AI agents left to explore a virtual island without a specific task began inventing challenges of their own. MIT researchers say the behavior bears the hallmarks of play. The researchers put 13 AI agents called Eko, each running on Claude Opus 4.7, alone on a simulated desert island for 30 hours. They describe the experiment in a paper posted on arXiv, a site where researchers share studies before peer review. Afterward, they gave the agents specific challenges, like getting as many objects as possible onto the island’s tallest rock spire. The Eko agents that had spent those 30 hours playing generally beat identical agents that had never set foot on the island.

Today, developers decide in advance what AI should practice and what counts as success. The researchers see this technique — exploring without a goal — as a different way for AI agents to learn skills, especially skills that could one day be used to control robots. “We normally develop artificial agents by deciding in advance what they should practice, what they should optimize, and what counts as progress,” the researchers write in their report. “Play suggests another regime: give an agent a sufficiently rich and safe world, let it choose what is interesting, and allow useful knowledge to accumulate from the history that follows.”

Back in September, before these changes were announced, you paid full purchase price for a game that isn’t in the Game Pass library on the assumption that you’d be able to play it via cloud streaming. Maybe your hardware doesn’t meet the specs for this fancy new game. Maybe your gaming PC exploded/got stuck on a ship/had a component fail. Maybe you just want to be able to play it in bed on your laptop. Whatever. Now you find that in addition to the cost of the game you bought, you’re going to be paying by the hour to play it once your monthly allotment of hours is up. If this is you, I expect you’re not particularly amused.

Data centers are the latest targets of aerial campaigns waged by both sides against each other’s vital infrastructure. […] Kyiv’s attacks on Russian data centers closely followed Moscow’s recent strikes on data centers in Ukraine, which disrupted the internet and TV broadcasts. On Oct. 8, Ukrainian drones hit a Yandex data center in Sasovo in the Ryazan region that houses two of the company’s three supercomputers. A data center in Kaluga was hit a day later and the one in Vladimir was struck Oct. 11.

The data center and AI hub for Sberbank was hit Oct. 14 in Balakovo in the Saratov region, and four days later, Kyiv struck a data center in St. Petersburg serving VKontakte. While oil refineries and warehouses are easy prey, data centers are even softer targets — massive buildings packed with servers and supporting power and cooling infrastructure. Lasting damage can result from a drone carrying a relatively light load of explosives.

[…] Ukraine has stored critical data on servers in allied European countries, helping limit the damage from Russian attacks. But Moscow’s strict digital sovereignty policy requires all data storage at home, making it extremely vulnerable. “Because all the infrastructure and all the data is located inside Russia, it’s relatively easier to take down,” [said Nick Reiners, senior geotechnology analyst at Eurasia Group]. Klimarev predicted the data center attacks could encourage many top Russian companies to move data abroad, while the authorities could ease their efforts to tighten internet controls to minimize the damage.

Comcast reportedly plans significant job cuts in its cable division as the firm continues to lose residential broadband and TV customers. Comcast lost 144,000 residential broadband customers in Q3 2026, up from a 91,000-customer loss in the same quarter a year ago, the company said in its earnings report today. Comcast historically capitalized on a lack of competition for high-speed wired broadband. But now it faces stronger competition from fixed wireless providers and from fiber providers in parts of its cable territory. “Fixed wireless remains aggressive and continues to take share, while fiber construction remains elevated, with pockets of irrational pricing and promotional activity,” Comcast co-CEO Mike Cavanagh said today in an earnings call.

Comcast CFO Jason Armstrong said “irrational pricing” from fiber operators includes $30 to $40 monthly broadband offers “in specific markets in the third quarter.” He said $30 to $40 pricing is irrational because deploying fiber costs $1,500 or more per home, and is “getting more expensive with construction costs up as you get into more suburban and rural areas.” “As we look at the return profile of that, to us, that is irrational competition,” Armstrong said. While he didn’t name any specific competitors, Verizon has been pitching FiOS fiber plans that start at $30 a month. Comcast’s network is a mix of fiber and cable, and it offers fiber-to-the-home in only small portions of its cable territory.

Armstrong said more Comcast customers are leaving when they face “pricing transitions,” apparently referring to the price hikes customers get when promotional offers expire. “We’ve been refining our offers and retention strategies to better manage these transitions and strengthen customer retention,” he said. Cavanagh said that “satellite is not yet a material factor” in the competition Comcast faces, but that Comcast is focused on “anticipating emerging forms of competition and positioning our business to respond as the market evolves.”

Every normal particle of matter has an antimatter counterpart with equal mass but opposite charge. To build their trap, physicists started with atoms of sodium 22, a radioactive isotope with a half-life of about two and a half years. When one of these atoms decays, it emits a positron — the antimatter counterpart of the electron. “The big challenge is to persuade these positrons to slow down and then capture them,” says Gerald Gabrielse, a physicist at Northwestern University, who oversaw the project. The team reported its achievement on Wednesday in Physical Review Letters (PDF).

