It booked our meetings and cleared our inbox beautifully. Then we hid one line of text on a web page, and it started taking orders from a stranger. A first-hand report on prompt injection, the flaw the people who build these tools admit they cannot fully fix.
The CLARITY Act, the crypto industry's top legislative priority, failed a Senate cloture vote on 15 September, reportedly 49 to 50, well short of the 60 needed to advance. It was not a vote on the bill's merits but a procedural gate, and what jammed it was a conflict-of-interest fight, not a disagreement about market rules. The industry's record lobbying spend bought a floor vote, not the votes to win it. Here is what happened and what fills the gap now.
iOS 27 shipped on 14 September with a rebuilt Siri AI, and its hardest requests now run on a Gemini-based model in Google's cloud. Here is what actually changed, which iPhones get it, the waitlist, and the privacy trade-off.
Marvel's Wolverine landed on 15 September with a Metacritic score in the high 70s, strong by most measures but a stumble for the studio behind Spider-Man 2. Here is what the reviews say, how long it is, whether it is coming to PC, and whether it is worth it.
A UCSF team has shown a single brain implant decoding attempted speech and gestures at the same time, driving an on-screen avatar for people with paralysis. It is a genuine advance, and a small proof of concept, not a finished device or mind reading. Here is what it did, how well it worked, and what it is not.
The Trezor data breach came through a shipping partner, ShipMonk, not Trezor's own systems, so your wallet and funds are safe. It exposed the personal details of around 80,000 customers, most with a home address and phone number. A phishing wave has already started; here is what leaked and how to stay ahead of the scams.
Fervo Energy's Cape Station in Utah is on track to send its first power to the grid in October, the first commercial-scale enhanced geothermal project to get there. The technology fracks hot dry rock to make geothermal work far beyond volcanic zones, and Google has just signed for 396 megawatts of it. Here is what is real, what is still a target, and why data centres are watching.
Two of the world's largest music publishers have sued Anthropic, naming its founders personally, over allegations that Claude was built on pirated lyrics and sheet music. The case leans on an earlier ruling with a crucial split: training on copyrighted work may be fair use, but pirating it to get there may not.
Reports say NVIDIA has agreed to buy Hugging Face, the 'GitHub of AI', for about $12.9 billion. Neither company has confirmed it, and it would face a long antitrust review. Here is what is actually known, and why it worries open-source AI.
An AI headshot costs about $30 instead of a $300 studio shoot, and the good ones are genuinely convincing. We test the best on realism, price and the part that matters most: what each one does with your face after you upload it.
The CLARITY Act, the crypto industry's top legislative priority, failed a Senate cloture vote on 15 September, reportedly 49 to 50, well short of the 60 needed to advance. It was not a vote on the bill's merits but a procedural gate, and what jammed it was a conflict-of-interest fight, not a disagreement about market rules. The industry's record lobbying spend bought a floor vote, not the votes to win it. Here is what happened and what fills the gap now.
Alpenglow is the biggest change to how Solana reaches agreement in the network's history: it retires Tower BFT, aims to cut finality from about 12.8 seconds to roughly 150 milliseconds, and is rolling out to validators in stages through September. Here is what is actually changing, when, and the caveats behind the headline numbers.
Circle's Arc is scheduled to open its public mainnet on 16 September: an EVM-compatible Layer 1 where the USDC stablecoin itself pays for gas, secured by a closed set of institutions including BlackRock, Visa, Mastercard and DTCC. It is open to build on and closed to validate, and the separate ARC token is not the gas and has no confirmed trading date. Here is what is actually launching.
Marvel's Wolverine landed on 15 September with a Metacritic score in the high 70s, strong by most measures but a stumble for the studio behind Spider-Man 2. Here is what the reviews say, how long it is, whether it is coming to PC, and whether it is worth it.
A day after the Zelda anniversary show, the general Nintendo Direct was headlined by two Switch 2 exclusives: Metroid Ravenous, a 2D adventure where Samus drains her enemies to survive, out 28 January 2027, and Kirby and the World Beyond, an open-world 3D Kirby for spring 2027. The rest leaned on ports and enhanced editions, which is why reaction was split.
