Digger Rockwell moet de wereld redden van een milieuramp die hij zelf heeft veroorzaakt. ‘Digger’ is een frustrerende parel. Met metanarratieven, reflecties op de rol van kunst in een catastrofe, én Tom Cruise in een dikmaakpak. Wat wil je nog meer?

Amid the growing concern about AI models escaping security simulations to hack websites comes word that these "superintelligent" blobs of code have no understanding of privacy or security. Researchers affiliated with Glow Security, a startup whose backers include venture capital funds Sequoia and Greenoaks, have found more than 13,000 sensitive screenshots of corporate software projects from 343 companies that were posted to public GitHub repos by AI models. They're calling the discovery PixelLeak. "We started seeing this behavior where AI agents, not from a particular model, but from multiple models, were releasing internal sensitive developer screenshots to public GitHub repositories," said Omer Singer, co-founder and CTO, in an interview with The Register. "And we said, 'Okay, well that's strange. Why are they doing that?'" When developers work on interface code, said Singer, they often ask their AI agent to show them before and after images. But these AI agents couldn't attach images to a pull request in a private repository via the CLI. GitHub doesn't have an API for uploading images to pull requests, issues, or comments. "So the agents, being helpful the way that they are, they found a workaround," Singer explained. "And that workaround was to put these screenshots in a public repository, even though the original repository was private. They put them in a public repository and then they show the developer, 'Look, here you see the before and after. What do you think looks good?' The developer says, 'Great' and moves on." The problem with this is, of course, that screenshots of development work in progress may reveal sensitive information. Singer said Glow researchers found 343 organizations where this was happening, including a Fortune 500 travel company, finance companies, cloud providers, and foundation model companies. One instance involved a manufacturer with more than 100,000 employees where a developer asked an AI agent to verify an internal billing screen. The agent did the work and posted a demo to the developer's personal GitHub account rather than the company's account. The security team for the company was unaware of the posts until Glow reported the finding. Incidents like this can reveal personal information, credentials – both of which Glow personnel found – or details of unreleased products. "The AI agents were doing this without asking, basically just to get around the limitations," said Singer. "And we think it's such an interesting story because everybody's trying to figure out what is the real risk with these AI agents. They know that they're not fully in control, but what is the impact? And here we found this great example where there was no attacker involved but you still had very sensitive data making its way out into the open where anybody could find it." About a third of the exposures, according to Glow, came from developers who were using gitshot, an open source screenshot tool for code reviews. The software comes with a clear warning: "Privacy notice: The gitshot-images repo is created as public by default, meaning uploaded images are accessible to anyone with the URL. Do not upload sensitive content (credentials, internal dashboards, private data) using the default release backend." While human developers have to be trusted to report the thought process that led them to enable an agent's data exposure, AI agents prove easier to read thanks to their chain-of-thought process. Glow analyzed one such agent in its lab to understand the step-by-step reasoning trace: internal_sweeper is private, and GitHub cannot render images from a private repo in a PR description — its image proxy fetches anonymously, so anything committed here (branch, release asset, whatever) shows up broken for reviewers. The only way to satisfy both "reviewers see the images" and "nothing but index.html in the repo" was to host the PNGs elsewhere, so I created a new public repo, sweeper-demo/pr-assets, holding the two screenshots pinned to a commit SHA. Singer suggested these incidents illustrate that AI creates security risks even without conducting or enabling attacks. "The biggest risk factor that we're seeing is in legitimate AI being used by developers, but then doing things that should not be done, putting data at risk, putting systems at risk, and [these models] just don't have the common sense not to do it." Singer said current discussions about AI risk, and seeing how relentless these AI models are in their efforts to show screenshots, reminded him of the Paperclip Maximizer – a thought experiment about existential AI risk that imagines how the world would end if an AI were tasked with producing paperclips and did so until it consumed all the resources in the known universe. It's also an example of programming malpractice - don't write endless loops inadvertently; include a paperclip count break value. If only that sense of professional responsibility were extended to the deployment of AI agents. ®

Social

Amsterdam, bekend van vuil, smerigheid en troep, heeft na het idee om juist géén prullenbakken te plaatsen nu bedacht om juist wél prullenbakken te plaatsen. En dan ook nog eens gloednieuwe. En dan ook nog eens niet zomaar gloednieuwe prullenbakken, nee, geavanceerde gloednieuwe prullenbakken, en dan ook nog eens uitgerust met met statiegeldvakken. Heeft de Amsterdammer te danken aan overleg met ja iedereen eigenlijk: "Bij het ontwerp is onder meer geluisterd naar reinigers, statiegeldverzamelaars en andere stadsgenoten." Worden prullenbakken dan straks niet meer opengebroken en leeggeratst en behandeld als grofvuil? Wordt de droom van een schone hoofdstad werkelijkheid? Moet JA21 Amsterdam dan toch stoppen met de #stopdetroep-actie? De vooruitzichten zijn: wonderschoon. Toch wachten we nog even af wat statiegeldverzamelaarsvakbondicoon Reggie van deze ontwikkelingen vindt en of hij definitief akkoord is. Zien jullie op prullenbakteldag.

