❌

Visualização de leitura

Activists break into building site of Microsoft datacentre in Amsterdam

Separate actions also take place outside fence and across Europe in backlash against impact of AI boom

Activists have stormed the site of a Microsoft datacentre being built in Amsterdam, as the backlash to the social and environmental harms of the AI boom spreads across Europe.

Protesters from Geef Tegengas, a Dutch direct action group, clashed with police while breaking into a construction site at Westpoort, Amsterdam, where some members climbed a crane, lit flares and tied helium balloons to equipment.

Continue reading...

© Photograph: MICHEL VAN BERGEN/AP

© Photograph: MICHEL VAN BERGEN/AP

© Photograph: MICHEL VAN BERGEN/AP

Quantum without the hype: The CIO’s next architecture challenge

The most expensive quantum mistake a CIO could make today may not be investing too early. It may be investing in the wrong capabilities, for the wrong reasons, without understanding the architectural and economic consequences.

Over decades of leading enterprise technology, architecture, modernization, and innovation in complex, highly regulated environments, I have seen a recurring pattern: technological enthusiasm advances faster than institutional readiness. Capital gets committed. Platforms become entrenched. Dependencies multiply. Business value remains difficult to demonstrate.

Quantum computing risks repeating that pattern, but with an important distinction: The cybersecurity consequences demand action today, while the timing and economics of broader commercial quantum advantage remain uncertain.

That is the strategic tension CIOs must resolve.

Quantum readiness and preparedness is not a race to acquire qubits. It is a discipline of protecting enterprise trust, preserving strategic options and directing scarce capital toward demonstrable value.

The fundamental question is no longer whether quantum computing deserves executive attention. It is whether CIOs and enterprises can distinguish what must be protected now, what deserves experimentation and what should remain an option rather than a financial commitment.

Two quantum clocks. One enterprise balance sheet

Quantum presents two fundamentally different timelines to a CIO.

The first is the security clock.

In August 2024, the National Institute of Standards and Technology (NIST) published its first three finalized post-quantum cryptography standards, establishing practical mechanisms for protecting information against anticipated quantum-enabled threats.

This is critical because cryptography is not an isolated cybersecurity component. It underpins identities, financial transactions, digital signatures, software integrity, communications, connected infrastructure and trusted business relationships.

A sufficiently capable future quantum computer could compromise certain widely deployed public-key cryptographic methods.

The October 2026 U.S. Government Accountability Office (GAO) report, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, reinforces the urgency. None of the 24 federal agencies examined had fully addressed all three assessed preparatory practices for migrating vulnerable cryptography.

The lesson extends beyond government: you cannot migrate cryptographic dependencies you have not discovered.

The second is the commercial advantage clock.

Quantum computing may eventually offer meaningful advantages in selected areas of chemistry, materials science, simulation and optimization. But promising research does not automatically translate into repeatable enterprise economics.

IBM’s published quantum technology roadmap targets a fault-tolerant quantum system in 2029. That is an important technological ambition, not a guaranteed date for widespread commercial advantage.

These two clocks should not share the same investment assumptions.

Security readiness is justified by exposure and risk tolerance. Commercial adoption must be justified by demonstrated advantage and economic returns.

Confusing the two creates either dangerous underinvestment or speculative overspending for the CIOs.

Architecture before acquisition

The enterprise architecture challenge is more consequential than the quantum procurement question.

For CIOs, post-quantum preparation begins with initial understanding of where vulnerable cryptography exists across their enterprise, how it supports critical business services and whether those dependencies can be changed without destabilizing operations.

For example, consider a globally distributed financial institution.

Cryptographic dependencies may span payment platforms, customer identities, authentication services, certificates, mainframes, cloud environments, third-party APIs and decades of retained information.

Replacing an algorithm is not necessarily equivalent to replacing a library.

Some changes affect protocols, hardware security modules, certificate lifecycles, application compatibility, vendor contracts and operational resilience.

This demands cryptographic agility: the ability to replace or adapt cryptographic mechanisms without rebuilding the enterprise.

The same architectural discipline applies to future quantum workloads.

Enterprises should favor modular integration, well-defined interfaces, workload portability and interoperability across classical computing, high-performance computing, AI and emerging quantum services.

Quantum will not make classical computing obsolete. The more credible architectural direction is selective integration where a quantum capability demonstrably improves a specific computational outcome.

The architectural objective therefore is not quantum dependence. It is quantum optionality.

An enterprise should be able to adopt a useful breakthrough without surrendering control of its technology economics or becoming captive to a single provider.

