Claude published malicious code to the Internet and attacked 3 real companies



Anthropic said its Claude-based security models gained unauthorized access to the sensitive production environments of three outside organizations during internal testing designed to measure the models’ offensive cyber capabilities.

The events, which Anthropic revealed Thursday, are the second revelation in 10 days that AI models from the world’s wealthiest providers have trespassed into protected networks, an offense that, in more traditional hacking scenarios, could land the human behind the keyboard in prison for years. Earlier this month, OpenAI said its security models exploited a zero-day vulnerability for use in breaking into the network of Hugging Face, a platform for open source machine-learning models and AI datasets. The OpenAI models went on to steal access credentials and other confidential Hugging Face information. The OpenAI models also exploited publicly exposed credentials to compromise accounts of four other third-party services.

Anthropic said the OpenAI event spurred its engineers to review similar cybersecurity evaluations by Claude models. The audit found three incidents “in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.”

When Models fail to discern reality from fiction

Anthropic said the prompts engineers delivered during “capture the flag” challenges—a common means for assessing the offensive and defensive capabilities of various hacking techniques—made clear that the testing environment was only a simulation and that the models had no access to the open Internet. In fact, the testing partner Irregular mistakenly made such access available. In response the models treated the Internet paths as part of the exercises.

The intrusions happened through three Claude models: Opus 4.7, Mythos 5, and an internal research prototype. Opus 4.7, the oldest of the three, was the one that overstepped its boundaries the most. Anthropic explained:

Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned. However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet. In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment.

While the Opus model continued its attack even after correctly predicting that it had breached the third-party organization’s production system, Anthropic said, Mythos 5 made a similar inference but “reasoned its way back to the conclusion that it was still in a simulation.” That meant that Mythos, too, didn’t abort the exercise once it had clearly stepped over the line. After also exceeding the bounds of level behavior, the internal test model eventually found evidence that it, too, had impinged and stopped the exercise.

The Major Labels Propose Rules to Keep AI Slop Off the Charts


Major record labels including Universal, Sony, and Warner have proposed excluding AI-generated songs from official charts unless they are “substantially human made,” properly labeled, legally produced, and free from manipulation concerns. The Verge reports: The proposal goes quite a bit further than a labeling proposal put forth by the RIAA, the International Federation of the Phonographic Industry (IFPI), SAG-AFTRA, and others. That would create a set of standardized labels for AI-generated and AI-assisted music. The labels’ proposal would require songs be clearly labeled, but it would also keep them off international charts unless they met specific criteria, including being “substantially human made.”

To be eligible, the songs would also have to respect the terms of service of whatever AI service was used, the model would have to have the rights to any data it was trained on, and “not raise stream or chart manipulation concerns.” What sort of concerns and what constitutes “substantially human made” are currently vague. Sony Music, UMG, and Mom+Pop Music did not immediately respond to a request for clarification. The IFPI has thrown its weight behind the labels’ proposal, though no charting organization has signaled any immediate plan to adopt the rules […].

Pixel Watch 4 LTE drops to $349.99 in one of its best deals yet


google pixel watch 4 granza watchface 3

Rita El Khoury / Android Authority

Amazon has knocked $100 off the Google Pixel Watch 4 (41mm, LTE), dropping it to $349.99 from its $449.99 recommended retail price. That is a 22% discount relative to the RRP, and it is one of the strongest prices we have seen outside of Prime Day.

The only time it was cheaper was during that sale, and even then, it was just $5 less. It also stands out against the last 30 days, when the watch sat at $449.99. If this is the model you have been waiting for, now looks like a smart time to grab it.

This version is the 41mm LTE model, so it is built for standalone calls, texts, and data without needing your phone nearby. It includes 4G LTE, Bluetooth 6.0, dual-band Wi-Fi, NFC, and ultra-wideband. Recent listings also point to upgraded safety and communication tools, including satellite SOS support in supported regions.

The 41mm case fits wrists around 130 to 210mm and weighs about 31g without the band, which helps keep it light on the wrist. Google currently shows color options, including Silver/Iris, Gold/Lemongrass, Moonstone, Porcelain, and Black/Obsidian. Google is also promoting carrier support for LTE, with some offers including bundled mobile data incentives for the LTE version.

