Like many leaders today, Prabha Jha has been feeling the significant impact artificial intelligence is having on business operations. While the rapid evolution of the technology can bring fear, uncertainty, and confusion, Jha chose a different response: excitement. She began asking herself, “How do I become part of this once-in-a-lifetime thing?” 

Jha holds a bachelor’s degree in information technology from the University of Calcutta and earned her MBA while working at Verizon, where she continues to build her career. As she looked for an educational opportunity to engage more deeply with AI, MIT quickly emerged as a natural choice. 

Growing up, Jha viewed MIT as “the mecca for anybody who is in engineering and technology,” so she naturally turned to the Institute when seeking an opportunity to learn about AI. Unlike other programs that took place fully online, MIT xPRO’s AI for Senior Executives stood out to Jha primarily because it offered an in-person component that allowed her to meet and connect with peers. 

Jha decided to take the leap. She acknowledges that the program was a significant investment of both time and money, but ultimately views it as one of “the best decisions [she] made” — one she “would do all over again if [she] had to.” The experience gave Jha the opportunity she was looking for to invest in herself and strengthen her skills in AI. It also provided her with invaluable professional relationships and the confidence to develop multiple AI solutions for Verizon. Putting those news skills and relationships to work, she co-wrote, with some of her peers, “The AI Anthology,” a collection of AI insights designed to support other leaders navigating similar challenges with AI. 

An unexpected learning obstacle

Jha’s learning journey wasn’t without its curveballs, though. Just two months before she was set to complete the program, she spent two weeks in the hospital with a severe infection and was unable to graduate with her original cohort. With the help of MIT staff, she joined the next cohort, giving her an unexpected opportunity to spend another five days on campus with 100 brand-new peers. 

“You just never know what curveball life can throw and what it might be there for,” Jha says.

What initially felt like a setback turned into an unexpected benefit. Jha valued the opportunity to meet new people and spend more time on campus. She also appreciated that just six months later, the program’s content had already been refreshed. Those additional “five days of immersion” became a vital part of Jha’s learning journey, giving her and her peers more time to collaborate face-to-face and learn from one another. 

“I think it was eye-opening to be able to meet so many people with diverse backgrounds and geography, and then we connected at the human level,” she says. 

Jha particularly valued that sense of connection in the context of learning about AI, a field that, she acknowledges, comes with fears, vulnerabilities, and difficult questions. Learning alongside peers with different professional and cultural backgrounds gave her new perspectives and added another dimension to the experience. Jha estimates that “30 percent of what I was learning was from the program, material, and professor [while] 70 percent was my peers and the interactions.”

Peer discussions spark an idea

The idea that would change the trajectory of Jha’s time in the program came during a “salon gathering” at the home of Manolis Kellis, a professor in MIT’s Department of Electrical Engineering and Computer Science. As students shared personal stories about their experiences with AI, one story in particular stayed with Jha: that of one of her peers, whose motivation to explore AI solutions stemmed from her work to find a cure for her mother’s Alzheimer's disease and dementia. 

At that moment, Jha realized that AI is personal. She still “gets goosebumps thinking of that moment where AI really became human and a connecting point.”

She saw the value in capturing these diverse perspectives and experiences with AI that go beyond operational efficiency and revenue growth, and wanted to continue the conversation beyond the program. Jha expressed to her peers an interest in capturing these stories and connections in a book. One year later, Jha and 20 other leaders released “The AI Anthology,” a collection of essays examining the influence AI has had across industries and across society. 

One of the biggest takeaways from the AI for Senior Executives program — and one that Jha hopes readers will take from her book — is the importance of thinking differently. 

Jha believes leaders may be missing a fundamental shift: “We are still kind of stuck in this traditional measurement of success,” she says. “We cherish revenue; we like cost-cutting and time-saving, and converting them to dollars.” 

While Jha acknowledges this mindset makes sense in corporate America, she believes leaders must move beyond it in order to find more empowerment through AI and its capabilities. She notes that future generations are already asking different questions, including: “What can I get in the quality of my life?” and “How can I use my time in a way that is fulfilling for me early on?” 

The future of embracing AI for business and a better world 

Jha recognizes that AI adoption is not optional for businesses, and that everyone must learn about and embrace it. At the same time, she is a steadfast believer in AI’s ability to create a better world. Instead of viewing AI as a foregone burden, she sees it as a “transformation unlike any other” that is providing us with the opportunity to overcome insecurity, adapt and grow, and invest in ourselves. 

In her work at Verizon, Jha takes seriously the company’s role as “a brand name for reliable, quality service” providing “critical infrastructure” to groups, such as first responders or children, who depend on their services. This responsibility comes with a privileged obligation to participate in and protect society, and Jha finds it empowering that AI can help enable this. In her own experience, she’s appreciated the ability to accelerate progress and impact, when she may have previously needed to rely on a larger team. 

So, what’s next for Jha? Currently, she is working on a new initiative focused on supporting small and medium-sized businesses that are navigating AI implementation. Her goal is to help them understand what tools they need, how AI fits into their specific operational model, and how they can measure success, so they can focus on their strengths as a business and how they can drive value. 

Angeline Peng doesn’t come from a strong faith tradition, but she is a big believer in the power of discussion. In her role with the Addir Fellows Interfaith Dialogue Program at MIT, she convenes and leads regular, small-group interfaith conversations to help other students — and herself — grapple with big questions.

The Addir Fellows Program was started in 2005 through a grant from the U.S. Department of Homeland Security. It is now supported by MIT’s Office of Religious, Spiritual, and Ethical Life. The program has maintained a steady focus on “sharing spiritual values and experiences, not just opinions,” says MIT Chaplain Thea Keith-Lucas.

A fourth-year math major, Peng sees deep connections between what she’s learning in class and the Addir Program. Here, she describes her work with the program, the link between faith and logic, and how she believes discussing big questions changes people.

Q: What is the Addir Fellows program?

A: It’s an interfaith dialogue club. “Addir” comes from the Sumerian word for “bridge,” and that's what we're here to do — build bridges between people from different walks of life. 

We meet every week in small groups of five to eight people. The groups start off with what we call our “spiritual autobiographies.” As much as we can, everyone gives a description of where they're coming from. After that, every week we pick a topic and discuss it. 

We try to balance faith traditions in the small groups. The biggest limiting factor is scheduling. That turns out to be really complicated. 

Q: What’s your own spiritual autobiography?

A: My family is atheist. I was born in Singapore, which is very multicultural, and we moved to Lehi, Utah, when I was 10. Utah is very homogeneous; most people in my neighborhood were part of the Church of Jesus Christ of Latter-Day Saints. Sometimes in high school I would ask friends about their beliefs, but college was the first time I could really explore. 

At some point I realized it's important to know myself better, to understand and have my own principles. Exploring different religions is an attempt — and I am still building this — to understand what I think is important, what I value, what I think is right, and what I think is wrong. 

Getting insight from different faith traditions is really helpful. I believe different religions, or different approaches to religion, are all interpretations of universal truth — and so exploring from all kinds of perspectives will give me a better understanding of what that could mean. 

I'll say, I'm not too sure about it yet. I don't know if there's some kind of universal good, or bad, or whatever. But I do think there are some kernels in everything. 

Q: Who participates? Does the program bring together a range of faith traditions?

A: When I signed up for my first Addir event, I met grad students and undergrads from just about everywhere. It was very refreshing, like — “Wow! I didn't know there were all these people here!” At MIT, you can end up in a kind of bubble. You know people from your dorm or your major. This program’s different.

The people come from a wide spectrum of traditions and backgrounds. Also, we have quite a lot who are somewhat agnostic or less extreme in their beliefs. 

A big part of why people sign up for Addir is they want to listen to other people and learn. Sometimes, this means they don't talk as much. I do my best to instigate — play devil’s advocate and push at people's ideas. I believe that’s part of my job.

Q: Do you think participants feel pressure to speak “for” their faiths?

A: I wouldn't say anyone is trying to represent their faith, because there are so many facets of just one faith anyway. When there are questions, everybody gives an answer like, “This is what I think.” Sometimes people will bring up a text and say, “It says this, and this is how I interpret it, or this is how certain people in my life interpret it.” That can be really helpful.

Also, I wouldn't say we’re focused on just religion. A lot of people are just trying to find their way in life, whether it’s through spiritual or secular questions. In my small groups, we've talked quite a bit about what we can do to just be a better person; exploring different aspects of that, and dealing with more everyday stuff like regrets, guilt, pleasure, pain, punishment. Obviously, religion can help you with answers. 

I like to think: How can we answer those questions as a group, in that room, in that moment? The answers might be different for everyone, but if we can hear what other people think, maybe we can get insight and be persuaded into believing something new. 

Q: How does the mathematician in you come out during these conversations? 

A: I think part of why I do math is spiritual, so they're connected in that sense. It all relates to how I want to live my life. Some people describe doing math like making art — they're in pursuit of beauty and some deeper truth. I think math is really pretty, and there's a lot of beauty in the truth. 

One of the great tools of mathematics is that it teaches you how to abstract and understand which details are just details, and what are the core ideas. Doing a lot of math helps me stay objective, abstracting away things that are less important. 

Q: Can it be difficult to reconcile issues of faith and logic? 

A: You have to always believe in something. It's like picking your axioms. You start with faith in something, and from there you can extrapolate away what you think.  

It can be very difficult. Gödel's incompleteness theorem says you can't prove everything with any set of axioms. You can choose whatever set of axioms you like, and it either is incomplete or inconsistent; incomplete, as in you can't prove every statement is either true or false, and inconsistent in that you will at some point prove that something is both true and false. So you can't have both. But we want both! 

Mathematicians live with the incomplete, and this is probably true for any belief system. Some people are deeply unhappy not knowing the answer, and some people are more OK with it. I tend to be very OK with it. 

Q: Do you think this program changes people?

A: Definitely. Over time, people's opinions really do change. We all have the more “press-ready” opinions we give to others. Even in Addir, it's got to be half or two-thirds of the year before I feel comfortable talking about everything I really believe. This program is genius because you actually become friends by the end. 

To actually care about another person — as a person, outside of what they believe — is really a function of time. You need to be together and have this dialogue for a while. When there’s conflict, finding solutions is very situation-dependent, and maybe not possible. But eventually, you get to know each other. You can talk about controversial issues or opinions that maybe you were scared of sharing before. It's so nice to have this space as your opinion is changing. 

Because of Addir, maybe one person learns a little bit, and they go back to their own group of people and share that perspective. And when they share it, someone else learns. I'm a big proponent of let's try to change things locally — very locally; person by person — and maybe we can spread that positivity. 

New records obtained by EFF expose additional issues with Medicare’s AI-driven prior authorization program and show why we need stronger legal limits around government use of automated decision-making. 

EFF sued the government back in March for information about the Wasteful and Inappropriate Service Reduction (WISeR) model, a new Medicare program that uses AI to evaluate prior authorization requests for certain medical services. We previously released records showing that WISeR has resulted in delays and denials of care, operational chaos, and reports of patient harm. Today, we’re publishing over 800 new pages of records, including:

• Requests for information (RFIs) or requests for corrective action plans (CAPs) sent from the Centers for Medicare & Medicaid Services (CMS) to four of the six WISeR vendors, along with the vendors’ responses.
• Applications of 66 companies to the WISeR model, including those of the 6 selected companies. 
• Task orders and contracts for the evaluation, implementation, and monitoring of the WISeR model.

