TECH

Can your employer demand proof that you’ve slept well?

Fatigue in the workplace today is often brushed off as just "being tired." However, from a medical and safety standpoint, real fatigue or sleep-related impairment is a crucial physiological condition that can make an employee unsafe to work. The inability to stay alert is a serious risk not only for production but also for physical safety, whether caused by an acute illness, a chronic sleep disorder, or extreme stress.

In Australia, employees who realise that they are too tired to work safely are not seen as weak but rather responsible. Under Work Health and Safety principles, workers are expected to consider their fitness for duty and may need to step away from tasks if fatigue could affect safety.

On the other hand, taking time off must be supported by facts. Employers must be able to determine whether a medical condition caused a temporary inability to work, rather than a "rough night." Prime Medic is the place where we make the pathway smoother. Our AHPRA-registered doctors can conduct telehealth consultations to assess work capacity and consider whether documentation is appropriate, allowing you to focus on recovery while meeting workplace documentation requirements.

Too tired to work? Request a telehealth consultation to discuss fatigue-related work documentation without exposing yourself to the danger of driving to a clinic.

Fatigue and work safety or performance...The state of mental fatigue is commonly associated with slower reaction times and reduced concentration. It causes delayed reactions, impaired decision-making, and inattentiveness. In many sectors, this is not just an inconvenience but a real danger.

Safety sensitive jobs...The limit of being "unfit for work" due to tiredness is much lower in industries that are highly safety-dependent.

Transport and logistics: For truck drivers and other heavy vehicle operators, microsleeps can be fatal. Regulators such as the National Heavy Vehicle Regulator (NHVR) enforce strict fatigue management laws.

Construction and mining: Operating heavy machinery requires constant, high-level focus. Fatigue increases the risk of crush injuries or falls.

Healthcare: Medical professionals making calculation errors due to exhaustion can compromise patient safety.

Even in office settings, extreme fatigue significantly impairs cognitive functions such as memory, logical thinking, and emotional control, making it impossible to perform complex tasks. Awareness of fatigue risk factors can support workplace safety practices.

Sleep-related diseases necessitating medical documentation...Extreme tiredness is a symptom of several medical conditions. A doctor will be able to assess the individual's ability to function, in other words, whether they have the capacity to maintain wakefulness and concentration, which is the focus of the documentation, rather than the diagnosis itself.

Acute insomnia: An episode of sleeplessness, typically stress-related, which results in a person not being able to function the following day.

Sleep apnea complications: A time when a person requires an adjustment of their treatment, which causes them to be sleepy during the day.

Shift work disorder: The conflict between shifts and the body's internal clock requires a few days of rest for the body to recuperate.

In such situations, the doctor may assess whether reduced alertness is affecting your current work capacity. An online family doctor consultation enables a GP to look at your medical background and symptoms and consider whether absence documentation is appropriate.

Fatigue can be just as dangerous as drink-driving. That is why both researchers and companies are increasingly investing in technologies that can monitor and improve our sleep. But what happens if sleep is no longer regarded as a private necessity, but as something that can be measured, documented and optimised?

This is the question posed by three bioethicists from the University of Copenhagen, the National University of Singapore and ETH Zurich in a new commentary article in the journal Nature. The researchers warn that sleep technologies can bring significant health benefits, but may also challenge fundamental rights such as privacy and the right to self-determination over one’s own body.

‘Technologies that improve sleep have the potential to benefit health, wellbeing and safety. But we need to discuss now who will benefit from these improvements and who will have access to the data these technologies collect,’ says Sebastian Porsdam Mann, a bioethicist and legal researcher at the University of Copenhagen’s Centre for Advanced Studies in Bioscience Innovation Law.

From sleep monitoring to sleep enhancement...Millions of people already use watches and apps to monitor their sleep. At the same time, researchers and companies are working on technologies that not only track sleep but actively seek to improve it.

These may include headbands that send weak electrical impulses to the brain during sleep, or systems that play sounds at precise times to influence brain activity and promote deep sleep. The aim is to enhance the restorative effect of sleep and improve both health and performance whilst awake.

‘However, the evidence is still limited. Most studies have been conducted under controlled laboratory conditions, and the effects vary between different technologies,’ emphasises Sebastian Porsdam Mann.

Risk of surveillance in the workplace...If these technologies prove effective, they may quickly become attractive to employers, particularly in sectors where fatigue can have serious consequences, such as healthcare, transport and construction.

This raises ethical dilemmas:

The researchers point out that companies have previously attempted to collect employees’ sleep data. In 2016, two Dutch companies were investigated by the data protection authority for collecting activity and sleep data from employees. The authorities assessed that this constituted sensitive health information and that the employees’ consent could not be regarded as freely given due to the power imbalance between employer and employee.

According to the researchers, sleep technology may seem more harmless than other forms of performance-enhancing technology. Precisely for this reason, the pressure to use it may also be easier to justify.

‘It can quickly come to resemble a welfare provision. But when monitoring and performance enhancement are linked, there is a risk that voluntary schemes will gradually turn into expectations or requirements,’ says Sebastian Porsdam Mann.

Three proposals for responsible regulation...In the article, the researchers highlight three key principles for the future regulation of sleep technology.

Firstly, we should ask what is actually being improved and who benefits from that improvement. The aim should not be solely higher productivity, but also the sleeper’s overall well-being and health.

Secondly, regulations on sleep technology should be developed through public debate and democratic participation before the technologies become widespread.

Finally, access to effective sleep-enhancing technologies should be equitable, whilst protecting privacy and the right to opt out. Among other things, the researchers argue that people themselves should control access to the data generated whilst they are asleep.

