Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Rising Digital Invitation Scams Highlight Need for Strong Cyber Awareness

  What was once used for birthdays, weddings, corporate events, and social gatherings has increasingly been weaponized by cybercriminals as ...

All the recent news you need to know
technology
Artificial Intelligence Claude GitHub Opencode technology

OpenCode’s Rapid Growth Reflects Rising Developer Concerns Over AI Vendor Dependence

 





A glaring divide is emerging in the AI coding industry as developers increasingly weigh the convenience of fully managed coding platforms against the flexibility of open-source alternatives designed to avoid dependence on a single provider.

The debate intensified this week after Anthropic used its first “Code with Claude” developer conference to showcase major upgrades across its Claude Code ecosystem. The company announced that rate limits for Claude Code users on Pro, Max, Team, and Enterprise plans would be significantly expanded, while peak-hour usage restrictions were removed entirely. Anthropic also raised usage limits for its Opus API and disclosed a major infrastructure agreement with SpaceX involving the Colossus 1 data center.

According to the company, the agreement will provide access to more than 300 megawatts of computing power and approximately 220,000 Nvidia GPUs expected to come online within weeks. The move reflects the broader AI industry race to secure high-performance computing infrastructure as demand for generative AI services continues to increase.

Anthropic also introduced several updates aimed at turning Claude Code into a more advanced managed development environment. These included expanded Managed Agents capabilities, support for coordinating multiple AI agents simultaneously, a public beta feature called Outcomes, and an experimental memory system internally referred to as “dreaming,” which is intended to help AI systems retain and improve contextual understanding over time.

During the event, Anthropic executive Boris Cherny demonstrated remote agents and automated routines capable of running coding tasks asynchronously, effectively allowing Claude Code to function more like a workflow orchestration platform rather than a traditional coding assistant.

At the same time, a separate trend has been accelerating across the open-source community. OpenCode, an independent coding harness project associated with SST, has experienced a dramatic rise in popularity after positioning itself as an alternative to vendor-controlled AI development environments.

The project’s GitHub repository has now surpassed 157,000 stars, overtaking the roughly 122,000 stars associated with Anthropic’s own Claude Code repository at the time of reporting. While GitHub stars do not necessarily represent active users or production deployments, they are often viewed as indicators of developer awareness, interest, and community support.

The roots of OpenCode’s instant growth trace back to January 2026, when Anthropic introduced server-side authentication checks that prevented third-party tools from accessing Claude Pro and Max subscriptions through OAuth-based authentication methods.

Several projects, including OpenCode, Cline, and RooCode, were affected by the policy change. Prior to the restrictions, these tools allowed developers to run autonomous coding workflows through fixed-price Claude subscriptions rather than paying significantly higher API-based usage fees tied to token consumption.

From Anthropic’s perspective, the restriction addressed a business and infrastructure problem. Subscription plans were designed to support usage within the company’s own ecosystem, while third-party tools were effectively redirecting high-volume workloads through pricing structures never intended for external automation platforms.

Discussions across developer forums, including lengthy conversations on Hacker News, showed that many users understood Anthropic’s reasoning. However, criticism quickly emerged over the manner in which the restrictions were enforced. Developers reported that the changes were introduced without advance notice, disrupting workflows in active sessions. Some users also claimed that automated abuse-detection systems temporarily restricted accounts during the transition period.

OpenCode responded rapidly after the restrictions took effect. The project added support for ChatGPT Plus integrations within hours and began expanding compatibility across multiple AI providers. Anthropic later formalized its position in updated Terms of Service published in February, clarifying that subscription OAuth tokens were not intended for third-party routing or automation tools.

The dispute escalated further in March after OpenCode reportedly received legal requests related to Claude subscription authentication. Shortly afterward, the project merged an update removing references to Claude Pro and Max authentication from its codebase. By April 4, Anthropic’s enforcement measures had expanded to additional third-party harnesses, including OpenClaw and NanoClaw, pushing developers toward pay-as-you-go API billing structures.

Interest in OpenCode accelerated during this period. On March 21, a Hacker News discussion surrounding the project gained more than 1,200 points and hundreds of comments, driving additional visibility across the developer community. By early April, the repository had already crossed 120,000 GitHub stars.

As of May 8, project activity data showed approximately 156,904 stars, 18,259 forks, 4,788 issues, and more than 1,600 open pull requests. OpenCode’s website also claimed participation from over 850 contributors and estimated usage among roughly 6.5 million monthly developers.