Documents obtained through EFF’s lawsuit are available here.

These newly released documents show that the WISeR rollout was rushed and rocky from the start, highlighting the dangers that arise when governments treat AI like a silver bullet for complex problems. The documents also highlight the need for more transparency about safeguards against inappropriate, AI-driven denials. The public still lacks the information needed to assess whether clinician review is providing meaningful oversight of AI systems and whether appropriate data is being used to evaluate prior authorization requests. 

EFF has long argued that AI has no place in consequential government decisions about peoples’ rights or access to benefits, such as immigration enforcement and policing decisions. That’s because using automated decision-making in these contexts risks decisions that violate people’s rights or deprive them of benefits they’re entitled to based on biased or inappropriate considerations and without proper due process or accountability if there is an error. 

By outsourcing decision-making to private AI companies without sufficient transparency, testing, or legal limits, WISeR jeopardizes seniors’ access to medical care. Congress should step in to place greater legal limits on the use of automated decision-making in Medicare. 

WISeR’s Rollout Was Rushed and Rocky 

CMS launched the WISeR program just six months after announcing it, ignoring calls from medical providers to delay its rollout. In records previously released by EFF, CMS acknowledged this “extremely condensed timeline.” 

New records suggest that WISeR’s unusually rapid rollout contributed to widespread problems in the first few months of the program. CMS did not disclose the extent of these issues to the public, even as agency employees privately contacted vendors about potential noncompliance with program requirements. 

In the first three months of the program, CMS sent RFIs or requests for CAPs to at least four of the six WISeR vendors. These requests, which describe delays, technical failures, and a lack of communication with providers, suggest that widespread problems during the program’s rollout were not limited to one vendor or state. 

These letters underscore the severity of the problems with the program. For example, CMS requested information from one vendor, Virtix, about numerous reported issues, including “determination turnaround times that exceed established guidelines,” “denials that appear inaccurate or inconsistent with applicable criteria,” and “inadequate customer service.” CMS’s RFI to Zyter–a vendor that uses Palantir software infrastructure–observed that the agency had received reports that “Zyter is not issuing determination letters in a timely manner” and communications indicating that it “may lack adequate processes for responding to and escalating provider/supplier concerns.” The vendor Innovaccer received two CAP requests and a “Performance Notice of Non-Compliance” over its failure to implement a fully functional portal for WISeR providers and suppliers.

Excerpts from CMS’ letters to vendors describe problems during WISeR’s rollout:

Excerpt from the RFI for Virtix, March 17, 2026

Excerpt from the RFI for Zyter, February 27, 2026

Excerpt from the Performance Notice of Non-Compliance for Innovaccer, February 20, 2026

Vendors’ responses to CMS provide further evidence that WISeR’s rushed rollout contributed to its problems. Innovaccer claimed it warned CMS months in advance that it might not be ready to provide full portal functionality by the launch date, even before signing a Participation Agreement. Another vendor claimed that “technical and workflow stabilization challenges were encountered due to the compressed implementation timeframe” it faced after joining the WISeR program a month after the other vendors. 

Excerpt from Innovaccer’s Proposed CAP, January 16, 2026

The issues reflected in CMS’s letters to vendors, and the vendors’ responses, illustrate the risks of deploying automated decision-making systems without proper testing or safeguards. While vendors’ responses describe fixes for the problems CMS identified, after-the-fact remedies cannot undo the harms that patients and providers already experienced during WISeR’s rushed rollout. 

More Transparency Needed About AI Safeguards

The public still knows far too little about any safeguards that WISeR vendors may have adopted—in part because the government chose to conceal some of this information. Transparency about these safeguards is critical to protecting patients, especially because WISeR’s payment structure gives vendors, as the government put it, “an incentive to deny as many claims as possible.” 

 Information provided by a vendor about safeguards that it says "ensure the responsible and clinically appropriate application of automation” appears to have been redacted from records released to EFF

The public has limited means to evaluate the effectiveness of even the safeguards that weren’t redacted from records released to EFF. For example, one vendor’s application touts safeguards like “Human-in-the-loop (HITL) workflows,” “Continuous model monitoring,” and “Transparent audit trails.” Yet it remains unclear whether these measures effectively prevent improper prior authorization denials. Some evidence suggests they may not: the company denied more requests than it approved in the first few months of the program, and CMS inquired about “denials that appear inaccurate or inconsistent with applicable criteria.”

Ultimately, the records obtained by EFF raise more questions than they answer about the safeguards used by WISeR vendors. 

Having a Human in the Loop Is Probably Not Enough

CMS has emphasized having a human in the loop as a key safeguard against inappropriate, AI-driven denials. The WISeR FAQ page on the CMS website states that “Non-affirmations will require the review of a human clinician and cannot be performed solely by technology.” But whether human review provides any meaningful protection depends on the details of its implementation, such as whether human reviewers have enough time to evaluate requests and practical authority to override AI recommendations. We still lack many of those details for WISeR vendors. 

A growing body of scholarship points to the substantial limitations of “human in the loop” policies as guardrails for AI systems. AI-generated recommendations can unduly influence human decisions, leading reviewers to over-rely on automated judgements and rubber stamp them as correct. Even worse, at least one health insurance company actively pressured clinical reviewers to accept its AI systems’ recommendations. Another company built a system that allowed clinical reviewers to reject claims without opening patient files; clinical reviewers using this system spent an average of just 1.2 seconds on each case.

Is the Right Kind of Data Informing Companies’ Decisions?

Some WISeR vendors’ applications offer general descriptions of the types of data informing their decisions. But far more details are needed to allow medical professionals to assess whether the data inputs to these AI systems are appropriate for evaluating prior authorization requests. 

Inappropriate training data or input data can lead to biased, unfair, or inaccurate decisions. CMS guidance for Medicare Advantage organizations using AI to make coverage decisions emphasizes the importance of basing decisions on individual patients’ circumstances. It cautions against using “an algorithm that determines coverage based on a larger data set instead of the individual patient's medical history, the physician’s recommendations, or clinical notes.” 

WISeR vendors’ applications reference data sources like “provider behavior,” “patient demographics,” “utilization management datasets,” “provider and payer performance metrics,” and “historical claims data.” Whether these sources could introduce bias or give too much weight to population-level patterns depends on how vendors use them to inform individual decisions. But we don’t yet have these important details about vendors’ data and algorithms. By outsourcing decision-making to private companies’ AI systems, the government has made it harder for the public to evaluate whether decisions are being made fairly.

Next Steps

As the government expands its use of automated decision-making, the potential for consequential mistakes increases rapidly. The records we’ve obtained so far raise questions about the rushed rollout and lack of guardrails for automated decision-making by the U.S. government. EFF urges transparency, oversight, and legal limits to protect people from the harms of automated decision-making in high risk systems.  

Related Cases: EFF v. CMS

At any given moment, a U.S. Air Force pilot may be maneuvering an aircraft mid-mission, a U.S. Navy officer resurfacing a submarine after weeks undersea, or a U.S. Army technician offloading drone data in a combat zone. Each operation depends on satellite communications (satcom) and, specifically, on cryptographic keys that allow terminals to communicate securely while keeping adversaries locked out.

At the scale of modern operations, managing these keys is a technical challenge. Every terminal needs to have the right keys at the right time, quickly and securely, and if any keys are compromised, they need to be refreshed without leaving out devices that may be offline, disconnected, or under attack.

MIT Lincoln Laboratory researchers have now solved this challenge with the Protected Anti-Jam Tactical Satcom (PATS) Key Management System (KMS) Prototype. This new architecture enables keys to refresh rapidly across terminals dispersed worldwide, even in contested or bandwidth-constrained environments.

"We're enabling the nation to achieve highly assured, highly available communications. Even when adversaries know where forces are operating and are trying to stop them from communicating, they're unable to do so, because we've built in smarts across this entire system to keep talking,” says Joseph Sobchuk, a principal investigator of the PATS KMS Prototype program and researcher in the Secure Resilient Systems and Technology Group.

This architecture is being adopted as the cryptographic backbone of the U.S. Space Force's next-generation satcom system, PATS. The KMS Prototype serves as the gold-standard reference implementation for the industry-built operational KMS, which will be integrated across the PATS ecosystem, encompassing satellites, user terminals on military platforms, and ground-based communication hubs.

Developed under sponsorship of the Space Force’s Space Systems Command (SSC), the KMS Prototype reflects Lincoln Laboratory's end-to-end approach to technology development, from shaping the core key-management concepts to putting them into practice in a prototype to transitioning a technical baseline to government and industry. For this transitioned innovation, the SSC and Lincoln Laboratory team received a 2025 R&D 100 Award, recognizing the KMS Prototype among the year’s most impactful new technologies.

Managing key challenges

Cryptographic keys are foundational to secure communications. These keys, strings of random characters used by cryptographic algorithms, help protect communications by encrypting data and supporting protected transmission patterns, such as frequency hopping. Without key protection, the communications sent and received by terminals are more susceptible to eavesdropping and interference.

Historically, operators manually uploaded keys to terminals before missions. More recently, some systems have supported over-the-air key updates, but bandwidth constraints, security concerns, and operational complexity have limited real-time, wide-scale refresh.  

"Key management is the linchpin that turns advanced, anti-jam hardware and waveforms into a usable mission capability," says Roger Khazan, leader of the Secure Resilient Systems and Technology Group. "Without a scalable way to deliver the right keys to the right systems at the right time, protected satcom cannot operate reliably across a dynamic force."

One primary threat to satcom is signal jamming, where adversaries flood specific frequencies with noise. To resist jamming, PATS uses frequency hopping, in which signals jump rapidly between frequencies in a pattern that looks random to anyone without the key. This hopping only works when every legitimate terminal holds current keys and stays in sync. Keeping all those terminals correctly keyed is the KMS's job. "Designing a system to handle that coordination efficiently, without breaking the conversation, is incredibly difficult," Sobchuk says.

Maintaining synchronization becomes even more critical when devices are compromised. Terminals share keying material so they can communicate as a group and follow protected hopping patterns. If an adversary captures a device, such as a downed drone, and extracts its keys, the exposure can extend beyond that one device. Depending on what keying material is exposed, an adversary may gain access to protected communications or help a jammer follow the hopping pattern. Restoring security means refreshing keys for legitimate terminals — including those that may be offline or operating in contested conditions — while locking the captured device out.

But here's the catch: To send new keys, you need to establish a secure link to terminals, and to establish a secure link, terminals need valid keys. This situation creates a long-standing "chicken-or-egg" problem for key management.

Solving the chicken-or-egg problem

Lincoln Laboratory's solution is a hybrid key distribution method using a "pull-and-push" approach. Each month, each terminal "pulls" a package of keys tailored to that terminal over the satcom link. Then, daily, the satellite "pushes" a smaller key to every terminal. The monthly keys encrypt the daily keys, creating layered security. The daily key determines the unpredictable frequency-hopping patterns. Even if an adversary captures today's key, tomorrow's will be different, and encrypted to exclude them.

