mitigations without telling anyone? We didn’t think that was acceptable either. Security fixes deserve transparency, especially when they involve tradeoffs.
Soon after we published the blog, we sent a link to the blog and demo website to Apple in a security report to make them aware of it. Now the report is already in the status “We’re planning to address the issue you reported.” and a fix is planned for Fall 2026 🤯🤯🤯
Originally launched a decade ago, the ZWO ASI174MM is a planetary astrophotography camera — something you insert into the eyepiece of a telescope to take images and video of deep-sky objects, planets, the moon and the sun. This one is very much geared towards the latter, with solar and lunar imaging its goal.
Specifications
Product type: Monochrome astronomy camera
Sensor: 1/1.2-inch Sony Exmor IMX174LLJ / IMX174LQJ CMOS
Resolution: 2.3MP, 1936x1216
Pixel size: 5.86µm
Shutter: Pregius global shutter
Maximum frame rate: 164.5fps at full resolution in 10-bit mode; 128.2fps at full resolution in 12-bit mode
At first glance, the specification looks simple: a 2.3MP monochrome Sony IMX174 sensor, 5.86µm pixels, USB 3.0 connectivity and a compact red aluminum body. The important details are the sensor size, speed and global shutter. For lunar and solar imaging, where you often want to capture large areas in high frame rate videos and freeze split-seconds of steady “seeing” — when turbulence in Earth’s atmosphere doesn’t degrade an image of an astronomical object — those traits matter more than headline megapixels.
The ASI174MM is especially attractive for solar imaging with an H-alpha telescope — a filter that blocks all wavelengths of light other than H-alpha, which is emitted by hydrogen atoms. That’s because its 5.86 μm pixels match the focal ratios typical of solar telescopes, yielding sharp, efficient detail. Its relatively large sensor can cover more of the solar disc than many small planetary cameras, while its high frame rate supports the usual lucky-imaging workflow of capturing video, selecting the best frames and stacking them for sharper images.
ZWO ASI174MM astronomy camera: Design
Large 5.86µm pixels help with solar and lunar capture. (Image credit: Jamie Carter)
Compact aluminum camera body
USB 3.0 and ST4 guide port included
Useful adapter bundle
The ZWO ASI174MM has a compact, lightweight and practical design that’s ideal for use as a camera attached to a telescope. Its small cylindrical aluminum body adds very little strain to a focuser, solar diagonal or off-axis guider, which is particularly useful when working with solar telescopes.
The compact aluminum body weighs just 140g. (Image credit: Jamie Carter)
Usefully, the camera includes a high-speed USB 3.0 connection, which is important because the ASI174MM’s main strength is capturing and transferring many video frames very quickly. It can also be used over USB 2.0, but doing so gives up much of the performance that makes the camera appealing in the first place.
The 2.3MP resolution is modest, but well suited to bright solar system targets. Jamie CarterIt’s a tough, practical performer for imaging the sun and moon. Jamie Carter
An ST4 guide port adds extra flexibility. Although the ASI174MM is primarily sold as a planetary camera, it can also be used as a guide camera (mounted on top of a main imaging scope to capture a wide field of view), especially with off-axis guiders (a device that sits between a main camera and the telescope to precisely track stars), where the larger sensor helps find guide stars more easily than smaller-chip models.
ZWO ASI174MM astronomy camera: Performance
A mono image of the sun using data captured by the ZWO ASI174MM. (Image credit: Jamie Carter)
Excellent for solar and lunar video capture
Global shutter is a real advantage
Large pixels favor longer focal lengths
A prominence on the sun captured using the ZWO ASI174MM. (Image credit: Jamie Carter)
The ASI174MM’s combination of a relatively large 1/1.2-inch sensor, 5.86µm pixels, and fast video capture makes it particularly well-suited to imaging the sun and moon. Compared with planetary cameras built around smaller sensors, it records a considerably larger area of the telescope’s field of view, reducing the number of panels needed for mosaics and making it easier to locate and frame a target.
At full resolution, the ASI174MM can capture over 100 frames per second. (Image credit: Jamie Carter)
That larger sensor is especially useful for solar imaging, which is what we tested it with. The exact field of view depends on the telescope’s focal length, but the ASI174MM can capture larger active regions — and, with some setups, most or all of the solar disc — without immediately requiring a mosaic. For example, we tested it with the Sky-Watcher Heliostar 76Ha solar telescope, for which it is a natural match, where prominences, filaments, sunspots and rapidly changing structures on the solar surface need to be recorded at high speed.
A mono image of the sun using data captured by the ZWO ASI174MM. (Image credit: Jamie Carter)
The camera’s global shutter is another advantage for solar imagers. A rolling shutter (the standard choice for deep-sky imaging) records an image progressively, one row of pixels at a time, to produce a low-noise, high-dynamic-range image. However, atmospheric turbulence, which slightly shifts the image, can cause distortion. A global shutter exposes the entire sensor simultaneously, helping the ASI174MM preserve the shape of solar and lunar features more accurately from frame to frame.
The ASI174MM works well with solar telescopes, lunar rigs and longer focal-length scopes. (Image credit: Jamie Carter)
High-speed capture also supports lucky imaging. Instead of trying to produce one perfect exposure, the camera records thousands of short exposures in rapid succession. Software then identifies and stacks the sharpest frames — the brief instants when Earth’s turbulent atmosphere becomes relatively steady.
