by Steve Sorbo | Aug 7, 2026 | Uncategorized
Last month brought news of an unprecedented event in the evolution of AI. Several OpenAI models hacked a real company, not for malicious reasons, but because they decided that finding the test answers was more efficient than solving the problems themselves.
This sounds like science fiction—it’s not far off the fictional Kobayashi Maru test in the Star Trek universe, where Captain Kirk beats an unwinnable simulation by secretly reprogramming it—but it’s really a wake-up call about how sophisticated cyber threats have become and why it’s more important than ever before to keep apps, operating systems, and networked devices updated.
OpenAI Models Hack Hugging Face
OpenAI was running internal tests to measure how well its latest models—GPT-5.6 Sol and an unreleased system—performed on cybersecurity tasks. The models were placed in an isolated sandbox environment with their safety guardrails deliberately turned off so researchers could assess their raw capabilities.
The test presented security challenges that the models were supposed to solve. Instead, they decided it would be easier to find the answers—an approach called “reward hacking.” The models spent substantial computing resources searching for a way out of the sandbox, eventually discovering a previously unknown vulnerability in a software proxy that was only supposed to let them download code packages. From there, they worked their way through OpenAI’s internal network until they reached a system with Internet access. (Yes, this level of sandboxing was a mistake on OpenAI’s part.)
Once online, the models reasoned that Hugging Face—a popular platform for AI research—might host the test answers. So they hacked it. They chained together multiple exploits, including stolen credentials and more zero-day vulnerabilities, to breach Hugging Face’s servers. Hugging Face’s security team logged approximately 17,000 hostile events before containing the intrusion.
To defend itself, Hugging Face relied on another AI—ironically, a Chinese open source model, since when Hugging Face tried to work with Claude, its safety guardrails blocked the security-related requests. The open source model was able to analyze the attack, processing the massive event logs quickly so the company’s security team could understand what was happening, stop the attack, scrub systems of the attack code, and deploy additional safeguards.
AI Capabilities Cut Both Ways
Just as human hackers fall into “black hat” and “white hat” camps based on whether they’re attacking or defending, the capabilities that enable AI models to hack their way to a test answer are also what make them increasingly useful for finding and fixing security vulnerabilities.
Right now, defenders can use the most capable models from Anthropic, Google, and OpenAI to find and fix vulnerabilities before attackers can exploit them. But attackers have access to AI models with similar capabilities. Security researchers track what’s called the Zero Day Clock: the time between a vulnerability being discovered and being exploited in the wild. That window has collapsed from months to less than a day, and some predict it will shrink to minutes by 2027.
You can see the defenders at work in the macOS security release notes. In the security release notes for macOS 26.5 and 26.6, the identification of several vulnerabilities was credited to “with Claude, Anthropic” or “Calif.io in collaboration with Claude and Anthropic Research.”
OpenAI’s inadvertent attack wasn’t malicious—its models were simply pursuing the goal of getting a high score on a benchmark without any sense of appropriate boundaries. (In fact, in the short time since the initial OpenAI attack, additional reports of cybersecurity evaluation models hacking into real companies have surfaced from Anthropic, the UK AI Security Institute, Meta, and OpenAI again.) But the technical capabilities these attacks have demonstrated are now part of the threat landscape, available to actors with far worse intentions. It’s only a matter of time before a hostile nation-state gives a capable open source model unlimited computing resources and tasks it with gaining access to secure systems. It’s probably already happening in the cyberdark.
Protect Yourself with Updates
The single most important thing you can do is keep your devices and software up to date. All those security patches from Apple, Microsoft, and app developers address vulnerabilities that AI-powered tools can find and exploit. Worse, once these vulnerabilities have been disclosed, hackers may be able to quickly leverage general knowledge of them to fabricate and deploy attacks against those who haven’t yet updated.
Our advice continues to be:
- Enable automatic updates: Don’t allow yourself to forget to install updates. On iPhones and iPads, go to Settings > General > Software Update > Automatic Updates. On Macs, go to System Settings > General > Software Update, click the ⓘ button next to Automatic Updates, and turn on all the switches. (If you’re working in an organization with an update policy, check with IT first.)