The missing equation: Quantum workload economics

The quantum conversation becomes strategically meaningful when CIOs stop asking what a quantum computer can theoretically perform and start asking what business outcome it can improve.

The OECD’s 2026 research, Building Business Readiness for Quantum Computing, identifies barriers including technological immaturity, uncertainty surrounding business applications, access and training costs, and shortages of specialized expertise.

These are not simply engineering obstacles. They are capital allocation constraints. This means that a quantum experiment may demonstrate technical progress while failing to establish commercial value.

For example, a proposed optimization workload should be evaluated against competitive classical algorithms, realistic datasets, operational constraints and the full cost of execution.

The comparison must include more than processing time. It should consider problem preparation, data movement, orchestration, error mitigation or correction, integration, specialized talent, assurance and recurring operating expenses.

Even an impressive laboratory result may offer little economic benefit if the end-to-end enterprise workflow becomes slower, costlier or less dependable.

I would therefore introduce a more demanding investment metric: Cost per Trusted Quantum-Enabled Business Outcome.

This proposed measure evaluates the total attributable cost of achieving a validated business result, including the controls necessary to make that result operationally acceptable.

The denominator is not the number of quantum circuits executed. It is the number of useful, verified business outcomes delivered.

Where no defensible quantum advantage exists, the responsible decision may be to continue using classical computing.

That is not technological conservatism. It is capital discipline.

Introducing the quantum capital discipline framework

I propose a six-dimensional executive framework for separating quantum preparedness from quantum speculation.

  1. Exposure: What must we protect? Identify vulnerable cryptographic dependencies, long-lived sensitive information, critical services and contractual or regulatory obligations. Prioritize remediation by business consequence, not technology fashion.
  2. Relevance: What problem warrants quantum? Establish a specific business problem whose computational characteristics plausibly justify quantum investigation. Scientific curiosity alone is not an enterprise investment thesis.
  3. Advantage: What evidence proves improvement? Demand reproducible comparisons against strong classical alternatives. Evaluate solution quality, performance, operational constraints and independent validation.
  4. Architecture: Can we adapt without lock-in? Assess portability, integration complexity, vendor concentration, reversibility and the ability to change technology choices as the market evolves.
  5. Economics: What is the full cost of value? Measure total lifecycle costs, opportunity costs, talent requirements and credible returns. Distinguish research expenditure from production investment.
  6. Authority: Who decides to advance, defer or stop? Assign accountable decision makers, measurable milestones, investment thresholds and explicit exit criteria. Together, these dimensions form the Quantum Capital Discipline Framework.

Its governing principle is straightforward:

Capital follows evidence. Architecture preserves options. Governance owns consequences.

Importantly, this framework does not subject essential cryptographic remediation to the same commercial-return requirements as speculative quantum workloads. Security obligations and innovation opportunities require different investment justifications.

What boards should demand from their CIOs

Quantum strategy should enter Board discussions through enterprise risk, capital allocation, resilience and competitive positioning — not promotional demonstrations.

I would encourage directors and executive committees to demand answers to five key questions:

  1. Which critical business services and information assets face material quantum-related cryptographic exposure?
  2. Can we modernize vulnerable dependencies without unacceptable operational disruption?
  3. Which proposed quantum applications outperform credible classical alternatives?
  4. What evidence would justify expanding, delaying or terminating quantum investments?
  5. Who is accountable for the financial, security and architectural consequences?

These five questions create a practical governance boundary between preparedness and speculation. They also expose a broader institutional weakness: enterprises often approve emerging technology investments without establishing the conditions under which those investments should be reconsidered.

Quantum requires a different approach.

Investment decisions should be revisited when technical capabilities, benchmark results, standards, security exposure or business economics materially change.

Boards should insist on measurable progress but avoid manufacturing artificial deadlines for breakthroughs nobody can reliably predict.

The CIO’s next mandate: Preserve the freedom to act

Quantum computing will not transform every industry simultaneously, deliver equal advantage across workloads or reward every early investor.

Some enterprises may eventually realize significant value from specialized quantum applications. Others may encounter quantum’s most immediate consequences through cryptographic modernization, technology dependencies and the protection of long-lived information.

Both outcomes demand leadership today.

The CIO’s responsibility is not to predict which quantum architecture will prevail or which vendor will dominate. It is to ensure that today’s decisions do not compromise tomorrow’s ability to compete, adapt and protect enterprise trust.

That requires investment discipline, architectural foresight, credible experimentation and accountable governance.

