New tools, products, platforms, funding rounds, and company developments in AI security.
Starlette 1.0 was released in March 2026 with breaking changes from previous versions, notably replacing the old on_startup and on_shutdown parameters with a new lifespan mechanism (an async context manager for managing app startup and shutdown). Since LLMs were trained on older Starlette code, the author created a Skill (a custom knowledge document that Claude can reference) by having Claude clone the Starlette repository, build documentation with code examples, and add it to their Claude chat so the AI could generate working Starlette 1.0 code.
Fix: The source explicitly mentions the solution implemented: creating a Skill document. The author states "I decided to see if I could get this working with a Skill" and describes the process: "Clone Starlette from GitHub...Build a skill markdown document for this release which includes code examples of every feature." They then used the "Copy to your skills" button to add this skill to their Claude chat, enabling Claude to generate correct Starlette 1.0 code in subsequent conversations.
Simon Willison's WeblogSpotify is investing heavily in AI-powered music discovery tools, including a new ChatGPT integration and a Prompted Playlist feature that let users describe what they want to hear through conversation rather than traditional buttons. Spotify executives say these AI features are key to keeping subscribers engaged as music catalogs become similar across streaming apps, with their interactive AI DJ feature already used by 90 million subscribers.
Elon Musk announced plans to build a Terafab chip manufacturing plant in Austin, Texas, jointly operated by Tesla and SpaceX to produce chips for robotics, AI, and space data centers. Musk and other industry leaders are concerned that chip makers cannot produce enough chips fast enough to meet growing demand from the AI industry, though building a chip fabrication plant requires billions of dollars, many years, and specialized equipment.
OpenAI is shifting away from its aggressive spending plans to build massive data centers, instead focusing on purchasing cloud computing capacity from other providers. CEO Sam Altman acknowledged that running data centers at this scale is difficult, citing severe weather events and supply chain challenges at their Texas facility (part of the $500 billion Stargate project with Oracle and SoftBank), and the company is facing pressure from investors to demonstrate more responsible spending before its planned IPO (initial public offering, when a private company becomes publicly traded).
At the Game Developers Conference, AI tools were heavily promoted for creating game content, NPCs (non-player characters, the computer-controlled characters in games), and automating quality assurance tasks, but these AI systems were largely absent from actual commercial games being released. The gap between AI hype in the gaming industry and its real-world implementation in finished games remains significant.
Director Valerie Veatch explored OpenAI's Sora text-to-video generative AI model (software that creates videos from text descriptions) in 2024, hoping to connect with other artists in online communities. However, she discovered that the AI frequently generated images containing racism and sexism, and was disturbed that other AI enthusiasts seemed unconcerned about these biased outputs.
Google has launched Gemini task automation, a feature that lets an AI assistant use apps on your phone to complete tasks for you, currently available on Pixel 10 Pro and Galaxy S26 Ultra phones in beta. The feature works with a limited number of services like food delivery and rideshare apps, and while it's slow and sometimes clunky, it represents an early example of an AI actually performing actions on a device rather than just answering questions.
OpenAI is running a limited test of ads on ChatGPT with major ad agencies, but the rollout is slower than partners expected, frustrating them since they committed large budgets ($200,000-$250,000 each) that may not be fully spent by the March deadline. OpenAI says the slow pace is intentional to learn from users before expanding broadly, and recent data shows ad delivery is accelerating with a 600% increase in ads served by mid-March.
The Trump administration released a seven-point plan for federal AI regulation that prioritizes reducing government oversight while preventing states from creating their own AI rules, arguing this protects a national strategy for AI leadership. The plan focuses mainly on child safety protections, managing electricity costs from AI infrastructure, and promoting AI skills training, but provides limited detail on most points.
OpenAI's Instant Checkout feature, which let users buy products directly in ChatGPT, struggled with technical problems and is being replaced with dedicated retailer apps that redirect users to the retailers' own websites. The main issues were that onboarding merchants was difficult, the AI often had outdated or inaccurate product information (because it relied on web scraping, automatically collecting data from websites), and the overall shopping experience fell short of what users needed.
The Trump administration released a national policy framework for AI that aims to create uniform federal safety and security rules while preventing individual states from creating their own AI regulations. The framework covers six areas including child safety online, AI data center standards, intellectual property rights, and preventing AI from being used to censor political speech, with the administration seeking to turn it into law this year.
This brief news roundup mentions several cybersecurity topics including vulnerabilities discovered in KVM devices (virtualization software that lets one computer run multiple operating systems), issues with Claude AI, and activity by The Gentlemen ransomware group (malicious software that encrypts files and demands payment). However, the source provides no detailed information about what these vulnerabilities are or how they affect users.
Google Search is now using AI to generate its own headlines in search results instead of showing the original headlines from websites. This changes Google's traditional approach of displaying exact content from websites, and in some cases the AI-generated headlines alter the meaning of the original stories.
Atlassian laid off 1,600 workers (about 10% of its workforce) with little warning, including staff who were building AI features into the company's products. The company cited the need to become more agile, invest further in AI, and break even, as its market value had dropped significantly from US$77 billion in 2021 to about US$13 billion by early 2025. Affected employees report feeling blindsided by the redundancies, which came despite strong performance and without clear explanations, and they struggled with unclear communication about severance packages and next steps.
Anthropic has refused to let the U.S. Department of Defense use its AI technology for mass surveillance (monitoring large groups of people without individual suspicion), but FBI Director Kash Patel revealed that authorities can already conduct large-scale surveillance of Americans by purchasing data directly from private companies, bypassing the need for AI firms' cooperation.
OpenClaw, an open-source AI assistant project, has become extremely popular and is enabling developers to build and run AI agents locally on personal computers rather than relying on expensive cloud services from major AI companies. This rapid growth has sparked concern that advanced AI models are becoming commodities, with the same capabilities now available cheaply through open-source alternatives instead of only through expensive proprietary services from companies like OpenAI and Anthropic.
Agentic AI (AI systems that can independently take actions) is expected to handle 15-25% of e-commerce by 2030, but this growth creates security risks for retailers. Threat actors may exploit AI agents to commit fraud such as gift card theft and returns fraud, with estimates suggesting one in four data breaches by 2028 could involve AI agent exploitation. Google has introduced the Universal Commerce Protocol (UCP), an open standard designed to enable secure payments between AI agents and retail systems, though the article emphasizes that defending against AI-enabled fraud remains a critical challenge for organizations.
Fix: OpenAI is moving Instant Checkout to a new Apps format within ChatGPT where purchases can happen more seamlessly, and is prioritizing better search and product discovery features in the chatbot. The company is now working with retailers to create dedicated apps that reroute users to the retailer's own website to complete purchases, giving those companies more control of the customer experience and transaction process.
CNBC TechnologyGoogle will no longer accept AI-generated bug reports for its open-source software vulnerability reward program because many contain hallucinations (false or made-up details about how vulnerabilities work) and report bugs with low security impact. To address the problem of overwhelming AI-generated submissions across the open-source community, Google and other major AI companies (Anthropic, AWS, Microsoft, and OpenAI) are contributing $12.5 million to the Linux Foundation to fund tools that help open-source maintainers filter and process these reports.
Fix: Google now requires higher-quality proof, such as OSS-Fuzz reproduction (automated testing that demonstrates the bug) or a merged patch (code fix already accepted into a project), for certain tiers of bug reports to filter out low-quality submissions. The $12.5 million in funding managed by Alpha-Omega and the Open Source Security Foundation (OSSF) will be used to provide AI tools to help maintainers triage and process the volume of AI-generated security reports they receive.
CSO OnlineCTI-REALM is Microsoft's open-source benchmark that evaluates AI agents on their ability to perform end-to-end detection engineering, which means taking cyber threat intelligence reports and turning them into validated detection rules (KQL queries and Sigma rules) that can actually catch attacks in real environments. Unlike existing benchmarks that only test whether AI can answer trivia about threats, CTI-REALM tests whether AI agents can do what security analysts actually do: read threat reports, explore system data, write and refine queries, and produce working detection logic scored against real attack telemetry across Linux, Azure Kubernetes Service, and Azure cloud platforms.
Agentic AI (AI systems that can take independent actions to accomplish goals) is rapidly spreading through organizations, with 80% of Fortune 500 companies already using agents, but these systems can become security risks if compromised into acting against their owners. Microsoft is addressing this challenge by introducing Agent 365, a control system that gives IT and security teams the ability to observe, control, and protect agents across their organization, along with new security tools in Microsoft Defender, Entra (identity management), and Purview (data governance).
Fix: Agent 365 will be generally available on May 1 and serves as 'the control plane for agents,' providing 'visibility and tools needed to observe, secure, and govern agents at scale.' It includes new capabilities in Microsoft Defender, Entra, and Purview to 'secure agent access, prevent data oversharing, and defend against emerging threats.' Additionally, Security Dashboard for AI (now generally available) provides 'unified visibility into AI-related risk across the organization,' and Entra Internet Access Shadow AI Detection (generally available March 31) 'uses the network layer to identify previously unknown AI applications and surface unmanaged AI usage.'
Microsoft Security Blog