"This way of sending keys hadn't existed before," Sobchuk says, adding that Lincoln Laboratory researchers have been pioneering this key-management technology for more than a decade. "The combination of pull and push, monthly and daily, is the magic behind all of it."

This hybrid approach also solves the issue of leaving out devices that were disconnected during a key refresh. For instance, if a submarine submerges for six months, it can request keys for the entire period in advance. Even if keys are refreshed while it's offline, the submarine can immediately reconnect when it resurfaces because the monthly keys provide access to the daily key.

"Submarine crews want to log on to the satellite and talk right away, not wait to get back to shore for new keys. They want to turn on their system and have it work," Sobchuk says.

Monthly and daily key broadcasts must reach thousands of devices spanning the globe. To enable this large-scale sharing, the team adapted theoretical algorithms from academia to create the first operational-scale implementation of broadcast encryption for such a protected satcom application. Broadcast encryption is a method for securely sending information to many users at once. These algorithms encrypt each daily key using just a small subset of keys instead of separately encrypting the daily key for every terminal. This implementation preserves communication bandwidth that would otherwise be consumed just by sending keys.

"The point isn't just stronger cryptography. It's making secure communications usable at operational scale, in contested conditions, without imposing a crippling burden on the warfighters and operators who depend on them," says Sean O'Melia, an assistant leader in the Secure Resilient Systems and Technology Group.

Transitioning to operations

Lincoln Laboratory has transitioned the KMS Prototype to multiple government and industry partners developing PATS components across service branches. To facilitate this coordination, the team has supported dozens of integration events and produced in-depth technical documentation. The prototype is allowing developers to test and validate their components while defense contractors build the operational version of KMS.

The laboratory's work is also enabling contractors to achieve National Security Agency (NSA) certification of end cryptographic units (ECUs), the hardware devices within a terminal that transmit, receive, or store keys. Last year, the first PATS ECU — the space-hub ECU that goes on the satellite — earned NSA certification. Achieving this certification is an arduous process requiring proof that the design, implementation, and supporting processes are all secure.

After years of work, the team is grateful to have helped lay a foundation for the future of secure satcom, both through the KMS Prototype and the larger PATS technical vision, Khazan says. The effort brought together expertise from across the laboratory’s Cyber Security and Information Sciences Division and Communication Systems Division.

"PATS KMS is the kind of problem Lincoln Laboratory was built to solve: high-risk research, rigorous engineering, and transition into a national-security capability. Working with Space Systems Command and the PATS community, our team helped turn advanced key-management ideas into a technical baseline that industry can build on and the government can use. The result is a more-resilient satcom architecture that can scale across a complex operational ecosystem," he says.

A nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights of a sports broadcaster. Forcing a responsible privacy service out of an important market is a predictable result of trying to force infrastructure providers to be copyright police.

When you visit a website, a DNS resolver reads the domain name you type in—like eff.org— and translates it into a numerical IP address that’s used to direct data across the internet. A DNS resolver can see the names of websites you connect to, so its privacy policies are important. Quad9 is an NGO that’s incorporated in Switzerland, in part to protect its users from data demands. The company also helps protect users from malware and phishing by blocking domains that are known to be malicious. Services like Quad9 offer an alternative to the DNS resolvers of local internet service providers and wireless carriers, which are vulnerable to demands from law enforcement, censorship, and commercial surveillance.

In a blog post explaining its decision, Quad9 explains that the French court’s order forces it to make a decision that, either way, is bad for users. It could either “extend French law to the whole world (blocking globally)” or try to identify and block users only in France—something that it can’t do reliably, and a move that could leave the company facing massive fines if it fails to block websites perfectly within France. Quad9 says it is facing about 20 other lawsuits in France seeking similar blocking orders. 

Rather than accept these demands, Quad9 has decided to withdraw its service from France. That is a real loss for French users who rely on the service to protect their privacy and security. It is also the right thing to do, when faced with the alternative: making promises it can’t keep, or abandoning users’ rights worldwide. 

Quad9’s decision will not remove any allegedly infringing material from the internet. The organization doesn’t host websites. Users looking for particular websites can  easily switch to another DNS resolver. So the material targeted by copyright holders will remain online and accessible, even while they drive a privacy-protecting service out of France. 

These events matter beyond the borders of France, and U.S. lawmakers should pay attention. Congress is considering multiple site-blocking proposals, which would require ISPs and other intermediaries, including DNS resolvers, to block access to websites in the name of protecting copyright. These bills threaten speech and our ability to access information online, and they are invitations to abuse. The Quad9 withdrawal shows another cost: if internet services get forced into being copyright cops, users can lose services that they rely on for privacy and security. 

Worse still, if neutral services like Quad9 are forced to build site-blocking systems for the benefit of copyright holders, it becomes far easier for other powerful interests, including repressive governments, to demand the same systems be used to censor speech they dislike, globally. 

Congress should reject site-blocking bills. They’re a threat to the open internet, and don’t help creators or creativity. 

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”

Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses...

MIT researchers developed a new type of origami-based construction method that could be used to build complex structures that are cheaper and easier to assemble, and use less material than those built with some conventional techniques.

This scalable system simplifies the process of designing lightweight, rigid structural shells from modular components that can be fabricated from flat sheets of material and then folded into shape. 

The units are connected to build a larger lattice structure using simple tools and a foolproof assembly process. They form a strong, load-bearing structural shell that doesn’t need interior support columns.

This method could be particularly well-suited for disaster relief shelters that can be rapidly fabricated and shipped efficiently as flat panels, then set up quickly by workers at the site of an earthquake or flood. It could also be used to develop strong, lightweight components for airplanes or modular robots, or architectural elements like sound-dampening panels and building facades.

The researchers’ technique can generate structures that are many times stiffer than those made using some other forms of structural origami, while requiring only about two-thirds as much material. This could make it a more sustainable form of construction.

In addition to developing small prototypes, the researchers demonstrated the scalability of this approach by fabricating a room-sized folded aluminum sculpture that was recently hung at the Boston Public Library as an exhibition inaugurated for the annual Fab Lab Conference and Symposium.

“This work shows that the power of digital manufacturing can go beyond personal fabrication projects and start touching the real world, enhancing the way we design houses and large structures. We are demonstrating structural origami on building scales,” says Alfonso Parra Rubio, a graduate student in the Center for Bits and Atoms (CBA) at MIT and lead author of a paper on this method.

He is joined on the paper by Riccardo Foschi, a researcher at the University of Bologna in Italy; Rupert Maleczek, a senior scientist at the University of Innsbruck in Austria; Tomohiro Tachi, a professor at the University of Tokyo; and senior author Neil Gershenfeld, an MIT professor and the director of the CBA. The research appears in the International Journal of Solids and Structures.

Lightweight, rigid components

The researchers drew inspiration from the folded tessellations developed by the artist and scientist Ron Resch in the 1960s. Resch employed repeating patterns of polygonal unit cells to create complex 3D structures (like a honeycomb). 

But rather than creating a shape from one folded piece of material, like Resch’s tessellations, the researchers fabricate unit cells that are folded individually and connected to form the 3D structure.

By designing individual building blocks, they can simplify the fabrication process and create more complex shapes.

While working in the Tachi lab, Parra Rubio developed a method for combining two tripod-shaped unit cells from a Resch tessellation into a building block that has zero degrees of freedom, which means it is completely rigid and locked in place. 

These rigid building blocks can be connected into a network of interwoven beams that form a 3D structure with extremely high stiffness and stability, but very light weight.

“This helps us build strong structures while minimizing the amount of material we are using,” Parra Rubio explains.

But it would be enormously challenging to manually design polygonal building blocks that will form a structure that meets a user’s constraints.

To simplify the process, Parra Rubio joined forces with CBA graduate student Erik Strand to develop an automated solver that designs a series of manufacturable unit cells that will form the user’s desired structure. These design files can be fed to a CNC milling machine that automatically cuts the building blocks from flat sheets of material, like aluminum. 

“On the computational part, we break this big problem down into many small subproblems. Now, we solve each cell independently to make sure that it is foldable, and then we globally assemble them after that,” Strand says.

Simplified assembly

Builders fold the individual units into shape and assemble them into a finished structure using only hand tools, like screwdrivers. 

The assembly process does not require any large-scale welding equipment, which could make it simpler, faster, and cheaper than some other forms of construction. In addition, the unit cells are designed so they adjust naturally into their correct shape as the structure is assembled. 

“The way the unit cells are designed, the structure can only exist in one configuration. The connection is the same everywhere, even though each unit cell is different,” Parra Rubio says.

Simulations indicated that this method yields structures about 3.5 times stiffer than those made with some other origami-based techniques, while using less material. In addition, the resulting structures could be strong enough for some architectural applications, Parra Rubio adds. 

To demonstrate the versatility of this approach, the researchers assembled a 23-foot sculpture from pieces of folded aluminum that was hung from the ceiling of the atrium in the Boston Public Library. A team with no professional construction experience built the entire structure in a matter of days, Parra Rubio says.

“It was really fun to work on something at such a quick pace where the theory was really meeting a practical use for it. We had to think a lot about how we could tweak the design to achieve each objective,” Strand says.

In the future, the researchers want to test this approach in larger, architectural structures. They also want to explore the use of unit cells with more complex geometries, which could offer greater strength or stiffness, and develop a user-friendly design interface. 

“This work shows that folding metal is a method that is ready to be used for building structures. We can do it big enough and strong enough, now that we can bring it out of the lab and to the construction site,” Gershenfeld says.

“Within the architecture, engineering, and construction industry, complex structures are often delivered through a fragmented sequence of handoffs between design, engineering, fabrication, and construction teams, with each transition creating opportunities for miscoordination, rework, and loss of design intent. By embedding geometric, structural performance, and assembly intelligence directly into each module, Rubio’s approach maintains a seamless digital thread from design through erection, enabling unprecedented customization while ensuring precise execution,” says James Coleman, SM ’14, MArch ’14, cofounder of SumPoint, a project installation specialty firm. 

Coleman works on design for fabrication and erection of complex architectural projects, and was not involved with this research.

This research was funded, in part, by the Center for Bits and Atoms Research Consortia, the University of Bologna in Italy, and the Austrian Research Agency.

J-PAL North America, a research and policy center in the MIT Department of Economics, is launching a free Homelessness Evaluation Resource Hub. 

The hub — a public repository of evergreen multimedia content developed with a grant from Google.org — aims to equip decision-makers with foundational tools on how to leverage evidence to reduce homelessness and improve housing stability.

Homelessness represents both a cause and a consequence of poverty and inequality. Rigorous evidence is critical in identifying effective solutions to eliminating homelessness, but rising constraints on time, funds, and other resources can create difficult barriers to developing and accessing high-quality evidence.

J-PAL North America aims to increase access to evidence-informed paths to housing stability by providing essential tools for researchers, policymakers, and practitioners to evaluate the impact of their programs, expand the body of literature on what works to reduce homelessness, and leverage existing evidence to inform programs and decision-making. 

To launch the hub, J-PAL North America is hosting a virtual event on Oct. 27.

David Phillips, director of research at the Wilson Sheehan Lab for Economic Opportunities (LEO) and research professor of economics at the University of Notre Dame, served as the scientific advisor on the hub. 

