Mark Carney’s pursuit of a global alliance of middle powers has a Europe problem.

Canada’s prime minister wants to help build a new world order that can counterbalance the power of the United States and China. But his vision depends on a new relationship with a Europe that doesn’t see itself as a middle power at all. 

European Commission President Ursula von der Leyen has a different vision: a Brussels-centered bloc that extends the EU’s economic and geopolitical influence, starting with Canada. The idea, according to senior European lawmaker Siegfried Mureșan, is to create an opportunity for the EU to become the “global center of gravity for liberal democracies.” 

The competing visions will be tested this week when Carney and von der Leyen meet in Montreal for a summit intended to chart a new course for transatlantic relations. Both want to demonstrate they can prosper in a world upended by U.S. President Donald Trump. But they have different ideas about their curious new alliance — and face political resistance that could limit how far the partnership can go. 

Von der Leyen’s offer of “associate membership” in the EU surprised officials on both sides of the Atlantic. Four diplomats told POLITICO they were not consulted before she floated the idea in the State of the Union. The officials added that they don’t understand the label, which has yet to be defined. Germany has since led pushback on the plan.

“We’ve definitely put the cart before the horse,” one of the diplomats said. “We’re announcing something and then figuring out how to flesh it out.”

Trump called the membership idea “laughable,” but also threatened “very serious tariffs” should it come to be — a reminder that leaders in pursuit of Washington workarounds must avoid provoking the White House. 

The leaders are under pressure to leave Montreal with more than a liberal democratic photo-op. For starters, they need to decide what “associate membership” means — and disarm resistance in the EU capitals blindsided by von der Leyen’s plan.

Canada’s Ambassador to the EU Jonathan Wilkinson told POLITICO last month that people got too hung up on a label that was revealed prematurely. Carney called the Canada-EU relationship an “alliance for the future” when he addressed European lawmakers in Strasbourg.

Wilkinson said the Canada-EU project will show other democratic nations how to deepen partnerships. “It ties into very much what [Carney] talked about at Davos — and after Davos.”

Carney, von der Leyen and European Council President António Costa have two days to chart what’s next while American foreign policy continues to stress test geopolitical relationships in midterm campaigns that will shape Trump’s last two years in office.

The economic divide 

Ottawa considers the EU an obvious partner in its push to diversify trade away from the U.S. There’s already a free-trade agreement that both sides view as being underutilized. 

Leaders gathering in Montreal this week will celebrate the 10th anniversary of the Canadian-EU trade agreement, nicknamed CETA. But nine EU member countries have yet to ratify the deal, underscoring the challenge of turning rhetoric into reality. 

“We have shared challenges and many more shared opportunities,” Canadian International Trade Minister Maninder Sidhu told reporters last week in Dublin, where he was invited to participate in an informal meeting of EU trade ministers, a preview of what a more integrated Canada could look like. “Canada wants to be Europe’s most reliable partner.”

Sidhu said CETA utilization rates in EU member countries range from 60% to 80%, making a point about room for improvement and perennial challenges. “We know there’s room to grow.”

Von der Leyen’s associate membership plan “has been coldly received by member states,” a senior EU official said. “It [the summit] is more about what we do, how we can use the real potential of the CETA agreement.” CETA has been provisionally in force since 2017.

Trade talks between Canada and the bloc read like a lengthy transatlantic grievance list.

At a meeting between Brussels and Ottawa last October, the EU complained about Canadian taxes it says disproportionately hit European carmakers, opaque cheese-import quotas, cumbersome rules on cosmetics and what it considers discriminatory provincial taxes and markups on European wines and spirits.

Canada, meanwhile, warned that the EU’s deforestation rules could burden its exporters, questioned the impact of Brussels’ carbon border tax and pressed for greater recognition of Canadian standards in areas including AI.

The senior EU official described the relationship as constrained by “irritants and unfulfilled promises” that must be resolved if the two sides are to make progress.

There are hurdles ahead. Even as Canada and the EU imagine a deeper economic and security partnership, both are pursuing industrial policies that could shut the other’s companies out of lucrative public contracts — death by compounded trade barriers.

Brussels has concerns about Ottawa’s “Buy Canadian” initiatives and their compatibility with the EU-Canada free trade agreement. “Some member states didn’t like the ‘Buy Canada’ thing from Carney,” the official added.

Canada is likewise uncertain whether its companies will qualify for the EU’s proposed “Made in Europe” preferences foreseen in a major industry bill that would seek to channel public procurement spending to European companies. The EU is divided over whether to extend those preferences to trusted trading partners, a topic that is expected to come up in Montreal.

Canadian business leaders recognize the domestic appeal of “Buy Canadian” in the face of Trump’s threats, but warn there will need to be concessions.

“It’s something that will have to be resolved in order to move the relationship deeper, particularly with respect to industrial cooperation or collaboration,” Mark Camilleri, president of the Canada EU Trade and Investment Association, told POLITICO.

Camilleri likened the 10-year-old CETA deal to a garden overgrown with weeds. “It pains me to see market access being eroded through Canadian and European preferences,” he said.

Pressure is on

European and Canadian leaders are under pressure to deliver wins this week that demonstrate that “non-hegemons” — a descriptor Carney used in his Davos speech — can survive and thrive in an age of great-power rivalry.

Canadians currently support closer ties with Europe. But the EU faces political headwinds of its own, from fraught budget negotiations within the bloc to right-wing populist movements that are picking up momentum in some of its biggest economies.

One likely deliverable is a new digital trade agreement. Talks launched in March and were still underway last week. But the agreement lacks substantive text on artificial intelligence, leaving the two sides to find other places to cooperate, potentially through the EU’s proposed Cloud and AI Development Act. That proposal seeks to reduce reliance on U.S. tech giants, raising the risk of a new row with Washington. 

The European Commission is also pushing for Canada to join Erasmus+, the bloc’s student exchange program, according to one EU official. Carney has already publicly expressed interest. 

But Brussels has bigger ambitions for the partnership. The EU is pressing Canada to increase its funding for Ukraine, a test of Canada’s willingness to take on more of the security burden. 

For von der Leyen, securing that commitment would be a win. So would leaving the summit with a pledge from Carney to explore her offer of an “associate membership” — or whatever they end up calling it.

Zi-Ann Lum reported from Toronto, Sebastian Starcevic from Brussels and Camille Gijs from Dublin.

There are some days when there’s so much that needs to get done, I daydream about having a clone of myself. Between paying bills, life admin like renewing my driver’s license, keeping up with doctor’s appointments, and planning meals, it’s a lot. And that doesn’t even begin to touch the work that goes into making a podcast or managing my social life.

This feeling of overwhelm resonates with Sari Azout. She’s a mom of three who works in tech. “There is just so much doing,” she told Explain It to Me, Vox’s weekly call-in podcast. “I wake up, and I have to do meal coordination and get my kids up for breakfast, coordinate carpools. Then a lot of work during the day, but there’s the email from the teacher, there’s the 20 group chats asking if you want to participate in this group gift. They don’t call it ‘the invisible load’ for no reason.’”

Silicon Valley says it has a fix for this kind of mental overload. They don’t want to clone us — at least not yet. But they do think they have the next best thing: AI agents. 

Azuot was skeptical when she first got an invite to try an agent, but she says she eventually came around on the technology after back-to-school shopping snuck up on her. She used her agent to get it done. “It blew me away,” she said.  “I remember that night coming home just feeling so calm and reading my son a book and feeling present. And I was like, ‘Wow, I actually was very cynical about something that is giving me more time for living.’”

Azout’s experience is, more or less, the sales pitch for AI agents: They’ll help you save time with everyday tasks, so you have more of it for what you want to do. But what are agents, exactly? Are they really all that? And what do we gain — and give up — when we use the technology?  

On this week’s episode of Explain It to Me, I spoke with Reece Rogers, a senior software reporter at Wired, to find out. Rogers says to think of agents as the next evolution of AI chatbots like Claude and ChatGPT. 

“I’d create this mental model of a tiny digital assistant that’s constantly searching the web, going through your email, and checking your calendar, trying to find ways it could proactively be helpful for you,” he explains. “Agents are more proactive. It’s scanning your email 24/7 and sending you a message, maybe highlighting a potential calendar conflict.”

Below is an excerpt of my conversation with Rogers, edited for length and clarity. You can listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If you’d like to submit a question, send an email to askvox@vox.com or call 1-800-618-8545.

What agents are out there right now?

At the start of this year, there was a tool called OpenClaw that really sparked this with early adopters in San Francisco, but now there are much more consumer-friendly versions, with one of the most notable being Meta’s Muse. 

There’s also a tool from OpenAI called Dots. But where Meta’s Muse is free to download, OpenAI’s Dots is still behind a $100/month paywall. 

You tried an AI agent for a recent story you wrote. How was that experience?

One personal example, to share something that I’ve actually been using agents for, is our couch. It’s broken, and finding a new couch has been a pain. We want a sleeper bed, but we want these specific colors. We have this specific budget. I’ve been using Meta’s Muse and OpenAI’s Dots to try to find a few different options for us. 

One interesting thing is that Meta’s Muse is connected to Facebook Marketplace. There are these really good integrations where I can give it all these details, and it found a few good couches that are only maybe a couple blocks from me. 