The next quantum advantage may belong not to the enterprise that invests first or spends the most, but to the one that knows precisely when to act, where to invest and when to walk away.

Quantum readiness is not measured by the technology an enterprise owns. It is measured by the strategic freedom it retains, the risks it responsibly reduces and the business value it can demonstrably create.

That is the difference between quantum enthusiasm and quantum leadership.

Quantum leadership is not about predicting when the future arrives. It is about architecting the freedom to embrace it, exercising the discipline to invest in it and preserving the authority to walk away when promise fails to become value.

AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028

National Cyber Security Centre expects attacks on critical facilities such as power stations, airports and hospitals

AI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power stations, airports and hospitals by 2028, according to the state cybersecurity body.

The National Cyber Security Centre (NCSC) said AI will probably enable a ransomware attack against critical national infrastructure [CNI] between now and 2028. The UK’s definition of CNI covers a range of facilities and services across sectors including energy, transport, defence, food, health and finance.

Continue reading...

© Photograph: Rounak Amini/AAP

© Photograph: Rounak Amini/AAP

© Photograph: Rounak Amini/AAP

Credit where it’s due to AI for uncovering the PHP flaw – and discredit to the leaker | Letters

David Gibson says the problem is that details of the flaw were revealed before it was fixed, while Charles MacKinnon notes that we are at the mercy of technology we don’t understand

Chris Stokel-Walker may be right (The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it?, 22 October), but the real issue lies elsewhere. The bugs in the PHP programming language that were recently found by an AI tool have been present for a long time without anybody noticing and without any harm being done – they are extremely obscure.

They were not found by hackers – they were found because an AI tool was used to check the PHP source code, which is a good use of AI.

Continue reading...

© Photograph: Kirill Kudryavtsev/AFP/Getty Images

© Photograph: Kirill Kudryavtsev/AFP/Getty Images

© Photograph: Kirill Kudryavtsev/AFP/Getty Images

The Guardian view on AI safety: the push for global regulation must advance | Editorial

The current US administration is an obstacle, but public demand for protection will ultimately prevail

Organisations around the world scrambled on Thursday to fix critical flaws in PHP, the software that powers much of the web. The vulnerabilities could allow attackers to take control of affected servers. Some websites were taken offline as a precaution while fixes were installed. The paradox is that while AI helped researchers uncover the flaw, it also threatens to accelerate the ability to exploit it. Amazon said that it had detected an attempt before the public disclosure of the PHP flaws.

What the episode highlights is AI’s central role in security – and not always for the right reasons. OpenAI’s models have also been responsible for two alarming hacks this year – a security breach of an Australian health department website and a raid by a swarm of AI bots on Hugging Face, an AI services platform. Citing those incidents, the AI minister, Kanishka Narayan, warned that a similar cyber-attack on the UK is “likely, if not inevitable”.

Continue reading...

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

The race to fix huge PHP code flaw at the heart of the internet - The Latest

Websites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue with the programming language was revealed, cybersecurity companies have said. Michael Safi speaks to global technology reporter Aisha Down

Continue reading...

© Photograph: Reuters

© Photograph: Reuters

© Photograph: Reuters

PHP: Pretty Huge Problem with the internet – The Latest

Websites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue with the programming language was revealed, cybersecurity companies have said. Michael Safi speaks to global technology reporter Aisha Down – watch on YouTube

Continue reading...

© Photograph: Dado Ruvić/Reuters

© Photograph: Dado Ruvić/Reuters

© Photograph: Dado Ruvić/Reuters

The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it? | Chris Stokel-Walker

I’ve been banging the drum about these vulnerabilities for years. It will take more than a handful of exhausted developers to keep us safe

Parts of the internet are going dark. In the Netherlands, government websites, including its digital ID login service, have become unavailable. Finland has taken public services offline, and Wikimedia, the organisation behind Wikipedia, has switched off some of its systems too.

This sounds like the results of a cyber-attack. In most instances, however, the people running the sites deliberately switched them off because the alternative – keeping them online – was too risky. The future is here, and suddenly much of our digital infrastructure is looking very fragile.

Chris Stokel-Walker is the author of TikTok Boom: The Inside Story of the World’s Favourite App

Continue reading...

© Illustration: Guardian Design/Getty

© Illustration: Guardian Design/Getty

© Illustration: Guardian Design/Getty

Vendor-driven upgrades saddle IT leaders with huge ‘software tax’

CIOs experiencing sticker shock from recent software bills should be questioning how they got there.