“I’m thrilled to have been able to contribute to J-PAL North America’s Homelessness Evaluation Resource Hub,” Phillips says. “In my 15 years working with nonprofit and government leaders on program evaluations, I've seen how much value comes from practitioners and academics entering each others’ world, learning to speak each others’ languages, and, most of all, learning from each other. This resource hub builds shared language for research design so teams can move forward with clarity and confidence — creating more time to focus on the shared goals of continuous learning and improving outcomes for communities.”

The hub includes resources focused on two primary activities: using evidence, and generating evidence. The Using Evidence section provides newly developed two-page policy briefs that synthesize experimental and quasi-experimental research results on five established homelessness and housing interventions — “Housing First,” emergency financial assistance, case management, legal assistance in housing court, and housing vouchers — with more on the way. 

The section also features J-PAL North America’s 2019 Evidence Review, “Reducing and Preventing Homelessness: Lessons from Randomized Evaluations,” which synthesizes results from 40 rigorous evaluations of 18 distinct programs related to homelessness prevention and reduction in North America. 

The Generating Evidence section houses seven modules on foundational concepts of rigorous impact evaluations such as ethics, data and measurement, and opportunities for randomization, and how to apply them to evaluations in the homelessness sector. These resources build upon J-PAL’s experience training over 30,000 learners over two decades to become better users and producers of evidence. 

“We are proud to be launching the Homelessness Evaluation Resource Hub,” says Laina Sonterblum, a J-PAL North America policy and communications manager who oversees the organization’s housing and homelessness portfolio. “These resources are informed by over a decade of experience working with partners and researchers to understand the current literature and build the base of rigorous research on the best ways to address homelessness. We’re hoping the hub can provide a free, accessible entry point for anyone curious about how evidence can be a tool for learning and maximizing the effectiveness of programs and policies.”

The resources in the hub are also informed by nearly 20 informational interviews with prominent researchers, intermediaries, government leaders, and service providers in the region and build off a decade of experience working with partners and researchers to build the base of rigorous evidence on the best ways to address homelessness. J-PAL North America developed these resources in close collaboration with partners at LEO at Notre Dame and is especially grateful to David Phillips, who provided meticulous guidance and subject matter expertise. 

Explore the Resource Hub. 

Hashim Sarkis will step down as dean of the MIT School of Architecture and Planning (SA+P) at the end of June 2027. During his 12 years as dean, Sarkis elevated the school’s role and impact by creating new academic centers, adding more support for students, and, quite visibly, moving into a new home in MIT’s renovated Met Warehouse building. 

To an unusual degree, these achievements are interconnected: The Met Warehouse, dedicated this month, features innovative and expanded spaces for education, research, and public engagement. The building enables SA+P to add programs, host interdisciplinary work, and stage events of Institute-wide interest. 

Sarkis, the Elizabeth and James Killian (1926) Professor at MIT, and a professor of architecture and urban planning, also led the Institute’s “One Community = One Campus” planning project from 2016 to 2018, which conceptualized MIT as a contiguous urban space. The report helped MIT add sustainable infrastructure as well as new buildings, from dormitories to the theater arts and music buildings — and now the Met Warehouse. 

For Sarkis, providing more support for SA+P students is as important as any other accomplishment. The school will provide full tuition support in multiyear graduate programs, starting with new students in the fall of 2027. 

“I do believe education is a right for every student,” Sarkis says, when asked to cite the most meaningful changes he has helped enact. 

In a letter to the MIT community, Provost Anantha Chandrakasan wrote that Sarkis had crafted “a remarkable tenure as dean,” one that has “advanced a distinctive role for SA+P within MIT: connecting technology to society through design, planning, making, and creative practice.”

Sarkis, a lauded architect who has published widely and runs an international design practice, became dean in January 2015. He will take a sabbatical in the 2027-28 academic year, then return as a professor and head of the MIT-LUMA Lab. 

In his letter to the community, Chandrakasan also announced the formation of a search committee to identify the next dean of SA+P. The 17-person committee is being chaired by Justin Steil, professor of law and urban planning in DUSP.

The “transformative power of design”

MIT’s School of Architecture and Planning is a broad-ranging place, encompassing the Department of Architecture; the Department of Urban Studies and Planning; the MIT Media Lab, which is home to the graduate program in Media Arts and Sciences; the Center for Real Estate; the program in Art, Culture, and Technology; the Leventhal Center for Advanced Urbanism; and the Morningside Academy for Design. One of the hallmarks of Sarkis’ tenure has been the growth of existing interdisciplinary programs at SA+P and the development of new ones. In 2016, a gift from the Leventhal family expanded the Center for Advanced Urbanism, established in 2013, and renamed it in honor of Norman B. Leventhal ’38. The center enables research and hands-on projects addressing complex design and planning challenges in cities globally. 

During Sarkis’ tenure, MIT also introduced an undergraduate minor in design in 2016 and relaunched its bachelor of science in art and design in 2018, expanding opportunities for students across the Institute. The school also established DesignX, an accelerator supporting entrepreneurship in design and the built environment.

In 2020, MIT launched the Mobility Initiative, bringing together researchers from across the Institute to examine the future of transportation and mobility. Led by Professor Jinhua Zhao, now head of the Department of Urban Studies and Planning, the initiative connects research in transportation, technology, urban planning, and policy.

In 2022, with support from the Morningside Foundation, the Institute founded the Morningside Academy for Design (MAD), an interdisciplinary design center allowing for campus-wide collaboration. And in 2024, with support from the LUMA Foundation, SA+P launched the MIT-LUMA Lab, which works across a wide range of fields, including design, science, technology, and art, to explore solutions for climate-based and other environmental challenges.

In a different vein, SA+P also collaborated with the MIT Schwarzman College of Computing this year to establish the MIT and HPI AI and Creativity Hub (MHACH), which aims to further work in design and computing at a time of rapid expansion for AI applications. 

Three of these centers — LCAU, MAD, and MIT-LUMA Lab — are located in the transformed Met Warehouse building, a leading example of adaptive reuse in architecture and engineering. The huge brick edifice, which initially had tiny window slits bringing in minimal light, was used for about a century as a storage facility, until 2015, when MIT began exploring other possibilities for the building.

By 2018, the concept of moving SA+P into the Met Warehouse had gained traction, with Sarkis publicly telling MIT News, “It’s about really creating a design hub for MIT on the campus. ... Moving does not address just the school’s aspirations, but MIT’s aspirations.” 

After working with the Cambridge Historical Commission, the project architects, Diller Scofidio + Renfro, replaced large segments of brick wall with glass sheets, added skylights, and reconfigured the interior, which now has multiheight design studios, modular classrooms and common spaces, an auditorium, public galleries, a large entrance lobby with a café, and building-long corridors on all floors. For almost a decade, Sarkis served as the key driver of the project — and was an advocate for adaptive reuse, rather than creating a new building requiring a greater carbon footprint. 

“I think it sends a very good message that this vanguard school of architecture, at the Massachusetts Institute of Technology, is moving into a historic building and adapting it for the future,” Sarkis told MIT News this summer. 

At the building’s formal dedication ceremony on Oct. 1, MIT President Sally Kornbluth called the Met Warehouse “a testament to the transformative power of design, which has been central to MIT from the very beginning.” She also heralded it as a model for education, noting that future learning in many fields may call for “exactly like the kind of hands-on, in-person, collaborative problem-solving the new Met was made for. … It’s also primed to help the rest of MIT meet the moment.”

The many sources of design and democracy

Sarkis grew up in Beirut, Lebanon, with a childhood interest in architecture. His views about the civic applications of design have long had many sources. He received his BA in architecture from the Rhode Island School of Design in 1987, then earned an MA in 1989 and PhD in 1995, in architecture, from Harvard University. At Harvard, his PhD work included political philosophy, as he studied with legal theorist Roberto Mangabeira Unger and philosophers Hilary Putnam and John Rawls, among others. 

Sarkis was a professor at Harvard’s Graduate School of Design from 1998 until he joined MIT in 2015. He has published widely, including the 2003 book “Circa 1958: Lebanon in the Pictures and Plans of Constantinos Doxiadis.” He edited the 2002 volume “CASE: Le Corbusier’s Venice Hospital and the Mat Building Revival,” and co-edited, with Eric Mumford, the 2008 volume “Josep Lluís Sert: The Architect of Urban Design, 1953-1969.” He is also co-author, with Roi Salguiero Barrio and Gabriel Kozlowski, of the 2020 book, “The World as an Architectural Project.” 

In 1998, Sarkis also established his practice, HashimSarkis Studios, which has offices in Lebanon and Massachusetts. Among his best-known works are the Byblos Town Hall in Lebanon, completed in 2016, which features three volumes rising above a glass-enclosed ground floor, to represent and help constitute the transparency needed for democratic government. His first major project, Housing for the Fishermen of Tyre, also in Lebanon, was cited as one of the most significant buildings of the century in the “Phaidon Atlas of 21st-Century World Architecture.”

During his upcoming sabbatical, Sarkis will work on a variety of projects in locations including Venice, Egypt, and Armenia. 

In addition to his many duties as dean, Sarkis served as the curator of the Venice Biennale’s 2021 International Architecture Exposition. The exhibition’s theme was a question Sarkis has long contemplated: “How Will We Live Together?” Featuring work conceptualized at many scales, the exhibition displayed projects by 112 designers from 46 countries and was critically acclaimed; The New York Times called it “a case study for how to begin to tackle such questions.”

A dose of optimism

Sarkis’ seriousness of purpose as SA+P dean has long meshed with what he has called a “quirky” sense of humor, in the MIT vein. In 2016 he served as a judge for the “Crossing the Charles” competition, in which dozens of inventive MIT-designed watercraft floated across the Charles River to mark the 100th anniversary of MIT’s move from Boston to Cambridge. A parade also unfolded on the bridge carrying Massachusetts Avenue across the river. 

In an echo of those events, last month SA+P organized its own procession into the Met Warehouse, complete with costumes gesturing at the Bucentaur, the boat that in 1916 carried MIT’s charter across the river. The procession was conceptualized and directed by MIT Professor Azra Akšamija, and developed in collaboration with many students, faculty, and staff. 

Meanwhile, when it comes to the experience of having other architects redesign the Met Warehouse, Sarkis quips, “I learned to be a client.” 

More seriously, talking about high points of his tenure as dean, Sarkis quickly calls the organized visioning process for the Met Warehouse “inspiring,” adding, “We needed a common framework, and faculty were able to project forward and identify it.” The building, Sarkis emphasizes, helps reinforce what he believes is central and distinctive about design work at the Institute: “the MIT model of conducting research and education at the same time.” 

In the face of current challenges confronting education, Sarkis steadfastly stuck with the Met Warehouse project, helping complete it while continuing to build up the School of Architecure and Planning and solidifying MIT’s place at the leading edge of design. That may be a larger sign that such progress remains possible. 

“Optimism is integral to our fields,” Sarkis says. 

Each year, Climate Week NYC brings together more than 100,000 people in more than 1,000 events across the city to discuss climate challenges, explore solutions, and spur action. Participants come from industry, academia, philanthropy, nonprofits, government, and finance and venture capital. And this year, the mix included a strong, cross-campus presence from MIT.