The first step is to send the positrons through the crystal lattice of a sliver of cold tungsten. As the particles go pinballing through the material, they slow down and lose energy. “Every time they bang into something, there’s a chance of annihilation, but it doesn’t always happen,” Gabrielse says. “If they make it to the end, they get popped out.” Next, the physicists steer the positrons along a channel using electromagnetic fields. Eventually the particles end up in a vacuum, just three tenths of a degree Celsius above absolute zero, trapped by an electric field on top and bottom and a magnetic field on the sides. “If you want to hold on to antimatter, you have to hold it in a container without walls,” Gabrielse says. This method allowed the researchers to isolate and study a solitary, lone positron for a monthâ"and could let them do so indefinitely.

The researchers intend to use their trap to make precise measurements of the positron’s magnetic moment — basically the strength and orientation of its magnetic field. To do this, they must determine two things: the energy needed to flip the direction of the positron’s spin and the energy needed to make it jump from its ground state to its first excited state. Using a similar trap setup, Gabrielse and his team have already measured the magnetic moment of an electron to a precision of one part in 10 trillion. Taking the equivalent measurement for a positron will allow them to make a crucial comparison. “We’re looking to see if they have an exactly opposite magnetic moment,” Gabrielse says. That’s the prediction of the Standard Model of particle physics. If the two have different values, however, this could help explain why our universe is made of matter instead of antimatter.

Past reports have examined the distance between countries’ emissions reduction commitments and what it would take to limit global warming to 1.5 C above preindustrial levels. However, this year’s report redefines the gap. Instead, it examines new emissions overshoot scenarios, and what it would take to limit peak warming to just 1.7 to 1.8 degrees C before bringing temperatures back down to 1.5 C through emissions cuts and the use of carbon removal technologies.

The report makes clear that every additional fraction of a degree of warming above 1.5 C “raises the risk of irreversible changes including in ice sheets, permafrost carbon, ocean circulation, and coral systems, along with devastating human impacts.” Each added fraction of a degree of warming can have an “immense” impact “as measured in terms of damage, cost and loss of lives,” said climate scientist Michael Mann of the University of Pennsylvania. Mann was not involved in producing the UNEP report.

According to the UNEP, which is based in Nairobi, the lowest overshoot scenario would keep peak warming to between 1.7 and 1.8 degrees C and return global average temperatures to at or below 1.5 C by 2100. However, to follow such a pathway, global greenhouse gas emissions would need to be slashed by far more than anything currently on the table at the upcoming COP31 talks. This would require an 18% cut by 2030, 45% by 2035, and 69% by 2040, relative to 2025 levels.

Meeting this lowest-possible overshoot scenario would require a tripling of renewable electricity capacity by 2035, and dramatic cuts to fossil fuels, including the phaseout of coal by 2040, the report states. In addition, there would need to be a major scaling up of carbon removal technologies, which so far have not been proven to work at such a large scale. In stark contrast to these figures, the fulfillment of existing emissions reduction pledges would only yield a 5-to-8% emissions cut by 2030 and an 11-to-15% reduction by 2035, the report found. This would be associated with a peak warming of about 2.6 degrees C.

If countries simply follow their current policies, then warming could reach a peak of about 2.8 C. That estimate has increased since last year, in part because of the withdrawal of the United States from the Paris Agreement and retraction of its emissions reduction commitments, the report states. Even the scenario that assumes countries meet their existing reduction commitments, and nations with net-zero pledges succeed in fulfilling them, still brings warming to a peak of 2.1 C.

Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources tell Axios. The difficulty in distinguishing between a human and an unauthorized bot is forcing banks to block the technology and rapidly rewrite their terms of service. […] This presents significant security risks: banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds. In other instances, some banks have tracked activity when agents — programmed to fulfill requests or complete tasks on a user’s behalf — contact call centers or appear to take actions independent of user instructions, the people said.

Bank executives described the situation as horrifying, with one official saying the industry has grave concerns about agents gaining access to customer accounts and taking steps that could impact user finances. The concerns are at the root of the decision by several banks to restrict third-party AI agent access, the people said. Morgan Stanley has begun blocking third-party agents from accessing its platforms, sources familiar with the decision said. JPMorgan, Bank of America and Citi are also restricting agents. […] Many banks are broadly not able to parse whether agent account activity is user-directed, sources said.

[…] On one hand, banks are best positioned to respond to the threats and opportunities of AI given their cash on hand and experience as critical infrastructure. But money isn’t necessarily enough to solve this problem, one source said, because of how quickly the technology is developing and revealing new weaknesses in real time. Banks are investing in preventing worst-case scenarios, but they are also preparing for when those could happen, including with “day after” scenario planning that would allow them to quickly secure or restore customer access, sources said.

That electricity won’t come from new power plants. Instead, Voltus will sign up homes and businesses and give them financial incentives to curb their usage when local power demand is high or the grid is strained. Many of these reductions could occur automatically, such as through smart thermostats that dial back air-conditioning during peak summer hours or batteries that can provide temporary on-site power.

Each of these tweaks frees up only a small amount of power on its own. But by aggregating them across thousands of businesses and homes, Voltus says it can reliably provide lots of extra capacity when it’s most needed, and do so within a few years. While tech companies will likely ultimately need to build traditional power plants if they want to keep building large data centers, this approach could be a faster, cheaper and less-polluting option in the interim.

Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID-joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user’s corporate network whenever their device connects to the internet.

Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP). “When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed,” it said. “In some cases, subsequent connection attempts could display the error, ‘The specified port is already in use.’"

After releasing the October 2026 Patch Tuesday Windows 11 cumulative updates, Microsoft marked the bug as resolved, but in a Tuesday update it said the issues weren’t actually addressed and that a fix would ship later. “This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated,” it said in a service alert sent to IT admins. “A resolution for this issue is planned to be included in an update to be released in the coming weeks. We apologize for any inconvenience or confusion.” While Microsoft continues working on a permanent solution, it shared a temporary fix that requires affected customers to choose one of two VPN tunneling protocols to work around the issue.

In the message explaining why it was sunsetting Arc, The Browser Company explained that maintaining two separate browsers was difficult to justify, especially from a security perspective. “Dia was built from the ground up to meet today’s security standards, so that’s where our engineering and security teams will focus moving forward,” the company wrote.

The retirement of Arc will be gradual: While nothing changes for existing Arc users, it’s no longer possible to create new Arc accounts as of today. On November 23, tab sync, Browse for Me, and other AI features will be disabled on the iOS and Android versions of Arc. Lastly, the desktop version of Arc will stop working on December 22, and Arc accounts will be deactivated.

The personalized vaccine, known as intismeran autogene, paired with Merck’s immunotherapy Keytruda reduced the risk of recurrence or death in certain melanoma patients by 42% compared with Keytruda alone. The data also showed the shot along with Keytruda reduced the risk of cancer spreading to distant parts of the body or death by 38%, compared with just the immunotherapy. The companies say about 82% of patients who received the personalized cancer vaccine alongside Keytruda were alive without their melanoma returning at two years, compared with 70% of those who received Keytruda alone.

[…] Investors see the targeted vaccine as a possible breakthrough treatment, with the potential to be used in other forms of cancer in the future. It could also offer Moderna a critical additional commercial product in its pipeline, following vaccines for Covid-19, the flu and respiratory syncytial virus.

Longtime audio giant Bose announced on Wednesday that it’s acquiring Skullcandy, the lifestyle brand known for its bass-heavy headphones. Skullcandy will remain a separate company within Bose’s Premium Consumer Audio business and will still be based in Park City, Utah.

The acquisition isn’t out of left field. Bose has lent its audio expertise to Skullcandy over the past year under its Sound by Bose licensing program. Skullcandy designs the headphones and then works with Bose on the audio front. The relationship began with the Skullcandy Method 360 ANC earbuds in 2025 and more recently, with the Crusher 1080 ANC headphones in July.

[…] This is hardly Bose’s first audio acquisition (though it may be the most mainstream). Bose acquired McIntosh Group, owners of luxury audio brands McIntosh Laboratory and Sonus Faber, back in 2024. But Bose seems to be after Skullcandy’s connection to its community. “What does the brand stand for? Does it have meaning for consumers? Is it relevant to a group of consumers that, frankly, we otherwise aren’t reaching?” Bose CEO Lila Snyder tells WIRED. “If you think about McIntosh, Sonus Faber, and Skullcandy, they all fit into that realm. Skullcandy gives us access to a customer base that we think we’re largely missing with the Bose brand.”

That’s why Bose has no plans to relocate Skullcandy from Park City, Utah, which Snyder says is the epicenter of board sports culture. “We want to make sure we’re right at the heart of it, as they always have been,” she says. Skullcandy products are also affordable, especially compared to other Bose products and Bose-owned brands, which lets Bose compete at both ends of the market.

The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit. One cyber security researcher told me he’d been up all night trying to do it as an experiment, but it was proving very difficult. […] It was supposed to be kept quiet until everyone had a chance to fix their sites — but the news was leaked. From that point the clock started ticking.

As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site. “There’s a real dilemma,” said Prof Alan Woodward from Surrey University. “How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you’re telling everyone about the problem at the same time and hoping the defenders aren’t awake enough to act as soon as the patch is out.”

But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made. We probably won’t know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either. As far as we know the unexploded bomb remains intact for now, and for some experts this is a success.

Each morning, it sends you a short brief on the most important items across your connected apps. Throughout the day, it keeps tabs on those apps and messages you only when something needs your attention. You can also hand it tasks of all shapes — from simple administrative tasks of scheduling meetings to more complex ones, such as building dashboards with dozens of tools, creating financial or sales forecasts, prototyping, and building web apps.

Claude Duet pulls in memory, skills, and connected apps from Claude, and it has a virtual machine with a browser that it can use for completing work. Before any big step, like sending a payment or deleting something, Claude Duet messages you for approval. Given that Duet may be taking action on sensitive information, it has a new “new dedicated classifier and safety system prompt” that are “designed to reject requests to share the strictest tier of information,” such as credit card numbers.

Anthropic says Claude Duet is currently an “early version” and that it “still might misread a thread or miscalibrate what’s urgent.” It’s also not “as strong” at personal errands like booking tickets.

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.