language models Archives

AppWizard

October 11, 2026

The developer of an AI-powered driving instruction simulator is spending $1,000 per month just to keep its demo running

Artificial intelligence, particularly through large language models (LLMs), is expected to significantly impact the gaming industry by enhancing non-player characters (NPCs). However, practical implementation has been limited, with few titles like Where Winds Meet exploring this technology. A case study from the developers of Teach My Little Sister How To Drive highlights the financial challenges of integrating LLMs, as daily operational costs have exceeded ,000 due to high player interactions. The developers, Easy Fox, have taken out a bank loan to sustain the demo but are uncertain about its long-term viability. They are considering alternatives like local AI models for players with powerful GPUs, though this would limit accessibility. The game’s reliance on a premium LLM raises questions about its necessity, especially given existing design challenges such as artificial dialogue and misinterpreted commands. The full release of the game is scheduled for January next year.

Winsage

October 8, 2026

Copilot Gets Control of Windows and Your Files as Microsoft’s Recall Bill Comes Due

Microsoft is requesting Windows users to grant its Copilot feature access to their files and activities, following a previous retraction of a similar AI integration due to scrutiny. Copilot can analyze content on the device with user consent, performing tasks like organizing files and troubleshooting, using both local AI models and cloud processing. Microsoft has implemented safeguards, but its security team has raised concerns about potential risks associated with powerful features. The opt-in nature of Copilot places accountability on Microsoft, as users must actively grant access. Hybrid features are set to roll out in the coming months, with taskbar search actions already reaching Windows Insiders. Over 40 percent of new business laptops are being designed as Copilot+ PCs, with the Surface Laptop Ultra scheduled for release on October 16.

Winsage

October 8, 2026

Copilot Gets Control of Windows and Your Files as Microsoft’s Recall Bill Comes Due

Microsoft is inviting Windows users to grant its Copilot feature access to their files and activities, with user consent. The new iteration of Copilot can understand content on the device, perform tasks like organizing files, troubleshooting, and writing code, with some tasks processed in the cloud. Activation is opt-in, folder access is limited, and Copilot operates under separate accounts from users. Microsoft has implemented safeguards, including Microsoft Execution Containers to define agent access. However, internal warnings from Microsoft's security team highlight potential risks associated with agents capable of modifying environments. Features for enhancing auditability of agent activities are under development. Microsoft previously faced criticism for its Recall feature, which raised security concerns. The opt-in design places accountability on Microsoft, as users must grant access. The hybrid features require a Copilot+ PC and are set to roll out in the coming months, with taskbar search actions already reaching Windows Insiders. Over 40 percent of newly manufactured business laptops are Copilot+ PCs, with the Surface Laptop Ultra launching on October 16.

AppWizard

September 30, 2026

GitHub AI Security Agent Finds 24 Android Vulnerabilities Including Account Takeover Flaws

GitHub Security Lab's open-source AI security agent identified 24 vulnerabilities in various Android applications, including critical flaws in the OsmAnd navigation app and the Wikipedia app for Android. The OsmAnd vulnerability allows a malicious app to silently import and replace settings, potentially enabling covert location tracking. The Wikipedia app's vulnerability involves inadequate hostname validation for deep links, allowing attackers to load malicious content and potentially take over user accounts. The research highlights the effectiveness of AI in identifying vulnerabilities while emphasizing the need for human validation. The GitHub Security Lab Taskflow Agent automates security research workflows, focusing on mobile entry points and evaluating them against Android-specific vulnerability classes. The findings stress the importance of expert review for AI-generated results.

AppWizard

September 29, 2026

How we found 24 Android vulnerabilities using our open source AI security agent

The GitHub Security Lab has introduced the Taskflow Agent, an open-source tool that uses artificial intelligence to automate the identification of vulnerabilities in Android applications. This tool allows security researchers to create custom taskflow prompts, leading to the discovery of over 20 vulnerabilities. To use the taskflows, a GitHub Copilot license is required, and users can run scripts to audit their projects, with results displayed in an SQLite viewer. Two specific vulnerabilities identified include: 1. OsmAnd app allows malicious applications to track user locations due to improper handling of intent extras in its exported activity. 2. The Wikipedia app has a logic flaw that enables attackers to redirect users to malicious sites via a deeplink mechanism, potentially leading to account takeovers. The GitHub Security Lab has reported a total of 24 vulnerabilities in Android applications, highlighting the effectiveness of AI in security research.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

AppWizard

September 18, 2026

Google just put the latest AI models through a brutal coding test

Google has launched Android Bench 2.0, a benchmark for evaluating large language models (LLMs) and AI agents on complex Android development tasks. This version focuses on long-horizon tasks (LHTs) that are more intricate than those assessed by the original benchmark. Key tasks include upgrading dependencies, adding major new features, and building Android apps from scratch. The new grading system uses continuous scoring instead of a binary pass-or-fail method, providing a more detailed performance evaluation. Currently, GPT-6 Astra leads the leaderboard with a 28% pass rate, followed by Gemini 3.8 Flash at 8%. Other evaluated models include Claude Fable 5.1, GPT-5.6 Sol, and Claude Opus 5. Google plans to expand the leaderboard with more models and results.

Winsage

September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.

Winsage

September 5, 2026

Nvidia & Microsoft push local AI agents on Windows

NVIDIA has enhanced the capability to run AI agents locally on its hardware in collaboration with Microsoft and software partners, coinciding with the launch of new RTX Spark Windows PCs. The installation process for local agent software has been simplified, with improved inference speeds and the introduction of NVIDIA PAIR, which distributes inference tasks across multiple PCs on a local network. Three applications benefiting from these enhancements are Hermes Agent, OpenClaw, and Perplexity Portable Computer, all designed to minimize manual configuration. Hermes Agent offers a one-click local setup for RTX and DGX systems, automatically detecting the GPU and optimizing model selection. OpenClaw simplifies local model setups for RTX GPUs with at least 24GB of VRAM, backed by an open-source community. Perplexity Portable Computer, already available on Linux, is extending support to NVIDIA RTX GPUs and Windows. NVIDIA is also improving performance in the open-source inference stack, achieving throughput increases of up to 1.9 times on GeForce RTX 5090 and up to 1.4 times on DGX Spark clusters. The PAIR software identifies compatible PCs on the same network to optimize computing resources, supporting various hardware configurations. The upcoming RTX Spark Windows PCs, set to launch in October, will include compact desktop and laptop designs featuring Blackwell GPU and Grace CPU architecture. Game publishers like Electronic Arts and Ubisoft are developing titles for these systems. Additionally, CyberLink's PhotoDirector AI PC Mode will integrate local AI processing for creative tasks, emphasizing the trend of migrating generative AI workloads from cloud to local devices. NVIDIA notes that over half of U.S. households have two or more PCs, indicating potential for maximizing computing power.