‘Unless such safeguards are put in place, society risks sleep shifting from being a personal need to an institutional obligation,’ warns Sebastian Porsdam Mann.

Can your employer demand proof that you've slept well? No, your employer generally cannot demand proof that you have slept well, such as requiring you to hand over sleep tracker data or biometric logs. Labor laws and data protection authorities view sleep data as sensitive personal health information, meaning your boss cannot legally force you to track or share it.

However, there is a legal and ethical line between tracking your private sleep habits and ensuring you are fit for duty.

1. The legal boundaries of sleep tracking...With the rise of commercial sleep technologies (like smartwatches, headbands, and apps), bioethicists from the University of Copenhagen have warned about the growing risk of workplace surveillance.

• The Consent Issue: Even if a company introduces a "voluntary" wellness program that tracks sleep, regulatory bodies argue that employee consent is rarely truly voluntary due to the power imbalance between boss and worker.

• Precedent: Regulatory authorities have heavily penalized companies attempting this. For example, the Dutch Data Protection Authority previously investigated companies for collecting employee sleep and activity data, ruling it a severe violation of privacy laws.

2. When employers can intervene: Fitness for work...While an employer cannot monitor your bed hours, they do have a legal right and obligation to ensure workplace safety, especially in high-risk industries like healthcare, transportation, and construction.

If you are visibly exhausted or impaired, an employer can take action:

• Fitness-for-Duty Evaluations: If an employer has a reasonable, data-backed safety concern that fatigue is impairing your ability to work safely, they can suspend you or request a medical clearance note from a doctor.

• What a Doctor's Note Shows: A doctor's note only certifies whether you are medically fit to perform your job. Under privacy protections like the Americans with Disabilities Act (ADA) or regional labor laws, the medical certificate does not need to disclose your specific sleep metrics, diagnosis, or private habits to your boss.

The commentary has been published in the journal Nature under the headline ‘How tech-enhanced sleep could improve rest but erode privacy’. The authors are Sebastian Porsdam Mann (University of Copenhagen), Brian D. Earp (National University of Singapore) and Effy Vayena (ETH Zurich).

DOSSIER

TECH

Snapdragon 8 Elite Extreme Gen 6 hits 5GHz with neural fusion gaming, Wi-Fi 8

Today at its Snapdragon Summit event, Qualcomm is launching its next-generation flagship smartphone silicon with not one, but two new members of the Snapdragon 8 Elite family. The Snapdragon 8 Elite Gen 6 and top-end Snapdragon 8 Elite Extreme Gen 6 are both built on an unspecified 2nm process and introduce a new generation of Qualcomm's custom Oryon CPU, Adreno GPU, Hexagon NPU, Spectra ISP, and advanced connectivity hardware.

The two chips are extremely similar at the CPU and platform level, with the Extreme model distinguishing itself primarily through a more capable GPU and expanded multimedia capabilities. Both chips feature an eight-core Oryon CPU with two Prime cores running at up to 5GHz and six Performance cores running at up to 4GHz, along with 16MB of Qualcomm's new Oryon Flex Cache. Qualcomm describes the 5GHz Oryon design as the first mobile CPU to reach that clock speed.

Oryon CPU Reaches 5GHz...The Oryon CPU retains the basic two-Prime, six-Performance configuration used by previous Snapdragon 8 Elite processors, but Qualcomm has redesigned the CPU subsystem around a new cache architecture called Flex Cache, which provides a dynamically allocated shared cache pool that can be accessed by the heterogeneous CPU cores. Qualcomm says this allows the Prime cores to draw on the entire cache when workloads demand it, rather than being constrained by a fixed cache allocation. Larger working sets can therefore remain resident in the CPU cache instead of spilling into external memory, reducing latency and memory traffic as work moves between cores.

The Snapdragon 8 Elite Gen 6 and Elite Extreme Gen 6 both feature 16MB of Oryon Flex Cache. The Extreme model's CPU isn't simply a faster version of the standard Gen 6, then; both are specified with the same maximum CPU frequencies and cache capacity. The chips also support both LPDDR5X and LPDDR6 memory at up to 5,300MHz (10.6Gbps DDR), with configurations of up to 24GB of memory, as well as UFS 5.0 storage.

Qualcomm has not specified the memory bus width or resulting peak memory bandwidth for either processor, but the company does say that CPU performance improves 10% and 13% over last generation for the Elite and Elite Extreme, respectively. Those gains are broadly aligned with what we'd expect from a small clock bump and cache improvements. The more impressive detail is the efficiency story; Qualcomm says CPU power efficiency is up 37% over last-gen. Of course, that's mostly thanks to the move to 2nm, but it's still very impressive.

Hexagon NPU targets agentic AI...Qualcomm is putting much of the new generation's emphasis on the much-vaunted Agentic AI, where an AI system handles multiple steps, tools, and tasks rather than simply generating an answer to a single prompt. The revised Hexagon NPU features a new Element Accelerator designed specifically around transformer workloads alongside 12 scalar units, eight vector units, and one tensor unit. Qualcomm also lists Hexagon Direct Link, Micro Tile Inferencing, and 64-bit memory virtualization as features.

The chip firm says that the new NPU has a 50% larger shared-memory subsystem than the previous generation, although it didn't actually tell us the absolute size of that memory. The expanded local memory seems intended to keep model state, activations, and intermediate tensors closer to the NPU, once again reducing trips to external system memory. Qualcomm says the resulting architecture is designed for longer context windows, concurrent workloads, and low-latency "action loops" in which an agent can repeatedly reason, call a tool, process the result, and continue working.

