VC-backed companies are spending more and more on tokens, but mainstream corporate America does not need the latest model and is unwilling to pay for it. As long as agentic AI and token spending are confined to a small part of the economy, the macroeconomic effects of AI will be very limited…

The question looking ahead is whether, even as models become commoditized, mainstream corporate America can turn increasingly cheap intelligence into higher revenue growth and higher profit margins. That may be harder than it sounds. AI may be a great calculator, but in business, intelligence is mostly judgment. Judgment depends on context, and the answer varies with which human or which model you ask. Perhaps most importantly, AI does not understand accountability, trust, culture, unwritten rules, ethical trade-offs or fairness, all of which shape reputational risk and ultimately drive revenue growth and profit margins.

The bottom line is that the AI story will be decided in the S&P 493, not the Mag 7, and so far, there is no evidence that revenue growth or margins are improving outside the tech sector.

Apollo’s Torsten Slok focuses on what he calls the S&P 493 — the S&P 500, minus Alphabet, Amazon, Apple, Meta, Microsoft, Nvidia and Tesla — finding that profit margins and revenue per worker appear to be flat, with no evidence that AI is improving productivity…

Recent studies have also found that AI has yet to deliver significant productivity gains.

Google updated its privacy policy to clarify that it could use information shared through Personal Intelligence to personalize ads. Gmail, Drive, and Photos content isn’t used for targeted ads by default, but connecting them to eligible Google services could change that.

Google has long promised that your Gmail, Drive, and Google Photos content never helps it personalize ads. However, since October 16, 2026, its privacy policy adds a catch. The promise lapses if you let other ad-showing Google services use that content. That means using Personal Intelligence, an opt-in tool that lets Google’s AI search read your connected apps, does exactly that (via Google).

If you ask Google’s AI Mode where to eat near your hotel, and it can identify your hotel from the booking confirmation in Gmail, find the location in Maps, and then suggest a few places you might like. That’s the helpful half. The twist, however, is that AI Mode can also show sponsored results. Google mentions that the personalized ads follow what the question and answer are about. So, while your inbox never goes to an advertiser, it can quietly shape the answer, which, in turn, shapes the ads.

Google’s defense is elaborate. First, it says connecting the apps is optional. Second, advertisers can’t see the information or content Google accesses in your Workspace apps (including your inbox and photos). Finally, sensitive topics like health are off-limits.

If you want to ensure ads never use your personal data in this way, you’ll need to make sure Personal Intelligence is turned off. The easiest way is to access the Gemini settings for Personal Intelligence and disable the connected apps. These settings are also a few levels deep in your main Google account settings under Data & privacy > Personalization settings > Manage Personalized Recommendations in Search Services > Connected Content Apps. From there, you can disable connections to Workspace and Google Photos.

You may join us virtually, or if you are in Boston, Massachusetts, United States (the FSF’s home base), you can join us in-person at the Boston Public Library’s Copley Square branch. You may also join us in-person at MakeHaven in New Haven, Connecticut, US, and meet our deputy director Sean O’Brien. Whether attending our event online or in-person, please register. It will help us plan ahead and enable us to contact you about other important details before the workshop, like what to expect and what to bring…

Bulk surveillance violates our fundamental rights and makes free speech dangerous. Email encryption is an excellent tool you can use to shield yourself from bulk surveillance. Encrypting your email is also a concrete step towards protecting your data from others whose intentions may not be honorable.

A certificate authority’s decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements… [In a press note the company added] that data sovereignty and compliance requirements had increased the business’s complexity and cost… The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced…

Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance. “The last thing organisations need is to migrate twice,” Kadakia said.

Replacing a website’s certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices. “The harder finding for many organizations will be that they can’t answer these questions at all,” Grover said, referring to where certificate trust decisions are made outside browsers and operating systems…

Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.

Last week, Getty announced plans to file for bankruptcy, marking a major reset after its planned merger with rival Shutterstock collapsed under the weight of heavy debt and growing competition from AI-generated imagery.

Getty said the affiliates of the Getty family and Koch Equity Development, which committed to provide up to $533 million in new equity, will own 100% of the company after the restructuring

It’s hard to compete against things like the DALL-E image generator.