- Keep apps updated: Your apps need updates too, including your Web browser, email client, messaging client, and any software that touches the Internet. Attackers often target the weakest link—an outdated app can provide an entry point even if your operating system is current.
- Update device firmware: It’s equally important to update the firmware on routers, switches, printers, and other networked devices that could serve as entry points for attacks or be recruited into a botnet.
- Consider security in hardware upgrades: Although the main reason to upgrade Apple hardware should be functional, keep in mind that a newer device will likely be more secure thanks to improved hardware protections.
- Replace unsupported devices: Older hardware that no longer receives security updates should be upgraded, whether it’s a Mac or iPhone, network hardware, or a device like a printer, security camera, or Internet-connected doorbell.
With sufficient attention from developers, security may eventually become less important for us to watch than it is today. But things will get worse before they get better, so please excuse us as we keep trying to get everyone to install updates regularly.
(Featured image by iStock.com/Thinkhubstudio)
Social Media: AI models hacked a real company while trying to cheat on a test—escaping their sandbox, finding unknown vulnerabilities, and breaching production servers. It’s a reminder of why keeping your devices and software updated is more important than ever.
by Steve Sorbo | Aug 7, 2026 | Uncategorized
We’ve become accustomed to being able to get nearly anything we want—including Macs—overnight, or at least within a couple of days. Unfortunately, surging demand from AI data centers has created a global memory shortage that’s squeezing the consumer electronics industry. As a result, we’re seeing both higher Mac prices and significantly longer delivery times as Apple competes for a limited supply of chips.
Although higher-memory configurations are particularly affected, there’s no guaranteed way to predict which Macs will be affected or the estimated length of delivery delays—the situation changes daily. As of August 4, the Apple Store is reporting the following representative delivery estimates to ZIP code 14850:
- MacBook Neo (8 GB / 256 GB): 10–14 days
- 13-inch MacBook Air (16 GB / 512 GB): 15–22 days
- 14-inch MacBook Pro (16 GB / 1 TB): 1 day
- 14-inch MacBook Pro (24 GB / 1 TB): 8–15 days
- 14-inch MacBook Pro M5 Max (128 GB / 2 TB): 50–57 days
- 16-inch MacBook Pro (24 GB / 1 TB): 1 day
- 24-inch iMac (16 GB / 256 GB): 2 days
- Mac mini M4 (16 GB / 256 GB): 22–29 days
- Mac Studio M4 Max (64 GB / 512 GB): 56–70 days
If you’re in the market for a new Mac, what should you do? It depends on whether you’re buying for yourself or for an organization.
Individuals
If you just want to upgrade from an older model, waiting might not be a hardship—what’s another few weeks? But waiting isn’t easy if you’re replacing a Mac that has been lost, stolen, or broken. You have a few options:
- Shop around: Some retailers may have precisely what you want in stock. Inventory may even vary by Apple Store, if there are multiple stores nearby. It’s often best to call before visiting since online inventory systems may not be up to date.
- Adjust your desired configuration: Standard base configurations often have the best availability. Delivery estimates change with configuration, so if you can get by with less memory or storage, you might be able to get a Mac sooner. Even a different color might be more readily available.
- Choose a different model: As with configuration, some models can be delivered sooner than others, so it may be worth getting an iMac instead of a Mac mini if that means you can have it right away.
- Buy used: Apple sells refurbished Macs (with full warranties) that may have been store models, returned within the 14-day window, or used for demos. Other retailers may also sell older reconditioned Macs, and you can always look on eBay or Craigslist. Thanks to the performance of Apple silicon, a previous-generation Mac isn’t much of a compromise, but be certain any used Mac has Activation Lock removed, isn’t assigned to an organization’s device management system, and is completely erased.
Organizations
The situation may be more problematic for organizations that can’t afford for an employee to be without a Mac or need to equip a new location or a cohort of new hires. Along with the strategies above, organizations should consider:
- Maintaining a loaner pool: Keep a few Macs on hand as backups, even older models that would otherwise have been traded in. This is a good strategy in general, but make sure to refresh the loaner pool periodically so they remain supported and useful.