I really enjoyed OpenAI’s Dots experience as well. I spent about an hour talking to it on the phone, and the AI agent made a packet of all these different options I could find. Just this morning, it flagged that one of them is now 40 percent off. 

Is that how this tech is typically used?

Most people are using this as part of a workflow. I attach it to my email, I attach it to my calendar, and I’m using it as a personal assistant to organize my life. But people have been quite creative. 

One of the breakout uses for Meta’s Muse is people have been connecting their bank account statements and then using it to scan for subscriptions they might want to cancel. So it can be used in many different ways, though I will say I do not connect it to my own bank account for a myriad of reasons.

I’m not going to lie, the idea of giving any third party access to my bank information does not thrill me. I don’t love that concept.

That’s one of my biggest concerns about these AI agents: how much personal information we’re handing over to these large companies. 

When I tested Meta’s Muse, it wanted access to my email, my bank account, even my passport expiration details. The pitch is convenience, but Muse users are automatically opted in to having all of their interactions with Muse used to train Meta’s AI models. 

I would definitely recommend, if you’re sharing personal details, go into the settings and turn that off because you might be handing over even more information about yourself than you initially realize.

What is the privacy situation with all of this? We all have various apps where we don’t read and still click “I agree,” but this feels like it could be more invasive.

Yes, especially because it’s all about automation. If you’re automating things and it has access to all of your data, it could make mistakes and embarrass you in ways you might not even be thinking about. 

There was this one really interesting story of someone who had connected an AI agent to their work Slack in addition to their bank account. And their agent just automatically posted how much money was in their checking account for all of their coworkers to see. 

Oh no.

I would be mortified. So there are these kinds of mistakes that these AI tools can still make. If you’re interested in experimenting with them, I would be really thoughtful with how you’re setting up these tools as well as what kind of information you feel comfortable sharing.

“You can see in the marketing that these companies are trying to find some way to entice new users.”

How are these AI agents being marketed? AI is not popular right now. Just ask any politician who has a data center coming to their state. People are not loving it. How are they trying to sell this to the average person?

The AI backlash really is at a fever pitch right now. You could almost see that in the way that AI companies are trying to market these tools. They’ve really, really leaned into cuteness and into adorable mascots. 

Muse, if you haven’t seen its agent, looks like a mix between a Labubu and an Ewok. It’s very furry, very cuddly, very cute. OpenAI’s tools also have similar kinds of blobs with large eyes that might be a little endearing. 

I feel like companies are hearing this kind of feedback that people aren’t trusting AI right now, or maybe they have moral or ethical reasons they don’t want to use these tools. You can see in the marketing that these companies are trying to find some way to entice new users.

Do you think AI agents are ultimately going to worm their way into our lives despite how unpopular AI companies are?

I do think so. I think in a couple months, maybe when I go home from Christmas, I would not be surprised if my mom had an agent on her phone because it does feel like it’s breaking through to average people in the way that ChatGPT had a moment a few years ago. 

Even though there’s a lot of distrust for large companies like Meta, I think there are some appealing parts of this that will bring in millions of people. I do see this as the future of the internet.

When I think of the dream of the average person working in AI in Silicon Valley, it’s “We’re going to use AI. It’s going to free up the free time of so many people. Work is going to get done faster. You’re going to have more leisure time.”

Has that been the case for the people you’ve spoken with who are using this? Has it given them more free time to enjoy themselves or has it done something else?

You would think so, right? You would think that if people are automating these boring aspects of their life, that they would have more time to go touch grass, go see a movie, have some fun. But it does feel like that time just gets filled with other work, other productivity measures. 

While agents may be able to take some more annoying or tedious things off of your plate, I am not as optimistic that it’s going to give us this utopia or freedom where I’m always at the beach.

On the first day of its war against Iran, the United States killed 123 children when it targeted and struck an elementary school. 

The strikes, ultimately approved by humans, were facilitated by the US’s Maven Smart System, an AI-enabled software platform developed by Palantir Technologies that allows the military to aggregate, organize, and process battlefield data. Operators fed Maven intelligence classifying the elementary school as an Iranian military facility, and the system, in turn, marked it as one of the priority targets for day one of the war. Though the site was formerly part of a naval military base, it had been converted into an elementary school in 2017 and had remained one since. The intel handed to Maven did not reflect this.  

This mistake resulted in what some reporters have called “one of the single worst massacres committed by the US government since the Vietnam War.”

Such scenarios may become more common as militaries continue to deploy a once-theoretical technology — AI-assisted or autonomous weapons, capable of making both targeting and launch decisions on their own — on real battlefields around the globe. And they raise a troubling, unresolved question: When human beings and machines collaborate in violating international law, who is to blame? 

In this case, the government and private sector are pointing the finger at each other. Some US Central Command personnel, according to Pentagon officials who spoke to Bloomberg, expected Maven to flag stale information or inconsistencies in the underlying intelligence assembled for potential targets. Meanwhile, a Palantir spokesperson told Bloomberg that the company “is not responsible for the underlying data nor identifying intelligence deficiencies,” while also denying that the evidence indicated that its software was at fault in the strike. 

This debate underscores the fact that AI and autonomous weapons are raising a new host of unresolved issues within the law, even as they’re actively assuming positions on the battlefield. In institutions where the line between human and machine decision-making continues to blur, how do we assign responsibility for war crimes? And, are the laws in place suited for the job?

In institutions where the line between human and machine decision-making continues to blur, how do we assign responsibility for war crimes?

To unpack some of these issues, I spoke with international law expert Allen Weiner, a senior lecturer at Stanford Law School, where he teaches courses on the law of armed conflict. Before teaching at Stanford, Weiner practiced international law in the US Department of State for more than a decade. We discussed the difficulties in attributing criminal responsibility, achieving justice for those harmed by lethal autonomous weapons, and much more. The conversation below has been lightly edited for length and clarity.

How do autonomous weapons challenge traditional understandings of responsibility when it comes to the law of armed conflict?

For most of the 20 years I’ve been teaching at Stanford, there’s been a real fascination and fixation on the problem of autonomous weapons. But the truth is that up until pretty recently, nobody really had any [of them]. It was more of an idea than a problem. It’s only in recent years that we have begun to see the deployment of tools that seem to have the capability [to make decisions themselves], so this does raise the question about compliance with illegal orders and where in the chain responsibility lies.

There are different theories about this. Some people say that if we’re engaged in an illegal attack, that has to be because of the programming or the code, so the manufacturers are somehow responsible for committing war crimes. 

Other people would say no, that’s not the case, especially if the military has said the tool is not allowed to make very substantial autonomous judgments, or can’t say no. Then it’s basically the commander, at the point they decide to deploy this weapon, who might be responsible for the illegal acts, even without knowing in advance what they’re going to be.

So to finish where I began, this does present a big challenge to our traditional understanding of responsibility for targeting decisions and of what it would mean if there were an obligation [for autonomous weapons] to say no. 

The real issue is not the obligation to say no, but this: If you train a tool and it wages war in a manner that’s unlawful, where does responsibility for that lie?

If a commander gives a clearly illegal order, such as, “blow up this school,” it seems clear that responsibility falls on the commander. But I could imagine a scenario where a commander is using an AI-assisted or autonomous weapon, isn’t giving it any illegal orders, is trusting that it will operate within the law, and the weapon breaks the law “on its own.” Where does responsibility fall in those cases?

I can imagine two different scenarios. One is that you say, “We’re going to carry out an attack against our enemy, and we want to hit them really, really hard.” Your tool has been trained to say, “We’re not allowed to hit civilian objects,” so it might say, “I’m not going to hit a school.” But if the military has said, “Don’t refuse any targets,” then it might override the way it’s been trained. 

We’re seeing this already, with the stories coming out about breaches where AI tools, Claude and ChatGPT in particular, interpret their instructions in a way that causes them to do something the person who gave the instruction would not have wanted. When Anthropic gave Claude a challenge to figure out if it could do something, the tool figured out, well, maybe we should break into Hugging Face as a way of solving this problem, and the people who gave the AI tool the challenge never intended that.

So if you said, “We want to launch a really punishing campaign,” what happens if the tool on its own says, “Nothing’s going to hurt them more than seeing their kids killed, so let’s attack the school?” That’s one risk, and it’s a real challenge.

So [as for who’s responsible], it’s not the commander who said “hit them hard,” because when he said that, he didn’t mean “attack schools.” It’s not really the companies, because the companies didn’t want them to hit schools either. 

But the tools are out there, reading everything on the internet, and it came across something that said the way you win a war is by attacking the things your adversary holds most dear, and they hold nothing more dear than their children. So it makes this kind of judgment on its own. And it’s not as if you can go back and say who ordered it to hit a school, which is the thing that is clearly illegal. So I do think there’s a risk of diffusion of responsibility here.

You could say the commander knew the tool might work this way, or the person who decided to contract with Palantir or with Claude, whoever it is, to build this tool. But if we’re really thinking about criminal responsibility, the level of responsibility you would need to convict someone requires a culpable mental state. You would need the person to intend, or at least know, that they were authorizing an attack against the school. And I can easily see a commander saying, “I had no idea.”

The decision to authorize this tool, or to give an instruction like “hit them very hard,” could be a basis for some other kind of accountability — administrative discipline within the military, a reprimand, your rank is lowered. But if we’re talking about criminal responsibility, which is what we often think about when we talk about war crimes, I think this diffusion of responsibility is going to make it very hard to identify any single individual who has the required mental state to give rise to accountability.