At a Direct marking Zelda's 40th anniversary, Nintendo finally dated its Ocarina of Time remake: 5 November 2026, Switch 2 only. It adds a jump button, a dash, a free camera and a microphone mode that plays songs when you hum or whistle them. A Triforce-themed console lands first, on 29 October. Here is what was actually confirmed, and what was only teased.
The Trezor data breach came through a shipping partner, ShipMonk, not Trezor's own systems, so your wallet and funds are safe. It exposed the personal details of around 80,000 customers, most with a home address and phone number. A phishing wave has already started; here is what leaked and how to stay ahead of the scams.
A dataset said to hold roughly 32.8 million records tied to Vogue, The New Yorker, GQ, WIRED and other Conde Nast titles was listed on a cybercrime forum for $15,000. It is alleged, not confirmed, the count is records not people, and it reportedly contains no passwords or card numbers. Here is what is actually being claimed, what a researcher checked, and why it still matters.
IDScan.net, an identity-verification company that holds what it says are more than 150 million driver's-licence records, has confirmed that an unauthorised party may have accessed or copied customer data on its cloud. The FBI is investigating. Sellers on a dark-web site advertised 153 million-plus documents, a figure the company has not confirmed. Here is what is known, what is only alleged, and what you can actually do.
Fervo Energy's Cape Station in Utah is on track to send its first power to the grid in October, the first commercial-scale enhanced geothermal project to get there. The technology fracks hot dry rock to make geothermal work far beyond volcanic zones, and Google has just signed for 396 megawatts of it. Here is what is real, what is still a target, and why data centres are watching.
SpaceX has filed for Starship's first flight to attempt orbit, carrying about 20 operational Starlink V3 satellites; its CFO calls it the programme's first revenue flight. As of this writing it has not launched, the FAA licence is still outstanding, and the ship is still planned to splash down rather than be caught. Here is the honest picture of what Flight 14 is, and is not.
At its 9 September 'Surprise and Shine' keynote, the first under new chief executive John Ternus, Apple unveiled the iPhone 18 Pro and Pro Max and its first foldable, the iPhone Duo. Here is what was actually announced, what it costs, when you can buy it, and the one big caveat: there is still no standard iPhone 18 this autumn.
A UCSF team has shown a single brain implant decoding attempted speech and gestures at the same time, driving an on-screen avatar for people with paralysis. It is a genuine advance, and a small proof of concept, not a finished device or mind reading. Here is what it did, how well it worked, and what it is not.
One team says cosmic acceleration may be an illusion once you account for the ages of the exploding stars. Another says acceleration is real but dark energy is fading over time. A third camp, with two Nobel laureates, says the original measurements were fine all along. It is a fight over one cosmic ruler, not a new observation, and the referee has not blown the whistle.
Hubble has confirmed a giant, evolving 10-sided jet-stream pattern, a decagon, encircling Saturn's south pole, a southern counterpart to the planet's celebrated north-pole hexagon. Here is what the Saturn decagon is, how it compares to the hexagon, and why these regular shapes form at all.
iOS 27 shipped on 14 September with a rebuilt Siri AI, and its hardest requests now run on a Gemini-based model in Google's cloud. Here is what actually changed, which iPhones get it, the waitlist, and the privacy trade-off.
N-able rushed out an emergency hotfix for CVE-2026-86218, a perfect-10 pre-authentication flaw in its N-central platform that its own customer notice says was exploited in the wild. Because managed service providers use N-central to reach thousands of downstream businesses, one flaw can cascade. Here is what to patch, and the honest picture of what is and is not known.
On 1 September SonicWall disclosed two zero-days in its SMA 1000 remote-access appliances, one of them a maximum-severity flaw, and both, SonicWall says, already under attack. CISA gave federal agencies just three days to fix them. Here is exactly what is affected, what is not, and the builds you need.
Fastest sustained speeds, audited no-log. Our pick after six weeks.
Read the test →Best AI coding toolThe one that actually finished the tasks. Best for real projects.