- Extending replacement cycles: Although many organizations prefer to replace Macs on a 3–5-year cycle, it may be worth extending replacement dates until new Macs can be acquired.
- Handing down equipment: Depending on what’s available, it might make sense to buy an existing employee a new Mac and hand their old Mac down to a new hire.
- Ordering earlier: Build Mac ordering into the hiring process earlier so machines are available when they’re needed.
- Building a deployment reserve: Organizations with predictable hiring may want to keep a few standard Macs ready for immediate deployment. Rotate those machines into normal service rather than accumulating sealed inventory.
Just-in-time manufacturing and overnight shipping have spoiled us, but with some planning and flexibility, you should be able to find the Macs you need to stay productive. Contact us if you need help forecasting Mac purchases, identifying acceptable alternatives, or adjusting deployment workflows around constrained availability.
(Featured image generated by Adam Engst with ChatGPT)
Social Media: Global memory shortages caused by AI data center demand are hitting Mac buyers with higher prices and longer delivery times. Here are strategies to reduce the pain for both individuals and organizations.
by Steve Sorbo | Aug 7, 2026 | Uncategorized
Generative AI is transforming software development. Large language models are good at human languages, but they’re even better at programming languages, which have much smaller vocabularies and fewer ways to combine words. Most importantly, code does something, so running it confirms whether it performs as intended.
The result has been a democratization of development, much as happened with desktop publishing. The Macintosh and PageMaker made it possible for almost anyone to produce a newsletter or brochure, but they did not turn every user into a professional designer, illustrator, or prepress specialist. AI can now produce working software for people who could never have written it themselves, but generating code is only part of building a reliable, trustworthy system.
Today, if you have a repetitive task that’s annoying to do but doesn’t warrant hiring a developer, you can use ChatGPT, Claude, or Gemini to help you create an AppleScript, shell script, Mac or iPhone app, or even a full-fledged Web app. However, if you’re going to dip your toe into AI-assisted development, you need to be careful. Professional developers know to watch out for numerous pitfalls, but if you’re using an AI, it’s up to you to make sure the AI takes them into account. Also, be aware that you’re still ultimately responsible for what you create with AI.
What Could Go Wrong?
In AI-powered development, there are two broad failure categories: problems with the development agent itself and problems with the finished product.
The AI world has moved past basic chatbots to agents that can look up information, change files, write and execute code, drive apps, and more. That makes them much more capable, but it also creates a situation where they could change or delete data, expose confidential data, or install software that itself creates a vulnerability.
On the other side of the equation is the finished product. If it’s local code, it could run but produce incorrect results, fill up a drive with data, overwrite important data, or cause crashes. A networked app could also generate excessive traffic, leak or expose confidential data, or serve as an entry point into your network.
Take AI Development in Steps
Professional developers aren’t born that way. They start with simple tasks and tackle more involved projects as they gain experience. With AI handling the programming for you, it can be tempting to take on a major app, but it’s safer to start with simple data analysis and local automation tools before moving on to full-fledged apps and networked systems. The process won’t turn you into a professional developer, but you’ll have a greater appreciation for all the things they have to consider.
Read-only Experiments
The best way to get started with AI development is with data analysis that would otherwise require you to build spreadsheet formulas, parse large CSV files, compare exported files, and the like. This may not seem like development, but when you drag the files into a chatbot conversation and ask it to work on them, you’ll notice that it does so by writing and executing one or more scripts, often in Python.
With this sort of AI work, you’re limited only by your data and your imagination. You could analyze an event registration or inventory spreadsheet to find trends, get a human-readable summary of errors in a massive log file, or compare data between two differently formatted CSV files to see which people appear in both.
The reason to start here is that you can easily detect errors, and nothing you do can change the data. Incorrect results may still look convincing, however, so compare them against known examples, verify totals, and spot-check the underlying records.
Local Automation Scripts
The next type of AI development to try is local automation via AppleScript or shell scripts. (If you’re uncertain how to execute a script, remember that you can always ask the AI for detailed instructions.) You could build customized scripts for batch-renaming files, creating future calendar events, manipulating images, and even reformatting HTML files.
However, because scripts can modify and delete data, you need to be more careful here. When possible, have the script create new output rather than modifying the original. Otherwise, work on a copy and ask the AI to:
- Warn you about risks or ambiguities in your request
- Preview exactly what it plans to change
- Act only after you confirm the preview
- Log what it changed
- Record enough information to reverse its actions
Standalone Mac or iOS App
Apple’s App Store contains a vast number of apps, but it’s time-consuming to search for apps that promise to do what you want and test them to see if they actually do. All too often, they don’t.
With AI and Apple’s Xcode development environment, you can now create native apps for all your Apple devices. Needless to say, even setting up Xcode is complicated, but once again, an AI agent can do much of it for you and walk you through the rest of the steps. The hard part is often figuring out where some interface control is located, so don’t be shy about pasting a screenshot into the chat and saying, “I don’t see that control—where is it?”
The sky is the limit when it comes to developing your own apps for personal or internal use. You could create an injury rehab tracker, a publishing production checker, a custom document converter, a specialized camera app that adds metadata to photos, and more. Any workflow that’s awkward or doesn’t meet your needs is a candidate. Mac apps can be shared by copying; iPhone and iPad apps must go through Apple’s TestFlight. Again, ask for help.
When it comes to safety, as long as the apps are for personal or internal use, you mostly need to focus on app reliability and data integrity. Make sure to emphasize that the AI should build and run automated tests on every change, and when you’re testing, comment on anything that seems wrong—don’t settle. Specify that data integrity is paramount, require automatic backups, and allow for manual exports.
The bar gets much higher if you plan to distribute the app more widely. You’ll need to consider your obligations regarding support, compatibility, privacy, distribution, and long-term maintenance. An AI can help with some of those issues—be sure to ask it if there are any ways that user privacy could be abused, for instance—but the buck stops with you.
If you’re contemplating selling your app, you’ll also need to confirm that the licenses for any external code, images, fonts, and other components permit commercial distribution. Be extremely cautious if you plan to build a business around an app!
Networked Systems
With great power comes great responsibility. You must be much more careful with networked systems, especially if they’ll be accessible over the Internet. But it can be compelling to build such systems—you could make an equipment checkout system, an event registration system that goes beyond Google Forms, a shared inventory system, a document submission service, or a dashboard that aggregates live data from multiple services.
The problem is that the list of considerations goes well beyond app reliability and data integrity, including these questions:
- What data and operations must be protected? Some data may be confidential, and personally identifiable information is especially important to protect. Authentication credentials, API keys, and other secrets should never be embedded in source code, prompts, logs, or shared configuration files. Instead, store them in a system designed to manage secrets and limit who and what can access them.
- Who may perform each action, and how is that enforced? Define user roles and limit each role’s permissions to only what is necessary. You don’t want a novice support representative accidentally deleting the database.
- How do you contain hostile inputs and abusive use? Attackers will probe what happens when they submit malicious URLs, API requests, filenames, uploaded files, Web hooks, and other unexpected input. To reduce your exposure, validate all input, limit its size and complexity, and restrict how frequently users can trigger operations.
- How do you separate development, testing, and production? Once you go live, it’s essential to separate these different environments so mistakes made during development don’t take down the live system and data generated during testing doesn’t contaminate the production database. Make sure to separate data and credentials as well.
- How will the system handle simultaneous requests, retries, and partial failures? Network requests can arrive twice, overlap, or fail midway through multi-step operations. Work with the AI to prevent these sorts of issues, which can result in duplicate payments, registrations, messages, or inconsistent records.
- How will you detect and contain attacks, outages, and unexpected behavior? Decide what to log, what conditions should trigger alerts, how access can be revoked, and if it’s possible to isolate a compromised component without shutting down the entire system.
Finally, assign an owner before putting any significant networked system into use. That person must be responsible for investigating failures, restoring data, updating dependencies, renewing credentials and certificates, responding to vulnerabilities, and eventually retiring the system. An internal application that nobody maintains may become less reliable and less secure with every operating-system update, expired credential, and newly discovered vulnerability.