The second scenario is where the tool just makes a mistake based on the information available to it. We saw that with the attack on the girls’ school in Iran, where it was pretty clear the tool was looking at old data. Now, who’s responsible for that? 

Is it the people who said “give me targets based on this data set,” when they should have made sure the data and the maps were current? All of this strikes me as negligence or recklessness, and it does seem challenging to imagine a situation in which we would say yes, somebody here has committed a war crime. 

“There can well be war crimes, but identifying who the war criminal is might be a big challenge.”

A war crime has been committed, but is there a war criminal? That’s the situation we’re seeing. There can well be war crimes, but identifying who the war criminal is might be a big challenge.

There’s a professor of law, Rebecca Crootof, who proposes the idea of “war torts.” Instead of thinking about war crimes involving autonomous weapons solely through a criminal responsibility lens, maybe tort law — which allows victims to sue wrongdoers for negligent, reckless, or intentional harm — could address the diffusion of responsibility you mentioned. What do you think about that idea?

I think the idea is interesting. We have to separate out the obligations that countries have under international humanitarian law. In a situation like the one I just described, where there’s a war crime but no war criminal, that doesn’t mean the country is not responsible. There may not be an individual who’s criminally accountable, but if a country targets civilians in a circumstance that’s unreasonable, that’s a violation of international humanitarian law, and that could be a basis for claims between the two countries. 

Tribunals were established between Ethiopia and Eritrea, for instance, after the Eritrean War of Independence, that dealt with claims between the two countries for money damages, and some of them involved allegations of violations of the law of armed conflict. Iraq paid reparations after the first Gulf War for harms it had caused to people in Kuwait, under something called the UN Compensation Commission. So the idea that the state is responsible is well established, and one of the ways states would discharge that responsibility would be by paying money damages. That’s the domestic-law equivalent of torts.

Whether there would be a mechanism for [civilians] doing this in domestic law is an interesting idea. We would probably need legislatures, either state legislatures or the federal government, to create a private cause of action allowing people who have been injured to bring claims against, say, the manufacturers of these tools. But this gets procedurally very complicated, because there’s a whole body of law on federal sovereign immunity. 

Could you sue the Defense Department? Probably not. Could you sue an individual soldier? Probably not. Could you sue Anthropic or Palantir? Maybe. But it would probably require Congress to enact a new cause of action, because in general it’s very hard to bring private lawsuits in US courts for violations of international law.

The basic idea of what we would think of as tort or civil responsibility is really the whole essence of international law. On the substance, states do owe responsibility to one another, and they can engage in violations of international humanitarian law that would invoke their responsibility. But then the whole separate question is whether you have a forum within which to adjudicate that and get compensation.

Does that look different in cases where violations of international law were committed by a human soldier versus a machine?

Well, we don’t know, because there have been no cases in the latter category. All of the international humanitarian law violations that have been the subject of international law claims were ordered by humans. 

Now, if an American machine launches an attack against a girls’ school in Iran, and there were a court with jurisdiction, the US would be responsible. In some ways it wouldn’t matter whether it was an individual or a machine, because we don’t have to go down to the level of the individual actor, company, AI tool, or commander. The responsibility is the responsibility of the country. In some ways, that makes it easier.

If we pursued compensation through state-to-state claims, you’d be able to do that without getting into the details of who within the state that committed the war crime was responsible. The state whose school was attacked would say, “I don’t care. You committed a war crime, you’re liable to me, you’re responsible for the damages, and you can figure it out internally.”

But if we were doing something like a war crimes prosecution, where we’re trying to hold an individual criminally responsible, that would make quite a difference. We would have to deal with all of these difficult questions about responsibility and mental state that you and I are struggling with right now.

So, in most cases, the state would have to take responsibility regardless.

Right, and there are lots of [International Court of Justice] cases involving different aspects of the use of force. The principle that you can bring state-to-state claims for violation of these rules is quite well established. 

But with international law, states have to consent to the jurisdiction of a court. They can do that in advance by saying “I’ve signed up to the jurisdiction of a court and I accept any claims that might be brought against me in this court,” or they do it on a case-by-case basis. And it may not surprise you to know that some of the most powerful countries in the world, the ones most likely to use force outside their borders, have tended to be reluctant to accept the jurisdiction of international courts and tribunals.

Russia, the United States, Israel, and China have not accepted the so-called optional clause jurisdiction of the International Court of Justice. So there’s the substance, about the responsibility of states, and then there are the procedural aspects of whether these cases could be brought in court.

And Trump recently said everyone on the International Criminal Court should “resign immediately.”

Yeah, exactly. 

And what about the role of these military tech companies, like Palantir?

“At what point does Palantir become a good target under international law? Or at what point does Anthropic become a good target under international law, if its AI tools are being used to promote the war effort?”

Another issue [I’ve been thinking on] because of the questions we’re talking about is when the companies themselves become combatants.

We know that a private company that manufactures airplanes, an airplane factory, is a good target under international law. At what point does Palantir become a good target under international law? Or at what point does Anthropic become a good target under international law, if its AI tools are being used to promote the war effort? I think that question is about when the connection of these private companies to the war effort, in a way we’ve never really seen before, meets the standards under international law.

A civilian loses their immunity when they directly participate in hostilities, or if they assume what is known as a “continuous combatant function.” Are there arguments to be made that some of these private companies are participating in hostilities by virtue of supplying the tools the military is using to wage war? I think that’s a really interesting question.

SpaceX’s Starlink and Starshield satellite communications services have been restored in Ukraine, allowing the country’s forces to operate drones at high speed, Defense Minister Yevhenii Khmara said on Saturday.

“The Ministry of Defense’s monitoring systems indicate that Starlink/Starshield speeds have been restored,” Khmara told reporters in WhatsApp messages. “We are recording speeds exceeding 400 km/h, and the connection is stable.”

Since last week, Kyiv had been reporting speed limits on Starshield, Starlink’s military-grade service, affecting Ukraine’s ability to use drones and carry out defensive strikes. The throttling came amid growing tensions between Washington and Kyiv, with Trump blaming President Volodymyr Zelenskyy for the continuation of the war with Russia.

On Friday, Ukrainian officials told POLITICO that drones continued to lose signal at speeds above 160 km/h, despite U.S. President Donald Trump saying on Thursday that SpaceX CEO Elon Musk had “put it back.” British Prime Minister Andy Burnham raised the issue in a phone call with Trump on Friday.

“This outcome is of primary importance for the front line, our military personnel, the operation of drones, logistics, and communications,” Khmara said.

He added that the ministry of defense would continue to “monitor and track the performance of Starlink/Starshield.”

The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.        

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a months-long process coordinated by OpenAI, caused cyber agencies across Europe, the U.S., the U.K., Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard’s CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he’d shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he’d seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws. 

While he disputed that his actions would have caused problems for other defenders, Lorenc conceded that the evidential threshold in these coordinated cyber defense systems is a “grey area.” 

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale. 

The cybersecurity world’s long-established protocols helped prevent disaster scenarios, in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But now the scale and end-of-days potential of AI-driven cyber risks are visible for the world to see. 

This “is what happens when AI turns up a flaw that’s been hiding for years,” said Eylam Milner, co-founder and chief technology officer at cybersecurity start-up Echo. The vulnerabilities, he added, are “about as serious as it gets for the web.”

Origin story

Understanding how this week’s emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward. 

The origins of the incident can be traced back as far as April when top frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI’s autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide. 

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a longstanding practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing to the public, meaning they don’t hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.” PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was “disappointed” with Chainguard, it hopes to “rebuild trust with them in the future to ensure we can continue to collaborate effectively.”

After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks, giving it a high level of visibility over what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

One senior U.S. government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

“The fire department is fighting multiple fires at once,” the official said, adding: “The good news is they’re all one-story structures on fire, which the fire department deals with all day, every day.”

More to come

Dauntingly, OpenAI said there’s more on the way. “These bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. “As soon as the frontier models came out, that’s exactly what we said, this will be the trend,” he said. “And actually that’s happening now.”

Thomas Caspers, vice president of Germany’s cyber agency BSI, concurred: “We expect that [to be] happening more and more during the coming months.” 

AI also ramps up the risks once the flaws are out in the open. Cyber agencies’ recommendation that organizations take their websites offline was “really a drastic measure,” Caspers said. “We wouldn’t have done that a few years ago or so.” But because AI has made it quicker and easier to exploit flaws, “we had to do that,” he said. 

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

“It seems a little bit more complicated than expected to exploit,” he said. 

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

“There are three things that you have to do right now,” said van Amelsfort from the Dutch agency. “And that’s patch, patch, and patch.” 

John Sakellariadis contributed to this report.

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

Are we living through “Black October”? Maybe, according to cybersecurity experts who are raising the alarm about AI’s increasingly sophisticated and far-reaching hacking abilities. 

This week alone has seen a string of alarming incidents where AI uncovered previously unknown security flaws deep in the infrastructure of the internet. The most concerning involves something called PHP —  a programming language that, according to The Atlantic, is used by “as much as 70 percent of websites.” Cybersecurity researchers used AI to locate a major security breach in the technology.

