One malicious extension can hijack five browser-based AI assistants
Security researcher Gal Weizman demonstrated BragJack, a family of attacks in which an ordinary Chromium extension could manipulate privileged AI components in Chrome, Edge, Perplexity Comet, Opera Neon and Claude in Chrome. Depending on the browser, the proof of concept could force prompts, read local files or browsing data, capture screenshots, and use the agent to act on websites. Google and Microsoft have fixed the assigned CVEs.
Why it matters to you
An AI browser turns extension risk into delegated-action risk. Keep browsers current, remove unused extensions, centrally block broad host and debugger permissions, and use separate managed profiles for administration. Do not let an agent with access to production consoles share a browser profile with general browsing or unreviewed extensions.
WaterPlum compromised at least 30,000 developer devices
A joint advisory from Japanese, US, Australian and German authorities says North Korea's WaterPlum group infected at least 30,000 devices across more than 100 countries and accessed over 7,000 cryptocurrency wallets. Attackers pose as AI, crypto or NFT employers, then use coding tests, malicious npm packages and booby-trapped VS Code projects to install credential stealers and remote-access tools.
Why it matters to you
Developers are both direct targets and routes into their employers. Run interview assignments and unfamiliar repositories inside disposable sandboxes with no secrets, browser sessions or corporate network access. Disable automatic workspace trust, review package-install scripts and immediately revoke credentials if a test project behaves unexpectedly.
IMF says European AI gains will depend on power and local capacity
An IMF paper presented to EU finance ministers estimates that AI could raise European productivity by about 1% over five years, while also widening inequality, stressing electricity infrastructure and deepening reliance on US and Chinese technology. Around 60% of workers in advanced European economies are in highly AI-exposed roles, and data centres already consume about 3% of electricity in several major European hubs.
Why it matters to you
AI adoption is an infrastructure and workforce programme, not only an API choice. For a European-facing SaaS product, track regional inference costs and energy constraints, keep model providers replaceable, preserve human workflows for essential tasks and document where customer data is processed.
Ohio data-centre resistance becomes a capacity-planning risk
Data-centre development has become a major political issue in Ohio as communities contest electricity demand, water use, farmland conversion and more than $2 billion in state sales-tax incentives during 2024 and 2025. One city has imposed a six-month approval moratorium, while the governor has suspended new tax-exemption applications pending reform and local groups are pursuing tighter limits.
Why it matters to you
A region listed on a provider roadmap is not usable capacity until power, permits and community approval are secured. Separate announced from contracted capacity, maintain alternative regions and providers, and include utility-price or permitting changes in disaster-recovery and cost forecasts.
CXMT begins mass production on a denser DRAM platform
Chinese memory maker CXMT says its fifth-generation DRAM platform has entered mass production. The company claims it can produce at least 50% more dies per wafer than its prior platform and has started manufacturing 24-gigabit LPDDR5X products that hold 50% more data than comparable earlier chips. The claims have not yet been independently validated.
Why it matters to you
Memory supply influences server pricing, accelerator utilisation and the cost of running AI workloads. A credible additional supplier could improve availability, but export controls and validation requirements still matter. Avoid specifying a single memory vendor and qualify capacity on performance, reliability and support rather than headline density alone.