(Featured image by iStock.com/Boonyakiat Chaloemchavalid)
Social Media: Thinking about using AI to write code? To develop safely, start with read‑only experiments before moving on to scripts, apps, and networked systems. Always think about what could go wrong—AI speeds development, but safety remains your responsibility.
by Steve Sorbo | Aug 7, 2026 | Uncategorized
Reading articles on the Web has become fraught with distraction. Ads are terrible, of course, but publications also inundate you with navigation links, pop-ups encouraging you to subscribe, popular article lists, and more. Even worse is when an article requires multiple clicks or taps to keep reading. It’s maddening—you just want to read and get on with your day!
The easiest, built-in solution to this admittedly first-world problem for Apple users is Safari Reader on the iPhone, iPad, and Mac, which you can use to “hide navigation menus and other distracting items.”
Apple is careful not to say that Reader hides ads—which it does, most of the time—to avoid conflict with publications that rely on advertising, some of which may even be placed by Apple itself.
Beyond hiding distracting items, Reader displays articles as a single page and automatically generates a summary and table of contents for longer articles to make navigation easier.
Even better, you can configure Safari to show articles in Reader automatically for specific websites, so you don’t have to turn it on manually for each article.
Here’s how to use it.
Switch to Reader
Since Reader’s reformatting would break many non-article Web pages, Safari offers Reader only when you’re viewing a page that it can reformat. As a reminder, Safari on the iPhone and iPad shows a brief “Reader Available” mention in the address bar when you open a Reader-compatible page.
To display a compatible page in Reader, tap the website 
button at the left of the address bar ➊, then tap Show Reader ➋. Safari immediately reformats the page, removing many extraneous items and potentially changing the background and font.
The reformatting can be even more significant in Safari on the Mac, where websites often add columns of ads, pop-ups over the text you want to read, and more.
When Reader decides a page is long enough and has enough headings, it automatically generates a summary and table of contents, displaying them in expandable sections at the top. This feature is, frankly, a little random. We couldn’t always predict when Reader would generate those sections, and it even sometimes varied by device.
Adjust the Look of Reader
By default, Reader uses a white background with Apple’s San Francisco sans-serif font. That’s entirely acceptable, but you can switch to a sepia, gray, or black background, choose from a selection of serif and sans-serif fonts, and increase or decrease the font size.
Tap the page 
icon at the left of the address bar to pick from those options.
The presentation looks a little different on the iPad (left) and Mac (right), but the options are essentially the same.
Use Reader Automatically
For websites you regularly read, it’s best to set Reader to kick in automatically. It won’t reformat pages that don’t make sense, such as section pages that contain links to multiple articles. How you enable this option varies by platform:
- iPhone and iPad: Whether or not you’re in Reader, tap the icon at the left of the address bar, tap the ••• button, scroll down in the page menu, and turn on Use Reader Automatically.
- Mac: When you’re not in Reader, click the website icon at the left of the address bar, choose Website Settings, and select “Use Reader when available.”
If you want to manage which sites use Reader automatically all together, on the iPhone and iPad, open Settings > Apps > Safari > Reader (way at the bottom), and on the Mac in Safari, choose Safari > Settings > Websites.
Helpfully, Safari syncs appropriate website settings between devices via iCloud, so once you set a site to use Reader automatically, all your other devices will default to that as well.
Switch Back to Standard View
Although Reader works well most of the time, it’s possible to run across an article with interactive elements that don’t display in Reader. If something seems wrong about an article in Reader, you can switch back to the standard presentation of the page. Just tap the page icon at the left of the address bar and tap Hide Reader.
The hardest part of using Reader is getting started. Once you’ve become accustomed to switching into it and setting it to trigger automatically for websites you visit regularly, you’ll find reading the Web easier, more relaxing, and less likely to tempt you down a rabbit hole of additional content.
(Featured image based on an original by iStock.com/Tippapatt)
Social Media: Tired of ads and pop-ups interrupting your reading? Safari Reader reformats Web articles for distraction-free viewing on the iPhone, iPad, and Mac—and it can even activate automatically.
Recent Comments