It’s the kind of thing that, when it’s working, is practically invisible. When it stops, though, you really notice it: Government websites in the UK and Europe briefly went down earlier this week after the PHP vulnerability was discovered, as did some sites in the Wikipedia family, the Internet Archive, and many others.

The outages weren’t actually the result of a hack, but rather preventative action as web engineers took sites down to fix the vulnerability before it was exploited. But not every PHP-like issue will necessarily be uncovered before it can be exploited by someone using AI tools less ethically, and older websites relying on PHP might go unpatched. 

The problem doesn’t stop there, either: Concern is also rising around AI cybersecurity risks to ubiquitous conveniences like online banking. As Axios reported on Thursday, banks are detecting more and more “unauthorized third-party AI agents” operating inside of their systems. 

Those agents are mostly unauthorized by the banks, Axios explains — the holders of the bank account might have given them permission — but it still creates a security risk that executives described as “horrifying,” in part because banks can’t necessarily tell if an agent doesn’t have permission. 

It’s a lot to take in, all of it moving extremely quickly, and it’s hard to tell what any of us can do about it as AI labs continue to forge ahead with ever more competent AI models and agents. Luckily, my colleague Adam Clark Estes has some simple recommendations to shore up your own cybersecurity.

How do I respond right now?

One problem with hackers — even those that happen to be AI agents — is that they can be unpredictable. You won’t know to, say, lock down your Quest Diagnostics records before a breach happens. But whenever you find yourself wondering if your data is safe, that’s a good time to double check that you’ve at least covered your bases.

The National Cybersecurity Alliance, a nonprofit dedicated to the safe use of technology, maintains a list of basic online safety practices that everyone should follow. In no particular order, here’s what to pay attention to now:

1. Keep your guard up. AI makes it difficult to know the difference between humans and robots. It’s a fact of life in the year 2026. So be extra careful to avoid engaging in potential phishing scams. Don’t reply to unknown texts, and do due diligence on texts or emails that look like they’re from people you know but just seem off. Don’t click weird links. Don’t give out personal info over the phone, even if it sounds like it’s someone you know. They might be scammers using AI to clone a loved one’s voice.
2. Update your software. Yes, it’s annoying to pause your phone or computer use for a few minutes to update your software, but this is one of the best ways to get rid of vulnerabilities. Companies like Apple and Google employ huge teams of security experts to spot these in their software and fix them with software updates. Do the updates.
3. Use a password manager or, even better, passkeys. Each of your online accounts should have a unique password that’s at least 16 characters. Yes, it’s impossible to remember that many passwords, so you should also use a password manager like 1Password or the app built into your iPhone or Android device.
4. Turn on multifactor authentication. Just in case you don’t already do it, make sure you use multifactor or two-step authentication for all your accounts, including email and social media. It can be annoying to type in a code or check your email while logging in, but hackers, including AI agents, will have a much harder time getting into your accounts if you take this step.

Taking all these measures is not a one-time affair. You have to be vigilant in keeping yourself safe online. Security experts have a term for this that’s almost too specific: cyber hygiene. Like brushing your teeth or taking a shower, take good care of your online life, and do it often.

One link for later

➨ Is it still possible to ban gerrymandering? The current US Supreme Court is very, very hostile to getting politics out of congressional map-making. But if Democrats win back power, that doesn’t mean they shouldn’t try. My colleague Ian Millhiser gamed out how they could do it in a way that survives the Court — as well as some approaches that almost certainly wouldn’t fly. But, he writes, the real trick will be finding a solution that functions the way Congress wants it to and can’t be exploited by mapmakers.

Before you go…

• Did you know…that the disease multiple sclerosis is misdiagnosed with surprising frequency? As many as 15 percent of diagnoses could be false positives — including that of Christina Applegate, who found out this week that she does not have MS despite a 2021 diagnosis.
• Today’s trivia: Which noble gas is radioactive and has the chemical symbol Rn? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in Monday’s edition.)
• Yesterday’s trivia: We asked what the plural was for multiple Toyota hybrids. That would be Prii, which Toyota officially confirmed in 2011 after holding a vote.

Let’s be honest. Nobody spends $2,000 on a phone and expects it to break a few hours later. Especially if all you’re doing is opening and closing the device.

Well, Apple’s first foldable iPhone, the iPhone Duo, launched today. Of course, it didn’t take long before reports of cracked screens hit the internet, giving many people who can’t wait to dunk on Apple all the ammunition they need to make jokes online.

Photos of damaged inner displays, with cracks around the hinge, are already showing up on Reddit and the MacRumors forums. Some photos also show phones with bright lines stretching across one side of the screen. One iPhone Duo owner claims their phone lasted only 6 hours and fewer than 20 openings before it began showing signs of damage. Not ideal, assuming all of these photos/claims are real.

Everything We Know About the iPhone Duo’s Screens Already Cracking

So, are people really having issues with these new iPhones already? According to PhoneArena, Reddit moderators verified the Australian owner’s damaged phone and replacement after reviewing additional photos and Apple repair paperwork. They couldn’t confirm the cause. The cause of the failure remains unsolved.

Apple hadn’t responded to The Verge’s request for comment at the time of publication, though PhoneArena reported that the owner said an Apple Store technician called it a “day one manufacturing error.” Of course, that isn’t an official statement from Apple.

As for how many iPhone Duos are out in the wild and already damaged, that number also remains a mystery. Odds are this won’t end up resembling the Red Ring of Death fiasco Microsoft dealt with all those years ago, though.

The post The $2,000 iPhone Duo Just Launched, and Owners Are Already Reporting Broken Screens appeared first on VICE.

💾

A complaint I hear a lot from my millennial peers is that our parents didn’t teach us enough about money. I can say that personal finance wasn’t dinner table conversation in my house, and even as I went off to college and started fending for myself, it was almost a taboo subject. When it came to money, people either had it or they didn’t, and you definitely didn’t talk about it. 

Maybe this is why the average American isn’t exactly fluent in personal finance, and the situation is getting worse. Americans can only answer about 50 percent of basic questions about borrowing, savings, and risk on a financial literacy survey, according to a 2026 study by TIAA, a retirement services company. About a third of those surveyed said they have a hard time making ends meet and are debt-constrained. These figures have remained relatively unchanged for nearly a decade, but dropped to their lowest level in this year’s study. 

It makes sense: It’s hard to learn about money when it’s not taught in schools, and it’s such an intensely private topic. It’s also hard to make good financial decisions when you’re one of the growing number of American households struggling to pay bills, repay debts, and save for the future — and feeling very stressed about it.

In a perfect world, each of us could sit down with a financial adviser to get help — but most of us can’t afford that. Instead, average Americans tend to find personal finance tips on TikTok, in Reddit threads, by watching Suze Orman on YouTube or How to Get Rich on Netflix, or by Googling their questions. 

Now we have AI tools, too. 

With access to an internet’s worth of information and financial advice, ChatGPT, Claude, and other AI chatbots can answer any question you ask. They can help you put together a basic budget or, armed with your bank statements and the details of your student loans and your retirement accounts, tailor solutions to your specific situation. Or, at least, that’s the promise.

AI could create a more utopian, more equitable future, where reliable, hyper-personalized advice is just a prompt or two away for people who can’t afford to meet with an expert in real life. But machines are built by people, and there’s good reason to be concerned that these machines will simply replicate the biases and disparities built into our current system.

Here’s what experts say about how to make the most of these tools — and how to think about all of the inherent risks of uploading a lot of personal financial information to a chatbot or, worse, giving an AI agent the keys to your bank account.

The steep rise, risks, and rewards of AI financial advisers

Nearly 20 percent of Americans have used AI tools like ChatGPT for financial advice, and close to 25 percent for Gen Z adults and millennials have tried it, according to an August Gallup poll. These numbers could tick up too: In October, OpenAI started rolling out a dedicated personal finance tool to its ChatGPT Free and Go users in the United States, which effectively means anyone can try it. ChatGPT Finances lets you securely connect your bank account to the tool using a platform called Plaid, and then you can basically have a conversation with the chatbot about your real-time finances down to the penny. It’s like an AI-powered Mint (RIP) that you can talk to directly.

Regardless of where you encounter a chatbot or how much data you give it, experts say these tools could genuinely help improve financial literacy. You can talk to them about money problems you’re too embarrassed to discuss with friends and family, or ask questions and receive actionable, personalized information. There are real upsides to using AI this way.

Taha Choukhmane, an associate professor of finance at the MIT Sloan School of Management, has been studying outcomes when people turn to chatbots for financial advice. In general, these AI tools give pretty good advice, and that advice gets better as people become more practiced in asking the right question, according to research he published earlier this year. 

“We were actually quite surprised that relative to the status quo, the average American would be better off if they were to follow the advice,” Choukhmane told me. But he added a caveat: “Just following the advice without understanding the advice puts you at risk of not fully understanding the risk.”

But you shouldn’t trust everything a chatbot tells you and should verify everything before making any decisions. 

Chatbot advice has some significant limitations. First, it’s not impartial. The finance industry has a vested interest in steering you toward certain ways of managing your money, and that typically means selling you products, like loans. If you’ve ever searched for personal finance tips on Google, you’ve probably noticed that a lot of the top results come from banks and other financial institutions. This is by design, according to John Campbell, an economics professor at Harvard. But because AI is aggregating all of that advice, the specific influences and possible bias is less obvious. 