The company is also positioning the NPU for much larger on-device models. Qualcomm says the platform can run Mixture-of-Experts (MoE) models with more than 30 billion total parameters, with roughly 3 billion routed parameters active for each token-generation step in its example. Because an MoE model doesn't execute all of its parameters for every token, that claim shouldn't be interpreted as equivalent to running a 30-billion-parameter dense model at its full computational cost; these are very different workloads.

For INT4 models, Qualcomm claims up to 50% higher prefill performance, along with faster decoding, enhanced speculative decoding, and higher overall tokens per second. The company is also emphasizing a broad INT2-to-FP16 precision range (including mixed-precision) as part of its effort to support different classes of local AI models.

The Hexagon NPU isn't the only AI processor in the platform, either. Qualcomm's new Sensing Hub includes "Dual Micro NPUs" as well as dual always-sensing ISPs intended to process sensor information of all types while keeping power consumption low. Qualcomm says the new Micro NPUs provide 85% more performance and 20% greater efficiency, while supporting models of up to 200 million parameters. The Sensing Hub also supports Qualcomm's Personal Scribe and the creation of personalized knowledge graphs. Privacy concerns aside, this sounds rather similar to a mobile version of Microsoft's Copilot for Windows 11.

Adreno adds dedicated AI hardware for neural fusion...The biggest generational improvements, as well as the largest architectural distinction between the two Snapdragon 8 Elite Gen 6 processors, both come on the graphics side. The standard Snapdragon 8 Elite Gen 6 uses a next-generation Adreno GPU (no name given) with Qualcomm's high-performance memory architecture, while the Elite Extreme Gen 6 adds dedicated Adreno Matrix Cores. Qualcomm describes the Matrix Cores as AI-dedicated GPU cores designed to run advanced AI models directly within the graphics pipeline, much like NVIDIA's Tensor Cores.

Those Matrix Cores are the foundation for Qualcomm's new Adreno Neural Fusion technology. Neural Fusion combines AI processing, performing super resolution and frame generation directly in the graphics pipeline. This will be familiar to most of the HotHardware audience, as it's directly analogous to NVIDIA's DLSS or Intel's XeSS. Qualcomm makes some bold claims about the quality and performance of Neural Fusion, and we're eager to test it ourselves. Notably, the technology is supported through Unity, Unreal Engine, and other development environments, allowing developers to integrate the feature without creating an entirely separate rendering pipeline.

The Extreme model's GPU also includes the full 18MB of Adreno High Performance Memory. Qualcomm describes HPM as a low-latency memory structure integrated closely with the GPU, keeping tiles, frame buffers, and compute data local to the graphics subsystem rather than repeatedly transferring that information through system memory. The new Adreno architecture uses three GPU slices, and Qualcomm says the combination of local memory and dedicated Matrix Cores is intended to reduce both latency and power consumption.

Performance-wise, the chipmaker claims 35% and 44% improved GPU performance over the Snapdragon 8 Elite Gen 5 for the Elite and Elite Extreme, respectively; these gains come along with an impressive 40% gain in GPU power efficiency, gen-on-gen. That means power actually goes down for the Snapdragon 8 Elite Gen 6, while the Extreme uses a bit more, although that's to be expected given all of the extra silicon present in that part.

The Elite Extreme Gen 6 also adds support for Unreal Engine 5's advanced graphics optimizations, including the new MegaLights feature, alongside hardware-accelerated ray tracing for Lumen global illumination as well as Nanite virtualized geometry. The standard Gen 6 retains support for the latter graphics technologies but does not receive the Extreme model's Neural Fusion feature set nor, apparently, support for MegaLights. We saw an Unreal Engine 5 demo running live on a demo unit at the summit and it looked very smooth, although it's not clear how much of that frame rate came from frame generation.

Spectra pushes mobile video further...Both processors feature Qualcomm's Spectra image signal processor with "triple 20-bit AI ISPs," real-time 3D LUT support through the Elite Color Engine, and support for a wide range of modern HDR sensor technologies. The image pipeline reportedly supports up to 64-megapixel triple-camera operation with zero shutter lag, up to 108-megapixel single-camera operation with zero shutter lag, and still-image capture at up to 320 megapixels.

The ISP also provides substantially more AI processing capability. Qualcomm specifies 16 bits of AI data per pixel, enhanced AI video segmentation at 4K60, and real-time AI skin and sky tone adjustments at 4K60. The system can perform AI-assisted noise reduction, including Bayer multi-frame processing, and supports ultra-low-light video capture at 4K60.

The Extreme model extends the platform's video capabilities substantially. Snapdragon 8 Elite Gen 6 supports 8K video recording at 30 frames per second and 4K slow-motion capture at 120 frames per second, while Elite Extreme Gen 6 raises those limits to 8K60 and 4K240. The Extreme model also adds support for the Advanced Professional Video codec, developed over years in close cooperation with rival Samsung.

The Spectra ISP can also work closely with Hexagon to provide considerably more granular AI information during image processing. Qualcomm describes this as providing up to 256 times more granular AI data per pixel, although the precise baseline behind that comparison isn't exactly clear. We suspect it simply refers to a move from 8-bit (256 values) to 16-bit (65,536 values) precision on the AI tag data, but that's not confirmed.

New connectivity for the 5G advanced era...Both Snapdragon 8 Elite Gen 6 platforms integrate Qualcomm's X105 5G Modem-RF system, which supports peak downlink speeds of 14.8Gbps and peak uplink speeds of 4.2Gbps. That's approximately 18% faster on the downlink and 14% faster on the uplink versus the previous generation X85 modem. The X105 supports 5G Advanced, both standalone and non-standalone operation, mmWave and sub-6GHz connectivity, up to eight mmWave carriers, six-carrier aggregation with up to 500MHz of downlink bandwidth (+25% over last-gen), four-layer uplink carrier aggregation, 1024-QAM on sub-6GHz, and six-antenna receive configurations.