That’s because IT leaders at large enterprises are paying a huge so-called software tax for vendor-driven upgrades, migrations, and licensing changes they would not have chosen for their organizations.

About 28% of software budgets at large organizations — an average of nearly $12.9 million per year — are being eaten up by vendor-pushed initiatives, according to a survey commissioned by independent software maintenance partner Origina.

Ninety-five percent of IT leaders surveyed said their organizations have paid for a vendor-driven upgrade in the past three years that they believed would actually reduce performance, according to the survey, which covered US and UK organizations with annual revenues higher than $1 billion or with more than 10,000 employees.

The sheer size of this “software tax” surprised Tomás O’Leary, Origina’s CEO, even though the company expected to see substantial costs for vendor-driven upgrades.

“Software was supposed to make businesses better, and it does,” he says. “But it’s also imposing a hidden cost on companies, quite a significant one. I’m quite taken aback because we know this exists, but we never quantified it before.”

When vendors control your IT spend

Big vendors have several major advantages over software customers, with the cost of switching or refusing to upgrade topping the list, O’Leary notes. In many cases, CIOs are faced with a loss of support if they turn down vendor-driven upgrades, leaving them with little room to refuse, he says. CIOs dependent on VMware are familiar with this squeeze play, as are those facing SAP deadlines.

“CIOs are left in a situation where the alternative may be worse, so upgrading is the lesser of two evils,” O’Leary adds. “When people buy technology, they don’t realize how long this stuff is going to hang around. Nobody realized this thing was going to be embedded, and the dependency was going to be greater and greater with time.”

In addition, software vendors have an experience advantage when negotiating contracts, O’Leary says. CIOs and procurement officers may try to negotiate favorable terms for upgrades, but big software vendors are expert at writing contracts that give them an edge, he notes, adding that the survey results suggest IT leaders’ current approach to negotiating better contracts is a failed tactic.

“If you keep trying the same thing over and over again, and it doesn’t work, you’ve got to try something different,” O’Leary says. “There’s a relief on the buyer side when the negotiations are over, and on the seller side for sure. But the seller side has to get back up again and do it again the next morning with somebody else, and the buyers don’t.”

Omar Amassine, founder and technical director at TripleW Digital, says between 20% and 30% of the IT services firm’s software and maintenance budget goes to vendor-driven migrations he didn’t request.

The biggest culprits? CRM, marketing automation suites, and cloud infrastructure, he says.

“Vendors frequently bundle mandatory AI features or restructure seat-based pricing into usage tiers, driving effective 20% to 35% price jumps with zero incremental utility for the core workflow,” he says.

IT leaders can fight back, however, by using modular, open standards and headless architecture, he adds. “The less proprietary logic locked inside a vendor’s walled garden, the higher your leverage when they mandate expensive upgrades,” Amassine says.

TripleW Digital also runs migration feasibility studies six months before software contract renewals. Having a migration roadmap can bring the vendor back to the negotiating table offering multi-year price freezes, he notes.

Emphasize partnership — and a credible threat of defection

Zachary Lewis, CIO of University of Health Sciences and Pharmacy in St. Louis, hasn’t seen the same software spending mandates as the organizations reflected in the survey.

The university has negotiated many of its software contracts to ensure upgrades and security patches are handled by the vendor, either with Lewis’ approval or during an agreed-on maintenance window, he says.

Even without costly upgrades, there’s still a time tax, he adds.

“With the sheer volume of new vulnerabilities being discovered, we’re spending more time following up with vendors to make sure they’re applying patches in a timely manner,” Lewis says. “My team simply isn’t large enough to manually manage patching across every application and software component we use.”

Here, establishing a vendor management strategy that emphasizes partnership over provisioning can help. And if vendors still drive costly upgrades, IT leaders can always switch providers.

But Lewis cautions that, as tempting as that is, it’s often a complicated process.

“Switching vendors is always an option, but it’s rarely simple,” he says. “Depending on the application, you may have years of integrations, processes, and institutional knowledge built around it. Sometimes the cost of moving away from a vendor is significantly higher than the cost you’re trying to avoid.”

Customers of large ERP solutions in particular are facing a significant reckoning on decades of customizations.

Collective bargaining power comes with communication

To regain their purchasing power, Origina’s O’Leary advises CIOs and procurement officers to negotiate shorter contracts, which would enable them to renegotiate terms more often and exit more quickly if their vendor jacks up prices.

“You have to get to a point where you can have a more frequent engagement with the vendor,” he says. “Negotiate your exit, and negotiate more frequently.”