“AI is very promising for providing low-cost financial advice in plain English that will arguably be better than what many people would be able to do on their own,” said Campbell, who’s also the co-author of Fixed: Why Personal Finance Is Broken and How to Make It Work for Everyone. “One caveat is that chatbot advice is quite likely — unless a model has been carefully trained — to reflect the average of whatever’s being posted on the internet, and that may or may not be first-rate advice.”

An example Campbell gives is the question of when to start taking Social Security benefits. While you’re eligible at age 62, many economists agree that you should delay your benefits, which, based on the way the government calculates your monthly payouts, will allow you to enjoy much higher benefits later in life. But paid financial advisers can recommend starting as early as possible, since waiting longer reduces the amount of money that needs to be managed, which reduces the adviser’s fees. That means there’s a lot of conflicting advice online, much of it supplied by the finance industry. And that’s the information used to train AI models.

“The advice is much more mixed,” Campbell said. “And so if a chatbot is learning from that, it may not actually give the best advice.”

It can be hard to recognize bad advice anywhere in life, but especially when you’re talking to a machine that’s programmed to please you. A chatbot could encourage you to consider a balance transfer, to lean in on credit card rewards, or to refinance your mortgage — all decisions with upsides and downsides for you, but definite upsides for banks — without you realizing how much of its training data comes from the finance industry selling these products. What’s worse is that if you do end up taking bad advice, it might be years before you realize it. You won’t know that you refinanced a mortgage at a bad time until a better time comes along.

That leads me to the other major issue with using chatbots for money advice: People who lack financial literacy are the most likely to fall for bad advice, because they simply don’t recognize it as such. They also tend to be less wealthy, which means they can’t afford big mistakes. 

One way to mitigate risk, oddly enough, is to give the AI chatbot more personal information. The more details about your situation it has to consider, the more it can offer personalized advice. More context also means better advice, according to Choukhmane. 

“There’s a trade-off there,” Choukhmane said. “There’s real risk around privacy, and so I think everyone needs to find their level of control.”

Don’t assume your data is safe

Any time you’re talking to a chatbot, you’re putting a lot of trust in tech companies to take care of the personal details you’re sharing. Sending sensitive financial data is an especially risky proposition. While tech companies, including OpenAI, promise to keep your data secure, there’s already a long list of breaches, leaks, and privacy violations that serve as cautionary tales.  

It’s also impossible to know what tech companies might do with your data in the future. Most of them will use it to train their models, unless you tell them not to. Some of them will use the data to serve you personalized ads. 

Then there’s the risk of bad actors getting into your ChatGPT, Claude, or Gemini account. If you’ve been using a chatbot for financial advice and uploading your bank statements, a hacker could gain access to a stunning amount of information that could enable them to do all kinds of terrible things to your life. 

“They could steal your identity and open accounts and then quickly bankrupt a person,” said Delicia Reynolds Hand, a senior director at Consumer Reports. “It’s not even so much the primary underlying accounts that could be at risk, it’s more just access to this information.”

The steady march of AI progress is making this situation even more complicated. The previous era of chatbots offering financial advice is quickly bleeding into a new phase of AI agents logging into bank accounts on users’ behalf. If you’re using a tool like Claude Cowork or even an AI assistant like Muse, you can give an agent the login credentials to your bank account, and because the agent is operating its own computer, it can actually make transfers, apply for loans, or really do anything in your account. This is reportedly driving major banks wild, since they don’t know which logins are coming from humans and which are agents. And because we know that AI agents are unpredictable, it’s hard to know how that access might go wrong.

Beyond data security and privacy, you should also be aware of the simple fact that nobody’s really at fault if you end up losing money using these tools. Chatbots are not regulated in the way that human financial advisers, who have a fiduciary duty to act in your best interest, are. 

“If I get bad tax advice from H&R Block or a tax adviser, there are a clear set of rules and guardrails in place to manage what I can expect in that relationship and where the service they use has liability and where that liability ends,” Hand said. “Currently, that’s not the case for these tools.”

Trust but verify — and then delete your data

In the final years of the Cold War, Ronald Reagan popularized an old Russian proverb: Trust, but verify. The phrase is somewhat nonsensical, since trusting someone implies that you don’t need to verify what they’re saying, and verifying what’s said implies you didn’t trust them in the first place. But if you are willing to shoulder a bit of risk, consider approaching AI this way, especially when your life savings are on the line. I’d also suggest adding a coda to the phrase: And then delete your data.

Chatbots are not stand-ins for licensed financial advisers, he said, and you shouldn’t let them make decisions for you.

The great paradox with tools like ChatGPT and Claude is that they’re very good at generating truthy text. It sounds authoritative and looks correct — and usually is. Except when it isn’t. AI is famously unpredictable and prone to hallucinations. You can ask the same question twice and get two different answers. That doesn’t mean these tools are useless. It just means you have to approach them with caution. You have to interrogate these chatbots, challenge whatever advice they give you, and then crosscheck that with other, more reputable, sources. 

“If you’ve never used these tools, I would not encourage you to just change all your financial plans based on your first conversation,” Choukhmane said. “You want to be quite careful. Start using these tools, start understanding, ask a lot of follow-up questions.”

When it comes to mitigating risk, consider giving ballpark figures for your income or spending when you’re talking to a chatbot about your finances. Uploading financial documents, even if they’re redacted, is inevitably filling a tech company’s vault with your sensitive information without necessarily knowing what will happen to it next. You should also dig into your privacy and security settings to make sure you’ve turned on multi-factor authentication and that your personal data is not being used to train AI models and gets deleted after 30 days. 

Ethan Bloch, the product lead for ChatGPT for Financial Services, made a similar set of recommendations when I talked to him recently. Chatbots are not stand-ins for licensed financial advisers, he said, and you shouldn’t let them make decisions for you. They’re designed to inform and help you think through complex topics.

“You should liken it to just talking to a friend who has some very informed opinions about finance,” Bloch told me. “But if you’re actually making some large financial decision — your portfolio or retirement — you still need to seek out the help.”

Regardless of how experienced you are with chatbots or how much data you’re prepared to hand over, remember what Campbell, the Harvard professor, said. If your financial literacy isn’t great, AI chatbots can be trouble. And if you’re like most Americans, you could probably stand to learn a little bit more about things like mortgages and interest rates. 

Yes, Chatbots can be a good way to brush up on financial literacy. You can ask them the money questions you’re too embarrassed to discuss with friends and family. But you can also learn about money the old-fashioned way: Reading books and websites written by reputable, independent sources. The Federal Deposit Insurance Corp. has a portal of financial education resources, including games and quizzes. Khan Academy has a course that covers everything from credit scores to college savings. There’s a personal finance subreddit that I joined years ago and read almost daily. There are budgeting apps, like YNAB which has its own huge Reddit presence. 

Whatever you do to learn more about personal finance, simply doing something is progress. Talking about personal finance isn’t the taboo it once was in the US, and it’s even a required course in the vast majority of American high schools now. And while AI won’t magically solve your money problems, it can help get you started. Just be careful. Your livelihood could be on the line.

THE HAGUE — The European Commission should act “as soon as possible” to give clear guidance on U.S. sanctions against the International Criminal Court, its top administrative official told POLITICO in an interview.

Osvaldo Zavala Giler, who oversees the day-to-day functioning of the Hague-based court as the institution’s registrar, said his job became “preparing for sanctions” as the White House imposed an escalating regime of restrictions against it.

The Trump administration targeted prosecutors and judges from the court first in February 2025 before announcing blanket sanctions on Oct. 9 this year. The EU has repeatedly backed the Court against Washington, but it has resisted calls to activate a mechanism that would forbid firms from complying with U.S. laws.

That has agonized senior figures in The Hague. Zavala Giler said the Commission’s “lack of clarity” left private companies and NGOs in the dark over whether they should comply with sanctions decided by Washington — and what risks they face if they don’t.

Zavala Giler’s call to the Commission adds to pressure from EU lawmakers for a swift response after the Oct. 9 announcement. Kallas told the European Parliament on Tuesday that Brussels would use the next few months “to open dialogue” on the issue. The new sanctions are set to take effect in April next year.

“What I would hope is that the space for dialogue is not interpreted as a space for waiting to protect the court,” Zavala Giler said, who spoke from his glass office on the eve of a visit to the Court’s headquarters by the EU’s top diplomat, Kaja Kallas.

Damocles sword

Anticipating sweeping sanctions, the Court spent six months abandoning U.S. tech providers and moving to an open-source software environment, and 20 months to make its financial transactions dollar-proof. That move has been a huge undertaking for Zavala Giler’s team, he said.

The Court initially deepened its reliance on U.S. technology after it was hit by a massive cyber attack in 2023, but what seemed a solution at that time became a problem in the face of sanctions. Even though the current regime includes a carveout for telecommunications, there is no guarantee it will remain the case.

“It becomes a sort of Damocles sword on top of our head that could be revoked at any time,” Zavala Giler said. “I cannot count on U.S. tech companies anymore.”

U.S. platforms operate as entire ecosystems, offering all-encompassing solutions under a single contract. To do without them, “you need to start creating your own architecture and systems that need to speak to each other,” the registrar said.

Financial autonomy was equally hard to achieve. The Court mapped all its suppliers’ transactions to ensure there was no U.S. nexus, meaning that no U.S. person, bank or currency is involved in a payment. “We made all of our staff members have European bank accounts. It was a very detailed process that we had to do, person by person, company by company, making sure that the contracts were in euros,” the registrar said.