Industry observers note that the OAuth dispute alone likely does not explain OpenCode’s growth. Instead, the incident appears to have accelerated an existing movement toward model-agnostic development tools. OpenCode gradually shifted its messaging away from low-cost Claude access and toward provider neutrality, emphasizing that developers should be able to switch between AI models as pricing, performance, and capabilities evolve.

That distinction is increasingly important as competition intensifies between major AI providers. A developer using a model-agnostic harness can move between Anthropic, OpenAI, or other models with relatively minor configuration changes. In contrast, developers operating entirely within a vertically integrated ecosystem may face higher switching costs if pricing structures, usage limits, or platform policies change unexpectedly.

The debate mirrors earlier divisions within the software infrastructure industry. Some analysts have compared the current situation to Docker and Podman, where one platform focused heavily on integrated services and managed workflows while the other prioritized portability, operational control, and independence from platform lock-in.

OpenCode’s rise has also drawn criticism from parts of the developer community. Users in public discussions have raised concerns about high memory usage, the growing complexity of the project’s TypeScript codebase, inconsistent release stability, and the broader security implications of integrating multiple AI providers into a single framework.

Security considerations remain particularly relevant because every additional provider connection potentially expands the software’s attack surface. OpenCode also faced backlash after removing Claude subscription authentication support following reported legal pressure, with some developers expressing frustration over how the project handled the situation.

Still, the overall ndustry direction appears increasingly clear. Anthropic is investing heavily in a future built around tightly managed AI coding ecosystems that combine infrastructure, orchestration, memory systems, and coding assistance within a single platform.

At the same time, open-source projects such as OpenCode, Cline, Aider, and OpenClaw continue to attract developers seeking portability and reduced dependency on individual AI vendors.

For many software teams, the central issue is no longer choosing between Claude Code and OpenCode alone. Instead, developers are beginning to decide whether critical AI-assisted workflows should remain under the control of a single provider or operate through more flexible systems capable of adapting as the AI landscape continues to shift.

Read more »
Data Theft
Cyber Attacks Cyber Data Cyber Security Ransomware Attacks CyberCriminal Data protection data security Data Theft

Foxconn Cyberattack Exposes Alleged Intel, Apple, Nvidia and Google Project Data

 

A wave of digital intrusion lately hit Foxconn, causing interruptions across certain segments of its North American facilities when the Nitrogen ransomware collective admitted involvement - disclosing they had infiltrated systems and extracted vast troves of confidential information. This incident underscores, yet again, how intensifying demands from cybercriminal networks now challenge critical links within international tech logistics, particularly those manufacturers embedded deep inside the production ecosystems serving top-tier technology brands. 

Later on, after initial reports emerged, Foxconn confirmed disruptions across multiple sites in North America. Right away, its cyber defense units began executing crisis protocols instead of waiting for further escalation. Because systems required immediate protection, temporary measures went into place to shield manufacturing flow. Even so, certain plants experienced brief halts in daily activity due to digital interference. Gradually now, output levels are stabilizing following those earlier setbacks. 

Later, the ransomware operators listed Foxconn on their public leak page, stating they had taken close to 8 terabytes of data - over 11 million individual files. Their claim centers on possession of private technical records: blueprints, project directives meant for internal use, engineering schematics. Information tied to big tech names like Apple, Nvidia, Intel, Google, and Dell reportedly appears within what was pulled. Though unverified, the alleged haul suggests access to development assets considered highly sensitive. 

Even though hackers say they took customer data, Foxconn hasn’t said if any was truly exposed. Without a clear statement, it remains unclear how much information may have been reached - or if partner details were touched at all. Ever since 2023, the Nitrogen ransomware crew has operated under suspicion of ties to variants spawned from exposed Conti 2 code. Researchers point out weaknesses in their tools - especially when striking VMware ESXi systems. 

Despite handing over payments, certain targets still could not retrieve locked data. This failure stems from defective decryption mechanisms built directly into the malicious software. Recovery gaps appear baked into its flawed design. Should that glitch persist, affected groups might face deeper troubles - offering money to hackers does not always bring back locked data or recover what was taken. Back in 2024, the LockBit group took credit for breaching Foxsemicon Integrated Technology - a firm within the larger Foxconn Technology Group. 

It wasn’t an isolated case; a similar unit of Foxconn in Mexico had drawn their attention two years prior. Ransomware attacks on this network are nothing new. The pattern stretches further back than it might first appear. Now worries spread through the hardware world after the recent security incident, given how central Foxconn is to building devices and moving parts for big tech firms worldwide. 

