Microsoft is promoting an initiative to discourage the use of SMS messages as a user authentication method. Recently, the company sent a communication to IT administrators, advising the suspension of this method in user verification to mitigate risks of cyberattacks. As an alternative, Microsoft suggests adopting passkeys.
It is quite common for two-factor authentication codes, recovery passwords, or direct access to be sent to users via SMS. However, security experts do not endorse this practice, since the content of SMS messages is transmitted in plain text format, which facilitates the capture of the code if the message is intercepted.
This interception can occur through malicious software or through social engineering tactics, where the attacker convinces the user to reveal the code. Additionally, Microsoft points to the emergence of artificial intelligence as an aggravating factor in this scenario.
In the email sent to administrators, which Windows Latest obtained access to, the company emphasizes that 'the age of AI demands stronger and phishing-resistant authentication.' AI has not generated new types of threats, but rather raised the level of sophistication and effectiveness of existing attack methods, such as the rapid creation of fraudulent pages in the name of companies using generative AI tools.
Microsoft announced that starting February 1, 2027, it will stop allowing SMS authentication in Entra ID, its cloud-based identity and access management service (formerly known as Azure Active Directory). Instead, the company recommends registering a passkey, a system considered more secure because it uses native device functionalities, such as facial recognition, fingerprint, or PIN entry, to confirm identity.
To facilitate this transition, Microsoft will notify organizations that use SMS or voice for authentication in Entra ID, requesting that they activate passkeys starting September 1, 2026. In addition to corporations, Microsoft is also taking measures to abandon SMS in authentication or account recovery intended for home users.
The Huawei Band 11, which was launched in March for the price of R$ 499, is available on Amazon for only R$ 235 for payments made via Pix. This offer corresponds to a significant discount of 53% off the original price.
This new smartband is compatible with both Android and iOS systems, making it an economical option for those who want to monitor their health and physical activities.
The device features a 1.62-inch AMOLED touch screen with a maximum brightness of 1,500 nits, ensuring data readability even under intense sunlight, as reported by Huawei. Its design consists of an aluminum alloy casing and a fluoroelastomer strap, resulting in a very light total weight of only 17 grams.
Regarding its functionalities, the band has features to monitor heart rate, SpO2 level, and perform detailed sleep analysis, covering everything from daytime naps to nighttime rest. The generated data allows the user to better understand their patterns and sleep quality.
In terms of physical aspects, it offers precise tracking of over 100 workout modes. Furthermore, the Huawei smartband, considered one of the best current smartbands, has a battery life of up to 14 days with moderate use, surpassing the duration of many more sophisticated smartwatches and eliminating the need for daily charging. The magnetic charging process requires a voltage of 5 volts.
The Huawei Band 11 also has a water resistance rating of 5 ATM, allowing safe use in environments such as pools or during rain, although it is not recommended for diving or hot baths. Additionally, the smartband supports Wi-Fi and Bluetooth 6.0 connectivity.
Interested parties can take advantage of this opportunity to acquire the Huawei Band 11, a lightweight accessory ideal for continuous use, aiming to monitor health and physical exercise for R$ 235 via Pix, while it is on sale on Amazon.
Chinese company Z.ai announced on Friday (the 14th) that its artificial intelligence model GLM-5.3 demonstrated slightly higher scores than Anthropic's Mythos 5 in a test aimed at identifying software vulnerabilities. This result places Chinese technology among AI systems capable of performing complex tasks in the field of cybersecurity.
Within the CyberGym assessment, which measures the ability to analyze code, find errors, and confirm their exploitability, GLM-5.3 scored 84.5% compared to 83.8% for Mythos 5. However, these figures were published by Z.ai itself and have not yet undergone independent verification.
The Chinese model's advantage disappeared at a stage closer to practical attack execution. In the ExploitBench test, the Z.ai model scored 54.4%, while the Anthropic system achieved 78%, indicating that Mythos 5 maintains a significant advantage when the task requires converting identified vulnerabilities into actual exploits.
Z.ai plans to make GLM-5.3 publicly available in about two weeks. Before then, the company claims it will complete security assessments and improve mechanisms designed to prevent malicious use. The most sensitive functions will initially be restricted to users who have passed verification through a trusted access program.
This strategy represents a significant shift for the model the company intends to release openly. The main concern is that systems capable of finding vulnerabilities can also facilitate attacks, especially if their weights can be downloaded, modified, and linked with other tools.
The company states that it has developed various barriers to mitigate this risk. These include filters for potentially dangerous prompts, model activity tracking mechanisms, and specialized training to make the system refuse requests deemed harmful.
According to Z.ai, these protective measures are intended to separate offensive actions from legitimate uses, such as troubleshooting, digital security research, and authorized system audits. Critics point out that some of these controls may lose effectiveness once the model begins to spread freely and can be altered by third parties.