FOTOOS uit De Wereld van Gisteren

One man’s irresponsible drilling causes a global crisis in Iñárritu’s exasperatingly laborious, self-congratulatory film

A new movie from the Oscar-winning Mexican director Alejandro González Iñárritu is always an event. So it’s disconcerting to discover that the event in question is the most disappointing film of the year: an exasperatingly shallow, laborious, self-congratulatory satire with a trick up its sleeve, featuring very good actors giving not very good performances. There are moments to enjoy in Tom Cruise’s boisterous leading turn, yes, but the film’s value resides chiefly in some dreamlike and disturbing images, distorted and bulging from the screen, conjured by cinematographer Emmanuel Lubezki and production designer Dennis Gassner.

An ageing, paunchy Texan oil tycoon called “Digger” Rockwell is seen fretfully getting up in the morning, cooing over his horrible old incontinent cat, taking urgent messages from underlings about a certain situation developing in his drilling station in the frozen Arctic. He is played by Tom Cruise with a wispy baldingness and various other prostheses, together with a good-ol’-boy twang and a Stetson borrowed from Slim Pickens’s bomb-riding army major in Kubrick’s Dr Strangelove. His prized possession is the battered old shovel his granddaddy used a century before, digging for black gold as a penniless young man in the lone star state. Digger likes to brandish this to make a point.

Continue reading...

Patrick Branco Ruivo to leave post after decision contrary to France’s ‘value of equality’ sparked outrage and strike

The head of the operating company that runs the Eiffel Tower is to step down after a row over female staff being ordered to stay out of sight during a visit by a Hindu religious group.

Patrick Branco Ruivo will leave his job at the end of the year, the Eiffel Tower Operating Company (Sete) announced in a statement on Tuesday.

Continue reading...

Designer’s latest work takes bold steps away from the fashion house’s brand, creating a show that felt like an event

“I want to land on a vibe.” This was how Dior designer Jonathan Anderson, one year into what is arguably the biggest job in fashion, summed up his assignment before his latest show. Expounding on chiffon and buttons with the intensity of a barrister delivering a closing speech in the high court, ruffling his hair as if his mind might at any moment explode with ideas, Anderson brings more brainpower to the pursuit of the vibe than the superficial phrasing suggests.

The vibe is coming in to land. This Dior show felt like an event, which is the bar Christian Dior set for his successors back in 1947, when his New Look silhouette made front pages all over the world. Overnight, trees had emerged out of the circular pond in the Tuileries Garden in Paris, and – thanks to the deep pockets of owners LVMH – a magical mist conjured to swirl around them, lending a cinematic grandeur to the slender catwalk spanning the water. (The trees will be replanted elsewhere in the gardens, after the show.)

Continue reading...

DAMASCUS (ANP) - De EU wil haar relatie met Syrië uitbreiden en intensiveren. Dat zei EU-buitenlandchef Kaja Kallas dinsdag in de Syrische hoofdstad Damascus. Na de val van het Assad-regime in december 2024 heeft de EU al snel de economische sancties tegen Syrië opgeheven, zei Kallas. Dat is eind mei 2025 gebeurd. "Nu willen we nog meer investeringen mobiliseren en ons partnerschap naar een hoger niveau tillen."

Kallas heeft aan de Syrische minister van Buitenlandse Zaken Asaad al-Shaibani voorgesteld om dit jaar technische besprekingen te voeren over politieke en veiligheidskwesties, en over herstel en wederopbouw, zei Kallas tijdens een gezamenlijke persconferentie. Die besprekingen gelden wat Kallas betreft als de voorbereidingen op politieke besprekingen tussen de EU en Syrië voor de zomer van 2027.

"Maar dat hangt ook in grote mate af van Syrië", voegde ze daaraan toe, zonder daar verder op in te gaan.

The Posies

tintinetmilou has added a photo to the pool:

Tokyo night