NerdNews

A security hole in Microsoft 365 Copilot allowed attackers to steal sensitive tenant data via indirect prompt injection attacks using Mermaid diagrams. The vulnerability has been patched by Microsoft, but the researcher who found it won't receive a bug bounty payout because M365 Copilot is not currently in-scope for the vulnerability reward program.

Microsoft is rebuilding Outlook around AI, with plans to integrate AI into every aspect of the email client. The overhaul will include features like automated message drafting and time organization. The changes are part of a larger effort by Microsoft to incorporate AI into its products and services.

OpenAI has launched a new ChatGPT feature called 'company knowledge' that allows it to search through workspace data, such as Slack, SharePoint, and Google Drive, to provide more accurate and comprehensive answers. This feature is powered by a version of GPT-5 and is available for Business, Enterprise, and Education users.

Google's Gemini now generates presentations with a prompt or uploaded sources, and can export to Google Slides for editing and collaboration. The feature is available in Gemini's Canvas workspace for both personal and Workspace accounts.

Amazon Web Services (AWS) experienced a major outage due to Domain System Registry failures in its DynamoDB service, causing cascading outages that took down wide swaths of the web. The company explained that issues with the Network Load Balancer service and disruptions to launching new EC2 Instances contributed to the complexity and impact of the outage. The incident took about 15 hours to resolve and affected many customers. Meanwhile, other security news includes a costly cyberattack on Jaguar Land Rover, concerns over OpenAI's new Atlas browser, and SpaceX's efforts to disable Starlink kits used by scam compounds.

OpenAI has formed an Expert Council on Wellness and AI to improve ChatGPT's mental health impact. The council consists of eight experts, including researchers and professionals with experience in child development, mental health, and technology. Notably, no suicide prevention expert is included in the council. The council aims to help OpenAI develop ChatGPT in a way that supports users' well-being, particularly children and vulnerable populations.

The concept of 'enshittification' refers to the process by which platforms, such as Google, Amazon, and Facebook, initially provide great services to users, but then gradually deteriorate in quality while maintaining their user base. This occurs due to the platforms' ability to 'twiddle' or manipulate the experience for each user, often to extract more value. The lack of competition, regulatory capture, and legal shields contribute to this phenomenon. Experts like Cory Doctorow argue that structural problems require structural fixes, including antitrust measures, regulation, interoperability, and worker power.

The use of AI to generate realistic faces and voices is creating new legal challenges, particularly around likeness law. While some states have introduced bills to protect against unauthorized replicas, the legal landscape is still evolving. Companies like OpenAI are implementing their own policies, but the issue is far from resolved, with concerns around consent, defamation, and free speech.

Researchers at UC Berkeley used OpenEvolve, an open-source implementation of Google DeepMind's AlphaEvolve, to improve a load balancing algorithm, achieving a 5x speedup over prior human designs. The AI-driven approach shows promise in optimizing algorithms and has the potential to transform systems research.

A BBC study found that popular AI chatbots, including Google Gemini and ChatGPT, often provide inaccurate or misleading news summaries, with Gemini having a 76% error rate. The study analyzed over 3,000 responses and found that 45% of answers contained significant issues, highlighting the need for improvement in AI news handling.

Shield AI has unveiled a mock-up of its X-BAT aircraft, a jet-powered vertical take-off and landing (VTOL) autonomous fighter drone. The drone is designed to operate without a runway and can carry air-to-air and air-to-surface weapons. It is scheduled for its first flight in 2026 and production in 2029.

Microsoft has added a new feature called Restyle to MS Paint, allowing users to transform images into different styles using AI. The feature is currently rolling out to Windows Insiders and will be available on Snapdragon-powered Copilot+ PCs. Restyle uses generative AI to change the look of an existing image with several preset styles, similar to other AI image generators.

Amazon's automation software DynamoDB suffered a bug, causing DNS failures and knocking numerous websites and services offline. The issue affected Amazon, Alexa, Bank of America, Snapchat, and more, with some experiencing slow responses and others being completely inaccessible.

The US Energy Secretary has directed the Federal Energy Regulatory Commission to implement new rules to speed up the connection of datacenters to the grid. The proposal aims to fast-track hookups for large datacenters, which are driving up US electricity demand. The rules would limit the review time for connection decisions to 60 days and apply to new loads greater than 20 MW.

Intel has returned to profitability with $13.7 billion in revenue and net income of $4.1 billion. The company's datacenter products saw a 1% decline in sales, but its client products led the way with $8.5 billion in revenue, up 5%. Intel is working to improve its foundry business and is making progress on its 18A process, which will bring it closer to rival TSMC. The company is also focusing on AI and plans to launch successive generations of inference-optimized GPUs.

Iran's MuddyWater cyberespionage group has breached over 100 government entities across the Middle East and North Africa, using a compromised enterprise mailbox and VPN to send phishing emails with malicious Word attachments. The attackers installed a custom backdoor, allowing them to access infected systems, steal credentials, and maintain persistence.

The EU has found Meta, Facebook, and Instagram to be in violation of the Digital Services Act (DSA) rules related to handling illegal content, moderation, and transparency. TikTok is also found to be violating transparency obligations. Both companies face fines of up to 6% of their annual worldwide revenue.

Ledger introduces the Nano Gen5, a 'signer' device that uses private keys to create a cryptographic signature, aiming to provide secure identity verification and compete with Sam Altman's World project, which uses iris-scanning orbs for online identification.

The ToolShell exploit, affecting Microsoft SharePoint servers, has driven a rise in threat actors exploiting public-facing applications for initial access, with almost 40% of engagements involving ToolShell activity.

AI investment is driving US economic growth, with datacenter infrastructure and model development spending offsetting high borrowing costs and trade turmoil. Despite concerns about unsustainability and uncertain returns, AI spending is expected to continue, with global datacenter capex projected to top $657 billion in 2025.