The Court also went from working with tens of banks to only “a few,” since only a handful of institutions are comfortable with dollar-proof payments.

Chilling effect

That situation is likely to worsen without clear guidance from EU countries and the Commission. As Zavala Giler put it, “if the International Criminal Court cannot transact in Europe, in euros within the SEPA zone with no U.S. nexus, then there is a bigger question about European financial sovereignty.”

The Court has long called the EU to use a legislative shield — known as blocking statute — that would forbid EU firms from complying with U.S. sanctions. The request was backed by dozens of lawmakers at the European Parliament, which incidentally awarded the court its human rights Sakharov Prize on Thursday.

The blocking statute “becomes an instrument to reassert the minimum space that should not be affected by unilateral extraterritorial sanctions … that minimum space should be, at the very least, the eurozone,” Zavala Giler said. Even without it, the court needs “the reassurances that, at least within the eurozone, [it] can continue to operate,” he added.

So far, however, the Commission has taken a cautious approach, choosing dialogue with the U.S. as a way of “buying time,” as a EU diplomat put it to POLITICO.

In a balancing act, EU heads of state and government backed Brussels’ diplomatic effort at their summit last week, while also committing to do whatever is needed to support the Court.

“I hope that now that the European Council has opened this door, the Commission will feel more comfortable in taking an extra step. And at the very least, providing some kind of clear guidance,” Zavala Giler said.

As an intermediate step, the registrar suggested the use of “comfort letters” reassuring firms that they should not comply with the U.S. measures.

Zavala Giler stressed that sanctions were not only a matter to address for banks and tech operators, as the current uncertainty has already affected NGOs working with the Court. NGOs play a critical role in supporting the work of the Court, for instance “to provide reparations for victims in Uganda” or “to assist the work of the court in providing assistance to victims in Ukraine.”

“This has created an enormous chilling effect,” he said. “They don’t know if they have the legal protections or not, to continue supporting the work of the court.”

The registrar’s office overlooks the moat circling the court’s six towers across the compound’s 46,000 square meters. In one of these buildings, the trial of former Philippine President Rodrigo Duterte over alleged crimes against humanity is due to begin next month. Reporters who will cover the proceeds won’t be allowed to use their phones — only paper and pen.

It is Zavala Giler’s job to oversee this huge institution, which relies on secure communications, cross-border funding for investigations and the contribution of many NGOs.

“This court has for victims the promise of the never again,” Zavala Giler said.

KYIV — Ukrainian interceptors still cannot use the internet at high speed to shoot down Russian attack drones or conduct mid-strike operations as of Friday morning, Ukrainian officials and a drone operator said, despite U.S. President Donald Trump saying SpaceX founder Elon Musk had lifted speed restrictions on his Starshield service.

“Morning tests show the speed limits of 140–160 km/h are still there, and the navigation isn’t working properly,” a Ukrainian government official told POLITICO on condition of anonymity.

“As of this morning, instances of connectivity loss at speeds of 161 km/h are still being observed. There is currently no confirmation that the restrictions have been lifted,” a defense ministry official told reporters on Friday.

Ukrainian drone units started testing speed limits from Thursday evening, shortly after Trump told reporters that Musk had restored Starlink. While some tests recorded speeds of up to 200 km/h over the Black Sea and noted an improvement, the drones still rapidly lost signal once flying above the 160 km/h speed limit.

“So, the key point is: We accelerate above 180 km/h, fly for a couple of minutes, the connection drops. It falls to 140–150 km/h and then is re-established — but the situation is better,” a drone pilot from Ukraine’s top drone unit known as Magyar’s Birds told POLITICO. “So it works better, but with constant connection interruptions,” the pilot, whose call sign is Leon, said.

The speed limit on Starshield, Starlink’s service designed for military purposes, stalled key operations and partially disabled crucial drone interceptors against Russian Shaheds attack drones.

Musk said that the U.S. government controlled Starshield, while U.S. Secretary of State Marco Rubio stated that the administration could not direct SpaceX or Musk regarding restrictions or slowdowns of Starlink services in Ukraine as it is a private company.

Ukrainian President Volodymyr Zelenskyy argued the Starlink restriction was a planned operation to specifically restrict Starshield’s operating speed over Ukraine. The Ukrainian government said that it was not told why that had happened for days. However, the Wall Street Journal reported Thursday that Trump had called Musk and asked him to lift restrictions.

“I don’t want to say. That’s a very interesting situation. My relationship with Elon is very good. I don’t want to comment on it, whether I called, or someone else called … The bottom line: he put it back,” Trump told reporters on Thursday evening.

U.S. President Donald Trump has the world’s war crimes court in his crosshairs.

By sanctioning the entire International Criminal Court, his administration is threatening its ability to function. Europe has rushed to the court’s defense — but can it actually protect it from American financial power? And how far is the European Union willing to go to confront Washington when it still relies so heavily on the U.S. for its own security?

Host Sarah Wheaton is joined by European Parliament lawmaker Dirk Gotink and Atlantic Council sanctions expert Lize de Kruijf to discuss Europe’s options, its dependence on the U.S. dollar and American technology and whether the EU can stand up for international justice.

If you have any questions or comments, send us a message on our WhatsApp here or at +32 491 05 06 29.

BRUSSELS — Centrist parties backing European Commission President Ursula von der Leyen clashed at Thursday’s European Parliament plenary over whether to hold artificial intelligence firms accountable for harm.

The EU executive had considered specific liability rules for AI in 2022, but withdrew these last year as part of the EU’s major simplification effort to make the bloc more competitive.

“To withdraw the AI liability directive was a big mistake,” said Alex Agius Saliba, a Maltese vice-president of the Socialists and Democrats, part of the majority coalition. “We strongly urge the Commission to bring forward this important piece of legislation.”

Thursday’s plenary debate, in which discussions centered on a global framework to regulate AI, showed strong tensions inside Europe between the centrist coalition backing von der Leyen. While the center-left pushed for new rules to address a series of AI-fueled hacking incidents, the center-right doubled down on simplification to ensure European companies can compete in the global AI race.

Socialist and Green lawmakers called for a new AI Liability Act in a bid to hold AI companies liable for harm done by their models, as with more traditional manufacturers’ products.

OpenAI CEO Sam Altman floated a similar idea for a new liability framework for companies whose models are capable of autonomous cyberattacks in the wake of this summer’s hack by autonomous OpenAI agents into another AI platform, Hugging Face.

“If a phone charger explodes in your house, we never call it innovative. We call it cheap, dangerous junk, and we hold the manufacturer liable for damages,” said Dutch Green European Parliament lawmaker Kim van Sparrentak.

She urged the Commission to “stop scrapping rules to please [U.S. President Donald] Trump” and come up with a “strong new liability act that covers the testing and the development of AI.”

The debate quickly descended into a fierce back-and-forth between key AI-focused lawmakers from von der Leyen’s centrist coalition.

“It feels [to] me like the Greens and the Socialists are living [on] a completely different planet than the rest of us when they are screaming for more regulation,” said Swedish center-right lawmaker Arba Kokalari, who led the work on the AI omnibus, which delayed a core section of the EU’s flagship AI law.

She said the EU already had a comprehensive regulatory framework — the AI Act — of which some parts are not even into force, and said the EU should focus on avoiding falling behind in the global AI race instead. She called for “less bureaucracy, more private investments, better access to data and computing infrastructure.”

Italian Social Democrat Brando Benifei, who led work on the AI Act in the previous mandate, snapped back that Europe should lead with new liability rules, “or we will need to wait for the next blogpost of a CEO to know what is happening.”

German Green lawmaker Sergey Lagodinsky also fired back at Kokalari: “What planet do you live on? Not on the planet where [AI] agents break out.”

International Partnerships Commissioner Jozef Síkela pointed out at the end of the debate that the rules were withdrawn because EU countries and European Parliament lawmakers couldn’t reach an agreement on them.

Cyberattackers have made “millions” of attempts to take advantage of a critical hole in a building block of the internet, a key cybersecurity provider said early Thursday.

Two top European cyber officials later told POLITICO that hackers have so far struggled to exploit the vulnerability.

Cybersecurity agencies worldwide continue to scramble to respond to the public revelation Wednesday of a flaw in PHP, a foundational computer programming language used to underpin 70% of the internet. 

Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks — giving it a high level of visibility over what hackers are doing — said in a post on X that it’s seen “millions” of “attempts to exploit” the flaw.

Cloudfare saw thousands in the 10 hours before the flaw was publicly announced, meaning information must have leaked, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

But Thomas Caspers, vice president of Germany’s cyber agency BSI, said in an interview that though his agency has also seen attacks, it has not seen any successful use of the flaw by hackers. 

“It seems a little bit more complicated than expected to exploit,” he said. “When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers.” 

Caspers is not certain why this is the case at this stage, but said it appears that successfully making use of the flaws is harder than expected. Global cyber officials were part of a process coordinated by OpenAI, to find and fix the flaws. “An ad hoc exploitation seems a little more difficult than expected,” he said.

The challenge for bad actors may also be linked to the major AI providers building guardrails so their tools can’t be used to exploit flaws, he said. When a POLITICO reporter as a test asked ChatGPT and Claude, models from OpenAI and Anthropic respectively, how to exploit the PHP vulnerabilities, both chatbots declined to provide the information. The two companies did not immediately respond to requests for comment. 

