DIGITAL LIFE

Dublin Declaration and priorities for AI in Europe

The Dublin Declaration, adopted on October 14, 2026, by participating European Union member states, establishes seven priorities for cooperation toward the development of safe, reliable, and technologically sovereign artificial intelligence. The document seeks to align national policies in areas such as model safety, computational capacity, the use of AI in public services, and European technological autonomy.

The text, published by the Irish government on October 15, reflects a concern that extends beyond the mere regulation of artificial intelligence. Europe aims to strengthen its capacity to develop, deploy, and apply these technologies within a market where a large portion of the computational infrastructure and the most advanced models depend on international providers.

The declaration was agreed upon during an international summit on artificial intelligence held in Dublin, coinciding with Ireland’s presidency of the Council of the European Union.

Declaration reinforces international cooperation on trusted AI and supports Ireland's ambition to become a global leader in AI innovation and adoption

Minister for Enterprise, Tourism and Employment Peter Burke TD and Minister of State for Trade Promotion, Artificial Intelligence and Digital Transformation Niamh Smyth TD have welcomed the strong international engagement at the International AI Summit in Dublin and the support secured from EU member states for the Dublin Declaration on Trusted, Safe and Sovereign Artificial Intelligence.

The International AI Summit brought together government leaders, industry, researchers and innovators to discuss how countries can work together to harness the opportunities of artificial intelligence while strengthening trust, resilience and technological capability. Building on Ireland's ambition to become one of the world's leading locations for applied AI, the Summit highlighted the role AI can play in driving productivity, supporting innovation, improving public services and enhancing long-term competitiveness.

The Dublin Declaration, which was agreed in the runup to the Summit, sets out a shared vision for advancing trusted, safe and sovereign AI across Europe. It calls for closer cooperation between participating countries on AI adoption, skills, safety, digital infrastructure, research excellence and strategic technological capacity, while promoting international collaboration with trusted partners.

Minister for Enterprise, Tourism and Employment Peter Burke TD said, "Artificial intelligence represents one of the greatest economic opportunities of our generation. Ireland is determined not only to adopt these technologies, but to help shape how they are developed and applied. The Dublin Declaration reflects a shared commitment to ensuring that AI is trusted, safe and delivers real benefits for businesses, workers and citizens.

“Ireland is well placed to lead in applied AI. We have world-class talent, a strong innovation ecosystem, deep connections to global technology leaders and a proven track record of turning technological change into economic growth. Through the International AI Summit, we are strengthening partnerships that will help Europe and like-minded countries compete, innovate and prosper in the AI era." Minister of State with Responsibility for Trade Promotion, Artificial Intelligence and Digital Transformation Niamh Smyth TD said,

"The Declaration seeks to advance cooperation among Member States in strengthening AI safety and resilience, accelerating the adoption of trusted AI across our economies and public services, investing in strategic digital and computing infrastructure, supporting European innovation, and building the skills and capabilities necessary for long-term leadership in artificial intelligence.

 "The Dublin Declaration is a strong political signal of Member States’ shared commitment to reinforce and accelerate the important work already under way at European level.

 “Ireland's ambition is clear: to be at the centre of Europe's AI future, helping to shape an AI ecosystem that is innovative, competitive and grounded in trust."

The ministers also outlined progress under the government's Intelligence: Applied agenda, which aims to position Ireland as a leading location to develop, deploy and scale AI. Measures include initiatives to strengthen AI literacy, accelerate adoption across key sectors of the economy, support AI startups and scaling companies, invest in research excellence and build the infrastructure needed to support future growth. The International AI Summit forms part of the government's wider ambition under Digital Ireland to ensure Ireland remains a global hub for AI innovation and adoption, building on the country's strengths in talent, enterprise, connectivity, research and trusted regulation.  

The seven priorities of the Dublin Declaration...According to the document published by Ireland’s Department of Enterprise, Tourism and Employment, the participating countries have committed to cooperating in seven areas:

AI safety and resilience, with increased cooperation in identifying and managing risks associated with these systems.

Adoption of reliable AI, both within public administration and in the private sector.

European technological sovereignty, to strengthen the capacity to develop and utilize strategic technologies.

Infrastructure, skills, and computational capacity, through investment in both technical and human resources.

Sustainability, with a focus on the environmental impact of artificial intelligence technologies.

Innovation in the public sector, to develop new applications and improve services provided to citizens.

European and international cooperation, regarding governance policies and technological development.

These priorities indicate that governments are seeking to address two interrelated issues. The first concerns the safety of and trust in AI systems. The second aspect concerns the economic and industrial capacity required to develop these technologies and deploy them across various sectors.

Technological sovereignty is gaining prominence in European strategy...Technological sovereignty occupies a central place in the Dublin Declaration. The concept does not necessarily imply abandoning foreign suppliers; rather, it seeks to reduce dependencies that could limit the decision-making and operational capacity of European nations.

In the context of artificial intelligence, these dependencies encompass components such as specialized processors, data centers, cloud computing services, and models developed by companies based outside the European Union.

This concern was previously voiced by Christine Lagarde, President of the European Central Bank. In a speech delivered in September, Lagarde warned of the risks posed by Europe’s reliance on AI, advocating for the strengthening of computational capacity and the development of European-made models to safeguard the continent’s economic sovereignty.

Bolstering Europe’s computational capacity could provide companies and public institutions with more alternatives for developing and running AI systems. Access to infrastructure that is either homegrown or provided by European entities may also be crucial for organizations that handle sensitive information.

The declaration links this ambition to economic competitiveness. For the participating states, establishing rules on the use of artificial intelligence is not enough; it is equally essential to create the conditions that enable companies, researchers, and public administrations to develop and implement the technology.

This approach complements the European Artificial Intelligence Regulation—known as the AI ​​Act—which imposes legal obligations on specific systems and providers. The Dublin Declaration, by contrast, focuses on policy cooperation and the development of technological capabilities.

Civil society criticizes representation at the summit... The initiative has also drawn criticism regarding the level of participation by independent organizations in the European debate on artificial intelligence. In an analysis published on October 27, CDT Europe—an organization dedicated to defending digital rights—noted that the official agenda for the Dublin summit prioritized political and business representatives, failing to include civil society organizations or academics among the speakers.

According to the organization, this absence prompted civil society representatives to organize an alternative summit, focused on the perspectives of workers regarding the development and adoption of artificial intelligence.

Critics raise questions regarding how European priorities will be implemented. Decisions concerning infrastructure, data usage, security, and the application of AI in public services could have implications for fundamental rights, working conditions, and citizens' access to technology.

Consequently, the involvement of various sectors of society may prove significant as political commitments are translated into concrete programs and measures.

The European commitment does not yet define funding or timelines. Despite the broad scope of these priorities, the Dublin Declaration creates no new legal obligations, nor does it establish a binding schedule for the implementation of the measures.

Furthermore, the document lacks a common budget, specific financial targets, or dedicated oversight mechanisms. The national investments announced by Ireland during the summit are part of the country’s own strategy and should not be conflated with funding approved under the framework of the declaration.

In its official announcement on October 14, the Irish government presented the commitment as a means to strengthen cooperation among participating states and accelerate European initiatives already underway.

