The latest technology articles from TheMurrow. In-depth analysis and reporting on the topics that matter.
Passkeys can kill credential phishing at the login prompt—yet synced backups, recovery flows, and legacy sign-ins can quietly reopen the side doors. The milestone is real; the risk just moved.
Apple’s iOS 26.5 beta brings end‑to‑end encrypted RCS to some iPhone↔Android chats—but the lock protects content, not the carrier ecosystem and its metadata.
Most “AI watermarks” aren’t in the pixels—they’re cryptographically signed provenance attached to a file. Screenshots and platform re-encodes don’t break the label; they bypass it.
MCP turns chatbots into operators that can touch files, secrets, and production systems. The mistake: treating tool servers like harmless plugins instead of a privileged part of your perimeter.
Congress is building an “AI labeling” regime around watermarks and provenance. But the most viral deceptions often use real footage, cheap edits, and context collapse—no model required.
The “149 million passwords” headline wasn’t a Big Tech breach—it was a cloud-exposed credential cache that shows why passwords still dominate enterprise logins despite passkeys.
The FCC isn’t recalling your router—but by blocking new approvals for “foreign-produced” models and time-limiting patch waivers, it may freeze older gear in place. That’s the paradox: a security rule that could extend the life of weaker home Wi‑Fi.
A $99M settlement looks like a win—until a “fixed” tractor still won’t run without the right software, calibration, or fault-code clearance. The wrench work isn’t the bottleneck anymore; the login is.
C2PA can cryptographically validate a file’s provenance while a different “authenticity” system validates something else—creating disputes where both sides can be right. In 2026, trust-list changes and “authenticated contradictions” make that confusion easier to trigger and harder to resolve.
Google didn’t predict the year quantum breaks the internet—it set a 2029 deadline to finish migrating to post-quantum cryptography. The scarier first cracks may be forged signatures that fake trust, not stolen secrets.
Microsoft is shipping agent governance and agent acceleration on the same day. The bigger risk isn’t hallucinations—it’s the new “prompt traffic” layer where context, tool outputs, and clickable actions can turn one approval into a company-wide spill.
Google’s unusually explicit 2029 post‑quantum migration target reframes quantum risk as a present-day confidentiality problem—because attackers can harvest encrypted data now and decrypt later. The real danger isn’t a dramatic 2029 break; it’s the quiet breach that becomes readable years after you thought it was contained.
Google didn’t announce a countdown—it narrowed a resource estimate. The bigger risk isn’t secrecy lost, but signature forgery that unravels web identity: certs, updates, attestations.
When HTTPS certificates expire, browsers don’t “degrade”—they block. Starting March 15, 2026, the new 200‑day cap turns sloppy renewals into recurring, client-side “outages.”
As soon as an agent can call tools—APIs, plugins, browser controls—attackers can hide instructions in “harmless” tool metadata. The transcript will look competent, right up until money moves.
The EU AI Act has been in force since Aug. 1, 2024—and compliance arrives in waves. For GPAI vendors, obligations begin Aug. 2, 2025, and Aug. 2, 2026 is when enforcement (and fines) turns unmistakably real.
The breach risk isn’t “AI wrote bad code”—it’s that AI makes unreviewed change feel safe, especially when it quietly rewires your dependency tree under deadline pressure.
Founders fixate on Aug. 2, 2026, because that’s when enforcement gets loud. But the compliance paper trail for GPAI models started Aug. 2, 2025—made auditable by a Commission template published July 24, 2025.
The standards are real, the cryptography is elegant—and yet labels vanish in upload pipelines, reposts, and UI design choices. In 2026, “AI labeling” fails less at creation than in the supply chain.
Baidu is moving its strategically sensitive AI chip arm toward a Hong Kong listing—seeking capital and a market benchmark without giving up control.