When something interferes with its work, delays may ripple into assembly timelines, logistics systems, operational frameworks, even sensitive processes behind upcoming gadgets and corporate tools. Because they rely on many partners, handle valuable technical details, and face tight deadlines when operations fail, factories and logistics companies often attract ransomware groups. 

With more strikes hitting essential vendors lately, better separation between internal systems is becoming a priority - alongside stronger crisis plans and tighter protection for confidential design files that could be stolen or leaked.
Read more »
zero-day vulnerability
AI-generated exploit Artificial Intelligence Cybersecurity Google Threat Intelligence Group Technology zero-day vulnerability

Google Detects AI-Generated Zero-Day Exploit Targeting Web Admin Tool

 

Researchers from Google Threat Intelligence Group (GTIG) have revealed that a recently identified zero-day exploit aimed at a widely used open-source web administration platform was likely created with the help of artificial intelligence.

The vulnerability, which targeted the platform’s two-factor authentication (2FA) mechanism, could have allowed attackers to bypass critical security protections. While the software involved has not been publicly identified, researchers confirmed that the attack was stopped before it reached large-scale exploitation.

According to GTIG, analysis of the Python-based exploit strongly indicates the involvement of AI tools during the vulnerability discovery and weaponization process. The team noted that the coding style, educational explanations within the script, and even fabricated technical details closely resembled outputs commonly produced by large language models (LLMs).

“For example, the script contains an abundance of educational docstrings, including a hallucinated CVSS score, and uses a structured, textbook Pythonic format highly characteristic of LLMs training data,” GTIG says in a report today.

Researchers also stated that the flaw itself appeared to be a semantic logic issue — an area where AI systems tend to perform effectively — rather than traditional vulnerabilities like memory corruption or poor input sanitization that are usually identified through fuzzing or static analysis techniques.

Google informed the affected software developer about the issue, allowing security measures to be implemented quickly and the attack to be disrupted before wider abuse occurred.

“For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI,” GTIG researchers say.

The report additionally highlights the increasing role of AI in cybercrime operations. Google observed threat groups linked to China and North Korea — including APT27, APT45, UNC2814, UNC5673, and UNC6201 — using AI systems for exploit development and vulnerability research.

Meanwhile, Russia-associated threat actors were reportedly using AI-generated decoy code to conceal malware strains such as CANFAIL and LONGSTREAM. Google also referenced a Russian campaign known as “Overload,” where AI voice cloning technology was allegedly used to imitate journalists in fabricated videos spreading anti-Ukraine narratives.

The report further examined the Android malware PromptSpy, previously documented by ESET, for its integration with Gemini APIs to automate interactions on infected devices.

Investigators identified an autonomous component called "GeminiAutomationAgent," which reportedly relies on a hardcoded prompt to help the malware evade AI safety mechanisms. Researchers explained that the prompt assigns the malware a harmless persona, enabling it to calculate interface geometry and interact with device functions more effectively.

Google researchers also warned that the malware appears capable of replaying authentication methods, including PINs and lock patterns, using AI-assisted techniques.

The company concluded that cybercriminals are increasingly scaling access to premium AI services through methods such as automated account generation, proxy relay systems, and shared account infrastructures.
Read more »
WhatsApp Payments
Bengaluru Startup Delayed Payments Fintech Solution Technology WhatsApp Payments

WhatsApp-Based Bengaluru Start-up Aims to Reduce Delayed Payment Woes

 

Delayed payments are a quiet but serious problem for small businesses, freelancers, tutors, and service providers, because the work may be complete while the money still remains stuck in follow-up cycles. In Bengaluru, a start-up called Lenda is trying to address that friction with a WhatsApp-first tool that automates reminders, supports negotiation, and helps users recover dues without creating awkward back-and-forth. 

The issue is not only financial but also practical, since chasing payments consumes time and can damage relationships between clients and providers. Many people already rely on WhatsApp for everyday communication, so the start-up is using that familiarity to make payment collection feel less like a formal recovery process and more like a normal conversation. 

Lenda’s approach is built around interactive messages instead of one-way reminders, which means a borrower can respond directly inside WhatsApp. The system lets recipients confirm payment, ask for extra time, raise a dispute, or even make a partial payment, which makes the process more flexible than a standard SMS reminder. That interaction matters because delayed payments often happen not just from unwillingness to pay, but also from timing problems, confusion, or simple forgetfulness. 