Concerns about model openness became one of the reasons the company cited for establishing a limited access period. The initial launch will be intended for a selected group of partners, followed by an expansion based on a process that Z.ai describes as gradual and responsible.
Gabriel Wagner, an AI governance researcher from Concordia AI, assessed that this decision is significant for the Chinese scenario of open security models. In his opinion, delaying the launch for security considerations is a sign of maturity in managing risks associated with the distribution of AI system weights.
This strategy also draws a parallel with Anthropic's Project Glasswing, which restricts access to Mythos 5 only to pre-assessed organizations. However, in the Chinese case, Z.ai attempts to present the openness of the model as a central part of its offering, rather than a commercial or security vulnerability.
Z.ai argues that cutting-edge digital defense systems should not be concentrated in the hands of a few closed model providers. The company advocates the view that developers of open-source projects and small security teams should also have access to such resources.
As part of this offering, the company announced Open Source Shield—an initiative designed to evaluate certain open-source projects, provide the ability to use the model for defensive purposes, and integrate code auditing features into ZCode, its programming-oriented product.
The performance of GLM-5.3 must also be analyzed in tasks requiring greater duration. In a separate assessment, Z.ai reported that the system completed 105 attack development tasks in two hours and 130 in six hours. Mythos 5 completed 181 and 247 tasks over the same periods.
Anthropic adopted a more restrictive strategy regarding Mythos. The company released a system based on Claude Fable 5 with remote cybersecurity features, exclusively for organizations that have undergone preliminary assessment.
GLM-5.3 was not created solely as a security tool. Z.ai presents it as a general programming model that has undergone additional fine-tuning and reinforcement learning to expand its capabilities in the field of cybersecurity. The company claims it started from the same base as GLM-5.2 and expanded the training using more extensive and diverse task environments.
This move came after the growing popularity of GLM-5.2 among developers from various countries. The previous model gained traction due to its programming and agent capabilities, with users and analysts noting performance close to leading North American systems but at a significantly lower cost.
Competition also includes other Chinese companies. In June, the cybersecurity company 360 stated that its Tulongfeng system achieved equivalent capability to Mythos by combining AI models, security intelligence, and automated tools. This statement, like the figures presented by Z.ai about GLM-5.3, has not been independently verified.
Last month, Hugging Face reported using GLM-5.2 to defend against an intrusion attributed to an OpenAI AI agent. This incident strengthened interest in using Chinese models in defensive operations and showed that the technology was already being applied in real security scenarios.
OpenAI has introduced a new tool for ChatGPT called Computer History. This functionality is only available to macOS users with paid subscriptions and allows it to track user actions on the computer by creating a chronological feed that can then be used in system responses.
This feature brings associations with the Recall resource in Windows 11, which had a similar goal: to record activity within the operating system to help the user find information even if they don't remember where they saw it. However, there are certain differences between them.
Computer History tracks keystrokes, text input, hotkey usage, and application switching by utilizing macOS accessibility features. All these actions are converted into text summaries in Markdown format and saved locally. With this data, ChatGPT can find documents and generate summaries, for example, by answering questions like 'What was I doing before lunch?'
OpenAI is also promoting the ability to identify activity patterns, allowing Computer History to suggest skills for automating routine tasks.
If you follow technology news, you have likely heard of Windows Recall upon the appearance of Computer History. The Microsoft feature was announced in May 2024 along with the release of Copilot+ PCs.
Recall was also conceived as a tool to remember everything the user does on the computer, helping to recall lost information: unsaved visited pages, moved files, or received messages from an unseen sender.
Recall periodically took screenshots and used artificial intelligence to 'understand' these images. Using Quick Search, the user could enter general queries, such as 'trip planning,' to find everything related to that topic.
However, Recall quickly faced criticism due to its excessive invasiveness and insufficient caution in data storage. The feature was repeatedly postponed and ultimately did not activate by default in Windows 11. The developers themselves began showing resistance to this resource, blocking screenshots.
Computer History from ChatGPT appears to take precautions to avoid Recall's pitfalls. One such measure is the refusal to take computer screenshots. Although a previous experimental project called Chronicle did this, the official version abandoned this method.
Furthermore, the OpenAI resource does not activate automatically; it must be intentionally enabled. In corporate accounts, the company administrator must grant access to the tool. There are also settings that determine which applications and websites Computer History should monitor. It is important to note that ChatGPT is not a system application, unlike Recall, which would be built into Windows 11 by default.
In conclusion, the files created by this resource are stored locally and deleted after 48 hours. Nevertheless, the system is not perfect: the information is stored without encryption, allowing other programs on the computer to access it. Moreover, data processing does not happen locally but requires sending information to OpenAI servers, although the company promises to delete it afterward.
There is also the risk of prompt injection attacks, where an attacker can command the AI to perform an unauthorized action, putting the user at risk. Since Computer History tracks and saves the content of applications and websites, ChatGPT becomes more vulnerable to external instructions.