While short-term contracts may impose more up-front costs on customers, they can pay off with the additional flexibility they provide, he says.

CIOs can also turn to third-party software management firms or consider internal support of their software packages if they have the resources, O’Leary advises.

CIOs should also share their software purchasing success stories and nightmares with each other more than they do now, he says.

“We all benefit from having a little bit more collective bargaining power,” he adds. “CIOs just need to take that leap of faith that others have the same problems, and maybe we can have some sort of collective pushback on this.”

Websites across world hit by millions of attempts to exploit PHP code flaw

Problem in language that underpins 70% of sites has led governments and companies to pull sites offline to patch fault

Websites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US warned the flaw could allow attackers to take control of web servers, steal data and disrupt services.

The problem in the PHP programming language, which underpins about 70% of the world’s websites, emerged on Wednesday causing governments and companies to pull their websites off the internet before they could be attacked and so they could patch the fault.

Continue reading...

© Photograph: Yui Mok/PA

© Photograph: Yui Mok/PA

© Photograph: Yui Mok/PA

What is PHP and how serious is the computer language flaw causing website shutdowns?

An estimated 70% of websites use the open-source language. What is the identified vulnerability in it?

Website owners faced millions of attempts to exploit a serious security vulnerability in their programming language, it has emerged, triggering a rush by governments and businesses to fix the problem.

The newly discovered vulnerabilities in PHP, a programming language that underpins most websites, allows hackers to carry out cyber-attacks and steal data if not fixed. What were the vulnerabilities and why did they affect so many sites?

Continue reading...

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

Flaw in PHP computer language leads to shutdown of websites around world

Precautionary takedowns come as experts say bad actors could exploit vulnerability in language used by 70% of sites

Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world wide web.

Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporarily as they scrambled to patch the critical weakness in PHP, a language used by almost 70% of websites.

Continue reading...

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

© Photograph: ANP/Shutterstock

Microsoft expands sovereign cloud offerings as data control concerns grow

Microsoft expanded its sovereign cloud offerings on Tuesday, adding new security, governance and AI capabilities as customers, particularly in Europe, demand greater assurance over where data is stored, who can access it and how critical services operate during disruptions.

The announcement builds on Microsoft’s ongoing digital sovereignty efforts, assisting organizations in applying appropriate levels of control to each workload rather than forcing a rigid, one-size-fits-all approach.

“Organizations are considering more than where data resides. They also seek to understand who can access and operate their systems, how sensitive digital assets remain protected, which technology dependencies matter most and whether critical services can continue as regulatory, geopolitical, security or network conditions change,” Douglas Phillips, president and CTO at Microsoft Specialized Clouds, said in a blog post.

The developments come amid growing international scrutiny of how global tech providers handle sensitive data and the extent of control customers retain over their digital infrastructure.

“Three factors are driving this, including stricter data regulations, rising geopolitical tensions, and growing AI adoption,” said Pareekh Jain, CEO at EIIRTrend & Pareekh Consulting. “Governments and enterprises want greater control over where their data is stored, who can access it, and whether critical systems can operate during disruptions. For instance, governments and big enterprises in Europe are worried about keeping their important data on an American company’s computers. Europe has proposed a new law that would limit the use of US cloud companies for sensitive government data in many areas. Microsoft is responding to these concerns while competing with local sovereign cloud providers.”

New controls across cloud and AI workloads

Microsoft is introducing the Sovereign Control Panel, a unified Azure portal experience that will allow organizations to assess their sovereignty posture, identify risks and gaps, apply controls, and evaluate workload portability. The panel is scheduled to enter public preview at Microsoft Ignite.

Expanding on Azure Key Vault Managed Hardware Security Module (HSM), which gives customers dedicated protection over encryption keys, Microsoft is now extending control beyond its own infrastructure. External key management with Azure Managed HSM is now generally available, enabling organizations to keep root encryption keys in hardware they own and operate on-premises or through a trusted third party.

In limited preview, Azure Confidential Clean Rooms will use confidential computing to support collaboration involving sensitive data, where participants will be able to analyse shared information while limiting broader exposure of the underlying data.

Microsoft is also expanding Azure Local to bring more cloud capabilities into customer-operated environments. The ability to transition workloads between connected and disconnected states is entering public preview. Additionally, DocumentDB and Blob Storage are entering public preview on Azure Local, while SQL Server on Azure Local is already generally available for connected and disconnected deployments.

On the AI front, Foundry Local is scheduled to become generally available at Microsoft Ignite for connected and disconnected operations on Azure Local. It will support local inference and agentic retrieval in natural language, backed by an expanded model catalog from Microsoft, partner networks, and the open-source community.