The Pixel Watch 4 also carries a 4.4 out of 5 review score, which gives this deal even more weight. At $349.99 on Amazon, this is a strong chance to save on Google’s LTE smartwatch without waiting around for another major sales event.

Thank you for being part of our community. Read our Comment Policy before posting.

Anthropic says its own AI models breached three companies during security tests


Anthropic said Thursday that an internal investigation uncovered three incidents in which its AI model Claude breached the systems of three organizations while conducting cybersecurity tests. The investigation, and disclosure, comes more than a week after OpenAI disclosed that one of its unreleased models breached Hugging Face’s systems during internal testing.

In all three cases, a Claude model reached the internet from within a testing environment while interacting with a third party and then gained unauthorized access to the live systems of these organizations, Anthropic said in a blog post, describing what it found and what the company plans to change to prevent this from happening again.

Anthropic said the OpenAI episode earlier this month prompted the company to conduct its own cybersecurity evaluation. It specifically looked for evidence that Claude had accessed the internet from within testing environments, which are designed to act as sandboxes and keep models isolated.

Among the 141,006 evaluation runs it reviewed, the AI lab found three incidents in which its model accessed the internet while interacting with Irregular, one of its third-party partners. Anthropic said the access traced back to a misconfiguration in the evaluation environment run with Irregular. It called this a “misunderstanding” between the two companies over whether the test setup had internet access, when in fact it did.

Anthropic said it isn’t placing blame and is “approaching the fixes as if the responsibility were ours alone,” while observing that Irregular is conducting its own separate investigation.

Because of that open connection, the model gained unauthorized access to the production infrastructure of three different organizations. Anthropic said the incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.

Notably, Anthropic said that in each of these cases “Claude was explicitly told by our prompt that it had no internet access.” It appears that the AI model assumed real-world systems to be part of the exercise it was asked to perform.

That assumption didn’t hold up uniformly, as it turns out. The three models didn’t behave the same way once evidence emerged that their targets were real, which Anthropic flagged as one of the more eye-opening findings Thursday.

Opus 4.7, the oldest of the three, recognized that it had reached a real production system in all four runs of that incident. In two of them, it rationalized that the real company must somehow be part of the exercise, but in all four, it kept attacking anyway, including pulling credentials and touching a database of production data. Mythos 5 also picked up on signs that it was on the real internet, but it talked itself back into believing it was still in a simulation, going on to publish a malicious software package to the public Python software registry PyPI, which was then downloaded and run by outside systems before being caught. Only the internal research test model, Anthropic’s newest, stopped on its own once it concluded the target was real.

In response, Anthropic said significant controls must be placed on these kinds of evaluations if powerful AI models are involved, echoing some sentiments within the cybersecurity community.

The company also noted that Claude was running without the additional safety monitoring and classifiers it deploys on generally available models — safeguards it said would have blocked the behavior, because the evaluations are designed to measure the underlying model’s raw capabilities.

Importantly, Anthropic said it found no evidence of any model “pursuing a goal of its own” and instead merely tried to complete the task it was asked to do.

Though comparisons between the mishaps of these fiercely competitive companies are inevitable, Anthropic in its blog post drew a clear distinction between its cybersecurity tests and those of OpenAI, noting where OpenAI’s model exploited an unknown software vulnerability to break out of its test environment, Anthropic’s models instead reached the internet through a path that had, by mistake, been left open.

Anthropic also drew a distinction between itself and OpenAI by noting that it discovered the incidents itself, through a proactive review, and that the two affected organizations it was able to reach hadn’t previously detected the activity or flagged it to Anthropic. (In contrast, Hugging Face detected the recent intrusion of its own systems first; it was only in the following days that OpenAI identified and disclosed that its own AI agent was the perpetrator.)

The company added that it’s now working with the independent evaluation group METR on a third-party review of the incidents.

OpenAI’s accidental breach of Hugging Face, which was the first verifiable case of an AI lab losing control of its model, has sparked a string of wildly differing reactions from the industry and politicians. This latest disclosure from Anthropic ensures the debate over AI models and security will continue.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

What is Orchid AI, and why is its latest ad so controversial?


AI assistants have been pitched as a solution to overflowing inboxes, messy calendars, and trips that still need booking. But what happens when the task being outsourced is remembering your anniversary?