The Dublin Declaration on Trustworthy, Safe and Sovereign Artificial Intelligence is a policy document adopted by 24 European Union member states on October 14, 2026, during the International AI Summit in Dublin, under the Irish presidency of the Council of the EU.

Key objectives and priorities:

The declaration is not a new law or a legally binding treaty, but rather a strategic commitment to translate existing rules into practical capabilities. It outlines seven core priorities:

• Safety and resilience: Advancing cyber defense, incident monitoring, and the technical capacity to test advanced AI systems.

• Trustworthy applied AI: Accelerating the adoption of safe and useful AI in public services, industries, and critical infrastructure.

• European AI sovereignty: Ensuring control over essential data, knowledge, and technologies, while avoiding foreign dependencies.

• Infrastructure and skills: Investing in computational capacity (compute), data networks, and skills training.

• Sustainability: Ensuring that AI infrastructure is both energy-efficient and environmentally sustainable.

• Public sector innovation: Leveraging purchasing power and public procurement to drive the development of interoperable and trustworthy European technologies.

• International cooperation: Deepening partnerships within Europe and globally to align governance frameworks and practical projects.

The immediate significance of the Dublin Declaration is, therefore, primarily political. While the document identifies areas for government cooperation, it does not specify which projects will be funded, what resources will be made available, or when concrete results might emerge.

The term "Dublin Declaration" can refer to several different official or scientific statements:

• Dublin Declaration of Scientists on the Societal Role of Livestock (2023): A scientific consensus statement emphasizing the nutritional, environmental, and socio-economic benefits of animal agriculture and warning against generalized anti-livestock reductionism (The Dublin Declaration).

• Dublin Declaration on Trustworthy, Safe and Sovereign Artificial Intelligence (2026): A commitment adopted by participating EU member states on October 14, 2026, focused on AI safety, infrastructure investment, public sector innovation, and European AI sovereignty (DETE).

• Dublin Declaration on Maternal Healthcare (2012): A statement signed by medical practitioners asserting that direct abortion is not medically necessary to save a mother's life, used in global debates regarding abortion laws (Committee for Excellence in Maternal Healthcare).

• European Declaration on Global Education to 2050 (GE2050): Adopted during the Dublin Congress in November 2022 to integrate global education into learning systems (GENE).

• Dublin Declaration on Access to Environmental Information: A United Nations Environment Programme (UNEP) document relating to environmental transparency (UN Digital Library).

• Global Diaspora Summit Dublin Declaration: An outcome document focusing on diaspora engagement supported by the African Union and international partners (iDiaspora)

mundophone

 

TECH

Thermal energy storage could let nuclear plants flex with the grid

The increasing penetration of intermittent renewable energy sources (RES) introduces significant volatility to electric grids worldwide. While RES are crucial for global decarbonization, their variable nature creates a mismatch between energy supply and demand, necessitating flexible grid balancing solutions. However, large-scale baseload units, particularly nuclear power plants (NPPs), are traditionally designed for steady-state operation. To illustrate this challenge, Poland serves as a highly relevant case study as it exemplifies the conflict between inflexible baseload generation and a highly dynamic energy market. RES have a fast-growing share in Poland’s energy mix, reaching 36.6 GW (∼51% of total installed capacity) by the end of October 2025, a 3.5 GW increase over the end of 2024. While this expansion aligns with broader climate goals under the “Fit for 55″ European Union package, which aims for a 55% reduction in greenhouse gas emissions by 2030 compared to 1990 levels, it has also led to electricity grid stability issues. Renewable energy curtailment periods occur more frequently during periods of low demand or constrained transmission capacity – in 2024, 731.4 GWh of renewable energy was curtailed, compared to 74.4 GWh in 2023 and 8.4 GWh in 2022. This trend has intensified further, as curtailed renewable energy totalled 1347 GWh by the end of November 2025.

This results in wasted potential of installed RES capacity, their reduced profitability and higher average carbon dioxide emissions of grid electricity, but also forces coal and lignite power plants, designed for baseload operation, to work as grid stabilisation units, further reducing their efficiency and increasing their carbon footprint. The problem is likely to grow, as the capacity of weather-dependent power sources is expected to increase by 58.8 GW (178%) by 2040.

In 2024, Poland used coal-fired and gas-fired units for grid stabilization. Coal and lignite plants generated 105 TWh, approximately 63% of national electricity demand. Coal-fired power units can adjust their output with ramp rates of 2–4% of installed capacity per minute. They also have a technical minimum of 40–50% of their installed capacity and start-up times of up to 5 h, limiting their ability to balance intermittent RES generation. Coal-fired units are expected to be decommissioned by 2049 (with approximately 30% phased out by 2030), so cleaner alternatives are sought to replace them, such as combined cycle gas turbines (CCGT) and NPPs. Simultaneously, various energy storing solutions are considered to allow the use of renewable energy at a time other than when it was generated. Pumped hydroelectric storage offers large capacities, but is strictly limited by geographical constraints. Hydrogen generation incurs severe round-trip efficiency penalties, while sensible or latent heat storage (e.g., using molten salts) requires costly intermediate heat exchangers and complex plant redesigns. Battery energy storage systems (BESS) provide rapid response, however their operational lifespan is limited due to calendar and cyclic aging. The distinct advantage of adopting a direct-steam accumulator approach is its low-intrusion nature and working fluid compatibility as it utilizes the exact same medium as already used in the secondary circuit of an NPP, avoiding the need for construction of intermediate heat transfer loops.

Modern nuclear power plants, similarly to coal units, are classified as thermal power plants. They use steam as a working medium in the Rankine cycle for power generation and offer comparable ramp rates usually between 2.5–5% of their power capacity per minute (depending on their power output at a given time and progress of the fuel cycle). Their technical minimum can be as low as 20% of their installed capacity (with load cycling operation between 50% and 100% of rated power), but the time to reach full power depends on how they were shut down and their operation before the shutdown (related to reactor poisoning). Nuclear power plants are considered a low-emission energy source with a median lifecycle emission factor of 12 g CO2eq/kWh, comparable to values for onshore wind turbines (11 g CO2eq/kWh) and lower than for utility-scale photovoltaic (PV) installations (48 g CO2eq/kWh).

According to Poland’s energy system projections, generation III + nuclear power plants with a combined installed capacity of 6.2 GW will be introduced by 2040. NPPs are anticipated to operate predominantly at baseload, with minimal grid stabilization roles, due to high capital costs and concerns about possible accelerated component degradation from frequent load adjustments. Periodic shortfalls in renewable energy source (RES) generation will be addressed through three primary measures: 12.9 GW of storage systems, 0.8 GW of gas-fired peaking plants, and a significant overcapacity of RES installations (90 GW) relative to projected average demand (35 GW).

The feasibility of using variations in the power output of the plant's nuclear reactor has been explored for the Slovenian power grid – the results demonstrate promising capability to compensate for daily solar power fluctuations, but also highlight control challenges such as managing boron concentration and control rod movements, potentially affecting reactor stability and waste generation. Another, revenue-oriented analysis for the U.S. Southwest power grid showed that flexible nuclear power plant operation allows for higher integration of wind and solar resources and provides frequency regulation, therefore improving the profitability of nuclear plants.

Integrating thermal energy storage (TES) with NPPs could improve operational flexibility to address grid demand fluctuations or RES oversupply, while maintaining stable reactor output and avoiding excessive load variations. This method leverages NPPs as dispatchable power sources by stabilizing thermal output through secondary steam circuit heat storage, decoupling electricity generation from direct reactor operation.

Nuclear power plants were engineered to do one thing exceptionally well: generate electricity at a steady rate, around the clock. That design philosophy made sense for decades, but it is increasingly at odds with a grid that now shares space with solar and wind resources whose output rises and falls with the weather and the time of day. Researchers at the University of Central Florida’s Center for Advanced Turbomachinery and Energy Research (CATER) argue that thermal energy storage, or TES, could be the key to reconciling the two.

In a study published in the Journal of Energy Resources Technology, Part A: Sustainable and Renewable Energy, the CATER team paired thermodynamic modeling with an economic analysis of how nuclear plants could operate in a shifting energy market. The paper, titled “Molten Salt Reactor Dispatch Optimization via Thermal Energy Storage: Coupled Thermodynamic Modeling and Rolling-Horizon Economic Analysis,” examines how a molten salt reactor equipped with TES could be dispatched more flexibly than conventional nuclear plants allow. The research team included doctoral research assistants Augusto Delavald Marques and Abhilash Prasad, postdoctoral scholar Shinjan Ghosh, associate professor Erik Fernandez, alumnus Marcel Otto, and CATER director Jayanta Kapat.

The core problem the researchers set out to address is a mismatch between reactor design and grid demand. “Nuclear power needs to be flexible while nuclear reactors operate at a steady pace because grid demand varies throughout the day,” Marques says. “This is a challenge for power plants because they must adjust quickly to meet grid demand.”

Traditional nuclear plants are not built to cycle rapidly on and off. When demand drops, operators face an unattractive choice: deliberately ramp down output, which can place mechanical stress on equipment, or keep producing electricity that the grid does not currently need. Both options carry costs, and both become more frequent as weather-dependent renewables claim a larger share of generation.

TES offers a third path. Instead of forcing the reactor itself to follow demand, a storage system can absorb excess heat produced by the reactor and regulate how much of that heat is delivered to the power conversion side of the plant. When electricity demand is low, heat accumulates in storage; when demand climbs, the stored thermal energy can be drawn down to run the plant’s generation equipment.

The reactor keeps operating at the steady pace it was designed for, while the plant’s electrical output flexes to match the grid. The flexibility has a financial dimension as well. Electricity prices fluctuate through the day as supply and demand shift, and the researchers’ rolling-horizon economic analysis was designed to capture how dispatch decisions play out under those changing conditions.

“By storing the energy when demand and prices are low and using it when demand and prices increase, it can increase the value of the electricity produced,” Ghosh says. In effect, TES lets a nuclear plant sell its output when it is worth the most rather than when the reactor happens to produce it. The study’s focus on molten salt reactors reflects where the researchers see the opportunity.

“As renewable power generation grows, the need for flexibility in nuclear plants has become more important,” Marques says. “The deployment of next-generation nuclear reactors in the US over the next few years, such as molten salt reactors, is an opportunity to incorporate TES and improve the integration of nuclear and renewable energy on the same grid.”

It is worth emphasizing what the study does and does not show. The findings come from coupled thermodynamic modeling and economic analysis, not from an operating plant, so the results represent model-based projections of how a TES-equipped molten salt reactor could be dispatched and how such dispatch might affect revenue. Real-world performance would depend on factors the models necessarily simplify.

For a country investing in both advanced reactors and large volumes of solar and wind, the CATER team’s analysis suggests that the heat leaving a reactor does not have to become electricity at the exact moment it is produced. Stored as thermal energy and released on schedule, it could give nuclear power the dispatch flexibility that modern grids increasingly demand, without asking reactors to do something they were never designed to do.

The integration of Thermal Energy Storage (TES) systems with nuclear power plants is gaining momentum within the scientific community. Researchers from institutions such as the Center for Advanced Turbomachinery and Energy Research (CATER) at the University of Central Florida (UCF), MIT, and various national laboratories have been exploring the use of these technologies to revolutionize the role of nuclear energy in modern power grids.

💡 The problem with traditional nuclear energy...Conventional nuclear power plants are designed to operate under a constant-load (baseload) regime. The reactor core functions most safely and economically when it generates a continuous, stable flow of heat.

However, as the share of intermittent renewable sources (such as solar and wind) in the energy mix grows, electricity demand and prices fluctuate significantly:

• Damaging cycles: Forcing a nuclear reactor to rapidly ramp its power output up or down—a process known as "load following"—subjects equipment to thermal stress and shortens its operational lifespan.

• Negative prices: During periods of peak renewable energy production, nuclear power plants are often forced to sell electricity at very low—or even negative—prices, as they cannot be shut down quickly.

Integrating Thermal Energy Storage (TES) with nuclear power plants allows steady-state nuclear reactors to adapt to fluctuating grid demands and high levels of renewable energy without constantly ramping their internal heat production.

How nuclear-TES integration works:

• Decoupling Generation: Traditional nuclear plants struggle to cycle rapidly on and off. TES acts as a thermal buffer in the secondary steam circuit or heat loop, separating continuous reactor operation from real-time electricity generation.

• Absorbing Excess Heat: During periods of low electricity demand or high solar and wind generation, surplus heat or power is diverted to charge the thermal storage medium (such as molten salt or steam accumulators).

• Releasing Stored Power: During peak demand hours or when renewable output drops, the stored thermal energy is sent to turbines to generate extra electricity alongside the reactor's baseline output.

Key benefits:

• Reactor Stability: Keeps the nuclear core running at a constant, optimal output, avoiding mechanical stress from frequent load-following.

• Economic Value: Allows plants to store energy when electricity prices are low and dispatch it when prices spike, improving financial returns.

• Renewable Integration: Helps grids absorb variable wind and solar energy, preventing renewable curtailment and acting as a dispatchable low-carbon resource.

mundophone

TECH

What can quench the thirst of AI data centers?

Data centers have a thirst for water, and their rapid expansion threatens freshwater supplies. Only 3% of Earth’s water is freshwater, and only 0.5% of all water is accessible and safe for human consumption. Freshwater is critical for survival. On average, a human being can live without water for only three days. Increasing drought and water shortages are reducing water availability. Meanwhile, data center developers are increasingly tapping into surface and underground aquifers to cool their facilities.

Data center water usage closely parallels energy usage and carbon emissions. As data centers use more energy for their typical data center operations and to meet AI requests, they consume larger amounts of water to cool their processor chips, so as to avoid overheating and potential damage. Similarly, as energy use increases in data centers, so do carbon emissions.

A medium-sized data center can consume up to roughly 110 million gallons of water per year for cooling purposes, equivalent to the annual water usage of approximately 1,000 households. Larger data centers can each “drink” up to 5 million gallons per day, or about 1.8 billion annually, usage equivalent to a town of 10,000 to 50,000 people. Together, the nation’s 5,426 data centers consume billions of gallons of water annually. One report estimated that U.S. data centers consume 449 million gallons of water per day and 163.7 billion gallons annually (as of 2021). A 2016 report found that fewer than one-third of data center operators track water consumption. Water consumption is expected to continue increasing as data centers grow in number, size, and complexity.

According to scientists at the University of California, Riverside, each 100-word AI prompt is estimated to use roughly one bottle of water (or 519 milliliters). This may not sound like much, but billions of AI users worldwide enter prompts into systems like ChatGPT every minute. Large language models require many energy-intensive calculations, necessitating liquid cooling systems.

The expansion of artificial intelligence brings a challenge that goes beyond electricity: how to remove heat from servers without intensifying the competition for water. Researchers at the University of Texas at Austin have investigated an alternative to meet this growing demand. Instead of relying solely on freshwater sources, data centers could—following appropriate treatment—utilize brackish water, seawater, or water produced during oil extraction.

The study, published in the journal *Water Research*, evaluated desalination systems designed to produce low-salinity water for use in data centers. The work combines technical and economic analyses, exploring various treatment configurations.

The concept does not involve circulating contaminated water directly through the equipment; rather, the water must first be processed to achieve a quality suitable for its intended use.

According to the university’s announcement of the research, the necessary technologies already exist. Vaibhav Bahadur, one of the lead researchers, states that part of the problem can be addressed with currently available solutions, though their implementation comes at a cost.

Different technologies are suited to different conditions. The researchers examined reverse osmosis, mechanical vapor compression, and systems that combine both processes. In reverse osmosis, membranes separate salts from water under pressure. In vapor compression, the treatment involves evaporation followed by condensation.

The choice depends on the characteristics of the water source. The study considered brackish water, seawater, and water produced during oil extraction, which can have an even higher salinity.

The study also analyzed methods for managing brine—the concentrated liquid left over from the treatment process. Recovering more water reduces the volume of waste, but it requires additional energy and investment. Therefore, efficiency must be evaluated by considering both the amount of water obtained and the resources consumed to produce it. Higher salinity water may come at a higher cost... In one of the modeled scenarios, a hybrid system applied to seawater recovered 736 liters of fresh water for every 1,000 kilograms of water processed. The estimated cost was US$ 3.20 per cubic meter produced.

For oil-field produced water with higher salinity, another system showed a similar recovery rate, but at a cost of US$ 10.40 per cubic meter. Energy consumption was also higher. These figures correspond to the specific conditions analyzed in the study and do not represent universal price points.

Despite this additional expense, the researchers state that even the most intensive treatment options account for only a small fraction of a data center’s total energy consumption. Feasibility, therefore, depends on the combination of the available source, the chosen technology, and local conditions.

The oil and gas industry generates large volumes of wastewater. The possibility of treating this water for cooling purposes addresses two needs simultaneously: managing an industrial waste product and supplying facilities that require heat dissipation.

This connection could reduce the strain on water sources used by local communities. However, transforming waste into a resource requires careful evaluation of the treatment process and the final disposal of the resulting brine; one cannot assume that every source will be equally advantageous.

The study also proposes an indicator to estimate how the use of saline water affects the pressure on local water resources. The goal is to facilitate the comparison of different alternatives, taking into account the specific location where a data center operates.

Environmental analysis must also account for the water used to generate electricity. A study on data centers from the University of Texas highlights the distinction between direct water demand—within the facility itself—and indirect demand, associated with energy supply.

In that separate report, researchers estimated that the sector could account for between 3% and 9% of total water use in Texas by 2040, depending on factors such as growth, cooling methods, and the electricity generation mix. Although the context is regional, the issue is of interest to other countries that are hosting new facilities. Planning data centers requires balancing water availability, energy capacity, and treatment infrastructure. Desalination expands the range of options, but its benefits must be demonstrated for each individual project.

AI data centers rely on massive amounts of freshwater (primarily "blue water") and electricity for cooling and power generation. A single hyperscale facility can consume between 1 million and 5 million gallons of water per day—an amount comparable to the daily usage of a town with 10,000 to 50,000 residents.

Industry solutions and technologies are emerging to reduce or replace this heavy reliance on traditional water sources:

Alternative cooling technologies:

• Direct-to-Chip Liquid Cooling: Uses sealed pipes to circulate specialized coolants (such as water-glycol mixtures) directly over microprocessors, moving heat away without open evaporation.

• Immersion Cooling: Submerges entire server arrays into non-conductive, specialized dielectric fluids that boil on contact with hot components to absorb and transfer thermal energy in a closed loop.

• Closed-Loop Systems: Used by companies like Nvidia (via DSX systems), Microsoft, AWS, and Meta, which recirculate coolant and nearly eliminate direct makeup water needs, though they can shift some of the demand over to higher electricity usage.

• Hybrid Rear-Door Heat Exchangers: Capture and reject heat closer to the source to lower reliance on room-wide air or water conditioning.

Alternative power and water sources:

• Fuel Cells: Hydrogen and fuel-flexible fuel cells (such as systems from Bloom Energy) operate with significantly less water than conventional thermal power generation and can capture byproduct heat and water for local use.

• Strategic Siting and Water-Positive Operations: Moving data centers to regions with sustainable water supplies or implementing strict wastewater recycling and public reporting frameworks can cut future direct water footprints by up to 86%.

mundophone

DIGITAL LIFE

When talent doesn't fit into the algorithm

Many organizations adopt AI with the goal of creating a more objective hiring process and a more diverse workforce. Yet, paradoxically, these systems can undermine the very goals they are meant to achieve. Because AI learns from historical data, it can easily adopt and amplify past biases, systematically excluding qualified candidates from underrepresented groups. This reinforcement of inequality is one of the most subtle yet significant risks of AI in recruiting. This article explores how algorithmic bias manifests, how it can hinder your diversity initiatives, and what steps you can take to ensure your technology promotes fairness rather than perpetuating the status quo.

Key takeaways:

-AI learns from your company's past: Recruiting algorithms trained on historical hiring data will adopt and scale any existing biases. This can lead to the automatic rejection of qualified candidates from underrepresented groups, creating significant legal and reputational risks.

-Human oversight is your most critical safeguard: Technology should support, not replace, your team's judgment. The most effective strategy combines AI's efficiency with human oversight, ensuring a person makes the final call and can apply the nuanced context that algorithms miss.

-You must be able to prove your AI is fair: With regulations like NYC's Local Law 144 becoming more common, simply claiming fairness is not enough. Maintaining legal-grade evidence through regular, independent bias audits and clear documentation is essential for compliance and building a defensible hiring process.

Artificial Intelligence has brought to talent assessment the ability to analyze large volumes of information, recognize patterns and support decisions quickly and consistently. Its value is evident. The problem begins when efficiency becomes certainty and what technology can measure starts to define what is considered talent.

A person is never just the sum of the data they leave behind. Talent includes knowledge and experience, but also the ability to evolve, read context, judgement, creativity, adaptability, empathy and critical thinking. It reveals itself in the way someone reacts to ambiguity, learns from a new situation, influences others or finds an answer when the data is no longer sufficient. These are decisive dimensions, but not always easy to translate into variables.

This is where the limits of technology become most evident. An algorithm can identify regularities in past behavior and estimate probabilities of success based on similar profiles. You will have more difficulty understanding what motivates a person, the intention behind their choices, their maturity or the potential that they have not yet had the opportunity to demonstrate. You can recognize a skill without understanding the context in which it emerged or whether it will be transferable to another reality.

The issue becomes critical when models learn from historical data. Whether this data reflects past decisions, dominant profiles, or existing inequalities, technology can reproduce the same patterns with a semblance of objectivity. The bias could be in the data, the variables, or the success criteria. It can favor conventional paths, penalize less linear trajectories and exclude profiles capable of bringing diversity of thought.

The risk is not just in the algorithm. It is also in the trust we attribute to him. A numerical result or automated recommendation conveys a sense of rigor. But a probabilistic estimate is not a truth about a person. And a consistent process can produce fragile decisions if the criteria on which it is based are not questioned.

This does not mean removing Artificial Intelligence from talent assessment, but using it with clarity about what it can and cannot conclude. Technology can organize information, flag patterns, make the criteria that support the decision more explicit, and reduce some variability between evaluators, but it requires monitoring and the ability to review conclusions. Human judgment continues to be indispensable, not because it is infallible, as people project expectations and confirm beliefs, but because they are capable of interpreting context, questioning inconsistencies, integrating contradictory information and recognizing that two similar stories can hide very different potentials.

The answer is not in choosing between technology and people, but in designing processes in which both complement each other. Artificial Intelligence can expand analysis capacity, but it should not replace the judgment needed to make decisions about people. When talent does not fit into the algorithm, it is important to ensure that what is left out of the model is not also left out of the decision. The real challenge is not limiting talent to what the algorithm can recognize. It's ensuring that we continue to recognize what the algorithm doesn't see.

Risks of using Artificial Intelligence in talent assessment...Using Artificial Intelligence in talent assessment introduces major risks around bias, legal non-compliance, lack of transparency, and over-reliance on automation.

Key risks:

• Algorithmic and Historic Bias: Training data often reflects past human prejudices, causing AI models to discriminate against protected groups (such as age, gender, race, or disability). For example, research highlights that some automated screening tools disproportionately filter out qualified candidates from specific racial backgrounds.

• The "Black Box" Problem: Complex mathematical weights make it difficult or impossible to explain how an AI reached a specific candidate score or rejection decision.

• Lack of Job Relevance: Algorithms may mistakenly evaluate traits unrelated to job performance—like birth location, cadence of speech, or facial expressions—leading to flawed assessments.

• Regulatory and Legal Penalties: Global and local laws—such as the EU AI Act, New York City's Local Law 144, and Colorado's AI Act—classify HR and recruitment AI as high-risk. These laws mandate independent bias audits, strict human oversight, impact assessments, and heavy fines for non-compliance.

• Over-Reliance and Loss of Human Touch: Relying completely on automation removes empathy, contextual awareness, and nuanced judgment. This can alienate applicants and cause companies to miss unique talent that does not fit a rigid algorithm.

• Unvalidated Psychometric Models: Many AI-generated personality or behavioral tests lack proper scientific vetting, construct definition, or empirical validation.

• AI Hallucinations: Large language models can occasionally fabricate or misinterpret candidate credentials, producing inaccurate summaries and poor hiring choices.

Best practices to mitigate risk:

• Maintain Human Oversight: Use AI as a co-pilot to assist human recruiters rather than letting it make final hiring decisions.

• Audit Systems Regularly: Conduct independent, periodic bias and validity audits on your assessment tools.

• Focus on Job-Related Metrics: Ensure assessments measure actual work capabilities rather than inferred psychological or personal traits.

• Ensure Transparency: Inform candidates when automated tools are used and maintain clear pathways for appeals.

by mundophone

 

TECH

AI and religion: who defines the ethical values ​​of these models?

The relationship between AI and religion has taken on a new dimension as companies like Anthropic, OpenAI, and Microsoft seek input from various religious and philosophical traditions to guide the behavior of their models. This initiative aims to address a problem that engineering alone cannot solve: how should an artificial intelligence system act when faced with moral questions on which even human beings cannot agree?

An investigation by the Associated Press, published on October 25, 2026, examines this approach and identifies the risks of distilling complex religious traditions into principles applicable to computer systems. The challenge lies not only in finding common values ​​but also in ensuring that the attempt to reconcile them does not erase cultural differences or concentrate moral decision-making within a small number of technology companies.

Anthropic is one of the most well-documented examples of this approach. In May 2026, the company revealed that it had consulted with academics, religious leaders, philosophers, and ethicists from more than 15 religious and intercultural groups.

According to an explanation published by Anthropic, the goal is not to align its AI, Claude, with any specific religion. Instead, the company seeks to understand how various religious, philosophical, humanist, and political traditions approach questions concerning character, responsibility, and moral behavior.

This initiative stems from the recognition that artificial intelligence models interact with people whose values ​​and cultural frames of reference may differ profoundly. A response deemed appropriate in one society might conflict with the principles held by another community.

OpenAI has also held meetings with religious representatives, while Microsoft has promoted dialogue initiatives with such communities. Representatives from Google, Meta, and Amazon have likewise met with the Vatican to discuss issues related to technology and its impact on society.

However, these initiatives are not necessarily equivalent. Participating in a debate about ethics and religion does not mean that a company has incorporated the input gathered into its models.

The "Claude Constitution" and the gap between principles and outcomes—this discussion takes on a particularly relevant technical dimension in the case of Anthropic.

The company uses a document called the "Claude Constitution," which establishes the principles and behaviors it aims to instill in its assistant. The revised version, published in January 2026, addresses issues such as safety, honesty, accountability, and respect for human autonomy.

This document did not emerge from the religious consultations announced in May. Anthropic had already collected external input during its drafting process. The subsequent meetings are part of a broader program that may contribute to the evolution of the existing guidelines.

The company also experimented with a mechanism that allows the model to consult its own ethical commitments while performing tasks. In internal evaluations, it observed a reduction in misaligned behaviors when Claude had access to these reminders.

However, these results have a limitation. Anthropic itself acknowledges that it has not yet been able to determine how much of the improvement stems from the content of the reminders, and how much might be attributed to the mere act of interrupting the task—which prompts the model to reconsider its actions.

This distinction is crucial. The experiments do not demonstrate that religious contributions have led to direct improvements in Claude’s safety or behavior.

The definition of principles for AI models is also being discussed at other companies. In September 2026, Microsoft presented a draft code of conduct designed to keep AI under human control, featuring rules regarding corrections, oversight, and system deactivation. The document was submitted for public consultation and was not yet being used in model training at the time of its presentation. The company anticipates that a revised version will guide the future development of its AI systems.

Both approaches illustrate the gap that can exist between the definition of values ​​and their technical implementation. Publishing guidelines provides insight into a company’s intentions, but it does not guarantee that its models will adhere to these principles in every circumstance.

In the case of Anthropic, it remains to be clarified how recommendations from religious experts might be integrated into future versions of Claude, and what criteria will be used to evaluate their effectiveness.

AI and religion: the risk of homogenizing diverse traditions... The intersection of AI and religion raises concerns among researchers who study cultural diversity and the nature of religious traditions.

Webb Keane, an anthropologist at the University of Michigan, challenges the notion that religions can be reduced to sets of moral rules independent of the practices of their followers.

In an Associated Press article, Keane explains that this interpretation tends to favor traditions rooted in normative texts—specifically, the Abrahamic religions.

Other traditions place greater emphasis on communal practice, rituals, oral transmission, and the relationships among their members. Reducing these to abstract principles may strip away elements essential to understanding their true significance.

Paolo Carozza, a law professor at the University of Notre Dame and a member of Meta’s Oversight Board, identifies another issue. Combining teachings from various traditions could result in a homogenized morality, one that loses the distinct characteristics that define each culture.

In Carozza’s view, religious traditions evolve through historical and social processes, allowing them to incorporate external influences without necessarily losing their identity. An AI system that indiscriminately blends elements from different traditions may fail to preserve these distinctions.

This concern is particularly relevant when developing models intended for global use. Cultural diversity is not merely a matter of different answers to the same question; in many cases, the questions themselves, as well as the priorities and modes of moral reasoning, vary from one community to another.

Philosopher Meghan Sullivan, director of the Institute for Ethics and the Common Good at the University of Notre Dame, offers a more favorable perspective on the initiative by Anthropic. After participating in one of the meetings organized by the company, she highlighted the depth of the discussions and the genuine interest shown by the researchers involved.

According to Sullivan, the debates covered a wide range of topics—from the nature of human consciousness to the use of AI assistants in early childhood education. The philosopher’s involvement in this field extends beyond meetings with technology companies. In October 2026, Notre Dame announced her appointment as a consultant to a working group of the United States Conference of Catholic Bishops, dedicated to preserving human dignity in the age of artificial intelligence.

The participation of diverse communities can, therefore, broaden the knowledge available for the development of these models. The problem arises when this diversity must be translated into concrete decisions regarding a system’s behavior.

Who controls the values ​​embedded in artificial intelligence? The central question is not whether artificial intelligence should have safety rules; models clearly require mechanisms to reduce the risk of being used for fraud, cyberattacks, privacy violations, and other harmful activities.

The challenge lies in distinguishing these safeguards from broader decisions concerning moral, cultural, and social values.

When an AI assistant refuses a request, offers recommendations on personal matters, or sets boundaries for certain types of content, its behavior reflects choices made during its development.

These decisions may stem from the data used for training, the alignment methods employed, or the guidelines established by those responsible for the system.

In situations involving conflicting values, applying a single, uniform guideline can prove problematic. The balance between individual freedom and collective responsibility, for instance, is not interpreted the same way across all societies.

Consulting with philosophers, academics, and religious representatives can help identify these differences. However, it does not automatically resolve the question of who holds the authority to decide which principles should prevail.

There is also an issue of transparency. Although some companies release documents outlining the expected behavior of their models, it is not always possible to establish a clear link between external consultations, development decisions, and the outcomes observed by users.

Publishing ethical principles serves as a form of accountability, but it is no substitute for independent assessments of how those principles actually influence the behavior of the systems.

Technological safety should not imply moral standardization. While attempting to identify shared values ​​across different traditions can help develop models that are more sensitive to the cultural contexts in which they are used, it also carries the risk of collapsing complex principles into a uniform moral framework.

This risk does not necessarily mean that companies are deliberately seeking to impose a specific worldview. Rather, it means that the choices made during the development of these models may prioritize certain perspectives over others—even when the stated goal is to promote diversity.

There is a clear distinction between preventing a system from facilitating harmful activities and dictating the "morally correct" response to social issues on which legitimate, divergent viewpoints exist.

The former responsibility is directly linked to technological safety. The latter requires a broader discussion concerning pluralism, transparency, and public participation.

Engagement between AI companies and religious communities can contribute to this debate, but it should not be mistaken for the discovery of universal moral principles. The lingering question is to what extent users and affected communities will be able to understand, evaluate, and challenge the values ​​embedded in the systems they use.

If such decisions remain concentrated within the companies responsible for these models, artificial intelligence may end up reproducing a narrow view of human diversity—even if it was developed with input from various traditions.

Artificial intelligence and religion intersect through practical use, ethical alignment, and emerging spiritual behaviors.

Practical uses in faith communities:

• Administrative relief: Religious organizations and clergy use AI to draft newsletters, write community bulletins, summarize long documents, and translate announcements.

• Bespoke chatbots: Specialized faith-based tools—such as Magisterium AI, Ansari, and Ephrem—provide 24/7 pastoral guidance, study assistance, and religious text interpretation.

Ethical alignment and tech collaboration:

• Faith-AI roundtables: Tech companies like Anthropic, OpenAI, Meta, and Google have engaged with religious leaders (including representatives from Christian, Hindu, Jewish, Baha'i, Sikh, and Mormon traditions) to build better moral guardrails into large language models.

• Secular bias concerns: Studies from institutions like Brigham Young University and The Economist note that frontier AI models often display a strong secular bias, underrepresent spiritual contexts in personal dilemmas, or lean toward Western or homogenized viewpoints.

Synthetic spirituality and "artificial religion":

• Authoritative attribution: Because AI generates responses that feel personalized, real-time, and all-encompassing, users increasingly treat algorithmic output with a level of reverence or authority akin to religious practice—a concept scholars describe as "Artificial Religion" or "synthetic spirituality".

• Agentic belief systems: In experimental settings, autonomous AI agent networks have occasionally generated shared stories, symbols, or localized digital culture among themselves without human programming

mundophone

 

TECH

AI agents accelerate cyberattacks and shrink the time companies have to react

The use of artificial intelligence by criminals is accelerating digital attacks and increasing the pressure on teams tasked with protecting companies and online services.

According to a report by The Wall Street Journal, tools capable of automating stages of an intrusion are being used both by sophisticated groups and by attackers with little technical experience.

This shift involves so-called "AI agents"—programs that can execute sequences of tasks and determine subsequent steps based on the results they encounter. During an attack, these agents can help map out systems, identify vulnerabilities, and attempt to gain access to information.

A report from CrowdStrike, published this week, details four operations in which attackers employed AI agents to select actions and carry out stages of an attack, with varying degrees of human oversight.

Continuous security operations for faster defense...To address this new threat landscape, organizations are transitioning to continuous security operations models.

In these environments, detection, correlation, and response no longer function as separate activities but instead become part of an ongoing workflow.

The goal is not simply to automate more tasks, but to expand the operational capacity of security teams so they can keep pace with fast-moving threats.

In this model, AI acts as an extension of the security team. Context is built continuously, investigations progress in the background, and much of the initial analysis is already available before a security analyst gets involved.

This approach is especially valuable for MSPs, whose ability to scale operations depends on simultaneously managing a growing number of clients without a proportional increase in staffing.

Organizations are pivoting toward AI-driven continuous security operations models. Context building, activity correlation, and elements of the investigative process no longer depend solely on sporadic human intervention, but instead operate continuously.

The goal is not simply to automate more tasks, but to expand the operational capacity of security teams so they can respond more quickly and consistently in a fast-paced threat landscape. Reducing the time spent on repetitive investigation and contextualization tasks means security teams can focus their expertise on decision-making, oversight, and strategic response.

Time has become the new perimeter...AI is redefining the balance between attack and defense. As attackers leverage autonomous capabilities to accelerate intrusions, defenders need new ways to expand their operational capacity and respond at the same speed.

Consequently, security operations must evolve toward continuous operating models where AI is not merely an efficiency tool, but an active component of an organization's defensive capability.

Because in the era of autonomous AI, time is no longer just an operational metric. It has become the most critical asset in modern cybersecurity.

If you'd like to explore this transformation further, read our article "Security Operations Enter the Age of Native AI", where we examine how artificial intelligence is reshaping cybersecurity’s operational capacity and why time is now the deciding factor in modern cyber defense.

In our next article, we will also explore why operational capacity is emerging as one of the biggest challenges in modern cybersecurity, and how it is changing the way organizations scale their security operations.

Attacks on the healthcare sector in Argentina: An operator compromised at least 15 organizations. In one instance, credentials and medical information were stolen. The system utilized one "supervisor" agent to select tasks, while another agent executed them.

Targets in Brazil and other countries: An operator compromised government entities in two countries and targeted companies in Brazil and the United States. Their systems allowed the AI ​​to operate autonomously or distribute tasks among specialized agents. The report does not state whether the attempts against Brazilian companies were successful.

An attacker with limited technical experience: An operator used a set of instructions to guide "Claude Code" during intrusions. Although the operator had to intervene to bypass the model’s built-in security barriers and persist with the attempts, they ultimately succeeded in compromising government domains and private companies.

Theft of corporate data: A Russian-speaking group stole customer data from a U.S.-based provider of customer relationship management (CRM) software and compromised several other organizations. The agents were provided with a seven-step roadmap, yet they retained significant autonomy in choosing their methods for carrying out the intrusion. In another study, Microsoft identified attacks involving ARTEX, an open-source tool designed for security testing and vulnerability discovery. According to the company, the group known as Storm-0940 used this tool to automate attacks against hundreds of organizations across various sectors. In some instances, the attackers gained access to restricted functions within the victims' cloud systems in less than three hours.

This does not mean every attempt was successful. Microsoft states that most of the observed actions failed, though the group did manage to maintain unauthorized access to several organizations. The challenge, the company notes, is that the speed of automation leaves security teams with very little time to analyze alerts and block the intruders.

The pressure intensified this week with the disclosure of critical flaws in PHP—a technology that powers many websites. These vulnerabilities could allow an attacker to execute commands remotely on affected servers without needing to log in. Emergency patches were released on October 21.

Amazon reported that its monitoring systems detected an attempt to exploit these flaws on October 17, four days before they were publicly disclosed. Following the release of the patches, new exploit code appeared within hours and was almost immediately deployed against the company’s sensors. Amazon points out that it remains unclear whether all these attempts would have been effective against actual, live systems.

While AI can assist in identifying security issues, it can also facilitate the work of those seeking to exploit them. According to Amazon, using such technology to analyze security updates makes it faster and cheaper to figure out how to attack systems that have not yet been patched. This shrinks the window of time companies have to respond, requiring that critical vulnerabilities in internet-facing services be addressed within hours.

AI agents accelerate cyberattacks by automating vulnerability discovery in real time, shrinking the time companies have to react by executing exploits at machine speed—effectively removing the human factor from the process.

While traditional attacks rely on human operators to analyze networks manually and in stages, AI agents operate autonomously and continuously. This transforms the window for defense—previously measured in days or weeks—into a matter of minutes or seconds.

Below are the primary reasons why AI agents have revolutionized the speed and scale of cyber threats:

How AI agents accelerate attacks:

• Autonomous Scanning and Reconnaissance: AI agents scour the internet and corporate networks around the clock. They identify security gaps and misconfigurations instantly, without requiring human input at every step.

• Tailored Exploit Development: Using advanced language models (LLMs), these agents can analyze the code of a target system and generate malicious code specifically designed to exploit a particular vulnerability in real time.

• Hyper-personalized Phishing at Scale: AI eliminates common grammatical errors and creates highly convincing emails, messages, and voice clones (deepfakes). A single agent can interact with thousands of employees simultaneously, dynamically adapting the tone of the conversation.

• Adaptive Evasion: If an AI agent encounters antivirus software or an endpoint detection and response (EDR) system, it does not give up. Instead, it modifies its own code or behavior in real time to bypass the security barrier and continue the intrusion.

Why the time available for corporate response has shrunk:

• Machine Speed ​​vs. Human Speed: Human defenders must analyze alerts, validate whether a threat is genuine, escalate the issue, and make a decision. AI agents make decisions and spread malware across a network in milliseconds.

• Immediate Exploitation of Vulnerabilities (Zero-Day): As soon as a new vulnerability becomes public, AI agents can create and launch attacks globally—even before a company’s IT team has the chance to apply a security patch.

• Coordinated Mass Attacks (Orchestration): A single cybercriminal can deploy multiple AI agents to attack different parts of an organization simultaneously. Security teams become overwhelmed by hundreds of concurrent alerts, which paralyzes their ability to perform human-led triage.

A paradigm shift in defense... Given this landscape, traditional approaches—relying on signatures and human reaction—have become obsolete. To survive attacks driven by AI agents, companies are being forced to adopt defense systems that also utilize AI agents, capable of isolating networks, blocking traffic, and mitigating threats in a fully automated and autonomous manner.

mundophone

 

DIGITAL LIFE

iPhone spyware can infect devices without a single click

An investigation by cybersecurity firms iVerify and Report URI has revealed that iPhone spyware can be distributed through legitimate advertisements and websites—without the victim needing to click a link, install an app, or open a file. These attacks exploit vulnerabilities in older versions of iOS, allowing for the theft of passwords, personal data, and information from cryptocurrency wallets.

The investigation, released on October 21, 2026, and reported by Axios the following day, identified an infrastructure that leverages advertising and traffic-analysis services used by thousands of websites. Researchers estimate that the operation spans pages receiving approximately 135 million monthly visits, though this figure does not equate to the number of infected devices.

Zero-click hacks are a holy grail for attackers and catastrophic for victims, because they can automatically install malware on devices without requiring any interaction or missteps from the target. When sophisticated hackers have deployed rare zero-click attacks in recent years, they have often exploited vulnerabilities in mobile messaging and communication apps to infect victims. But attackers have also exploited the sprawling infrastructure of the online ad ecosystem to distribute malware, sometimes with little or no interaction needed from victims. Evidence of the zero-click spyware campaign that Citizen Lab’s researchers uncovered shows the two threats merging, underscoring the extent and urgency of the risk.

“AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet,” says Bill Marczak, a senior researcher at Citizen Lab. “Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.”

The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.

“The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario,” says Wolfie Christl, a senior Citizen Lab researcher.

During 2024 and 2025, Citizen Lab concluded that 45 devices belonging to the news outlet Al Jazeera were targeted with zero-click attacks delivered by ads. The researchers say that the targeted ads were issued by the Israeli-founded marketing firm Discover-Tech and distributed spyware attributed to the Israeli developer Candiru. Infected devices had contact with domains linked to Discover-Tech and then connected to infrastructure associated with Candiru, according to Citizen Lab’s analysis. (Al Jazeera, which participated in the investigation and shared device logs with Citizen Lab researchers, did not respond to a request for comment.)

“The ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem, and is perfectly suited to the mercenary spyware industry,” Marczak says. “Until this architecture changes, or ad companies get serious about customer vetting, we’re going to keep seeing this kind of abuse.”

Emails and messages sent to Discover-Tech and its CEO by WIRED did not receive a response before publication. Integrity Partners, which is believed to own Candiru’s assets, following sanctions by the US government in 2021, also did not respond to requests for comment.

Google, which operates one of the world’s largest advertising businesses, terminated Discover-Tech’s registration after collaborating with Citizen Lab and researchers from the cybersecurity firm Confiant and confirming a spyware link. “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies,” a Google spokesperson says. “We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.”

How iPhone spyware arrives via legitimate websites...The core of the investigation centers on an operation dubbed "DeadTag." According to an analysis published by Report URI, cybercriminals are acquiring expired domains that remain linked to legacy advertising and traffic-analysis tools.

Many websites retain references to these services long after they have stopped using them. Once a domain expires and is purchased by a third party, the new owners gain control over the code that those websites continue to load automatically.

It is precisely this reliance on external resources that the DeadTag operation exploits. By taking control of abandoned domains, attackers are able to distribute malicious content through pages that users perceive as legitimate.

In the identified cases, the system distinguishes visitors using iPhones and determines whether their devices contain known vulnerabilities. When it encounters a susceptible device, it can load tools capable of exploiting browser flaws to install spyware.

The investigation identified two such tools, known as "Coruna" and "DarkSword." Both exploit iOS vulnerabilities, though they target different versions of the operating system.

Coruna: targets vulnerable versions from iOS 13 through iOS 17.2.1.

DarkSword: targets vulnerable versions from iOS 18.4 through iOS 18.7.

These ranges correspond to the versions targeted by the analyzed variants; they do not imply that every device running these versions is necessarily vulnerable. Security updates already released by Apple are crucial for protection.

Exploiting vulnerabilities in browsers and internal operating system components is not a new phenomenon. In May, TecheNet reported that over 50 vulnerabilities had been patched in iOS 17.5—including flaws in WebKit and the kernel.

Attacks have also been identified on Instagram...The research was not limited to websites using expired domains. iVerify also uncovered a campaign that distributed a variant of DarkSword via a malicious advertisement on Instagram, themed around the FIFA World Cup.

According to iVerify’s investigation, the ad infected the iPhone of an employee at a client organization while they were browsing content on the social media platform. No click on the advertisement was required.

The same user was later targeted by another attack, this time involving a malicious connection and a different variant of DarkSword. The organization’s security team received alerts and was able to change the compromised credentials before they could be used to access the corporate network.

Investigators also discovered code linked to DarkSword on hundreds of online stores that used the PrestaShop e-commerce platform. The malicious software was hidden in directories with names designed to mimic traffic analysis tools.

The combination of these techniques demonstrates that cybercriminals no longer rely solely on fraudulent messages or fake applications to compromise mobile devices. It is enough for a vulnerable iPhone to load certain malicious content via a web browser or an application.

What attackers seek to steal...The analyzed variants of Coruna and DarkSword aim to obtain information stored on the devices—specifically, passwords saved in the iPhone’s credential management system, account data, and information related to cryptocurrency wallets.

Targeted applications include Coinbase Wallet, Binance, Trust Wallet, OKX, Bitget, and Exodus, among others.

Researchers also identified capabilities for collecting contacts, messages, and location data. This information could enable other forms of fraud or facilitate subsequent attacks against personal and business accounts.

The analysis points to primarily financial motivations. However, the identities of those responsible for the "DeadTag" operation remain undetermined. There are indications linking the operators of certain exploitation campaigns to Chinese-speaking individuals, though this does not confirm their nationality or establish a connection to any government.

How to protect your iPhone from these attacks: Although these tools have the capacity to compromise devices without direct user interaction, researchers emphasize that the attacks rely on specific vulnerabilities. An iPhone with the appropriate security patches does not necessarily face the same level of risk as a device running outdated software.

Apple has previously acknowledged the existence of attacks involving malicious content on the internet. In a security advisory published in April 2026, the company explained that it had investigated these vulnerabilities and released updates to prevent them from being exploited.

According to the manufacturer, devices running updated versions of iOS were protected against the attacks identified at that time. The company even provided patches for older models that no longer support the latest versions of the operating system.

Apple also offers specific mechanisms for users targeted by sophisticated espionage operations. In August, TecheNet reported on a new wave of alerts from Apple regarding "mercenary spyware," highlighting the importance of "Lockdown Mode" for individuals at heightened risk.

To reduce risk, users should take the following precautions:

Update iOS: Install available security updates by going to Settings > General > Software Update.

Keep apps updated: Use the latest versions of your applications and compatible web browsers.

Consider using "Lockdown Mode": This Apple feature is designed primarily for individuals who are at a higher risk of being targeted by sophisticated cyberattacks.

Check for signs of compromise: If there are concrete indications of an infection, seek a technical assessment and change any potentially exposed credentials using a secure device. The investigation also offers recommendations for website operators. These include removing code associated with services that are no longer in use, monitoring external resources loaded by web pages, and implementing security policies that limit the execution of third-party code.

The potential reach of the "DeadTag" operation warrants attention, but the figures must be interpreted with care. The 135 million monthly visits represent traffic to the websites identified within the analyzed infrastructure—not the number of iPhones that were actually attacked or infected.

The investigation’s primary conclusion is that espionage tools—previously linked to operations targeting specific individuals—are now being employed in broader criminal campaigns. In this context, keeping iOS updated remains one of the most critical measures for protecting personal data, even when browsing websites that appear entirely legitimate.

Zero-click spyware can infect iPhones and other Apple devices automatically without requiring the user to click a link, open a file, or take any action.

How zero-click attacks work:

• No user interaction: Unlike traditional malware that relies on a phishing link, zero-click exploits take advantage of hidden flaws in automatic data processing services.

• Common sectors: Attackers have historically exploited vulnerabilities through messaging apps like iMessage (using malicious attachments, PDFs, or PassKit images) and web-based traffic.

• Targeted Ads ("AdFection"): Recent research by the Citizen Lab revealed campaigns where real-time online advertising auctions were weaponized to inject spyware just by loading a website or opening an app.

• Mercenary software: State-sponsored groups and commercial spyware vendors (such as NSO Group with Pegasus) use these methods to compromise high-value targets like journalists, activists, and politicians, though cybercriminals have increasingly adapted similar exploit kits for broader financial theft.

How to protect your device:

• Update iOS promptly: Install the latest software updates immediately, as Apple frequently patches active zero-day vulnerabilities.

• Enable lockdown mode: Turn on Lockdown Mode in your device settings if you believe you are at high risk of being targeted by mercenary spyware.

• Review official guidance: Check Apple’s Support Page on Mercenary Spyware for step-by-step hardening recommendations

mundophone