Numerous European government departments took their websites offline as a precaution to Wednesday’s developments. As of Thursday morning, key French websites such as the justice ministry and the data protection authority still featured a message they were undergoing maintenance. 

Matthijs van Amelsfort, the head of the Dutch cybersecurity agency, told POLITICO that his agency has no indication that the flaw is “actively being misused” but said that can change, particularly because AI makes it easier to exploit flaws. The agency took its website offline on Wednesday, but it is now back up.

This article has been updated.

An underground monorail, non-existent bizarrely skinny killer whales, directions to extinct attractions, guide maps that bear no resemblance to reality. AI-generated Disney theme park guide books are flooding the market, filled with hallucinated slop that would drive a trusting tourist insane with misinformation. — Read the rest

The post AI-written Disney guidebooks send tourists to rides that don't exist appeared first on Boing Boing.

BRUSSELS — Europe’s biggest media companies have asked regulators in Brussels and London to stop Meta from introducing new terms they say would let it copy publishers’ websites to build artificial intelligence, as a backlash that began in the U.S. spreads across Europe.

In a letter Monday, the European Publishers Council, whose members include POLITICO’s owner Axel Springer, called on EU competition boss Teresa Ribera and tech chief Henna Virkkunen to press Meta to put the terms on hold before they take effect Oct. 30.

The group wants Brussels to check them against EU copyright and competition law, and has requested an urgent meeting with the teams of both commissioners.

“The Commission remains committed to ensure that Meta’s practices fully comply with all applicable obligations under EU law, including competition rules and the Digital Markets Act,” Commission spokesperson Ricardo Cardoso told POLITICO, referring to the EU’s rulebook for Big Tech. He said Brussels was aware of both Meta’s changes and publishers’ concerns.

The U.K. competition watchdog has moved as well. British publishers have complained to the Competition and Markets Authority that Meta is so dominant they are compelled to accept its terms. 

The watchdog’s chief, Sarah Cardell, told British lawmakers on Tuesday that it had asked Meta to explain the changes and would meet the company on Wednesday. She named Meta as a possible candidate for Britain’s new rules for tech giants.

The terms cover businesses that use Meta’s tools to run Facebook pages, Instagram accounts or ads, which includes almost every newsroom. 

The fight began in the U.S. last week, when Nieman Lab, a journalism research outlet at Harvard, reported on the terms after receiving a tip from a small business owner.

As first written, they let Meta send automated programs to copy websites linked to those accounts and use the material to “train” its products, Nieman Lab concluded. There is no opt-out, and a business that continues to use Meta’s tools after Oct. 30 will be deemed to have consented.

Publishers say the terms would hand Meta content for free that other AI companies pay to license.

Rapid reaction

On Friday, Meta communications chief Andy Stone responded on X that the Nieman Lab report was “false” and that there was “no change to how Meta uses web crawlers.”

Stone said the update aimed to let Meta pull accurate product information from shopping sites for ads, not to scrape news sites. The company also said the crawling language already existed in other Meta terms and was just being gathered in one place.

Late Friday, however, Meta revised the terms and deleted the word “train,” saying the terms cover only its advertising and business products.

“We’ve heard you and want to clarify,” a spokesperson for Meta told POLITICO over the weekend, adding the change was “not about scraping news sites.”

Publishers say that changes little, however. 

Meta has given them verbal assurances that they can keep using its tools without surrendering their content to AI, but the terms themselves don’t guarantee that, the European Publishers Council’s letter says.

“Meta’s supposed Friday night correction is a farce,” said Jason Kint, who heads Digital Content Next, a U.S. publisher group whose members include Axel Springer. “Exactly what you’d expect from a gatekeeper notorious for abusing its market power.”

Others have gone further. 

“This is unscrupulous theft,” Germany’s newspaper and magazine associations said in a joint statement on Tuesday. They want Brussels to block the terms while it reviews them, warning that once articles are copied into AI systems, they can’t be clawed back.

Joseph Bambridge in London contributed reporting.

PARIS — The French government has called on leading online marketplaces such as Vinted and eBay to bar listings that include goods stolen during this weekend’s looting spree across France. 

“We expect these platforms to remove the listings in question without delay,” France’s Digital Affairs Minister Anne Le Hénanff wrote Monday in a post on X. “They will also be required to work closely with public authorities so that those reselling potentially stolen goods can be identified and prosecuted.”  

Le Hénanff and fellow cabinet members called a 7 p.m. meeting with representatives of Vinted, Amazon, eBay, Meta, and TikTok, as well as France’s leading independent reselling platform Leboncoin. 

During a government press conference earlier in the day, Minister for Small Businesses Serge Papin said officials were working on “coordination between investigators and online platforms” to identify the individuals behind suspicious listings. A specific protocol is expected to be put in place, according to a government source speaking to POLITICO. 

A spokesperson for Vinted France said the sale of stolen goods, or soliciting the purchase of such goods, is strictly prohibited on the platform. “We have a zero-tolerance policy on this matter,” said the company representative. “Since this past weekend, our teams have taken immediate action to identify and remove listings that may involve stolen goods, and we have stepped up our monitoring of suspicious listings.”

Other platforms weren’t immediately available for comment.

The discussions with the reselling websites are also likely to touch on longer-term questions around platform responsibility and the monitoring of illicit trade within the EU’s digital marketplace. 

The issue of looted goods sold on online marketplaces “is a new dimension and the Commission is happy to look at it in collaboration with French authorities,” European Commission spokesperson Thomas Regnier told POLITICO.

French Prime Minister Sébastien Lecornu has instructed local authorities to enact “partial curfews” Monday evening to prevent further looting and rioting. Papin said a “special support fund” will be set up to provide financial assistance to the estimated 3,000 local businesses affected by the weekend’s unrest. 

Eliza Gkritsi contributed to this report.

French presidential candidate Gabriel Attal reiterated his call to grant the government power to selectively block access to social media platforms to quell riots in the aftermath of widespread unrest across France over the weekend.

“You have young people at home who see their friends going out to loot, which gives the impression that they’re getting away with it; they see them on social media, and then they go out too,” Attal said in an interview with French radio station RTL.

Attal, a former prime minister who now leads French President Emmanuel Macron’s political party, said the measures must be “temporary” and “limited to the area where the riots are taking place.”

Saturday saw hundreds of thousands of protesters take to the streets nationwide across France, with students — who have been blockading schools in recent weeks to call for better study conditions, more teachers and more funding — joining trade unions and members of the public to protest the cost of living. While many protested peacefully, scenes of extreme violence also played out across the country. According to the latest figures from the interior ministry, some 2,000 people were arrested during the turmoil.

During Attal’s tenure as prime minister in 2024, France blocked TikTok access to one of its overseas territories, New Caledonia, amid widespread protests there. But France’s highest administrative court ruled that this suspension constituted “a disproportionate infringement of rights and freedoms.”

It’s unclear whether Attal’s latest proposal would survive a judicial review given that over the summer, France’s Constitutional Council, which reviews the constitutionality of French legislation, blocked a bill seeking to ban access to social media for under-15s after finding the legislation disproportionately infringed on minors’ right to freedom of expression and communication.

Such internet restrictions are more commonly associated with countries like China, Iran, Russia and, more recently, India. These countries either have permanent blocks on certain social media platforms or have more recently restricted them during protest movements, with India and Iran going so far as to block internet access completely.

Klara Durand contributed to this report.

They power our phones, cars, dishwashers—and the A.I. systems that prop up the economy. They’re also at the heart of fierce geopolitical rivalry.

BRUSSELS — NATO is beginning talks this month on the forces and weapons allies would need to defend against a Russian attack — and how they would pay for them.

The talks will set capability targets for 2029, requiring each of NATO’s 32 member countries to provide specific forces and equipment.

The deadline raises the stakes: European officials have warned that Russia could be ready to attack a NATO country by then.

At the same time, the Trump administration is weighing a sharp reduction in U.S. forces in Europe, which could leave the alliance short of troops and critical capabilities with fewer like refueling aircraft, long-range missiles and intelligence, surveillance and reconnaissance assets.

The negotiations will test how much each country is willing to spend, how much Europe can do without the U.S. and whether NATO’s military plans should make greater use of technologies such as robotics and artificial intelligence.

“It’s going to be tough,” said one senior NATO diplomat, who, like others, was granted anonymity to speak freely on the sensitive issue. “Burden sharing, the U.S., how to combine the level of ambition with political priorities … it’s huge.”

NATO allies will begin discussing the broad mandate for the new targets — known as Political Guidance — in the coming days. It’s the first step in a five-part effort called the NATO Defence Planning Process.

“The ambition … is for this to be a transformation cycle and not one that’s just off the shelf,” said French Adm. Pierre Vandier, NATO’s Supreme Allied Commander Transformation and the alliance’s chief for future warfare.

POLITICO spoke to 15 current and former NATO officials and diplomats to get a sense of the five key debates likely to define the negotiations.

1. Deciding on ambition

The most significant issue will be deciding exactly how many troops and military capabilities allies want to provide — known as the level of ambition.

Historically, NATO allies have agreed that beyond the forces needed for major operations, they should have 18 spare brigades — each a unit of about 5,000 soldiers — to carry out smaller crisis-management missions outside alliance territory, like Afghanistan or Kosovo.