Cellular transformations can be done in two main ways. The first, more circuitous route turns a specific cell back into a pluripotent stem cell, or an embryonic “blank slate,” and then into a different cell type. The second method involves a “direct conversion,” which skips the middle stage and directly transforms a cell into a different type. “Using this method, we have directly converted red blood cell precursors into neural stem cells,” summarizes Oliver Brüstle, the director of the Institute of Reconstructive Neurobiology at the University Hospital of Bonn…

The researchers used a virus to deliver two transcription factors, or proteins that attach to DNA to regulate gene activity, to get the cells to change their types. Then they used two genome-bloodhounding methods — DNA methylation measures and RNA sequencing — to track the resultant anti-aging effects and genetic behavior. By the 12th day after the viral “infection,” the cells started showing their new identity, ditching their blood-like proteins and replacing them with the expression of neural-like proteins instead. Initially, the epigenetic age (the DNA changes accumulated over time) of the EPCs was highly correlated with the chronological age of their donors [but] the neuronal stem cells kept getting younger as they got older… Over the following 50 to 100 days, they kept de-aging, eventually reaching about 5 percent of the donor age, with the majority of epigenetic age-related traits resetting by around 50 days of the conversion process…

In effect, the converted cells became 60 years younger in 50 days, the researchers note in their official statement.

A Censuswide survey of 2,018 CIOs and senior IT decision-makers at large organisations in the US and UK for independent software maintenance provider Origina has found that organisations spend almost $13m on upgrades pushed by IT providers. On average, 28% of enterprise software budgets go on upgrades, migrations and licensing changes driven by their IT suppliers. IT leaders who took part in the study reported that their organisation would not have actively chosen to upgrade…

The research published in Origina’s The Software Tax report, in partnership with Thinkers50, suggests these costs have shifted the balance of power between buyers and sellers. Customers exercise choice once, at the point of purchase. After that, control over the timing and terms of change passes largely to the IT supplier. Out of those surveyed, 78% agree their primary provider of enterprise software, rather than their own organisation, sets the timing and terms of change. A similar proportion said they would have no meaningful choice but to accept if a major enterprise IT provider changed its commercial terms. Some 76% said their organisation has very little real leverage in negotiations, and 80% said moving away from major IT suppliers would cause significant disruption…

Marshall Van Alstyne, professor at Boston University and co-author of The Software Tax, said: “Economists have studied this problem for decades: once a customer makes relationship-specific investments, the vendor gains leverage that no contract can fully anticipate. For CIOs, the lesson is simple: negotiate the exit before the entry. You don’t have to leave a vendor to benefit from being able to.”

Information on the Technology Support Office, or TSO as it is called internally, is nearly impossible to find on Pentagon websites, and the agency is mentioned by name only in several previously unreported Defense Department historical records and memoranda. While the specifics of its work are highly classified, POLITICO spoke with 12 current and former U.S. national security officials with varying degrees of knowledge about TSO to understand how the agency came to be, the broad contours of its mission and why its operations are shrouded in secrecy…

[The Pentagon’s Defense Secretary and Deputy Defense Secretary] established TSO quickly and without attracting outside scrutiny because they largely built the agency by reorganizing two classified Pentagon intelligence programs that have conducted similar clandestine tech-sabotage efforts at a smaller scale since 2023. But by creating an agency dedicated to expanding that work, the Defense Department is signaling its intent to ramp up a range of aggressive covert activities abroad — potentially including cyberattacks, supply chain disruptions and disinformation operations. Many of the people who spoke to POLITICO argued that the aggressive new initiative is needed to help the Pentagon counter foreign adversaries they say are harnessing artificial intelligence and advanced commercial technologies, such as drones, in creative ways that could erode America’s military advantage…

While TSO lacks the legal authority to conduct clandestine operations directly, it works closely with senior U.S. military and intelligence officers to develop cutting-edge tools and strategies to disrupt adversaries’ access to critical defense technologies — or subvert them from afar. TSO is staffed with engineers, special operators and intelligence officers, and its work spans everything from building bespoke hacking tools to planning elaborate deception operations that trick adversaries into installing faulty components — likely designed by TSO — in key foreign weapons platforms. TSO’s overarching goal is to “buy time or stop adversaries from developing technologies” that would most threaten the U.S. military in a major conflict, said a former U.S. intelligence official who worked closely with the agency… A second former Pentagon official and a former U.S. national security official said the agency has told some defense contractors it’s interested in offensive hacking capabilities. The former senior Pentagon intelligence official estimated that its budget for classified contracts alone is likely north of $1.5 billion.