To further protect data during processing, Confidential Virtual Machines on Azure Local is now generally available, leveraging hardware-encrypted memory and isolation alongside workload attestation before sensitive keys or data are released.

While these additions give enterprises greater flexibility, industry analysts emphasize that localized deployments do not automatically erase vendor dependency.

“Depending upon the deployment model, in the public cloud, enterprises get better visibility, stronger access controls, and more control over encryption keys,” said Ashish Banerjee, senior principal analyst at Gartner. “In the Sovereign Private Cloud, they can operate infrastructure locally and even disconnect selected workloads from Azure. But I would not call this complete control. Enterprises still need to check whether Microsoft remains involved in identity, software updates, management, or technical support for the services they use.”

European oversight and partner options

For customers in the EU and the European Free Trade Association (EFTA), Microsoft is rolling out Data Guardian. Under this model, a trusted regional partner will provide independent oversight of remote access requests by Microsoft engineers. Simultaneously, a Production Touch Ledger will create tamper-evident logs of all technical actions performed.

Microsoft is also broadening its Sovereign Partner Ecosystem, highlighting regional operators like Bleu Cloud in France and Delos Cloud in Germany, alongside independent software vendors specializing in security, identity, observability, and backup.

Geopolitical realities and market limits

Despite these additions, analysts note that technical controls cannot eliminate geopolitical dependence entirely. US hyperscalers (Amazon, Google, and Microsoft) continue to account for roughly 70% of the European cloud market, whereas European providers’ market share has contracted over the last decade.

The new measures introduced under Microsoft Sovereign Cloud do reduce risks but cannot eliminate them. “Local infrastructure, independent encryption keys, and disconnected operations make it harder for external parties to access data or disrupt services. However, Microsoft remains subject to applicable US laws, sanctions, and export restrictions. Enterprises gain greater operational independence but not complete legal or technological independence,” added Jain.

Furthermore, while sovereign cloud capabilities can offer greater control over data, infrastructure, and operations, this often comes with trade-offs in cost, performance, scalability, and access to services.

Banerjee noted that sovereignty should be assessed workload by workload, rather than applied as a label to the entire cloud environment. Greater sovereignty generally comes with greater cost and responsibility. Local or disconnected environments may not receive every Azure service at the same time. Enterprises may also need dedicated infrastructure, specialist skills and separate continuity arrangements. On top of that, they may lose some elasticity and economies of scale.

“So, I would not recommend maximum sovereignty for every workload. Reserve it for workloads where the legal, operational or geopolitical risk genuinely justifies the additional complexity,” added Banerjee.

What are self-replicating ‘AI worms’, and why is Anthropic worried about them?

The tech company says successful AI worms need more capability on less powerful devices, but current trends make that feasible by the end of the year

Warnings about what artificial intelligence might do in the future – together with alarming reports of what it has gotten up to already – are being issued so quickly that even security experts have difficulty triaging what to worry about.

Yet a report this week from Anthropic’s offensive research team grabbed attention by describing a new, practical threat, one devoid of human characteristics or apocalyptic musings. The red team, as such internal testers are called, said it created a malicious AI program that spread autonomously through internet-connected “smart” televisions and could do the same inside other ordinary devices. While machines running AI usually need a fair amount of computing power, the researchers said that their program split parts of itself among 15 televisions and was still able to function by using a bit of power from each.

Continue reading...

© Photograph: Kim Kyung-Hoon/Reuters

© Photograph: Kim Kyung-Hoon/Reuters

© Photograph: Kim Kyung-Hoon/Reuters

The power of AI is worrying senior Labour figures – as is the fear of ‘falling behind the public’

Westminster appears to be waking up to warnings over AI safety, with concerns over its use by extremist groups and bad actors

“I have this sense that, within a few months, AI is going to be all anyone is talking about,” said one cabinet minister, with an ominous stare.

It was Labour conference, with everyone from ministers to activists jubilant at Andy Burnham’s takeover and a bounce in the polls after the change of leader.

Continue reading...

© Photograph: MASTER/Getty Images

© Photograph: MASTER/Getty Images

© Photograph: MASTER/Getty Images

Cyber-attack similar to OpenAI Medicare breach seems likely in UK, says minister

Kanishka Narayan, concerned by Australian incident, says British cyber defences could be bypassed by artificial intelligence agent

An AI-driven cyber-attack similar to the OpenAI breach of Australia’s healthcare system is likely, “if not inevitable”, in the UK, according to a senior minister.