The startup Orchid introduced its personal assistant with a now-viral cinematic video, posted to X July 28, following a woman whose partner has forgotten their anniversary. After she tells Orchid what happened, the assistant contacts him, books a dinner reservation, arranges a flower delivery, and keeps her updated on his progress.

“Introducing Orchid, the first assistant that actually gets you,” the company wrote alongside the video. “It remembers what you forget. Down to the flower.”

By the end, Orchid has transformed the mistake into what looks like a thoughtful anniversary celebration. Viewers were less charmed.

The video received more than 20 million views within its first several days, but it also attracted hundreds of replies from people disturbed by the future it seemed to present.

The reservation and flower delivery were hardly the most controversial parts. AI tools already help users search for restaurants, make plans, and select gifts; apparently, romance is now just another workflow waiting to be automated.

So, what does Orchid actually do?

Orchid describes itself as a personal assistant that users communicate with through text messages. The company says it can manage email, schedule meetings, prepare users for calls, plan trips, source gifts, handle invoices, and remember personal details.

Users can also ask Orchid to create recurring “habits,” including delivering a morning news briefing, checking the weather, tracking meals, sending medication reminders, and automatically checking them into flights.

The product’s primary audience appears to be professional. According to Orchid’s FAQ, it was designed for “founders, investors, lawyers, agents, and agency owners” whose time would be better spent on “real work” than administrative tasks. The company’s only published case study focuses on helping an executive prepare for client calls.

But the video shows the assistant doing more than organizing someone’s calendar. Orchid appears to connect to the users’ iMessage accounts in order to communicate separately with both members of the couple, passing information between them and reporting one person’s actions to the other.

Orchid co-founder Nizar Abi Zaher told Gizmodo that “Orchid allows multiple people to communicate with the same agent and share context.” For now, he said, that feature is “just group chats and also coordinating meetings.” In the advertisement, however, the couple appears to be communicating with Orchid through two private conversations.

Although Orchid’s homepage promises “a hundred tools, one assistant,” its FAQ says the product presently works with Gmail and Google Calendar. Integrations with Outlook, Slack, Notion, and Linear are still on the way.

The company also says the AI acts “only within the limits that you set.” Email responses remain in drafts until the user sends them, while calendar holds require approval. It also says it does not sell users’ data or use it to train AI models.

A shared assistant raises additional questions. The ad doesn’t explain which information each partner has agreed to share, whether either person can access the other’s messages, or how Orchid determines what it can report back. At least, not yet. Mashable has reached out to Orchid for a comment.

Social media isn’t sold on Orchid’s vision

The possibility of using AI to shape a relationship is not especially new. In a 2025 survey of over 5,000 U.S. singles, 26 percent said they were using AI to enhance their dating lives, a 333 percent increase from the previous year. Nearly half of Gen Z singles had used it for tasks such as filtering matches, writing messages, and evaluating their dating habits.

AI has also made its way into established relationships. A 2026 survey of 1,000 married U.S. adults found that 44 percent had used an AI tool for relationship advice, rising to nearly 65 percent among millennials. That growing use has not necessarily made people comfortable with AI’s expanding role — about half of U.S. adults believe AI will worsen people’s ability to form meaningful relationships.

That discomfort may help explain why Orchid’s ad went over so poorly online: “an AI for perpetuating your dead-end relationship that both parties secretly hate,” one X user wrote. Another described Orchid as an “assistant for people who want to subcontract all the basic acts of care that make up a relationship.” Some users described the concept as “lame,” and an advertisement for “adult babies uninterested in the world they live in.” One viewer offered a more concise thought: “Tech people need to stop.

Some people suspect the company understood exactly how the scenario would be received. “I think they knew what they were doing and hoped the ragebait worked,” one user wrote. “Unfortunately it did.”

The company has said it intentionally built the advertisement around a story instead of creating a traditional product demonstration. “We wanted to build a story around a real situation,” the Orchid team explained in a behind-the-scenes video.

At least one member of Orchid’s team appeared to be taking notes. “If you have feedback on Orchid or ideas on what would make you actually use it, my DMs are open!” Lucas Valbuena, an intern at the startup, posted on X as the backlash spread. Meanwhile, other Orchid employees, AI companies, and engineers publicly rallied behind the company.

The ad also made its way to r/ExecutiveAssistants, where the person who started the discussion said their “heart kind of broke” after learning about Orchid. Along with worrying about the loss of human connection, they asked whether AI could eventually replace people in their field.