They are seeking contractors on “the leading edge of technology,” that official said, and hope to procure “a whole host of tools wherever your imagination can go.”

A recent Slashdot poll showed roughly 15% said bots write most their code. But in my experience, I generally find bots don’t and can’t understand very specific domains. The rules often come from institutional habits and/or arbitrary-seeming government policies and regulations.

So what exactly are the bots doing for you?

If there are regular patterns they’re milking, why can’t those patterns just be factored into modules and functions? So I’m skeptical of “AI writes most of my code”. Something smells off!

“We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants. The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday’s patches… “We received no further indication from OpenAI, Wiz or Calif, with whom we’re working closely on this issue, regarding any issues on patched systems,” she said…

Recent events have shown how heavily companies and governments rely on PHP, Barron said. “Given that reliance, it is clear that PHP is incredibly under-funded.”

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged…

The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date. On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media… In response, the PHP project brought its pre-announcement forward [and also the release date for the patch. But as a result of the leak and pre-announcement] one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various exploitation proofs of concept, which then increased circulation on October 21st. Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing proofs of concept after the leak but did not identify any functional exploits at the time of release/public disclosure.

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.

Once the full impact of the OOM problem was understood in August, the security team, the foundation, and the release managers delivered a fix for this deeply rooted problem across all supported branches, and distributions and LTS vendors received the patch ahead of time so their users can update quickly… We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.

Multiple companies now offer products that promise to spot the difference, with often contradictory, biased or erratic results. The makers of Pangram, an AI detection platform that has been cited as authoritative in many of the recent controversies, claim it can distinguish between human and synthetic writing with near-perfect accuracy… The company’s own estimates claim that false positives — in which the tool wrongly reports that a piece of human writing was created — are 1 in 10,000 and shrinking. Peer-reviewed studies from the University of Chicago and the University of Brussels support that claim, though one 2025 study from the University of Maryland found that Pangram erroneously labeled 2% of documents as AI.

A widely referenced 2023 Stanford study that found AI writing detectors produced higher rates of false positives on writing from non-native English speakers was conducted before Pangram was created. Pangram ran an internal study using a database of non-native English texts and self-reported that false positive rate was around 8 in 10,000… Given the thousands upon thousands of pieces of writing published each day, a 1 in 10,000 chance of a false accusation — let alone an 8 in 10,000 chance — means that even the most trusted AI detector is going to be wrong, and wrong about a lot of people.

Pangram isn’t able to tell users the truth about someone’s writing, but it is able to introduce something much more complicated: doubt. Unless an accused writer confesses to using an LLM, there is no bulletproof way to prove an accusation, short of being given full access to someone’s computer history and finding the chatbot prompts… To some people and institutions on the literary side, using automated AI writing detectors to fight the influx of AI writing is just trading one form of technological domination for another.

In the felling-site near the Finnish village of Otanmäki, the ensuing loss of prey has forced packs of wolves to search for food elsewhere: nearby villages. “We had wolves coming into the village because all the wild animals moved out of the forest,” 53-year-old Otanmäki resident Anni Ranta told the Guardian. “They fled.”

In West Virginia, a grove of critically endangered Chestnut trees is under threat of being bulldozed to make way for a new Anthropic hyperscale facility. Outside of Fort Wayne, a chunk of Indiana’s once-bountiful wetlands is being tilled to fit a new Google data center. In Southern New Jersey, a data center operator was recently slapped with a $1 million fine after inspectors uncovered 62 illegal gas generators belching exhaust into the surrounding environment.