The MIT community could be seen multiple days during Climate Week, with appearances by Evelyn Wang, vice president for energy and climate, at the official opening ceremony discussing artificial intelligence and the climate equation; an event co-hosted by MIT and the Bezos Earth Fund on climate innovation; and 14 sessions organized by the MIT Climate Project and eight MIT departments, labs, centers, and initiatives — including the Abdul Latif Jameel Water and Food Systems Lab (J-WAFS), the MIT Sloan Sustainability Initiative, the Center for Transportation and Logistics (CTL), MIT Lincoln Laboratory, MIT Open Learning, the MIT Initiative for New Manufacturing (INM), the MIT Climate Policy Center, and the Priscilla King Gray (PKG) Center for Social Impact.

“The MIT Climate Project is a whole-of-MIT mobilization, but no single institution can deliver the climate solutions the world needs — from reducing greenhouse gas emissions to adapting to a changing climate and building more-resilient communities and systems,” said Wang, who is also the Ford Professor of Engineering in the Department of Mechanical Engineering. “Climate Week New York is important because it convenes the range of stakeholders and sectors that must work together to confront these challenges. When we connect the MIT community with this global network, we uncover powerful possibilities to strengthen not only our own efforts, but the world’s capacity for change.”

One location, numerous events

Climate Week NYC was held Sept. 21-27 at venues across Manhattan and other New York boroughs. Utilizing multiple spaces at the Dream Downtown Hotel in the Chelsea neighborhood of Manhattan, the MIT coalition attracted more than 700 attendees for events ranging from small, private conversations to workshops and panel presentations.

Larger sessions included “The Future of Data Centers: Technologies to Change the Paradigm.” “Data centers are at an inflection point, facing interconnected technical, operational, economic, and community constraints that demand cross-sector dialogue and innovation,” says Gang Chen, the Carl Richard Soderberg Professor of Power Engineering and faculty director of the Climate Project at MIT.

Chen, who leads the Data Centers of the Future frontier for the Climate Project, convened a panel of experts across research and industry to address technologies that can change the paradigm. “Technology can't solve all the challenges we’re facing with data centers, but technology has a significant role to play in shaping a future role that is more sustainable and better for the communities that are home to these facilities,” Chen says. “This session was a productive conversation on data center challenges and the potential solutions to overcome them.” 

The workshop “Next-Generation Super Pollutant Solutions: Challenges and Opportunities,” hosted by Jesse Kroll, a faculty director and lead for the Super Pollutants frontier for the Climate Project, convened speakers from the Environmental Defense Fund, Spark Climate Solutions, and across MIT labs and initiatives. 

Accounting for nearly half of all global anthropogenic warming to date, super pollutants currently lack viable solutions for adequate abatement. Many super pollutants have shorter atmospheric lifespans than carbon dioxide, with solutions providing an “emergency brake” to decrease peak warming in our lifetimes. Investments in tackling super pollutants can generate economic benefits, including lowering health-care costs and increasing productivity, and require cross-disciplinary teams to develop and advance the next-generation solutions to meaningfully address super pollutant emissions. 

“Super pollutant mitigation is getting a lot of attention as an ‘emergency brake’ for near-term climate warming. But a huge fraction of our super pollutant emissions simply cannot be mitigated with current technologies and approaches,” said Kroll, the Peter de Florez Professor in the Department of Civil and Environmental Engineering. “Our session focused on the innovation — technical and otherwise — needed to tackle these hard-to-abate pollutants.”

Other events included:

• “2026 State of Supply Chain Sustainability Report” with the MIT CTL
• “Building Flood Resilience” with MIT Lincoln Laboratory
• “Climate Communication for Impact” from the MIT Climate Project
• “Climate Impact Founder and Funder Connect” with the PKG Center for Social Impact
• “Educating Tomorrow's Climate Leaders: An MIT Perspective” from the MIT Climate Project
• “Trading for Food Security in a Changing Climate” with J-WAFS 
• “Industrial Decarbonization: Pathways to Productivity and Growth” with MIT INM
• “Mobilizing Climate Knowledge for Action” with MIT Open Learning
• “Rethinking Climate Innovation” from the MIT Climate Project
• “What is Sectoral Acceleration and How Do We Fund It” with the Sloan Sustainability Initiative
   

Rethinking the climate innovation pipeline with the Bezos Earth Fund

A critical climate challenge is moving from breakthrough technology to real-world impact at scale. MIT and the Bezos Earth Fund brought together leaders from industry, venture capital, government, academia, philanthropy, and startups to explore solutions for a stronger innovation pipeline. 

A panel of MIT faculty and alumni spinout leaders Asegun Henry, Seonghoon Woo, Ariel Furst, and Assil Halimi, moderated by Ray Rothrock, venture capitalist and life member of the MIT Corporation, explored the period between a promising scientific invention and commercial deployment. For many breakthroughs that can benefit climate and nature, that journey requires more early-stage science and engineering research, specialized testing infrastructure, validation, patient capital, and pathways to demonstration and pilot projects.

“A breakthrough in the lab is not yet impact in the world. For climate and energy technologies, we need to think about the entire journey — from discovery and invention through validation, commercialization, and deployment — and build better pathways through the gaps along the way,” Wang said in a conversation with Tom Taylor, Bezos Earth Fund president and CEO. 

Tapping into global nexus to find and scale solutions

New York Climate Week is a global nexus for climate, where the connections required to develop, test, and scale potential solutions form. Across the board, MIT sessions addressed the need for solutions to be large in magnitude, technically feasible, and contextually realistic. 

 “Even when a technology is low-cost, it doesn’t mean it will diffuse naturally or get widely adopted,” said Claire Walsh, global director of policy and communications at MIT’s Abdul Latif Jameel Poverty Action Lab. “Frontier technologies are often more expensive to start, so that means it’s even more important for scientists and engineers to think about end user adoption, and their incentives and constraints, from the start.”

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it’s built on the backbone of a technology we already object to: behavioral advertising. Although this type of attack has only been described targeting journalists, you can take a few steps we outline in the next section to mitigate the risk no matter who you are.

A few factors combined to make this attack a noteworthy first-of-its-kind. First, it utilized the surveillance ad-tech ecosystem to specially target the malicious code. Second, the spyware it delivered was so-called “zero-click,” meaning it required no interaction from the user to be infected: all that is required is for the ad to be delivered and code bundled along with it to be run, which happens automatically. Neither malvertising nor zero-click attacks are new on their own. What’s novel about the AdFection attack is combining them, creating a highly targeted, extremely dangerous attack which is difficult to defend against and even harder to detect.

Let’s take a deeper look from the perspective of one of the Windows devices supplied to the researchers from Al Jazeera. Here’s how the report describes the infection happening: 

• Someone browsing the web or using an app on that machine is served an ad created by Discover-Tech, a company exposed in the report as “purporting to be a legitimate advertising company, [but] appears to be a front for large-scale ad espionage abuse.” 
• The ad contains a small snippet of JavaScript code which is automatically executed when rendered in the app or website. 
• This code reaches back out to a Discover-Tech server, referred to as their “NOAS server,” with detailed information about the machine rendering it: its cookie-set advertising ID, IP address, and more.

So far, nothing particularly unusual has happened. Ads that contain JavaScript code and reach back out to their servers with lots of information on your device—and by extension you—are commonplace. It’s all part of the data-driven advertising ecosystem. What happens next is more interesting:

• The NOAS server uses this detailed information to determine it is an Al Jazeera machine requesting the ad. 
• Instead of returning an empty response (as it does most of the time), it responds with a malicious, zero-click spyware payload. That payload was created by Discover-Tech’s partner Candiru/Integrity Labs, a company previously exposed for involvement in sophisticated malware attacks. 
• The payload is then executed and infects the targeted machine.

Companies targeting zero-click malware attacks against journalists might seem like the plot of a blockbuster spy thriller. But this attack was enabled by the everyday practices of ad-tech companies, which unfortunately have extreme latitude in the collection of users’ data. By leveraging the tracking identifiers and data collected on devices for the purpose of delivering targeted ads to specific individuals, mercenary spyware companies can repurpose this data in order to fine-tune who they infect—and hide that they’re doing it from everyone else. 

Most ads are not delivered directly by the ad creators, but rather by intermediaries that facilitate Real-Time Bidding auctions. Nonetheless, winning bidders are given the ability to execute JavaScript code in the browser of the person who receives the targeted ad. This allows for interactive ads to be displayed, but also (as we’ve seen) for the compromise of a device just by delivery of malicious code.

While the different components in this attack chain are not novel on their own, the exposure of this combined attack is significant because it reveals a technique to hyper-target individuals and organizations for infection. Luckily, there are steps you can take to protect yourself from the myriad of dangers presented by the ad-tracking industry. Here’s how.

What You Can Do About It

As we work towards fundamental fixes to the ad ecosystem and banning online behavioral ads altogether, the onus is on all of us to protect ourselves. This is especially important for higher risk individuals or journalists working in states with heavy surveillance. Citizen Lab outlines several steps, depending on your threat model, to take to help protect yourself:

• Take some simple steps to lock down your devices right now.
• Establish strong security fundamentals. Sites like our own Surveillance Self-Defense and Consumer Reports’ Security Planner can help get you started.
• Use a browser extension to reduce tracking. Our Privacy Badger extension is an excellent start. Network-wide ad blocking services are also worth considering if you’re comfortable handling the set up process.
• On mobile phones, disable or reset your AD ID. Here are directions to do so for Android and iPhone.
• Consider using more privacy protective browsers.

These steps can be very helpful in protecting yourself, but there is only so much you can do as an individual. Banning behavioral ads like this would be a good place to start. Behavioral ads aren’t just a privacy nightmare as designed. They are the perfect vehicle for malvertising and similar threats, just as we see here.

The vast amount of information on the open web requires researchers and journalists to adapt with new tools to make sense of it all. Checking facts, gauging public opinion, and other lines of inquiry depend on being able to analyze the overwhelming amount of material posted online every day. Unfortunately, responding to the AI industry’s voracious appetite for data, companies stewarding this public data are looking to cash in and block access to the open web. This makes the web harder to navigate, and threatens all kinds of important research.

Reddit’s lawsuit against SerpAPI and Perplexity threatens to do exactly that.

Reddit was once a very open platform, fostering a community of alternative apps and extensions putting users in control of their experience. Since the rise of AI however, it changed tack. Over the last three years Reddit has closed APIs to users, limited UI features, and otherwise restrained access without login. By making the voices on the platform harder to access, the company has positioned itself as a gatekeeper, and has since struck a lucrative data-sharing arrangement with Google.

SerpAPI, in contrast, is a tool which offers automated access to Google’s search engine results pages. It’s used by Perplexity, an AI-based search tool. Reddit sued to stop SerpAPI and Perplexity from bypassing Reddit’s own arrangement with Google. (Google brought a similar suit, which was dismissed by another court.)

It comes as little surprise that the legal weapon Reddit employed in this case is Section 1201 of the Digital Millennium Copyright Act, the same “anti-circumvention” law that has caused so much trouble for artists, innovators, and researchers over the years—and that EFF has fought against from the beginning. Reddit’s suit claimed that SerpAPI’s use of widely used techniques to access Google search results amounted to “circumventing” access controls on copyrighted works. 

There are major problems with this argument. 

First, Reddit doesn’t own the copyright in its users’ posts—the users do, and they grant Reddit the right to distribute the posted content freely.