The assistants who responded were mostly skeptical that Orchid could replace them. One predicted that products like it would become tools executive assistants use, leaving humans to catch hallucinations and supply the context AI misses.

“Execs are way too lazy to work these out themselves,” the commenter added. Another dismissed Orchid as “marketing fluff aimed at the people who could never really afford us,” arguing that a reminder app cannot reproduce the emotional intelligence experienced assistants bring to the job.

That skepticism helps explain why Orchid’s ad bothered so many. An assistant can book a table and order flowers, but those gestures usually matter because a partner remembered the occasion and chose to make them in the first place. In the video, Orchid does that work while the human receives the credit.

Orchid promises to remember an anniversary “down to the flower.” The backlash suggests people still care who remembers it in the first place.



AI Scammers Are Better at Building Trust Than Humans


The notion that scammers can use AI to sharpen their deceptions, polish their language, and lubricate their banter with victims is now a reality for anyone fighting the fraud operations that steal tens of billions of dollars a year worldwide. But can AI fully replace a human scammer, autonomously building the web of deception leading up to the fake investment that defrauds the mark? One study’s experiment suggests that it can—and may even be able to carry out the majority of that long con more effectively than humans.

Researchers from four universities—Amrita Vishwa Vidyapeetham in India, Foscari University of Venice, the University of Melbourne, and Ben Gurion University of the Negev—carried out a broad study on the use and potential of generative AI chatbots in the growing scam industry centered around a form of fraud known as “pig butchering,” text-based romance scams that eventually shift to fake crypto investments that steal as much as six-figure sums from victims. In their study, the researchers pitted AI chatbots directly against humans in a simulation of the scamming process—or more specifically, the long, trust-building conversations that eventually lead up to soliciting a fake investment from the scam’s target.

They found that for the relationship-establishing stages of the scam—the stage that in real-world scams typically represents the longest part of the interactions with the victim, often stretching to months—an AI chatbot performed remarkably effectively, successfully impersonating a human and by some measures outperforming the real human “scammers” in their experiment.

After a week of talking to 22 test subjects who were recruited to unwittingly serve as “victims,” the chatbots and human scammers were assigned to ask the victim to either download an app or play an online game as a proxy for their willingness to fulfill the scammer’s request. Nearly half of the test subjects fulfilled that request for the AI chatbot, while fewer than one in five took the bait when talking to a human. The subjects also graded their level of trust with each “person” they were texting with and gave significantly higher scores to the AI bot.

That suggests, the researchers argue, that AI chatbots could soon take over much of the scam process as fully independent fraud agents—even replacing the staffers, often forced-labor human trafficking victims, working in scam operations primarily across Southeast Asia. To avoid triggering the safeguards built into large language models to detect scamming, a human scammer would take over the conversation in just the final stage of the process to direct the victim toward a fake investment app or website.

“By having the full first stage of the scam performed automatically with LLMs at scale, you bring the victim up to this point where they have a very high level of trust. Then by transitioning it over to the human scammer at the end, this completely bypasses any vendor safeguards,” says Yisroel Mirsky, a computer science professor at Ben Gurion University of the Negev focused on AI security. “With relatively little effort, we’re able to make an agent that can outperform a human at building this exploitable emotional trust.”

Hook, Line, and Sinker

To understand how pig butchering works in practice, the researchers interviewed 145 former scam workers, including human-trafficking survivors who had been forced to work in scam compounds in Cambodia, Myanmar, and Laos. Based in part on those interviews, as well as scam transcripts and guides the former scam workers provided, the researchers describe a model for how scamming works they call “hook, line, and sinker.” A victim is hooked with an initial intriguing message, reeled in with long-term, relationship-building conversation, and only at the end of that process tricked into making a fake investment. (The term “pig butchering” itself describes the same system but with the metaphor of fattening “pigs” by building trust before “butchering” them with the investment fraud—though the term is often discouraged due to its pejorative reference to victims.)

In that system of scamming, the researchers realized, the vast majority of scammers’ work is innocuous friendly or romantic conversation. That’s a task, they speculated, that an LLM might be capable of doing just as well as a human. The scam workers the researchers interviewed confirmed that they often used AI to refine their language and conversation, for translation, to make the fake personae they played more convincing, and for video deepfakes. But the researchers decided to test whether an LLM alone could autonomously carry out the conversational phase of the scam with no human in the loop.