But U.S. pressure to hand off more security responsibility to European allies — dubbed NATO 3.0 — could put pressure on allies to reduce or even eliminate requirements for any smaller operations.

Discussions will also cover whether to speed up the process itself in future in response to the furious pace of battlefield innovation, from AI to ground robots. 

Allies are also likely to tackle how to provide conventional military support — like ground troops or aircraft — to nuclear-armed countries like the U.K. and U.S.

“Conventional support … capabilities are absolutely part of the NDPP process,” said Nassima Barrows, NATO’s nuclear policy director, “so that is one of the big messages that we underline as a part of the next [negotiations].”

2. Filling the American gap

Looming over the talks is the Pentagon’s upcoming review of American forces in Europe. Washington earlier this year already pulled assets like strategic bombers, fighter jets, drones, submarines and warships from the pool of forces NATO can draw on.

The review lands in December, midway through the NATO talks, prompting concerns it may delay negotiations. There are worries that the U.S. could pull out assets Europe needs, like heavy transport aircraft.

Washington’s drive to curb its military presence in Europe will set off a scramble among allies to replace its capabilities. That will open discussions on how to share the burden fairly, likely to be very difficult as national budgets are increasingly squeezed.

“Not so long ago, the whole NATO process was … you do the math on what NATO needs, and then when you realize you don’t have everything, the U.S. fills in the gaps,” said Camille Grand, head of the ASD defense lobby and a former senior NATO official. “This is no longer the case.”

One way to tackle that is to shift away from specific weapons requirements to assigning objectives to countries, such as having their forces eliminate Russian command outposts. That could create more flexibility for European allies to who can’t access U.S. weapons like Tomahawk cruise missiles.

“We don’t have to have thousands of Tomahawks … but we can have thousands cheaper, low-cost alternatives,” said Fabrice Pothier, a former NATO policy planning director who is now CEO of the Rasmussen Global consultancy.

3. Regional divides

The focus on Russia is likely to cause friction with allies worried about other threats.

On paper, NATO espouses a “360-degree” approach to security. In practice, the alliance’s focus has shifted eastward since Russia’s full-scale invasion of Ukraine in 2022, and northward in the past year as it set up an Arctic mission (largely in response to pressure from Donald Trump over Greenland).

Some allies would like to see more attention given to the alliance’s southern and southeastern flanks. Issues include Russian mercenary presence in Libya, the potential for weaponized migration and increased submarine activity, alongside drone attacks on vessels in the Black Sea.

“There is too much north,” said a second NATO diplomat. “We should reset.”

4. More drones or more tanks

The drone warfare dominating the frontlines in Ukraine is likely to force a debate on the balance between adding unmanned capabilities and continuing to build up conventional military equipment like tanks and artillery.

Most allies are making plans to increase their use of unmanned systems.

The U.K. this year announced a “hybrid fleet” that leans on autonomous vessels like Type 93 uncrewed underwater vehicles. France has earmarked roughly €8.4 billion for drones and loitering munitions while Germany is establishing its first dedicated drone regiment next year.

Europe’s difficulties in recruiting soldiers also feed into the debate, said Grand. “One thing that is driving everybody in the direction of more unmanned [systems] is we have aging societies — we have a manpower issue.”

Countries also have to figure out how to match Russia’s technological developments without breaking national defense budgets.

Vandier said Russia produces 9 million drones a year, a figure that requires a “pretty radical effort” from the alliance. He suggested one fix could be a subscription-style model for hardware updates to keep weapons systems from becoming obsolete.

5. Learning from Ukraine

Most NATO allies agree that Ukraine contributes to their security thanks to its large and battle-hardened military and its rapid technological developments in air, sea and ground drones, air defenses, missiles, and its advanced Delta battlefield management system.

That has some countries calling for closer military and industrial cooperation, even as others urge caution because the war in Ukraine is different from NATO’s doctrine, which calls for rapid-maneuver warfare, air superiority and standoff precision strikes.

“There are tremendous lessons from the conflict that we need to capture,” NATO’s top commander, U.S. Gen. Alexus Grynkewich, told the European Parliament earlier this month. But “we do not want to fight that kind of war.”

The cyberattack last week that hit hundreds of French supermarket refrigerators had Europeans wondering if the nonstop warnings about AI risks had finally landed in the real world.

They hadn’t — at least, not yet.

Experts say the attack, which forced hundreds of retailers to throw away defrosted food and spoiled milk, was mostly a reminder of the importance of old-school cybersecurity in safeguarding essential goods and services.

The attack is a “typical example” of how “low-key cyber-enabled sabotage can affect very crucial supply for society,” said Ferdinand Gehringer, hybrid threats lead at FTI Consulting. 

It’s arguably the most consequential hack in the European Union this year, with tangible, disruptive real-world repercussions. France’s Prime Minister Sébastien Lecornu personally managed the fallout, which prompted coordination and information-sharing at the EU level. 

The perpetrators, whose identity and motives are currently unknown, hacked into digital systems to remotely raise the temperature of refrigerators in supermarkets including Intermarché and Carrefour.

One cybersecurity expert working with Lecornu’s office said the French government held meetings after the attack to try to map all the potentially affected sectors, beyond supermarkets. “We’re in the middle of the flu vaccination campaign,” he said, referring to vaccine storage, which also relies on temperature control solutions, though no such attacks have been registered.

To add to the fear and confusion, supermarkets in the Netherlands and Belgium experienced unrelated cyber incidents that same week. Though there was limited impact in those cases, they were a good example of “how big our reliance is in the food supply chain on IT and network systems,” Dutch food security minister Silvio Erkens told POLITICO. 

The attacks come after citizens and policymakers have spent months being bombarded with warnings about scenarios in which unpredictable advanced artificial intelligence models escape human control.

While most good and bad actors on the internet are increasingly using AI models to increase speed and capacity, cyber experts say the hackers in question in the French case most likely used traditional methods to take advantage of devices needlessly exposed to the internet.

Connecting devices to the internet in this way is “an old-fashioned bad practice,” said Amir Preminger, chief technology officer at Claroty, a cybersecurity company that identified a software flaw in a product made by Danfoss, one of the refrigeration companies targeted by the French hacks. Danfoss fixed that flaw in 2025. 

Food systems

The attacks come at a time when Europe’s food security is already under considerable pressure due to geopolitical insecurity and climate change. The continuing disruptions in the Strait of Hormuz are pushing up fuel and fertilizer prices at a time where farmers struggle with the fallout of extreme drought that caused lower yields in many parts of Europe. These problems are compounded by the blockade of the Black Sea which is fueling the rise of global food prices.

“It is very serious that cyber criminals attack our food systems,” said Else Groen, director general of trade body Independent Retail Europe. She nonetheless stressed that food supply chains are resilient, which reduces the chances that consumer food supply would be endangered — even if such attacks are already a “major blow” for retailers operating on razor-thin margins.

The incidents bring to the fore a long-running problem with so-called operational technology, meaning industrial devices with physical outputs, like refrigeration systems. Critical sectors are packed with these kinds of devices, many of which are old, poorly protected, unnecessarily connected to the Internet, or some combination of the three. They’re also obscure and sometimes forgotten, despite the ramifications if they’re tampered with.  

And last week’s problems are far from solved. French and German cyber authorities warned that attacks were probably still ongoing, and the Greek cyber agency and an industry tracker said after the attack that there were hundreds of devices still connected to the internet.

Preminger too said there are still devices exposed, though he added that the number is declining, and not all are necessarily vulnerable to attack. Another research group found that the number of exposed Danfoss devices had significantly decreased.

Finding a fix

What’s changed with the widespread diffusion of advanced AI models is that cyber attacks are now faster and easier to replicate. Claroty reproduced the original flaws in Danfoss products in 28 minutes at a cost of $6, it said. 

In broad terms, AI makes it easier to carry out many types of cyberattacks and enables attackers to pounce on software flaws more quickly. Financially motivated cybercriminals — who have already spent years extorting businesses and disrupting essential services like hospitals — can use AI to simultaneously launch attacks on multiple targets.

Though the motive for the attacks on French supermarkets remains unknown, it is notable that there was no reported attempt at extortion. The strike did come as Russia ramps up its campaign of hybrid warfare against Europe, and senior EU and European leaders have consistently warned that Moscow could use cyberattacks to disrupt real-world services. Beyond food supplies, AI-enhanced targeting could be aimed at banking, hospitals and the functioning of the internet itself.

Still, these fears of bad human actors using AI should be distinguished from the science-fiction scenarios pushed by so-called AI doomers, in which bots themselves are motivated and able on their own to wipe out humanity.

Digital security experts, including the EU’s own in-house cyber team, are also turning to AI for defense. But it’s not a silver bullet, said Rémi Enjolras, a chief technology officer at Splunk, part of Cisco. Critical industries need to stop “seeing AI as a magical tool that will solve everything and go back to the fundamentals,” he said.

The EU has passed laws intended to force critical industries and product manufacturers to get those fundamentals right. But France, for example, is lagging in implementing such national regulations, and there are few other incentives to get companies to do that difficult and costly work.

Still, the images of empty supermarket shelves could provide a new incentive. “It should serve as a kind of a wake-up call,” Enjolras said.

Émile Marzolf contributed to this report.