California currently ranks third among U.S. states in overall data center density, according to independent trackers like the US Data Center Map, with the state home to 366 of such facilities that are either fully operational, under construction, or moving through the planning process. Local elected officials are proposing data center moratoriums to slow that momentum — if not stop it in its tracks. In the first half of October alone, Oakland’s city council unanimously approved a 45-day moratorium on new approvals, making it the first city in Alameda County and the fourth in the Bay Area to adopt such a measure. San Francisco approved a similar moratorium this month, while the Los Angeles County Board of Supervisors postponed a vote to permanently ban large-scale data centers, often called hyperscale facilities, on unincorporated land after receiving an overwhelming volume of public feedback. In Santa Clara, city officials considered a moratorium vote, and are moving forward with new rules to govern data center development, including more stringent water and air pollution regulations. Alhambra residents will vote on a moratorium measure in the November election....

The escalating pushback underscores a widening gap between state-level regulation and municipal action. While Gov. Gavin Newsom last month signed into law seven new measures that focus primarily on disclosure requirements, environmental impact studies, and grid protection, grassroots groups and city councils are moving fast to halt construction entirely. “I have a hard time remembering something that caught fire the way the opposition to data centers has,” said Nicole Ghio, California Director at Food & Water Watch. “Local municipalities have been able to respond quicker to the grassroots wave of opposition of people saying, ‘Hold on, let’s press pause. Let’s actually figure out what we’re doing before we commit to this huge change....’"

As cities continue to draft temporary freezes and outright bans, the tension between local community control and global technological dominance remains unresolved. State transparency laws may have opened the books on data center growth, but local opponents are making it clear that seeing the plans isn’t the same as approving them.

Nonprofit evaluators METR and Redwood Research on Thursday said they conducted a pilot review of an internal monitoring system at OpenAI… METR and Redwood said the exercise was designed for OpenAI to test what it would look like to give external researchers “a deep level of access” to its internal infrastructure. From July 21 to Aug. 11, an employee from each organization had access to OpenAI’s internal codebase, documentation and some technical staffers. The employees were chaperoned while on-site and used OpenAI-issued devices that “never left the premises,” according to a release.

The evaluators discovered several “novel vulnerabilities,” including an exploit that would allow agents to prevent “hundreds” of recent actions from being monitored. OpenAI told METR and Redwood that it has patched the identified vulnerabilities that impact its production safeguards, according to the release… OpenAI CEO Sam Altman pledged to grant independent evaluators "employee-like access" to the company in September, after Anthropic CEO Dario Amodei proposed the idea as part of his plan to slow the pace of AI development. Anthropic has since announced agreements with organizations like Accenture, METR and SecureBio. OpenAI said earlier this month that it’s “actively finalizing contracts with third-party safety assessors.”

The new wikis [for Python, Jython, and the PSF] will have a more modern front-end, as well as a permissions-based content management system for community members to make updates.

With the old wiki structure, we received a large volume of alerts at all hours, each serious enough to page and wake our on-call infrastructure staff, which is very limited (just one person currently, although this will be changing soon!). The quantity of scraping overloaded our servers, causing outages, which happened often enough that these issues required a significant amount of effort for the PSF staff to manage…

Additionally, some portions of the wikis were still built with Python 2. Python 2 reached end of life on January 1, 2020, and no longer receives upstream security fixes. Moving to a static site makes it very fast and reduces security risks, while also having the benefit of a more modern user interface… GitHub was chosen for the home of the new wikis as this is where CPython, python.org, and other properties the PSF hosts currently live. The hope is to continue to streamline the PSF’s hosting and stewardship of services to simplify for both PSF staff and the community folks who contribute to them. Previously, the Python and Jython wikis were user-editable by invitation of an existing editor and the PSF wiki was permissions based. Moving forward, all three of the wikis will be permissions based via the GitHub repository they are hosted on, and changes can be requested through pull requests by anyone in the community…

GitHub allows us to distribute granular control, review changes through pull requests, and maintain the uptime this service deserves. Also, since the site is now generated statically, it removes any worry about AI bots overwhelming the hosts that the wikis were previously hosted on.