The start-up also tries to solve a structural problem for small operators such as teachers, class coordinators, and freelancers who collect money from many people at once. Its batch-reminder feature allows users to organize groups and send collective follow-ups, which reduces repetitive manual work and makes collections easier to manage. Lenda also includes late-fee options and a repayment score, aiming to encourage timely payment while giving businesses more control over overdue accounts. 

What makes the issue important is that delayed payments can disrupt cash flow, especially for small businesses that depend on regular incoming money to pay expenses and plan operations. By offering a “no-app” solution inside WhatsApp, Lenda is betting that the biggest barrier is not a lack of reminders, but the inconvenience and discomfort of asking for money repeatedly. That is why this Bengaluru start-up’s idea is less about messaging and more about fixing a common payment problem in a simpler, more human way.
Read more »
Secure Messaging
Apple Privacy Apple Security Encrypted RCS End To End Encryption iOS 26.5 iPhone Security Mobile Cyber Security RCS Protocol Secure Messaging

iOS 26.5 Introduces Private RCS Messaging and Core Feature Improvements


 

By introducing end-to-end encrypted RCS messaging between iPhone and Android devices for the first time, Apple has taken another step towards unifying secure cross-platform communication. 

In the update, Apple's messaging architecture has been significantly altered, extending advanced encryption protections beyond its proprietary ecosystem and into carriers' Rich Communication Services networks. This feature is currently being tested across major US networks and enables encrypted message exchange through the most recent version of Google Messages for Android, as well as Apple's native messaging experience, which is enhanced with visual encryption indicators and automatic activation mechanisms. 

RCS encrypted messages are currently available through a phased beta rollout to iPhone users running iOS 26.5 across supported carrier networks. Android compatibility is dependent on the latest version of Google Messages. It has been confirmed that encryption will be activated by default and gradually extended to both newly initiated and existing RCS conversations, eliminating the need for users to configure encryption manually.

Supported chats are now equipped with a dedicated lock icon that acts as a real-time confirmation layer, making sure messages are not readable while in transit between devices. Apple reiterated its commitment to privacy as its first priority, stating that iMessage remains fully encrypted within its native ecosystem, while the expansion of encrypted RCS provides an additional layer of security for cross-platform communication. 

According to industry analysts, the move is more of a strategic extension of Apple's broader device security framework than simply a messaging upgrade. According to Faisal Kawoosa, Founder and Chief Analyst at Techarc, the latest update enhances security assurances for Apple users outside of the iOS ecosystem, despite the fact that third-party messaging platforms will continue to be relevant.

With iOS 26.5, multiple system-level vulnerabilities are addressed, including issues relating to malicious media files and crafted text messages, causing application crashes, interface freezing, and potential denial-of-service exploitation scenarios before. 

Along with messaging overhaul, iOS 26.5 incorporates stability and security fixes. Modernizing the functionality of RCS itself, the update also brings advanced messaging capabilities, including high-resolution media transfer, typing indicators, read acknowledgement, reactions, and collaborative group chats across multiple devices. 

 Additionally, iOS 26.5 introduces a series of ecosystem refinements for personalization, subscription flexibility, and contextual user experiences in addition to its security-focused messaging upgrades. Apple has released an animated vertical light band wallpaper collection entitled Pride Luminance in honor of Pride Month, which shifts subtly as the device is unlocked, highlighting the importance of awareness of Pride Month. 

Apple continues to integrate adaptive visual design into iOS with its newest features, allowing users to customize wallpaper based on 11 predefined colour combinations or to create their own palette configurations. In addition to expanding subscription controls in the App Store, developers may also now offer monthly payment structures for discounted annual plans, a move that is intended to reduce upfront costs for long-term subscriptions while maintaining yearly commitments. 

The revised billing framework will require users who subscribe to annual packages through monthly payments to complete the payment cycle, regardless of whether the subscription is cancelled prior to the expiration date. Along with these additions, Apple has been continuing to expand its RCS rollout. Even though Rich Communication Services support was introduced with iOS 18 in 2024, it did not initially offer end-to-end encryption support, despite offering advanced messaging features such as high-resolution media sharing, typing indicators, read receipts, and advanced group chat features. 

In response to the integration of E2EE standards in the RCS specification by the GSMA last year, Apple has begun testing encrypted RCS support through the iOS 26 beta cycle and is preparing for a wider stable rollout. The availability of RCS support on iPhones continues to vary according to the network provider, because RCS functionality remains dependent on carrier-level implementation. 