Second, there’s no meaningful copyright infringement going on here. Perplexity functions like a search engine, responding to users’ queries with relevant links and optionally an AI-generated summary. Crawling and indexing the web to create a search engine was long ago ruled a fair use under copyright law.

And third, Google’s efforts to put rate limits on search queries and block some kinds of automated querying aren’t the sort of “access controls” that Section 1201 was written for. The law was passed in 1998 and targeted things like breaking the encryption on DVDs and other digital media. In contrast to physical or paywalled media, Reddit posts are visible to everyone, without a paywall and generally without a login. 

Unfortunately, a federal district judge ruled in July that the suit could proceed, concluding that Section 1201 applied. That’s a dangerous ruling, because it casts a cloud of legal uncertainty over lots of important research, including efforts to study public sentiment through social media and to preserve records of historical events. Without tools that can look at the web at scale, many kinds of research are simply impossible today. But if employing those tools risks Section 1201 liability, only the wealthiest institutions will be able to use them.

We cannot let the internet be rebuilt such that information is divided up among a handful of gatekeepers and sold back to us like cable subscription packages. If our knowledge of the online world comes only through wealthy institutions, the cost of knowledge will only increase and access to unbiased answers diminishes. 

Patients with glioblastoma, an aggressive type of brain tumor, usually undergo surgery to remove the tumor. However, it’s difficult for surgeons to remove all of the cancer cells, and the tumor often recurs.

MIT researchers have now designed an implantable drug-delivery device that they hope could help prevent recurrence of glioblastoma. Their device contains a reservoir that can release drugs over an extended period, along with ultrasound transducers that use sound waves to help drugs spread farther through the brain and bypass the blood-brain barrier.

Such a device could be implanted in the brain during surgery, then gradually release drugs that would help kill the remaining tumor cells. After implantation, a wireless controller can be used to program the exact ultrasound dosages to be delivered, enhancing the reach of the delivered therapy.

“We have 24 transducers in one ultrasound array, which can help a given drug bypass the blood-brain barrier and enhance the drug infusion. The device also gives doctors options in terms of the size, the length, and the number of infusions,” says Canan Dagdeviren, an associate professor of media arts and sciences at MIT and the senior author of the study.

In a paper appearing today in the journal Device, the researchers showed that their ultrasound device allowed molecules to spread further after being released, in tissue models and in a mouse study. 

MIT graduate student Sarah Ornellas and Jason Hou PhD ’26 are the lead authors of the study.

Enhanced by ultrasound

Glioblastoma is a rare but deadly cancer, with a little more than 10,000 cases diagnosed in the United States per year. On average, patients survive 12 to 15 months after diagnosis. Patients typically undergo surgery to remove as much of the tumor as possible, followed by radiation and chemotherapy.

Chemotherapy drugs are usually given either as pills or an intravenous infusion, but in recent years, scientists have developed drug-delivery wafers and hydrogels that can be implanted directly in the skull. That can help to eliminate the side effects of chemotherapy and ensure that a higher concentration of the drug reaches the brain.

Those devices work by passive diffusion of drugs, but the MIT team wanted to design a new device that would allow for greater control of the timing of drug release. They also wanted to incorporate ultrasound arrays to enhance the distribution of drug molecules. 

Previous research has shown that ultrasound helps drug molecules to disperse more widely, by creating convective flows that help travel them longer distances. The mechanical oscillations generated by ultrasound waves also temporarily increase the permeability of the blood-brain barrier, helping drug molecules get into the brain.

Dagdeviren had previously designed a tiny cannula, about as thin as a human hair, that could be implanted in the brain to deliver drugs. She also built an implant called ImPULS, which uses tiny ultrasound transducers to deliver deep brain stimulation.

In the new study, her lab combined these technologies to create LUCID (Long-term Ultrasound-enhanced Convective Injection Device) — a flexible implant as thin as a sheet of cardstock. A drug-delivery cannula is 3D-printed directly onto an array of 24 miniature ultrasound transducers. These transducers generate ultrasound waves right at the tip of the needle, helping drug molecules to diffuse farther into tissue after they are released.

“Getting a drug into the brain is only part of the challenge. It also needs to spread through the surrounding tissue. We brought a delivery channel and a tiny ultrasound array together in one implant to help molecules reach a larger area, even during slow infusion,” says Hou.

The implant’s reservoir carries about 100 microliters of fluid, and infusion is supplied by a passive osmotic pump, while ultrasound can be controlled wirelessly through Bluetooth. The device also contains a small battery that can be recharged wirelessly. 

In tests in a “tissue phantom” — a gel-like material engineered to mimic human tissue — the researchers showed that ultrasound-aided delivery spread drug molecules much farther than when the drugs were delivered without ultrasound. 

“By enhancing that distribution locally and programmably with ultrasound, you can reduce systemic toxicity in nontarget organs, while the therapy that you’re using has a better chance of reaching whatever tumor cells are within the affected area,” Ornellas says.

Wider distribution

The researchers also tested their system in mice, using it to deliver an MRI contrast agent. When the ultrasound array was activated, the contrast agent spread further through the brain than when ultrasound was not used.

If developed for use in patients, the drug cannula and ultrasound array would be placed inside the skull, while the part of the device containing the battery and other electronics could sit outside the skull, the researchers say.

In addition to delivering small-molecule drugs, this technology could also be used to deliver immunotherapies or nucleic acids, including gene therapies. It could also be potentially used in organs other than the brain.

“We started with the brain as a follow-up to our ImPULS technology, but eventually this can be used for other soft tissue treatments for different types of drugs, different types of interventions in deep body tissue,” Dagdeviren says. “We are showing that we can make any kind of payload be distributed in a better way.”

Other authors of the paper include Michal Nowicki, a research associate at Massachusetts General Hospital; Jerry Li, a recent graduate of Harvard University; Heloise Leblanc, a graduate student at Boston University; Betul Serra Tulu, an MIT undergraduate; David Sadat, a research specialist at MIT; Marco Mineo, an instructor in neurosurgery at Harvard Medical School; Steve Ramirez, an associate professor of psychological and brain sciences; and E. Antonio Chiocca, a professor of neurosurgery at Harvard Medical School and Massachusetts General Hospital. 

The research was funded by the MIT Media Lab Consortium and the National Institutes of Health.

Interesting research:

TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.

• One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked. ...

With the Big Bang, the universe burst into existence as a hot and dense soup of electrons and subatomic particles. This primordial ionized plasma, initially smaller than a single atom, rapidly expanded and cooled. In the process, particles in the soup slowed enough to bind with electrons, forming electrically neutral hydrogen. 

As this neutral hydrogen accumulated, the effect was like a shroud, preventing light and other forms of radiation from freely passing through. Around 380,000 years after the Big Bang, the universe was plunged into a cosmic “dark age.” 

Now, a new computer simulation is giving scientists a detailed view of how the first galaxies, stars, and other structures could have unfolded from that time, to eventually pull the universe out of its dark age. 

In a paper appearing today in the Monthly Notices of the Royal Astronomical Society (MNRAS), physicists from MIT, Harvard University, and elsewhere present Lumina — a large-volume, high-resolution simulation that follows the early universe from the dark ages through the next 2 billion years of cosmic evolution. 

Two pivotal transformations

Lumina covers a huge patch of the early universe that spans 500 megaparsecs, or about 1.6 billion light-years wide. In that space, the simulation tracks the evolution of dark matter, gas, stars, and radiation (such as photons), across enormous cosmic scales and also zooming down to the detail of an individual developing galaxy. 

Over the 2 billion years that Lumina simulates, it captures the emergence of two huge transformations in cosmic history: hydrogen re-ionization and helium re-ionization.

Hydrogen re-ionization is a period when early stars were able to push out enough ultraviolet light to interact with neutral hydrogen and strip it of its electron. This “re-ionizing” prevented the hydrogen from absorbing photons, instead allowing light to travel freely. Hydrogen re-ionization helped to lift the veil of neutral hydrogen — a process that Lumina captures in detail for the first time. 

The simulation also tracks helium re-ionization, a process similar to its hydrogen counterpart, in which much higher-energy light breaks apart neutral helium. 

In its detailed simulations, Lumina revealed that hydrogen re-ionization was likely driven by light from early galaxies and stars. In contrast, helium re-ionization was fueled by much more energetic early supermassive black holes in their active, accreting phases. Together, this represents the first time a simulation has captured both hydrogen and helium re-ionization.

“Lumina does everything from small-scale star and galaxy formation to large-scale re-ionization of hydrogen and helium, in a volume that is 100 times larger than previous best simulations,” says study author Mark Vogelsberger, a professor of physics at MIT. 

He and his colleagues are making Lumina available to the scientific community so that scientists can compare its detailed simulations of the evolution of early cosmic structures with snapshots taken by new and future telescopes. Then, they might begin to piece together the processes that shaped the first galaxies, stars, and structures in the universe. 

The study’s MIT co-authors are Xuejian (Jacob) Shen and Teodora-Elena Bluichi. Additional authors include first author Oliver Zier (a former postdoc in the Vogelsberger Lab), Rongrong Liu, Sonja Koehler, and Lars Hernquist of the Harvard and Smithsonian Center for Astrophysics; Aaron Smith of the University of Texas at Dallas; Rahul Kannan of York University in Canada, and Volker Springel and Rüdiger Pakmor of Max Planck Institute for Astrophysics in Germany.

Cosmic computation

Lumina takes its name from the Latin word meaning “lights.” At the heart of Lumina is IllustrisTNG, which was previously developed by scientists at MIT and elsewhere, including members of the Lumina team. IllustrisTNG is a large-scale simulation that tracks the interactions of dark matter, gas, and other processes involved in forming galaxies, from the Big Bang to the present day. 

In building Lumina, the team refined IllustrisTNG’s code to enable the simulation to track the formation of galaxies with the same level of detail but throughout a much larger volume. They combined this leveled-up galaxy model with a model of radiation transport, which simulates how different forms of radiation such as ultraviolet light interact at extremely large, cosmic scales to capture processes such as hydrogen re-ionization. 

The new and improved simulation resolves extremely fine details across huge scales. In practice, the simulation encompasses half a trillion individual elements, including dark matter particles and gas cells, which is about 30 times higher-resolution than IllustrisTNG. Lumina captures all this detail and evolves it forward in time, across an enormous patch of about 500 megaparsecs, which is 100 times larger in volume than previous simulations. 

Running the calculations for every single cell over 2 billions years of cosmic time, and across extremely large and very small scales, involves a significant amount of computing power. The team ran Lumina on Frontier, one of the world’s most powerful supercomputers, based at Oak Ridge National Laboratory in Tennessee. 

“At peak scale, the calculation brings together the equivalent of more than 100,000 CPU cores and around 15,000 GPUs,” says Shen. “Making all of those processors communicate efficiently while continuously evolving trillions of interacting pieces of information is itself an extraordinary feat of computer engineering.”

Full zoom

Lumina begins its simulations at around 45 million years after the Big Bang, in the midst of the dark ages, when neutral hydrogen dominated the early universe. The researchers set the simulation with initial conditions approximating what physicists theorize should have existed in such a dark cosmic period. 

