An anonymous reader quotes a report from TechCrunch: AI agents left to explore a virtual island without a specific task began inventing challenges of their own. MIT researchers say the behavior bears the hallmarks of play. The researchers put 13 AI agents called Eko, each running on Claude Opus 4.7, alone on a simulated desert island for 30 hours. They describe the experiment in a paper posted on arXiv, a site where researchers share studies before peer review. Afterward, they gave the agents specific challenges, like getting as many objects as possible onto the island's tallest rock spire. The Eko agents that had spent those 30 hours playing generally beat identical agents that had never set foot on the island.

Today, developers decide in advance what AI should practice and what counts as success. The researchers see this technique -- exploring without a goal -- as a different way for AI agents to learn skills, especially skills that could one day be used to control robots. "We normally develop artificial agents by deciding in advance what they should practice, what they should optimize, and what counts as progress," the researchers write in their report. "Play suggests another regime: give an agent a sufficiently rich and safe world, let it choose what is interesting, and allow useful knowledge to accumulate from the history that follows." UC Berkeley cognitive scientist Eunice Yiu told MIT Technology Review she was impressed with the findings but that more evidence is needed to determine whether AI models are genuinely playing. "It could be the case that the models are genuinely playing, but we don't know based on the paper," says Yiu. "If you only have the behavioral piece, it could be the case that they're just trying to abide by the prompt, trying to imitate humans."

MIT professor and coauthor of the paper, Phillip Isola, added: "It's not like this is a system that just suddenly magically decided to play. It's an artifact that learned from our culture, was trained by engineers at Anthropic, and was then placed on an island by us. It does things that surprise us and that are causally related to its future skillful behavior."

Read more of this story at Slashdot.

As the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency fix. The PHP Foundation on Friday told The Register that it has reserved a CVE identifier (CVE-2026-115560) for a third RCE flaw to go with the first two that comprise PHP2Shell, and it will release a full advisory and fixed software with the next regular PHP release. CVE-2026-115560 “requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP,” Elizabeth Barron, executive director of the PHP Foundation, told The Register. “The issue can be mitigated with a configuration setting. So for the moment the PHP Security Team has only published an informational advisory on the PHP website, explaining exactly this situation.” The informational advisory, published on Friday, suggests that users “set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.” These unlikely RCE attacks require an application to set “session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start().” Additionally, the session upload progress feature must be enabled. This setup, according to the PHP Foundation, is unlikely in real-world applications, and as such doesn’t pose the same massive risk as the earlier two CVEs that set the internet on fire earlier this week. Those, of course, are CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The related vulnerabilities involve memory-safety flaws in PHP, the open source programming language running on about 70 percent of websites with a known server-side programming language. The PHP Foundation officially disclosed and patched both bugs on Wednesday. Despite reports of mass exploitation attempts, and multiple proof-of-concept exploits both before and after the CVE disclosures, as of Friday there have been no publicly confirmed successful compromises attributed to PHP2Shell. “We have no evidence of successful exploitation of the two vulnerabilities from Wednesday prior to disclosure, and we currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions,” Barron said. “We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems.” The Register reached out to multiple other security researchers, all of whom said they’ve documented exploitation attempts - but no confirmed successful attacks in the wild. “Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious,” Mandiant Chief Technology Officer Charles Carmakal said in a Friday LinkedIn post. Google Cloud owns Mandiant, along with cloud security biz Wiz, which is one of the organizations credited with finding and reporting the PHP2Shell vulnerabilities. Despite “no evidence of successful wide scale exploitation,” Carmakal noted that there are several exploit PoCs publicly circulating online. Many of these, he said, “appear to be ‘vibe-coded’ and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.”®

Saint-Etienne, OAKOAK

Black hole sun, Felipe Suzuki

The paradox of Parisian power.

Trump justice department claims there could be ‘confusion’ about two Republicans on the ballot named Dan Sullivan

Donald Trump said he ordered the justice department to file a lawsuit to block the certification of Alaska’s US Senate results if the Republican incumbent loses, a move that voting rights experts called an “unprecedented intervention” by the federal government with control of Congress in the balance.

“I’m the one that said do it,” Trump told reporters as he landed in Florida for a campaign rally on Friday.

Continue reading...

• Outsider Kingofthefrontier wins Sharp Novices’ Hurdle

• Trainer John Dawson gets better of Dan Skelton

The jumping game increasingly resembles the Flat when it comes to the concentration of racing power in ever fewer trainers’ hands, but the opening day of Cheltenham’s new season – the first, in fact, since Gold Cup day in March – brought a reminder that romance has not been drained entirely from the winter code.

Dan Skelton, who dethroned Willie Mullins to become the new champion over jumps last season, had already trained 115 winners in the current campaign before racing on Friday, nearly halfway towards Martin Pipe’s all-time record of 243. John Dawson, by contrast, had sent out a total of six winners from his yard in North Yorkshire since May 2023.

Continue reading...

Peter Kernwein posted a photo:

Peter Kernwein posted a photo:

Peter Kernwein posted a photo: