7 min read · 11 sources

Meta’s new macOS AI assistant Muse has a zero-day that should make you rethink whether desktop agents with broad permissions belong on your fleet. Any locally installed app or terminal command can hijack the entire Muse account by changing an undocumented transcription endpoint to an attacker-controlled server. That exposes the authentication token and effectively hands over the agent’s access to files, camera, messages, and connected services - bypassing the macOS security model that normally keeps apps from touching each other’s resources. Meta has shipped a hotfix, but the design lesson is the story: a privileged AI endpoint needs the same scrutiny as your remote management tooling, and Amazon has already started blocking Muse.

The rest of the day is a mix of crypto agility done right, a VMware exit clock that’s now quantifiable, and a fresh batch of AI-infrastructure launches. Here’s what actually matters for people running systems.

A single undocumented setting lets any local process redirect Muse’s transcription endpoint and walk away with the full account token.

Muse's 0-day: one undocumented setting, full account compromise

Source: arstechnica.com ↗

The flaw, reported by Ars Technica, is depressingly simple. Muse’s transcription endpoint is configurable through settings that aren’t exposed in the UI, and nothing stops a local process from changing it. Point that endpoint at your own server, and every transcription runs through you - including the authentication token that rides along. This is the “lethal trifecta” in miniature: private data access, untrusted input, and an outbound path.

For engineers, the practical takeaway is to treat any AI assistant with device-level permissions as a new privileged endpoint. That means inventorying where it’s installed, restricting who can use it, and watching for the settings files it reads. Amazon blocking Muse suggests enterprise buyers are already making that call.

1Password ships post-quantum TLS with zero code changes

Source: 1password.com ↗

1Password’s writeup of its post-quantum TLS rollout is a masterclass in cryptographic agility. The server side was a single AWS Application Load Balancer policy change to enable the hybrid X25519MLKEM768 key exchange. The client side was one dependency bump in their Rustls-based TLS stack. No application code touched, no protocol rewrites, no downtime.

The point isn’t that quantum computers are here - it’s that harvest-now, decrypt-later attacks are a live threat to vault data sitting in transit. Teams that keep crypto implementation isolated from application logic can upgrade foundational security in days. Teams that don’t are looking at months of work when the next algorithm deprecation lands.

Gartner puts a number on the VMware exodus: 55% by 2029

Source: assets.theregister.com ↗

Gartner’s prediction is the clearest signal yet that Broadcom’s VMware strategy has a shelf life. By 2029, 55% of enterprise VMware users will have initiated proofs of concept for alternative hybrid cloud platforms, up from 25% in 2026. That’s not a prediction of mass migration - it’s a prediction that the evaluation cycle starts in earnest.

Notably, Gartner still rates VMware a leader in its Distributed Hybrid Infrastructure Magic Quadrant, alongside AWS, Nutanix, Microsoft, and Oracle. The strengths are real: core virtualization, sovereign cloud, AI-native infrastructure. The weaknesses are the ones you’ve been hearing about for two years - negative customer sentiment on communication and commercial practices. The practical read: plan for at least three more years of VMware in production, but start the alternative evaluation now so you’re not making a panic decision in 2029.

Microsoft's Hyderabad region goes live, and it's a $20.5B bet

Source: news.microsoft.com ↗

Microsoft’s new India South Central region in Hyderabad is now live, positioned as a strategic hub for Asia and the Global South. The facility runs a three-zone architecture with AI-capable hardware and zero-water mechanical cooling, part of the company’s $20.5 billion India commitment. All Indian datacenter regions are now AI-enabled, aligned with MeitY guidelines including DPDP, RBI, and CERT-In requirements.

For teams running Azure workloads in the region, this means expanded AI capacity and a datacenter design that doesn’t compete with local water supply. The BCG estimate attached to the announcement - $140-200B in economic output through 2030 - is the kind of number Microsoft likes to float, but the engineering-relevant part is the three-zone resilience and the cooling design. India is now a first-class Azure AI region, not an afterthought.

Vast Data's DataEnclave: confidential computing for GPU workloads

Source: siliconangle.com ↗

Vast Data’s DataEnclave is a confidential computing environment inside its DataEngine and AI Operating System, built on Nvidia’s confidential computing tech. It creates hardware-isolated trusted execution environments spanning CPUs and GPUs, encrypting guest memory, GPU memory, and NVLink traffic. Attestation is handled via the CNCF Trustee project or Fortanix, and encryption keys stay customer-controlled.

The target market is financial, healthcare, and government orgs that want to run AI on sensitive data without exposing model weights or training data. It supports deployment in data centers, AI clouds, and air-gapped environments. If you’ve been avoiding AI workloads because of data-privacy requirements, this is the kind of infrastructure that changes the calculus - though “customer-controlled keys” always deserves a close read of the actual key-management flow before you trust it.

Jamf and Ravenna put Mac support in Slack

Source: jamf.com ↗

Jamf’s integration with Ravenna’s AI service desk resolves Mac issues directly in Slack using Jamf Pro data and team runbooks. The AI agents can pull hardware details, management status, and configuration profiles, and they can run workflows for remote locking and FileVault recovery. IT defines the runbooks - where to look, which tools to call, when to escalate to a human - and can require confirmation before sensitive actions execute.

This is the practical version of AI in IT operations: not a general assistant, but a tightly-scoped agent with explicit guardrails. The FileVault recovery key access is the sensitive part, and the approval requirement is the right call. For teams drowning in L1 Mac tickets, this could meaningfully cut the queue.

Palo Alto's Unit 42 goes continuous with frontier models

Source: reuters.com ↗

Palo Alto Networks launched Unit 42 Continuous Frontier AI Defense, using frontier and open-weight models to continuously assess web applications, APIs, and cloud environments for vulnerabilities and attack paths. It doesn’t just find problems - it recommends remediation, including code changes and virtual patches.

The notable part is how fast AI-assisted offensive security has become a commercial product category. A year ago this was research demos; now it’s a managed service with an SLA. The flip side is that the same models are available to attackers, so this is as much about keeping pace as getting ahead.

The lethal trifecta: why enterprise copilots leak data

Source: aminrj.com ↗

Amin Rj’s analysis of what Simon Willison calls the “lethal trifecta” is required reading for anyone deploying enterprise copilots. The three legs: access to private data, exposure to untrusted content, and an outbound communication path. Remove any one and the attack fails.

The poster child is EchoLeak (CVE-2025-32711, CVSS 9.3), a zero-click attack against Microsoft 365 Copilot where a crafted email executes hidden instructions during retrieval, exfiltrating OneDrive, SharePoint, and Teams data. It beat Microsoft’s injection classifier and link redaction using reference-style Markdown. ForcedLeak in Salesforce Agentforce shows the same pattern. Classifiers and allowlists aren’t enough - you need structural controls: least-privilege scoping, rule-of-two limitations, and explicit outbound access control.

Apple's M6 Mac mini and M5 Ultra Mac Studio ship

Source: apple.com ↗

Apple’s new Mac mini and Mac Studio are available today. The Mac mini with M6 offers up to 4x faster AI performance, 2x faster graphics and storage, and 40% faster CPU performance, starting at $899; the M5 Pro version starts at $1,699. The Mac Studio with M5 Max or M5 Ultra starts at $2,499 and $5,499 respectively, with up to 512GB unified memory and 4.3x faster AI performance.

For engineers, the interesting shift is Apple’s positioning of these as local AI compute. On-device inference on a $899 box that sits on a desk is increasingly viable for private workloads, development, and alternatives to usage-based cloud AI. The M6’s Neural Accelerators and macOS 27 support make that pitch concrete.

Microsoft sets a deadline: SMS first-factor dies in February 2027

Source: bleepingcomputer.com ↗

Microsoft’s reminder is straightforward: SMS first-factor sign-in for Entra ID retires starting February 2027, and the retirement applies even if you use custom telephony providers. Passkeys are rolling out as the default authentication method, with QR code authentication and FIDO2 security keys as alternatives. The Entra SMS/Voice Policy Scanner PowerShell script will show you exactly which users are affected.

That’s roughly 16 months out, which sounds like plenty until you remember how long identity migrations actually take. Run the scanner this week, not next year.

Google Cloud hardens CI/CD with Secure Source Manager controls

Source: cloud.google.com ↗

Google Cloud’s two new generally available capabilities in Secure Source Manager target the supply-chain attack surge - more than double in H1 2026 versus H2 2025. The first blocks unauthorized access to CI/CD systems even if the corporate network is compromised. The second is a Code Owners system for granular merge guards, supporting per-path approver sets with glob-style patterns, branch-specific governance, and nestable multi-file ownership via CODEOWNERS files.

If your source control and deployment scripts are the crown jewels, these controls are worth adopting now. The Code Owners system in particular addresses the “who approved this change” question that audit teams keep asking.