Kanishka Narayan, the UK AI minister, indicated that the British government’s own cyber defences would be bypassed by a technology that has developed highly sophisticated skills in cybersecurity.

Continue reading...

© Photograph: James Manning/PA

© Photograph: James Manning/PA

© Photograph: James Manning/PA

I audited an award-winning AI project. The case study left out the cloud bill

I have audited enough celebrated technology rollouts to notice a quiet omission across the industry: nobody talks much about what happens to the unit economics once the pilot ends and the software enters daily production.

I have anonymized the company and changed identifying details for confidentiality, but the operating economics and workflow behaviors below are taken directly from the post-implementation audit.

About six months ago, I was brought into a mid-sized enterprise to review a document workflow that had recently received an industry innovation award. The platform vendor published a case study highlighting the deployment. The trade press ran a short feature on it. Internally, the business unit sponsor pointed to a ninety percent reduction in turnaround time for vendor onboarding agreements, using that headline metric to secure a larger operational mandate for the coming fiscal cycle.

A couple quarters later, the finance team reached out with an uncomfortable question. Document volume had stayed flat, yet the monthly operating expenses attached to processing those agreements were climbing steadily every single billing cycle.

They asked me to trace the spending back through their systems and reconcile the operational data with the general ledger.

Under the previous manual workflow, an operations clerk opened an incoming contract, checked five or six key clauses against internal guidelines, verified the vendor details and filed the document away. The entire review took about four to five minutes. Using the department’s fully loaded labor rate, including benefits and allocated overhead, that came out to roughly eighty cents per document.

The automated pipeline was running between $12 and $14 for the exact same file.

The system was technically stable. It processed thousands of files a month without dropping connections or crashing servers, and the operations dashboard stayed green. But the business was spending $12–$14 to complete work that had previously cost about 80 cents.

Every enterprise award celebrates speed and throughput. Few of them audit the cost to finish a single unit of work.

Nobody caught the discrepancy during the original three-month pilot because the computing bills, data lookups and third-party model access fees had been charged to a central innovation fund. The departmental budget never saw an invoice. As far as operations was concerned, the tool was essentially free software that dramatically reduced turnaround times on incoming requests.

The moment the pilot concluded and the system moved into full daily production, the accounting changed. Corporate finance closed the innovation project code and began allocating the actual infrastructure invoices directly back to the business line. That was when the operational reality surfaced. Within sixty days of running full transaction volume on the department’s budget, the economics of the unit turned negative.

Traditional enterprise software often has a predictable cost curve. Once the baseline platform is running, processing another five hundred records usually does not require the same kind of fresh computation and external model consumption as an automated pipeline.

In this kind of workflow, each customer interaction, incoming contract or automated data extraction can trigger additional computational steps. The system had to interpret the document, check it against internal rules, compare the result with reference data and validate the answer before completing the transaction.

If an automated pipeline requires multiple model queries and several background checks to finish a task that an experienced employee used to resolve in five minutes, you have not eliminated an operational cost. You have swapped a predictable human payroll line item for a consumption-based cost that scales directly with the work.

Falling model prices don’t mean falling workflow costs

The standard counterargument is that computing power is getting cheaper. That part is true. Research published in the Stanford HAI AI Index Report documented that the cost of querying benchmark foundation models dropped by more than 280-fold between late 2022 and late 2024.

It is tempting to assume that automated business processes will experience the same cost reductions.

In practice, a dramatic drop in per-token rates does not guarantee a lower operating bill if the production workflow performs significantly more retrieval steps, document parsing passes and validation checks to complete a single business task.

Gartner’s latest forecast points to the same tension, predicting that inference costs per agentic workflow will increase more than fivefold through 2028 as increasingly complex workflows offset falling model prices.

Both things can be true at the same time: base model prices can fall while the total cost of completing a business transaction rises.

Cheap models do not guarantee cheap business processes.

The economics of an automated system depend on the cost of the entire workflow, not just the base model.

Production complexity is where the bill gets bigger

During our audit, the operational problem showed up the moment real-world documents stopped looking like the clean samples used during vendor sales demonstrations.

The demonstration files were digitally generated PDFs with uniform fonts, consistent layouts and standard contractual language. The live production queue was full of low-resolution scans, photocopied forms rotated sideways, documents with handwritten marginal notes, and agreements containing conflicting payment terms.

A human operations specialist can often resolve that kind of ambiguity with a quick judgment call based on institutional context. The automated workflow struggled when the document fell outside the assumptions built into the process.