Qualcomm also says the X105 is hardware-ready for 3GPP Release 19 and supports both NB-NTN and NR-NTN, providing a path toward satellite connectivity using cellular standards. An integrated fifth-generation Qualcomm 5G AI processor provides additional AI-based network optimization, while the modem supports global 5G bands and Qualcomm's Turbo DSDA multi-SIM technology.

The wireless connectivity subsystem gets an even more substantial upgrade with Qualcomm's FastConnect 8800. The new system supports Wi-Fi 8 and a peak PHY rate of 11.6Gbps, using a 4x4 design and high-band simultaneous multi-link operation. FastConnect 8800 also integrates Bluetooth 6.0, Bluetooth Channel Sounding, Qualcomm's High Data Throughput technology, Ultra Wideband, and Thread 1.4, making it remarkably versatile. Qualcomm is positioning these technologies as part of a broader effort to make the smartphone aware of its surroundings and its nearby devices, rather than simply providing higher raw wireless throughput.

Two flagships, one new platform...The Snapdragon 8 Elite Gen 6 family is really less about a dramatic increase in CPU speed than it is about broad improvements throughout the smartphone SoC. The new Oryon CPU reaches 5.0GHz and delivers up to 10% more performance on the standard Gen 6 and 13% more on the Extreme, while Qualcomm claims substantially greater power efficiency (37% on both). Even larger gains arrive elsewhere, with the Adreno GPU apparently improving by up to 44% and the Hexagon NPU by up to 35% on the Extreme model.

That performance split also explains why Qualcomm is offering two flagship platforms. The standard Snapdragon 8 Elite Gen 6 carries the new CPU, NPU, connectivity, and graphics architecture into a broader range of premium smartphones, while the Extreme adds dedicated graphics AI hardware, additional high-performance GPU memory, Neural Fusion, and higher-end media capabilities that many users may not want or need. Rather than making the Extreme a faster CPU, Qualcomm has elected to build a more capable accelerator-heavy platform for enthusiasts and power users.

Motorola is providing the first concrete example of that strategy with the "Motorola Signature 27," which it announced on stage at the Summit and which it plans to launch as one of the first smartphones powered by the Snapdragon 8 Elite Extreme Gen 6. The handset pairs Qualcomm's highest-end mobile silicon with an advanced multi-camera system including a 50MP Sony LYTIA 910 main sensor and 200MP periscope telephoto, seven years of operating system upgrades, a new Audio by Bang & Olufsen partnership, and a substantially upgraded ArcticMesh cooling system, which Motorola emphasizes considerably in its press release, signaling to us that the new chip can get pretty spicy.

The result is a Snapdragon generation where the most significant advances aren't necessarily visible in a spec sheet or technical readout. Qualcomm has increased CPU, GPU, and AI performance while targeting substantially lower power consumption, and it has added increasingly specialized hardware throughout the SoC to keep data close to the engines processing it. The coming generation of flagship phones will be the ultimate measure of just how much of that silicon can be translated into real-world performance, battery life, camera quality, and gaming experiences.

 

by mundophone

TECH

Apple iPhone Air 2 to get even thinner, despite battery upgrade

The second-generation Apple iPhone Air is set to receive even more upgrades than previously expected. According to the latest rumors, the flagship smartphone will be even thinner, but will still feature a larger battery, as Apple is reportedly opting for a battery with higher energy density.

For months now, rumors have been circulating that the successor to the iPhone Air will launch in spring 2027 with a range of exciting upgrades. Leaker yeux1122 has now learned that, despite several hardware upgrades, the smartphone is expected to become thinner by around 0.4 millimeters.

This would reduce its thickness from 5.6 to 5.2 millimeters, making the second-generation iPhone Air exactly as thick as an unfolded iPhone Ultra. Despite the thinner chassis, Apple is reportedly not making any further compromises on the battery. Quite the opposite, as a battery with higher energy density is expected to actually increase capacity. The exact battery capacity of the second-generation iPhone Air is not yet known, the current model has a 3,149 mAh battery. Combined with the more efficient Apple A20 Pro the iPhone Air 2 should deliver noticeably longer battery life.

According to earlier rumors, the second-generation iPhone Air will receive at least one more significant upgrade, namely a 48-megapixel ultrawide camera, which is expected to be installed alongside the 48 MP main camera. This would address one of the iPhone Air's biggest weaknesses, as the expensive flagship smartphone is set to offer at least as many cameras as the cheaper iPhone 17. The N2 chip for wireless connectivity and the C2 modem are expected to further improve battery life, while the iPhone Air 2 is also set to receive the smaller notch of the iPhone 18 Pro. As usual, such early rumors about new iPhones should still be treated with caution, as Apple's plans may change before launch.

mundophone

 TECH

Metallica’s high-tech show at the Sphere impresses fans

Metallica kicked off their residency at the Sphere in Las Vegas this Thursday (the 1st), combining some of the biggest hits from their 45-year career with the arena's massive technological capabilities.

For over two hours, James Hetfield, Lars Ulrich, Kirk Hammett, and Robert Trujillo performed a 16-song setlist that spanned various eras of the band.

However, part of the spectacle unfolded all around the musicians, reports *USA Today*. Known for the enormous LED screen that envelops the audience, the Sphere featured visuals created specifically to accompany Metallica’s songs.

During "The Shortest Straw," for instance, a massive skull with red eyes dominated the screen, while the band appeared inside a custom slot machine that featured guitar picks as the prize.