Through the Messages settings panel, eligible users can manage the feature, displaying dedicated visual verification indicators, such as lock icons and encrypted session labels, in encrypted RCS chats. Aside from the refinement of core applications within Apple's release cycle, other core applications are being refined as well, including Maps updates that incorporate recommendations based on nearby trends and recent search behaviour, demonstrating the company's growing emphasis on contextually relevant software. 

Apple's iOS 26.5 not only extends feature parity between platforms but also reinforces its broader strategy to embed privacy and resilience deeper into everyday digital communication. By implementing end-to-end encryption for RCS conversations and simultaneously addressing media-handling vulnerabilities at the system level, the company is strengthening security controls around one of the most widely targeted layers of the mobile ecosystem. 

It reflects the growing industry trend towards interoperable, yet encrypted communication standards, where usability enhancements will increasingly coexist with enterprise-grade security protections and real-time threat mitigation.
Read more »
Phishing
2FA Cyber Attacks MFA Microsoft password Phishing

Microsoft Warns Passwords and SMS-Based 2FA Are No Longer Enough Against Modern Cyberattacks






Microsoft is intensifying its push toward passwordless security, warning that traditional passwords and older forms of two-factor authentication are becoming increasingly ineffective against modern phishing attacks powered by artificial intelligence.

In a statement released during World Passkey Day, Microsoft said the cybersecurity industry must reduce dependence on passwords and other “phishable” login methods by accelerating the adoption of passkeys. 

For years, technology companies encouraged users to strengthen account security by enabling two-factor authentication (2FA) or multi-factor authentication (MFA). Microsoft itself previously stated that MFA could block more than 99% of password-based attacks. However, cybercriminals have steadily adapted their tactics, particularly targeting SMS-based authentication systems through phishing pages, SIM-swapping schemes, session hijacking, and social engineering attacks.

The company now argues that passwords, even when paired with weak MFA methods like text-message verification codes, continue to leave accounts vulnerable. Microsoft described these older protections as “legacy” authentication methods that can still become entry points for attackers. 

Instead, Microsoft is promoting passkeys, which rely on cryptographic authentication rather than memorized passwords. A passkey stores a private digital key directly on a user’s device and only works on the legitimate website or application where it was created. Access is then confirmed through biometric verification, such as fingerprints or facial recognition, or through a device PIN. 

Security experts say this approach makes phishing significantly harder because passkeys cannot be reused on fake websites designed to imitate legitimate login pages. Unlike passwords or SMS codes, the authentication process is tied directly to the original domain. 

Microsoft also stressed that enabling passkeys alone is not enough if passwords and fallback authentication methods remain active on accounts. According to the company, weak backup options can still be exploited even after stronger protections are introduced. Microsoft has therefore continued removing older authentication systems across its ecosystem, including plans to eliminate security questions from password reset flows beginning in 2027. 

The urgency surrounding this transition has increased alongside the rapid growth of AI-generated phishing campaigns. Microsoft cited internal findings showing that AI-assisted phishing operations can achieve click-through rates as high as 54%, meaning more than half of targeted users may interact with malicious messages. 

Industry-wide adoption of passkeys is also accelerating. The FIDO Alliance estimates that more than five billion passkeys are already in use globally. Microsoft said hundreds of millions of users now sign into services such as OneDrive, Xbox, and Copilot using passkeys every day. 

Internally, Microsoft claims that over 99% of users within its environment now have access to phishing-resistant authentication methods. The company added that account recovery systems remain a critical security challenge because attackers increasingly target recovery processes instead of direct logins. 

Researchers and government agencies are broadly supporting the move toward passwordless security. The United Kingdom’s National Cyber Security Centre recently encouraged organizations and consumers to adopt passkeys, citing growing risks from AI-driven phishing and phishing-as-a-service platforms. 

Still, cybersecurity researchers caution that passkeys are not completely immune to attack. Recent academic research examining FIDO2 authentication methods found that while passkeys substantially raise the difficulty for attackers, sophisticated compromise techniques involving infected devices, session theft, or manipulated browser environments may still pose risks under certain conditions. 

Microsoft maintains that removing passwords and other phishable credentials remains essential as AI systems increasingly act on behalf of users across enterprise environments. If a single digital identity is compromised, attackers could potentially exploit connected AI agents to access systems, trigger workflows, and operate with existing permissions at machine speed. 

Read more »
Subscribe to: Posts (Atom)

Featured