When the system encountered messy formatting or contradictory clauses, it triggered extra processing routines. It ran multiple extraction passes, queried internal reference databases and executed secondary verification checks to resolve the ambiguity. Each extra step added to the cloud invoice, yet the system still struggled to reach an acceptable confidence score.

When confidence fell below the required threshold (which occurred in roughly forty percent of daily transactions), the pipeline halted and routed the file into an exception queue.

That created a secondary labor expense the original business case never budgeted for.

When an agreement landed in the exception queue, an operations specialist had to log in, read the system’s partial extraction notes, diagnose why the software stalled and manually enter the correct data into the core database. Because the specialist had to review both the original document and the system’s confused output, resolving an exception took ten minutes (twice as long as the original manual baseline).

The company found itself paying twice. It was paying the full monthly cloud invoice for the automated software, while simultaneously retaining the payroll cost of the operations staff required to supervise the exceptions.

Goldman Sachs has raised the broader macroeconomic question of whether the massive corporate spending on AI infrastructure will produce productivity returns sufficient to justify the investment. Our audit showed what that question looks like inside a single department: replacing an eighty-cent clerical task with a fourteen-dollar automated pipeline that still requires human labor for four out of every ten transactions.

The problem rarely comes from the user-seat price on the purchase order. It comes from what the system consumes to complete the work.

The vendor can price the platform around usage, but the customer owns the business case. If an automated pipeline requires multiple processing passes to interpret a crooked document scan, the customer still has to absorb that consumption whether the final output is usable or not.

When you scale a human operations team, the additional cost is relatively predictable. You know what another specialist costs in wages, benefits, equipment and management time. For this kind of workflow, automated costs can rise with the ambiguity of the inputs.

When the fiscal quarter wraps up, this creates an organizational disconnect where every department claims victory while the business loses margin:

  • The engineering team reports ninety-nine percent system uptime and clean infrastructure performance.
  • Operations leadership reports that turnaround times on clean files dropped from forty-eight hours to under a minute.
  • The software vendor references the client in marketing collateral as evidence of enterprise transformation.
  • Finance is left trying to figure out why the cost of goods sold increased while revenue stayed flat.

When leadership asks why an automation milestone fails to improve operating income, engineering points to platform uptime, product leads point to system adoption and software vendors point to successful transaction counts. Every department hit its individual performance goals. Yet the business process itself became strictly more expensive to run than it was before the project started.

In this deployment, the team tried to fix the issue by adding secondary filtering scripts and tuning prompt instructions. Those additions increased system complexity and cloud consumption without solving the core unit cost problem.

An automated workflow can execute with zero technical errors while still undermining departmental margins.

Three questions before you call an AI project a success

Before approving a production, rollout or expanding an automation pilot, finance and technology leaders should put three direct questions to their teams:

  • What does one completed transaction actually cost compared with the manual baseline, accounting for all infrastructure compute, database lookups and third-party model charges?
  • How often does a human still have to intervene, and what is the loaded payroll cost of that review time?
  • Do the economics still work at production volume, or is the organization simply moving an operational expense from payroll into an unpredictable consumption meter?

If the economics only work during the pilot, the system is not creating operational leverage. It is creating an operating expense the pilot never measured.

Dutch Tax Agency Reverses Microsoft 365 Cloud Migration Over Data Risks

The Dutch Tax and Customs Administration is reversing a planned Microsoft 365 cloud migration as officials seek greater control over sensitive government data.

The post Dutch Tax Agency Reverses Microsoft 365 Cloud Migration Over Data Risks appeared first on TechRepublic.

OpenAI came to Australia to apologise. It will leave without answering these key questions | Toby Walsh

We don’t accept drugs killing a few people because they cure most patients. Or a few planes crashing because most land safely. AI should be no different

OpenAI’s CEO Sam Altman was asked to appear before the Joint Select Committee on Artificial Intelligence in Australia and explain how and why their agents have been hacking into multiple government websites. Altman didn’t turn up but sent Jason Kwon, his chief strategy officer, instead to answer the committee’s many tricky questions on its first day of public hearings on Tuesday.

The committee is conducting a comprehensive inquiry into the economic, societal, regulatory, and national security implications of AI for Australia. It will report back to parliament at the end of November. This is an unusually fast pace, but then it’s an unusually fast paced technology.

Continue reading...

© Photograph: Jeff Chiu/AP

© Photograph: Jeff Chiu/AP

© Photograph: Jeff Chiu/AP

❌