"Wherever I May Roam" was accompanied by a black-and-white video simulating a high-speed journey past landmarks around the world, including the Statue of Liberty, the Eiffel Tower, and Yankee Stadium. The visuals included roller-coaster-like dives, creating a sensation of movement within the arena.

Technology also played a role in the stage structure itself. Lars Ulrich used three different drum kits during the performance; they emerged at various points on the triangular stage to bring the musician closer to different sections of the audience.

"This is a dream come true—and more than that," Hetfield told the crowd. "After 45 years, there’s still a lot of fun ahead." Metallica’s Sphere residency will consist of 24 shows, spread across 12 "No Repeat Weekends." The concept is for each weekend's shows to feature distinct setlists, with no songs repeated between the two nights.

Metallica made their monumental debut at the Las Vegas Sphere last night, blending thrash metal with cutting-edge visual storytelling. The four-piece opened their 18-song set with the classic 'Battery,' utilizing the venue's massive curved screen to display haunting imagery, including ruined buildings and multidimensional monsters during 'The Call of Ktulu.'

Frontman James Hetfield praised the synergy between their loud, old-school sound and the venue's modern technology. The performance marked the beginning of a 24-show residency running through March 2027. These dates follow the 'No Repeat Weekend' format, ensuring fans get a unique experience every night with no overlapping setlists between shows.

The setlist covered everything from their 1983 debut to their latest 2023 album. Highlights included 'Sad but True', 'Nothing Else Matters', and 'Lux Æterna'. For event organizers looking for world-class production inspiration, this residency sets a high bar for live entertainment.

The band’s Sphere residency will see live staples and surprises spanning the Metallica catalog enhanced by the venue’s immersive technologies that will allow fans to experience the sound and fury of the band’s live performance in new experiential dimensions. Whether you’ve seen Metallica from the upper reaches of a stadium or arena, at an intimate club or theater gig or from the famed Snake Pit surrounded by the 360-degree M72 stage, Sphere’s technology, including the world’s highest resolution LED display that wraps up, over and around the audience; Sphere Immersive Sound, which delivers audio with unmatched clarity and precision to every guest; and multi-sensory 4D technology, will present a wholly unique and entirely new Metallica experience for all who attend — including James, Lars, Kirk and Robert.

Metallica co-founder/drummer Lars Ulrich commented, “About 12 seconds into the opening night of  Sphere with U2 back in ‘23, I thought ‘We have to do this, it’s completely uncharted territory!’ This residency gives us another chance to reinvent how we interact with our fans in a live setting. We are beyond excited to share this with the world in six months time, and way fuckin’ psyched to go next level!”

Metallica Life Burns Faster at Sphere is produced by Live Nation and presented by inKind.  inKind rewards diners with special offers and credit back when they use the app to pay at thousands of top-rated restaurants nationwide.  inKind also provides innovative financing to participating restaurants in a way that enables new levels of sustainability and success. 

Do you want to experience Metallica live at your event? Tributeworld books S.A.D. — Metallica Tribute (IT) — the professional Metallica tribute act for festivals, theaters, and events in the Netherlands and Belgium 

mundophone

TECH

AI agents breach Dutch vulnerability disclosure group using chained Zammad zero-days

The Dutch Institute for Vulnerability Disclosure suffered a breach on September 21 when AI-driven attackers exploited two zero-day flaws in its Zammad ticketing system, stealing email addresses of volunteer researchers and escalating to root access within seconds.

The Dutch Institute for Vulnerability Disclosure (DIVD) confirmed on Thursday that automated AI agents compromised its infrastructure via two zero-day vulnerabilities in Zammad, the open-source helpdesk platform the non-profit uses for support ticket management.

The attack took place on September 21. The attackers chained CVE-2026-102489 and CVE-2026-102490—both carrying a combined CVSS 4.0 score of 9.4—to hijack sessions, execute code as the local 'zammad' user, and escalate privileges to root in seconds. DIVD discovered the intrusion the following day, cut off access to its data center systems, and engaged the incident response firm Merlon Security.

The breach exposed email addresses belonging to DIVD's volunteer security researchers. The organization warned that this creates an elevated risk of social engineering, as attackers can now more convincingly impersonate DIVD personnel. Anyone receiving suspicious contact from someone claiming an affiliation with DIVD should verify the claim via communications@divd.nl.

DIVD acts as a CVE Numbering Authority and assigned the identifiers itself. CVE-2026-102489 affects Zammad versions 6.3.0 through 6.5.4 and 7.0.0 through 7.1.3, although the vendor states that the 7.x branch is not exploitable due to environmental conditions. CVE-2026-102490 affects all versions of Zammad. DIVD urges all users to upgrade to Zammad 7 or take the software offline.

The offensive against DIVD highlights the evolution in the use of automated agents that operate using language models and task-execution modules. Unlike conventional scans—which follow static scripts to test for known vulnerabilities—AI agents attempt to interpret server responses, generate commands in real time, and dynamically iterate through potential weaknesses. This approach produces exploit traffic with unusual signatures, combining various probing techniques within a short timeframe.

For companies and security teams in Brazil, the significance of this case lies in the large-scale proliferation of this attack methodology. Corporate environments with internet-facing services, legacy portals, or inadequately protected APIs become targets of continuous, unstructured testing; this overwhelms Security Operations Centers (SOCs) with false-positive alerts and increases the risk of compromise due to basic configuration flaws.

The incident did not stem from a single zero-day vulnerability with a registered CVE identifier, but rather from a sequence of brute-force attempts, command injections, and tests for known flaws orchestrated by the agent. Common vectors for this type of agent include directory enumeration, the submission of varied payloads via HTTP parameters, and attempts to exploit exposed credentials or API keys.