They then let Lumina run to calculate how matter at those times, in the form of gas and dark matter, interacts across the simulation’s half-a-trillion cells. Simultaneously, the simulation calculates where and how radiation, such as ultraviolet light from stars, emerges and interacts with its surroundings.

On the project website, the team provides a number of videos that depict the various scales, time periods, physical processes, and layers of cosmic structures that Lumina simulates. Examples include a “zoom-in” from the full, large-scale patch of the universe to a single, disk-shaped galaxy; and a time-lapse of the full volume, over 2 billion years, that captures the pattern of hydrogen as it is re-ionized over time. 

“On the one hand, it’s evolving dark matter as well as the gas in the universe, and on the other, it’s also tracking how radiation travels,” Zier explains. “We see dark matter and gas start to clump in these over-densities. And when we zoom in, we can see gas is falling into these dark matter haloes. Zooming in more, we see this is where the first galaxies form. And the first stars form in those first galaxies. Those stars then create radiation. The simulation then tracks that radiation, and we can zoom way out to see how that radiation travels out from stars, through the universe, until at some point it ionizes some neutral hydrogen.”

“Other simulations cannot zoom in as far as this,” Vogelsberger notes. “The difference between the smallest and largest scales that we simulate is larger than in any other simulation.”

Looking ahead, the team plans to apply Lumina to map the large-scale structure of the early universe. The simulation can also help to predict the gravitational-wave patterns that early galaxies and black holes might produce. Whatever Lumina simulates could soon be compared with actual observations from new and upcoming telescopes.

“One of Lumina's major advantages is its sheer size,” Shen says. “It produces enormous populations of simulated galaxies, finally allowing us to make comparisons with the very large galaxy samples that upcoming surveys will observe.”

This research was supported, in part, by NASA and the National Science Foundation, and used resources of the Oak Ridge Leadership Computing Facility at the Oak Ridge National Laboratory, which is supported by the Advanced Scientific Computing Research programs in the Office of Science of the U.S. Department of Energy.

If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week—and all your nerdiest friends were talking about "The Vulnerability Apocalypse” and this thing called PHP that powers nearly 70% of the websites on the internet. You may find yourself wondering: what is PHP, what just happened, what is the vulnerability apocalypse, and what do I need to do?  

To find out what you can personally do read the first blog post in this series!  

What Is PHP?  

PHP is a programming language used mainly to create interactive websites. Facebook, Wordpress, Wikipedia, Etsy, and other major sites all use or were originally built on PHP. It is a long-established mainstay of web development. But because it is open-source, maintenance of these critical systems depends on a small number of volunteers working on this in their free time. The disaster scenario that happened this past week is the perfect example of why we need more money and people supporting open-source projects. Corporations should be contributing both. 

What Is the Vulnerability Apocalypse?  

Common Vulnerabilities and Exposures (CVEs) are the way that security professionals file reports about vulnerabilities in software. The National Vulnerability Database (NVD), run by NIST, is the official national database of CVEs. In other words, CVE reports managed by NIST are the closest thing we have to a canonical database of security vulnerabilities in software. The NVD currently has around 400,000 CVEs that have been filed and accepted since 1988. In just the month of October, 13,000 new CVEs have been submitted. This means that 3% of critical software security bugs that have ever been officially logged were found in the last month alone. And it's likely that by the end of the year over a quarter of the software vulnerabilities that have ever been found will be from 2026.  

 

Computer vulnerabilities reported are rising exponentially. Source: CVE Tracker

This research is being driven almost entirely by the cybersecurity capabilities of major AI models from companies like Anthropic, OpenAI, and Google. Historically it has been popularly assumed by cybersecurity experts that finding unknown (zero-day) exploits in any specific project and turning them into exploits was expensive. The knowledge to discover them was not widespread, and it was a hard task even for those initiated into the arcane ways of vulnerability hunting. Google even dedicated an entire team to it.  

But now thanks to major AI models, vulnerabilities are cheap, and anyone of moderate technical skill with a few dollars and access to a frontier AI model can find vulnerabilities in a few minutes. For example, recent vulnerabilities in PHP were found with a prompt to an AI model that literally said "find bad vulnerabilities in PHP."  

What Happened This Week? 

In 2024, a potentially severe vulnerability in PHP was discovered during an external security audit. PHP’s maintainers couldn’t agree on a solution, but more importantly, they couldn’t find a way to exploit the vulnerability. Because it didn’t seem like an active threat, they ended up deprioritizing a fix in favor of working on more urgent security issues. Then, in August 2026, security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one—and now, with a way to exploit them.  

We now know that the vulnerabilities were so severe that they would have allowed even moderately inventive hackers to take over any website that uses PHP and then steal customer data, launch further malware attacks, spy on users, take websites offline, or launch a massive denial of service attack.[1] 

Because of the severity of these vulnerabilities, several of the involved researchers got together with the makers of PHP to patch the vulnerabilities and disclose them in a coordinated manner. The idea was that hopefully everyone would get a chance to quietly release and then apply fixes for the vulnerabilities before the whole world found out about it. 

But news already started to leak on October 20th. There was a post on a widely read forum “Hacker News” and other posts elsewhere. One of the researchers accidentally published a video early. Companies reported seeing active exploitation of the vulnerabilities going back as far as October 17th. On October 21st, six hours before the planned press embargo, one company, Chainguard, jumped the gun and released a patch early, essentially giving anyone instructions about exactly where to find the vulnerabilities and how to weaponize them. This sent system administrators everywhere scrambling to patch their systems before they were taken over by hackers. And it’s going to take a long time to patch all these systems. At the time of this writing over 33 million websites are still running on vulnerable versions of PHP.  

The internet is run largely on open-source software, mostly maintained by a small handful of skilled volunteers occasionally getting a small stipend, not by major corporations and highly paid engineers. These are projects you have perhaps never heard of, like PHP, OpenSSL, and SQLite, but these programs run on nearly every computer in the world and are maintained by teams as small as one person. When a vulnerability is found in these projects, it can be devastating.  

PHP isn’t the only critical open-source software with a high severity vulnerability this week either. Other widespread open-source projects like Node.js and GitLab also had severe security bugs reported.  

The small number of already overworked open-source maintainers are now facing a deluge of vulnerability reports, some of which are false, but many of which are very real. Burnout in open source has never been higher.  

We Need Stronger Support for Open Source Projects

Much of the foundation for the modern multibillion-dollar internet industry is built on open-source products that were created and still maintained—for free—by dedicated volunteers in their spare time. It’s an imperfect system, and it can lead to errors.  

One of those critical, under resourced open-source products is PHP. And while vulnerabilities in PHP were privately found years ago, they were left unfixed because they didn’t seem as impactful as other bugs at the time. These same vulnerabilities were recently rediscovered and proved to be trivially exploitable by security researchers using advanced AI models. While in the middle of the widespread, global effort to correct this mistake and deploy fixes, the problem was leaked by some of the security researchers who had gotten early access to the fixes. Unfortunately, this left millions of websites, ranging from personal blogs to government sites, vulnerable to hacking that could result in data theft, malware distribution, and worse.  

Open-source projects like PHP and others are the backbone of the entire internet. If they don’t get the resources they need, they and the internet they power, are at risk of falling apart. Corporations (whose products would not exist without these products) should be actively contributing to their maintenance. 

1. A technical analysis of the vulnerabilities is out of scope for this post and has already been written by the original researchers.

It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer. Any piece of software that anyone actually uses will have a security vulnerability somewhere in the code. The more complex that software is, the more likely there will be a vulnerability. Fortunately for everyone, finding severe vulnerabilities was generally considered an expensive and difficult task requiring years of training and deep knowledge of how computers and software worked. Until recently there was a steady background hum of vulnerabilities being found and patched, with major vulnerabilities that could cripple the entire internet only happening every few years. Now that is no longer the case.  

You may have noticed your nerdiest friends freaking out about the “Vulnerability Apocalypse” this week and waving their arms in panic about something called PHP. You may have also noticed that some of your favorite websites were down for a bit. In the last two weeks of October alone, there have been multiple, potentially internet-breaking vulnerabilities reported and patched. Many of those vulnerabilities were in the open-source software that is the foundation of the vast majority of the internet.

For more detailed information on what happened, and why supporting open-source projects matters, check out our other blog.

This is all because frontier AI models, such as those created by OpenAI, Anthropic, and others, have made it incredibly cheap and easy to find previously unknown vulnerabilities (zero-days) in open- and closed-source code. Three percent of all software vulnerabilities ever found in history were found just in the month of October. This year alone researchers have found nearly a quarter of all software security issues which have ever been discovered. 

If exploiting critical software is now cheaper and easier than ever, what does that mean for us as individuals and what does that mean for society as a whole? TL; DR: It’s going to get worse before it gets better. But you can protect yourself with basic digital security hygiene that is now more important than ever.  

What Do I Need to Do? 

There absolutely needs to be a bigger conversation about how we got here and how to fix the systemic issues involved, including how corporations that depend on open-source code should contribute to their upkeep, and how big tech should be regulated.  

But for now, this news is a compelling reason to tighten up your digital hygiene. A lot of computers are going to get hacked a lot more often, and unfortunately, it isn’t going to get better any time soon. Thankfully, EFF has compiled a comprehensive set of security advice in our Surveillance Self-Defense guides. To start, we recommend making sure your browser and all applications are always up to date with the latest patches.   

You should also consider installing a tracker blocking tool, like EFF’s Privacy Badger (now on Safari), and remain vigilant for phishing attempts. Additionally, install a password manager and use unique passwords for each website, so that if one site is compromised, the rest of your passwords are safe. You should also be aware that data breaches may now be more likely, and the websites you visit may experience more attacks than usual, which means that some services may be disrupted.  

If you host a blog or other website, make sure that either you or your hosting provider has patched this particular issue.  

For additional tips on protecting yourself and others, head over to our Surveillance Self-Defense site. Additionally, if you’d like to support any of EFF’s open-source projects like Privacy Badger, Rayhunter, and Certbot, visit our donate page. 

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

Legal scholar Martha Minow delivered this fall’s Compton Lecture at MIT on Thursday, examining the civic foundations of democracy — and describing how artificial intelligence is undermining it, but could be used to help reinforce traditional U.S. governance. 

“It’s not a good time for democracy or constitutionalism,” said Minow, who is the 300th Anniversary University Professor at Harvard University, and a prominent expert in constitutional law and human rights. She noted a litany of challenges to democracy in recent years, including violations of laws and norms, the stifling of free speech, a diminution of congressional authority, disregard of legal rulings, the common vilification of others in society, and more. 

Recent Gallup polling, Minow observed, shows 77 percent of people saying that the founders of the U.S. would be disappointed in the contemporary condition of the country. 

“Many people genuinely wonder whether this nation’s system of government and rule of law, ignited 250 years ago, will survive,” Minow said.  

Her remarks assessed the state of the U.S. in terms of what she called four key “ingredients” of democracy: education, reliable and accessible information, security from violence, and fairness. Minow evaluated how AI has, among other things, influenced these areas of life — but also suggested ways people could use contemporary technology to help. 

“It’s very familiar to hear blame attributed to digital technologies and experts of all stripes, but a turnaround, I believe, is genuinely possible if people at MIT and elsewhere pour time and talent towards real and much-needed solutions,” Minow said. 