Read the test →Best crypto walletClearest security warnings we tried. Best for staying un-drained.
Read the test →
Researchers say retail LG smart TVs logged microphone audio with the screen off and quietly scanned the home network to fingerprint nearby devices. Here is what the investigation actually showed, what is still unproven, and the settings that reduce what your smart TV collects.
From November, Xbox Game Pass cloud gaming moves from unlimited to a monthly hour cap: 15 hours on Ultimate, 10 on Premium, 5 on Essential. Here is exactly how the cloud gaming hours limit works, when it starts, and why it does not affect games you install and play locally.
Blockstream's Liquid Network was drained of roughly 4,000 BTC through a software bug, and the attackers returned about 85 per cent, branding themselves 'white hats.' Here is what the Liquid Network is, why this is not a hack of Bitcoin itself, and what was actually lost.
Princeton's PACMAN system used AI to predict a plasma-destroying instability in a tokamak about 200 milliseconds before it struck and adjusted to avoid it, in live experiments. Here is how AI control of nuclear fusion works, why it matters, and why it does not mean fusion power is suddenly close.
Europe's giant tech show is in full swing, and the announcements are a mix of shipping products, sealed-case previews and pure concepts. Here is a clear-eyed guide to the headline reveals, from Samsung's Galaxy S26 FE to a full-leg exoskeleton, with each one tagged for what you can actually buy.
The LUX-ZEPLIN experiment has recorded a single particle interaction it cannot explain, its most compelling hint of dark matter yet. But at 2.6 sigma, from only about a quarter of its planned data, the team is careful to say it has not found dark matter. Here is what the signal is, and is not.
On 31 August Google removed the last Manifest V2 extensions, uBlock Origin included, from the Chrome Web Store. It is the final step of a phase-out that has run since 2024, not a sudden ban. Here is what actually changed, why Google and its critics disagree, and where full uBO still runs.
A roughly 12TB trove of old Valve data spread online in late August, spilling Portal 2 prototypes, canceled projects and third-party builds from a decade ago. It is a genuine leak, but it does not appear to be a hack, no user data has surfaced in it, and the Half-Life 3 excitement rests on a single reused model. Here is the disciplined version.
On 30 August, validators froze the Crypto.com-linked Cronos chain and rolled it back about two hours to reverse a lending exploit. The headline says $75M, but only $6.3M actually left. The bigger story is a chain choosing to rewrite settled history, and the argument that restarts every time one does.
An amended complaint against Meta and Luxottica adds a proposed class for bystanders it says were recorded by Ray-Ban smart glasses without consent, on top of the original false-advertising claims from buyers. Everything is an unproven allegation, and Meta says captured media stays on your device unless you share it. Here is what the case actually claims.
A little-known medical-data vendor, Aesto Health, has disclosed a breach affecting 9,540,683 people, the second-largest confirmed US healthcare breach of 2026 so far by HHS-reported totals. The intrusion happened in December 2025; the public disclosure is what is new now. Here is the timeline, why patients who never heard of Aesto are affected, and the standard steps to take.
Researchers documented a ransomware crew using Cursor's AI coding agent, powered by Claude, to help break into companies. It is a milestone, but the AI assisted a human, it did not attack on its own. Here is what happened, and how to defend against it.
NASA's Nancy Grace Roman Space Telescope launched on 30 August, months early. It will survey the sky roughly a thousand times faster than Hubble to chase dark energy and find perhaps 100,000 new planets. Here is what it does and why it matters.
AI note-takers can transcribe every meeting for free now, but two questions decide which to pick: is it actually free, and is it even legal to record. We test the best on accuracy, price and the 2026 privacy problem most guides ignore.
AI voices sound human now, so the catch is the licence, not the sound. We test the best text-to-speech tools on quality, price and the thing people get burned on: whether the free tier actually lets you download and sell what you make.
AI, crypto, privacy, gaming, science and software, decoded in five minutes. Free.
By subscribing you agree to receive The Frontier and to our privacy policy. No spam, unsubscribe anytime.