The primary factor determining whether such an attack succeeds—or simply generates noise—is the direct exposure of services to the public network without edge-based behavioral mitigation. Environments that maintain accessible administrative interfaces and outdated systems, or lack request-rate limiting rules, end up absorbing the full testing cycle generated by the offensive agent.

An intruder that narrated Its own moves...In an update on Monday, DIVD described the attack as “loud and very very messy”. The agent chose each next step itself, at speed and with sloppy logic. At one point its password spraying disrupted its own adversary-in-the-middle attack.

It also over-explained its decisions in its comments. DIVD believes the agent was poorly trained and badly configured for the job and the trail it left is enough for investigators to reconstruct the intrusion.

The way in was an ordinary vulnerability in a system DIVD has not named. It has ruled out Citrix NetScaler whose two zero-days CISA added to its Known Exploited Vulnerabilities catalogue on 27 September.

What DIVD has not said yet...The purpose of the attack is unknown and so is what, if anything, the attacker took. DIVD is withholding technical detail so that it does not disturb the investigation or expose other organisations running the same vulnerable system and says it will notify them as soon as it can. A fuller update is due on 1 October.

Treat the agentic AI attack label as DIVD’s working assessment until then. It rests on how the intruder behaved, not on a recovered tool or a named model and nothing has been published that outsiders can check. The people making the call analyse intrusions for a living which counts for a lot. It does not replace the evidence.

Spain, ENISA and Microsoft flagged agent-driven attacks in September...DIVD’s case is not isolated. In mid-September Spain’s data protection agency, AEPD, said it had received its first breach notification describing an attack carried out by an AI agent built on a known large language model. The agency has not yet verified the organisation’s account.

On 22 September ENISA published its Threat Landscape 2026 which assesses that AI will highly likely support malicious operations to a growing degree and that 2026 may see experiments with attacks that run without a human in the loop. Three days later Microsoft described agent-driven attacks by a group it tracks as Storm-3168. The group used compromised Azure service principals and targeted more than 100 storage accounts in a destructive stage that lasted seven minutes.

DIVD spotted the activity itself...The most useful line in DIVD’s first statement is the least dramatic one, it noticed the suspicious activity itself. An intruder that picks its own next move at machine speed shortens the gap between foothold and damage, and a weekly log review will not close it.

Patch internet-facing systems against actively exploited flaws first. DIVD’s attacker still needed an ordinary vulnerability to get in and the agent only took over after that.

Hunt for automation inside the network, not only at the edge. Password spraying from internal hosts and bursts of commands issued faster than any person types are the patterns DIVD’s account points to.

If DIVD contacts your organisation once its investigation ends, treat the message as an incident report, not a courtesy notice.

How to check...Defense and AppSec teams should analyze logs from WAFs, load balancers, and web servers for anomalous request patterns. The behavior of an autonomous agent often manifests as bursts of sequential calls to various endpoints using synthetically generated parameter values, alongside variations in HTTP header composition—such as User-Agent strings and custom headers.

At the internal detection layer, SOC analysts should monitor for clusters of HTTP 400, 404, and 500 errors originating from a single source address or from residential and cloud service network ranges. It is also crucial to correlate these network events with endpoint telemetry (EDR) from edge servers, looking for the execution of atypical child processes—such as command-line interpreters or operating system utilities—launched by web services.

Agentic AI fingerprints...DIVD researchers stated that the attack exhibited characteristics typical of an agentic AI operation—behavior they had never encountered before. The intrusion was "noisy and very, very messy," featuring automated decision-making at machine speed and "sloppy logic or patterns."

Log screenshots shared by DIVD show comments embedded in the attack scripts where the agent justified its own actions, explaining why its steps were "ok and really not phishing." Human attackers rarely annotate their own exploit code with moral reasoning.

"What human attacker leaves notes for themselves in their scripts?" DIVD wrote. "The AI ​​was simply given a task and keeps justifying its own actions in the code via comments. Who has time for that, anyway?"

Praised for transparent response...Security researchers praised DIVD's openness. Patrick Garrity of VulnCheck called it "brutal honesty" and noted that the organization is "eating its own dog food" by disclosing the issue quickly, allowing other Zammad users to apply fixes before being targeted. The DIVD reported the vulnerabilities to the vendor on September 24, notified the Dutch Data Protection Authority and the National Cyber ​​Security Centre, and discussed the incident with the police. The investigation is ongoing.

mundophone

 

DIGITAL LIFE

Sleep disruption increases preference for artificial intelligence

When a person’s biological sleep cycle falls out of sync with their daily schedule, the resulting fatigue can trigger feelings of social anxiety. To avoid the pressure of human judgment in this anxious state, people often prefer to be evaluated by artificial intelligence instead. These findings were recently published in the journal Computers in Human Behavior.

The human body operates on an internal biological clock that regulates sleep and wakefulness. Often, the demands of work, school, or socializing clash with this natural rhythm. Social jetlag happens when a person’s biological sleep cycle falls out of sync with these external time constraints.

A common example is staying up late on Friday and Saturday, sleeping in on Sunday, and then forcing oneself awake early on Monday morning. The resulting fatigue feels similar to traveling across time zones. This temporal misalignment does more than just cause daytime sleepiness. It can disrupt emotional regulation and make people hyper-sensitive to how others perceive them.

Researchers Xiaoyu Zhou, Yuxuan Chu, Liwei Zhang, and Jianping Liang of Sun Yat-Sen University wanted to know how this specific type of fatigue influences human behavior in the digital age. They hypothesized that social jetlag induces social anxiety, which is an intense worry about being negatively judged by others.

Artificial intelligence is increasingly stepping into evaluative roles across many industries. According to industry reports cited by the researchers, the vast majority of companies have integrated algorithmic tools into their hiring processes, and several dating applications claim to use AI to evaluate user profiles.