A substantial portion of her remarks focused on the pitfalls of AI in education. That issue compounds some other troubling trends: The U.S. already has large local and regional disparities in educational funding, Minow noted, while schools have actually become significantly more segregated in economic and ethnic terms over the last three decades. 

In this context, AI threatens to further weaken independent-thinking skills, Minow suggested, just when greater understanding of civic issues is absolutely vital. 

“As AI surges, I think we have to learn to be smarter about how to use it, how to regulate it, and how to actually educate people about the costs of mindless using,” Minow said. She added: “Dominant AI platforms supercharge the strategies that are deployed by social media companies, inducing passivity in people … Leading AI models and interfaces and sycophantic elements endanger the development particularly of young people’s capabilities to think, to remember, and to engage in critical thinking.” 

That trend away from cognitive effort, she suggested, can be changed — perhaps through AI tools that act more like tutors and are designed to enhance people’s deep thinking.

“Existing LLMs, model training, and interface design can offer nudges and questions and hints rather than replacing student work, but there’s so much more that could be developed, and more effectively, to be trustworthy, and to deepen human activities and curiosity, rather than replacing people,” Minow said.

To the audience, she added, “AI tools could do much more of that … And I believe that you, the people here, could develop better tools than the ones that are out there. And make better assessments, more meaningful and cheating-resistant.” 

Minow’s talk, “Constituting Democracy in the Era of AI,” was delivered to a large audience in MIT’s Huntington Hall, Room 10-250 on campus.

MIT President Sally A. Kornbluth delivered introductory remarks to the audience. The Karl Taylor Compton Lecture Series, introduced in 1957, is the highest-profile event of its kind at MIT. Karl Taylor Compton was MIT’s ninth president, serving from 1930 to 1948, and then becoming chair of the MIT Corporation from 1948 to 1954.

“He guided MIT through the Great Depression and World War II,” Kornbluth said, “transforming the Institute from an outstanding school for training job-ready engineers to a great global research university.” 

She added: “He was also a deeply committed patriot who helped harness the intellectual power of America’s research universities to serve the nation during World War II.” 

Kornbluth called Minow “a legal scholar of extraordinary intellectual scope,” and a “dedicated educator whose work has shaped how we think about the law and our own humanity, as individuals and as a society.” 

Minow has been a faculty member at Harvard Law School since 1981, and served as dean of the school from 2009 through 2017. Minow earned her BA in history from the University of Michigan, an MA in education from Harvard, and a JD from Yale University.

Minow’s books include “Making All the Difference” (1990), “Partners Not Rivals” (2002), and “When Should Law Forgive?” (2020). 

In her talk, Minow also discussed the civic effects of misinformation, threats of violence, and multiple dimension of societal fairness. Modern media technology has led to a 75 percent reduction in journalists in recent decades, Minow observed, with an attendant rise in corruption in places without local media. Civic-minded technologists, she proposed, should work towards establishing a widely-used “information commons,” or many forms of them, to help people access more reliable information. 

Meanwhile, when it comes to basic security in society, Minow warned, “We’re on the brink right now. I know a lot of judges, and every one of them has a credible threat of violence against them. In America. This is not acceptable.” 

For all the challenges to democracy and traditional civic norms, however, Minow sounded positive notes throughout her remarks, pointing out that there are many opportunities to create new forms of reliable information, education, and community relations. 

“We have to actually invent the world that we want to live in,” she offered. 

Minow’s remarks were followed by a Q&A session in which Kornbluth read aloud questions submitted by the audience — and asked her to characterize her concerns about present trends. 

“I worry about the loss of the Enlightenment,” Minow said. “I worry about the loss of the belief that reason, and testing hypotheses, and rejecting myths in the face of evidence, and the toleration and rights and expansion of participation that came along with the Enlightenment, that’s what concerns me the most. That’s why the disinformation issue for me is so important, that’s why the loss of critical thinking in schools is so important.”

She added: “I’ve spent much of my own career thinking about mass violence. What happens when people don’t understand each other, and are afraid. And it’s terrible, and we don’t want to be there. And I do view the Enlightenment as a time when people learned that actually having mass wars is a bad thing, and coming up with toleration is a good thing, and testing our ideas in light of evidence other people can share can produce a better life for everybody. I worry we’re abandoning that right now.”

At the MIT School of Humanities, Arts, and Social Sciences (SHASS) 75th Anniversary Symposium, speakers celebrated the school’s value and contributions, while exploring how artificial intelligence is transforming many aspects of teaching, research, and society.

The symposium was held Sept. 24-25 in the Linde Music Building’s Thomas Tull Concert Hall. Scholars, students, staff, and alumni from across SHASS and MIT gathered for the event, which kicked off with welcoming remarks from MIT leadership. 

“How should we think about MIT’s School of Humanities, Arts, and Social Sciences? With enthusiastic appreciation and gratitude,” said President Sally Kornbluth.

The school’s origins date back to the Lewis Committee Report, commissioned by MIT and published in 1949, which called for stronger integration between scientific and technical topics and humanistic scholarship and teaching.

Kornbluth noted that, much like when the school was founded just after World War II, the world faces uncertainty as it grapples with the broad implications of artificial intelligence.

“AI has suddenly arrived with enormous consequences for both research and education,” she said. “As we face the challenges of our own time, and our own society, it’s clear that MIT has never needed your particular insight and guidance more than we do now.”

In opening remarks, Provost Anantha Chandrakasan described the importance of a human-centered approach to technology, one that considers both its efficacy and its impacts. He lauded many of the new research projects happening through the MIT Human Insight Collaborative, a strategic initiative launched in 2024.

“Today — a time of rapid, AI-driven change — the arts, humanities, and social sciences are as important as ever,” he said. “To be able to contribute effectively to solving the world’s great challenges, it is not enough to gain technical mastery.”

Chancellor Melissa Nobles recalled how, during her tenure as SHASS dean from 2015 to 2021, reading the positive feedback from students in their SHASS course assessments reinforced the value of the school’s teaching.

“MIT students have a range of interests that draw them to our classes that may be invisible to their STEM professors, but that we very well know our students have,” said Nobles, who is also a professor of political science.

Agustín Rayo, the Kenan Sahin Dean of SHASS and professor of philosophy, noted that, while research in the school plays a key role in addressing global issues such as climate change and AI, the value of the work in SHASS should not be measured by practical application alone.

“Education should also help us ask what is worth doing, what do we owe one another, and what makes a life worth living,” Rayo said. “Some research matters because it helps us understand the histories, cultures, and social structures that have made us who we are. Some things matter because they enrich human life.”

Scholarship from across SHASS and beyond 

Over the symposium’s two days, research presentations, panel discussions, and performances offered attendees opportunities to engage with the role of SHASS in exploring today’s biggest societal questions.

“We gather not so much to look back over the past 75 years, but to showcase where we are now, and share what we urgently aim to tackle together in the years ahead,” said David Kaiser, Germeshausen Professor of the History of Science and professor of physics at MIT, who also served as chair of the symposium planning committee.

The first day included a session on teaching and learning innovations. Faculty presented on the success of educational programs housed within SHASS, including the MIT Indigenous Languages Initiative Master's Program, the Master in Data, Economics, and Design of Policy (DEDP), and MISTI, the hub for global experiences for MIT students.

Stephanie Seed, associate professor of literature, spoke about why she and others are working to reintegrate classic books into their teaching.

“MIT, of course, is an institution unusually oriented towards the future,” she said. “Our students are trained to imagine and create worlds that don’t yet exist. And it’s precisely this future orientation that makes reading the past especially important here.”

Eric Klopfer, professor of Comparative Media Studies/Writing and co-author of MIT’s recent report on AI and instruction, said this is a moment when instructors must reassess how courses are taught.

“I don’t know exactly what that looks like, but I do think it means something that’s more than modifying our curriculum. I think it really means rethinking what the educational experience is,” he said.

During a session on computing and society, panelists described different views and research into technology and how it affects humans.

“We project aspects of ourselves onto computational systems,” said MIT Professor D. Fox Harrell during his talk about seeing “selfness” in machines. 

“What makes an AI system is not just the code, not just the programming or the algorithm, it’s the fact that we narrate it as being intentional,” he said.

Program in Science, Technology, and Society Professor Sherry Turkle offered a skeptical view of human-technology interaction, particularly with AI chatbots, which she describes as “intimate machines.” 

“If social media came for our attention, I argue that chatbots are coming for our capacity for attachment, which is deeper and much more troubling,” said Turkle.

Professor David Autor, head of the Department of Economics, said it’s an exciting time to be working at MIT, where scholars are collaborating to explore AI’s impact on society.

“I don’t think there’s a close analogy to a moment when everyone felt the world change so quickly,” he said. “The stakes feel incredibly high.”

Celebrating the arts and engaging with the future 

The first day concluded with a rousing Music and Theater Arts performance showcase, which began with an excerpt from Stan Lai’s “A Dream Like A Dream,” a play directed and performed by students and instructors in class 21T.100 (Theater Arts Production).

“Variations on the Theme of SHASS 75,” a piece choreographed by Dan Safer, senior lecturer and director of dance programs, combined movement, lighting, and music in a celebration of both the human body and the school’s milestone anniversary.

Student and faculty musicians from a variety of styles and disciplines shared the stage, including Rambax MIT, MIT Concert Choir, and the MIT All-Star Jazz Combo. The showcase included stirring renditions of “Madrigal,” composed by Vice Provost for the Arts Keeril Makan, and “Prayer for Peace.”

On the second day of the symposium, several alumni presented on their current work and the impact of their SHASS experiences.

Jessica Coon PhD ’10, now a professor of linguistics at McGill University, spoke about the leading role MIT Linguistics plays in preserving endangered languages, and how her studies at MIT prepared her to carry on that work.

“SHASS gives us the tools not just to conduct research, but to communicate the impacts of this research across a variety of different audiences and in different ways,” she said.

Ankita Reddy ’19 double-majored in anthropology and biology and is now an MD/PhD student at the University of Pennsylvania. She highlighted her most impactful SHASS courses, including 21A.308 (Global Mental Health).

“This was the first time I was forced to consider how good health care looks different based on social systems and cultural practices,” she said. “SHASS made me more comfortable with, and more curious about, complexity.”

During the symposium’s final session, panelists engaged in a conversation about AI, art, and the implications for creatives in an era where their art can be co-opted and copied. 

“There’s so much praise for new and upgraded technologies,” remarked associate professor of literature Sandy Alexandre. “The question I consistently have is: What does it mean to be an upgraded human being? How are we innovating as technology is innovating?”

Philosopher Justin Khoo said AI’s role in art could be considered a “giant paint brush you don’t have much control over,” adding he could see the creation of new sub-genres of art that are human-only, AI-infused, and purely AI, for example.

Khoo closed by saying he encourages students to “think broadly, and really take seriously the humanistic education here at MIT.”

“A broad understanding of a set of concepts which are widely applicable, not just narrowly applicable, I think that’s what we need more than ever now,” he said.

As the symposium came to a close, attendee Kent Sahin praised the event.

“I’ve attended every session, and this is a fantastic program and a great celebration of the 75th anniversary,” he said. “Clearly, whether it’s AI impact, the impact of climate change, or the impact of political and social change, SHASS is in the right place at the right time.”