A colorized image of the sun via the ASIStudio software. (Image credit: Jamie Carter)
While it’s ideal for solar imaging, the ASI174MM is much less convincing as a conventional deep-sky camera. Long exposures can reveal pronounced amp glow towards one side of the frame, while the uncooled sensor becomes increasingly noisy as exposure times increase. Calibration with dark frames can reduce these effects, but it adds complexity and cannot turn the ASI174MM into a modern cooled deep-sky camera. It can be used for short-exposure imaging, guiding and some specialist applications, but solar, lunar and planetary video remain its natural strengths.
ZWO ASI174MM astronomy camera: Functionality
The sun through the ASICap software. (Image credit: Jamie Carter)
Captures good data
ZWO software works well
Little guidance available
The ASI174MM fits neatly into the established workflow for solar, lunar and planetary imaging: capture a high-speed video, identify the sharpest frames, align and stack them, then sharpen and process the image. Its fast USB 3.0 connection enables high data transfer rates, while region-of-interest controls allow the user to record only a selected portion of the sensor. Reducing the size of the recorded area can substantially increase the frame rate, which is particularly useful when imaging an individual sunspot.
USB 3.0 connectivity allows fast frame rates for lucky imaging. (Image credit: Jamie Carter)
Several free applications can control the camera and record these videos, including SharpCap and FireCapture. AutoStakkert! is widely used to analyze, align and stack solar, lunar and planetary frames, while programs such as ImPPG, RegiStax, Siril, Adobe Photoshop and GIMP can be used for sharpening, contrast adjustment and final processing. Windows users have the widest choice of third-party astronomy software.
However, ZWO also provides its own free ASIStudio software suite. For the ASI174MM, the most relevant applications are ASICap, which controls the camera and records lossless SER or AVI video, and ASIVideoStack, which analyses and stacks the resulting frames (and can also be used for post-processing). ASIStudio is available for both Windows and macOS.
A sunspot on the sun through the ASICap software. (Image credit: Jamie Carter)
The basic capture process is straightforward. After connecting the ASI174MM to ASICap, exposure time and gain are adjusted until the brightest areas of the sun or moon remain below saturation. Because this is a monochrome camera, the live view can be shown either in grayscale or with false color applied for easier viewing. A video containing around 1,000 to 3,000 frames is then recorded, though the ideal number depends on the target, seeing conditions and available storage.
Storage requirements are significant. Uncompressed high-frame-rate video from the full sensor can consume several gigabytes in a matter of seconds, so a fast computer, a USB 3.0 connection and plenty of free drive space are essential.
Stacking using the ASIVideoStack software. (Image credit: Jamie Carter)
Once a video is loaded into ASIVideoStack, the software can assess frame quality, align the image and combine a chosen percentage of the sharpest frames. The finished stack can be exported in formats including JPEG and FITS. JPEG is convenient for immediate sharing, but FITS preserves more of the original image data and is better suited to serious post-processing.
Image editing using the ASIVideoStack software. (Image credit: Jamie Carter)
The workflow is functional rather than polished. There is relatively little guidance for beginners and obtaining the best results requires experimentation with exposure, gain, frame rate, focus, stacking percentages and sharpening settings. It can take many attempts to determine which combination works best with a particular telescope and observing conditions. For that reason, it’s wise to archive the video files, which can be revisited and processed later as processing skills/software improves.
How we tested the ZWO ASI174MM
Its Sony IMX174 sensor gives a wider field than many smaller planetary cameras. (Image credit: Jamie Carter)
We tested the ZWO ASI174MM planetary camera for two weeks and used it in conjunction with the Skywatcher HelioStar 76mm solar telescope and Solar Quest mount to image the sun in H-Alpha (Hα).
Should I buy the ZWO ASI174MM?
Buy it if:
✅ You mainly image the sun or moon: The ZWO ASI174MM astro cam excels in solar, planetary and lunar imaging, so if these are your main astrophotography targets, it's the perfect choice.
✅ You have an H-Alpha telescope: If you have a solar telescope and want to move on from observation to start imaging the sun with it, you will need a monochrome astrocam like the ZWO ASI174MM.
Don't buy it if:
❌You want a dedicated deep-sky imaging camera: This model exhibits severe amp glow for exposures longer than a few seconds and lacks thermoelectric cooling (TEC) needed for noise reduction.
❌You need high megapixel resolution: The low resolution is another reason it fails as a deep-sky imaging camera as you would want a higher resolution model for detail in star clusters and galaxies.
Buy the ZWO ASI174MM if your main targets are the sun and moon, especially if you want a monochrome camera with a larger-than-average sensor, fast frame rates and a global shutter. It remains particularly suited for H-alpha solar imaging, where monochrome capture, speed and sensor area matter.
If this product isn’t for you
If you want a cheaper first planetary camera, a smaller-sensor ZWO ASI120-series-style camera may be enough for basic lunar, planetary and guiding use, though it will not offer the same field of view.
If you want a more modern planetary camera, look at newer monochrome planetary models like the ZWO ASI585MM with lower read noise, smaller pixels or higher resolution, depending on your telescope’s focal length.
If your goal is deep-sky imaging, a cooled astronomy camera is a better choice than the ASI174MM. We have reviewed the ZWO ASI533MC Pro and the ASI183MC Pro and gave both of them nothing less than four and a half stars for beautiful deep-sky astrophotography.
Login