Because these algorithms are widely viewed as consistent, objective machines, being evaluated by an AI might feel less threatening than facing the subjective judgment of a human being. The research team suspected that people suffering from social jetlag might actively seek out these automated evaluations to cope with their anxiety.

To test this idea, the researchers conducted four interrelated experiments. In the first study, they recruited 250 participants and assessed their natural chronotype, determining whether they were biologically wired to be morning or evening people. The participants were then randomly assigned to complete a second survey at either 8:00 a.m. or 8:00 p.m. the following day.

If a natural evening person was forced to complete the morning survey, the mismatch between their biological clock and the required time served as an experimental induction of social jetlag. In the second survey, participants read a scenario about registering for a dating application. They were told the platform would evaluate their attractiveness to recommend potential partners.

The participants then had to choose whether they wanted this evaluation to be conducted by a human staff member or an AI system. The researchers found that participants experiencing social jetlag were substantially more likely to choose the AI evaluation. By contrast, those who completed the survey at a time that aligned with their natural clock showed no strong preference between the human and the AI.

The second study explored the underlying psychological mechanism by measuring social anxiety. The research team recruited 226 participants and calculated their real-world social jetlag by comparing the middle point of their sleep cycles on workdays versus free days. The participants then imagined passing a resume screening for a job and had to choose between being interviewed by a human recruiter or an AI recruitment system.

After making their choice, the participants filled out a questionnaire designed to measure their current levels of social anxiety. The results mirrored the first experiment: participants with greater social jetlag were more likely to choose the AI interviewer. The data also revealed that social anxiety acted as a statistical bridge between the two variables. Greater social jetlag was associated with more anxiety about being judged, which in turn was associated with a preference for the AI system.

For the third study, the team wanted to ensure that people were actually fleeing human judgment, rather than just acting out of laziness or a general distaste for social interaction. They recruited 240 participants on a Monday morning, a time when weekend-induced social jetlag is especially common. The setup was similar to the dating app scenario used in the first experiment.

This time, however, the researchers provided no descriptive information about how the AI or human evaluators operated, forcing a purely intuitive choice. Alongside social anxiety, the researchers measured the participants’ desire to avoid interpersonal contact and their motivation to complete tasks efficiently.

Once again, social jetlag predicted a strong preference for the AI evaluator, with 80 percent of the participants choosing the algorithm. The statistical analysis showed that social anxiety was the sole psychological driver of this choice. Neither a general desire to avoid people nor a need to be efficient explained the preference for AI.

The final study examined whether this preference depends on how people fundamentally view artificial intelligence. The researchers recruited 218 participants and presented a scenario involving an AI-based virtual app that evaluates a user’s clothing choices. The participants were split into two groups and given different descriptions of the technology.

One group was told the AI evaluated outfits objectively based on standardized data, while the other group was told the AI had learned subjective aesthetic biases and evaluated outfits emotionally. When the AI was framed as an objective and unbiased tool, participants with greater social jetlag reported a stronger intention to adopt its evaluations.

However, when the AI was described as subjective and capable of emotional bias, the effect vanished. The socially jetlagged participants no longer showed a greater intention to adopt the AI’s evaluations, suggesting that they were specifically seeking an escape from subjective judgment.

While the experiments demonstrate a consistent pattern, the researchers note a few limitations to their work. The studies relied on self-reported measures of sleep schedules and hypothetical scenarios. These methods may not perfectly capture how people behave in high-stakes, real-world situations.

Real-life evaluations often involve power dynamics that a survey cannot fully replicate. A real job interview, for instance, carries financial consequences that might alter how an anxious person weighs the benefits of an algorithmic assessment against a human one. Future studies could track actual user behavior on digital platforms to see if social jetlag predictably shifts real-world choices.

Researchers might also explore how other factors, such as a person’s baseline technical literacy or their general distrust of opaque algorithms, interact with their social anxiety. The current findings focus specifically on short-term sleep disruptions. This leaves room to investigate how chronic social jetlag, such as the fatigue experienced by permanent night-shift workers, influences decision-making over time.

When your biological sleep cycle falls out of step with your daily routine, the resulting fatigue can trigger social anxiety, making you more likely to choose artificial intelligence over humans for evaluations like job interviews or dating matches.

The science behind sleep and AI preference:

• Social Jet Lag: This mismatch happens when your internal biological clock clashes with external demands like work or school schedules.

• Triggering Anxiety: Fatigue from a disrupted sleep cycle increases feelings of social anxiety and the fear of negative evaluation by other people.

• Seeking Neutral Judges: To escape the pressure and potential bias of human judgment, tired individuals often prefer being assessed by artificial intelligence, which they may perceive as more objective.

• Role of Perceptions: If a person views AI as objective, the preference for AI evaluations during sleep disruption is much stronger

The study, “Too tired to be judged by humans: Social jetlag increases preference for AI through social anxiety,” was authored by Xiaoyu Zhou, Yuxuan Chu, Liwei Zhang, and Jianping Liang.

Sun Yat-Sen University

DIGITAL LIFE

Should quitting smartphones be this hard?

According to a Pew survey conducted this year, about half of U.S. adults say that they spend too much time on their phone. About a quarter say that they are on their phone “almost constantly” and, of the 45 percent who have tried decreasing their phone use, only 25 percent say they succeeded.

In the past five years, attempts to disconnect from the smartphone have abounded: There are communities dedicated to “dumbphones” (cellphones capable of little more than calling and texting) and similar low-tech gadgets; people attend Luddite festivals; weary workers go on digital detox retreats or try integrating a digital sabbath into their week.

Reducing smartphone screen time has been linked to both physical and mental health benefits. Stepping away from the screen can reduce eye strain and improve posture, and participants in social media detoxes have reported decreased feelings of anxiety, depression, and insomnia.

Despite the benefits, there hasn’t been widespread adoption. Why don’t these methods stick?

“The go-to when people are like, ‘Oh, I’m done with Instagram, I’m done with Facebook’ is just to delete it. They don’t have a plan,” said Gabriela Nguyen, Ed.M. ’25. She’s the founder of Appstinence, a free program “Created by Gen Z For All,” incubated at the Harvard Innovation Labs, that helps people “get off of addictive tech for good.” To her, the problem with other approaches is sustainability.

Nguyen receives emails from appstinent hopefuls explaining how they’ve tried, and failed, to reduce use in the past, their “process” essentially amounting to going to the store, buying a Nokia, and swearing off smartphones. When it doesn’t work in the long-term, “they feel like it’s a moral failing,” she said. “It’s not.”

Expecting to end smartphone dependency quickly is where most go wrong. Appstinence’s 5D Method — decrease, deactivate, delete, downgrade, and depart — is a guide for gradually weaning from social media and smartphones, created specifically with human psychology in mind. Take the second D, deactivate. According to Nguyen, Anna Lembke, author of “Dopamine Nation,” “basically describes how our reward cycle settings need about a month to reset behaviors.” That 30-day period aligns with the 30 days social media platforms like Instagram give you to reactivate your account before automatic deletion — the third D.

“Appstinence is not hard and fast self-optimization; it’s not an ‘I’m gonna regain focus and instantly get a six-pack’ kind of thing,” she said. “The overall method is supposed to bring people to a point where they’ve re-understood the way technology is supposed to work in their life.”

This thinking tracks with what Greg Epstein, humanist chaplain for Harvard and MIT, has been saying and writing about for more than 15 years. Author of “Good Without God” and “Tech Agnostic: How Technology Became the World’s Most Powerful Religion, and Why It Desperately Needs a Reformation,” he likens our relationship with technology to a reverent — and destructive — faith. He first faced phone addiction in 2006, when the Palm Treo was the center of his attention. He was able to curb his addiction for a while, but then came the pandemic. He realized that he was no longer in control of his relationships with his devices: “They were running me.”

Fifty-eight percent of adults under 50 have attempted to decrease time spent on their smartphone within the last year — Epstein included. He’s tried it all: dumbphones, e-ink devices, identifying as Luddite, even formal addiction recovery meetings. What worked best was interrogating the relationship itself. “We have agency to choose applications for technology,” he said, not the other way around.

And it isn’t an all-or-nothing decision. “Imagine if someone were to say, ‘I’m in a bad relationship romantically, and so therefore I shall never have another romantic relationship ever again,’” he said. “It’s like no, we want healthy relationships. Either make this relationship healthier by working on it or get out and find somebody else.”

Once people finally kick their toxic relationship to the infinite scroll, Nguyen says the next battleground will be in the workplace. “I hear from friends, family, and colleagues about how their companies have policies that AI is not optional,” she said. Between employers that force tech use and those that are laxer, Gabriela Nguyen(Iimage above) sees workers, especially young ones, choosing the latter.

But it won’t be as easy as telling your boss you’re cutting back on screen time.

“The model was that people went to work; they physically crossed a threshold,” said Sharon Block, professor of practice and executive director of the Center for Labor and a Just Economy at Harvard Law School. “They worked for X amount of time, and then they re-crossed that threshold and they weren’t at work.” Whether blue- or white-collar, that’s no longer the reality for most workers. “The law hasn’t been adapted to fit the blurring of that boundary between when are you working and when are you not.”

Progress toward redefining that boundary has recently come in the form of “right to disconnect” legislation. In 2016, France passed its “right to disconnect” law, giving employees the right to ignore digital communications from their employers after work hours. Similar laws exist in Australia, Italy, and Ontario, Canada, but despite these strides abroad over the past decade, a 2024 “right to disconnect” bill proposed in California was shelved without a formal vote.

Block says the chances of adoption in the U.S. are slim, given how “far behind” the country is in terms of worker protections. “Working people in the United States don’t have a [federal] right to paid sick days, what most countries in the world consider the absolute bare minimum for having a decent work-life balance.”

One potential avenue for work-life tech balance, Block says, could be charging a premium if employers require employees to respond to after-hours messages, similar to overtime. But, according to Block, when it comes to legislative priorities, the right to disconnect is likely low on the list. “Paid sick days and paid maternity, paternity, and family leave would come first.”

That doesn’t mean, however, that those working in labor law aren’t thinking about what tech is doing to workers.

“We spend some time here in the center looking at the impact that AI is having on the experience of work,” Block said. When she worked at the Department of Labor, Block juggled three cellphones: one personal and two for work. It couldn’t be called work-life balance, but it maintained something that remote and AI-infused workplaces can’t promise. “Most of my closest friends are people from work,” she said, “in part because I spent a lot of my career working such long hours, but I just don’t think I could have had those relationships if we were on Zoom screens all the time as opposed to actually sitting together, working, and seeing each other as full humans.”

So, there’s little stopping your job from taking over your personal devices and everything requires an app. It increasingly seems like there is no escape from the plugged-in lifestyle. But the defeatist outlook is why Nguyen, Epstein, and others interested in a low-tech future champion the agency we do have when it comes to technology.

“[Tech companies are] convincing us that we’re not adequate as we are and that everything has to be enhanced by godlike superintelligence in order to be valid or worthwhile,” Epstein said. “They’re prescribing to us a certain set of expectations, which are essentially to use tech all the time for everything forever. We’re saying no.”

The Harvard Gazette