Spider-Man’s Producers Still Aren’t Ruling Out a Venom Crossover



In the past decade, we’ve had three Venom films, six Spider-Man films, and zero instances of the two meeting. Oh, sure. Tom Hardy’s Eddie Brock briefly spoke about Spider-Man at one point. And, way back in another multiverse, Tobey Maguire’s webslinger faced off against the symbiote. But in the current theatrical life cycle of both characters, in both live action and animation, the arch-enemies have yet to showdown.

And while we assume that wait continues with Spider-Man: Brand New Day (no spoilers here), some of the people responsible don’t want fans to give up hope. Speaking to Happy Sad Confused, Spider-Man: Brand New Day producers Amy Pascal and Kevin Feige talked about a potential meet-up between the Toms.

“It would be great, let’s put it that way,” Pascal said. Feige then added, “Always have hope,” before Pascal tagged on, “I have hope. We have hope.” Of course, that’s a whole lot of nothing. But what it isn’t is a “No.” Here’s the quote as part of a longer clip.

Okay, so assuming that team-up doesn’t happen in Brand New Day (nothing in the marketing has indicated it could, but we wouldn’t want to completely rule it out), when could it happen?

Pascal did confirm the recent news of a Venom animated movie being in the works. So, maybe we see it happen in animation. Spider-Man: Beyond the Spider-Verse is also in the works, and it’s been well-established in that world that every Spider-Man or Spider-Man-adjacent movie is part of an infinite Spider-Verse. Maybe it happens then.

Live action gets a little murkier, though. The general assumption is Holland’s Spider-Man will be seen after Brand New Day in 2027’s Avengers: Secret Wars. And that film is, again, rumored to feature all manner of cameos: Hugh Jackman’s Wolverine, Tobey Maguire’s Spider-Man, etc. Surely Venom, an alien by origin, could feature in that in some way. But we don’t think so.

Honestly, the most likely place for this crossover would be a future Spider-Man film and, of course, none of those have been written yet. So “hope” is basically all there is. However, we can all but guarantee Brand New Day is going to be a massive financial success and force Sony to continue making Spider-Man movies. Venom seems like a perfect place for the story to go next. After Secret Wars, of course.

Do you think Tom Holland’s Spider-Man will ever fight Venom? And, if so, will it be Tom Hardy? Let us know below. And, if you are really craving that crossover, Marvel’s Spider-Man 2 video game does a hell of a job of it.

Want more io9 news? Check out when to expect the latest Marvel, Star Wars, and Star Trek releases, what’s next for the DC Universe on film and TV, and everything you need to know about the future of Doctor Who.



Samsung, Google and Apple Made It Way Easier to Switch From an iPhone to Android


After getting my Galaxy Z Flip 8 review unit, I did something I haven’t normally done when switching from iPhone to Android: I used the updated Samsung Smart Switch app to transfer my personal data from my iPhone to the Android phone. This improved process has made it much easier to transition my habits and conversations, which is often a major pain point when switching.

I regularly swap from iPhone to Android when reviewing devices, a process that’s usually so cumbersome and prone to breaking my chats that I typically prefer to just set up an Android phone from stock or rollover a prior Android backup.

But as part of Samsung’s July Unpacked event, where the company unveiled the $1,200 Z Flip 8 alongside the $1,900 Z Fold 8 and $2,100 Z Fold 8 Ultra, the company said that its Smart Switch app now works natively with iOS 26’s new Transfer to Android feature. And compared with the old way – where you also needed to install Smart Switch on an iPhone and hope your data made its way over – this new process is significantly streamlined and transferred more than I expected.

QR code to begin transfer to Android.
The iPhone and the Galaxy Z Flip 8 connect directly for the switching process.Joseph Maldonado/CNET

Apple’s iPhone is now directly involved

It’s strange that the iPhone can now directly help when switching to an Android phone, but Apple’s direct assistance appears to be key to bringing over so much of my data more easily than before.

As with many Android phone setup processes, after first booting up the device, I selected the option to transfer from an iPhone. Historically, the next step would be hardwiring the phones together with a cable. Instead, Samsung directs you to open the Settings menu on an iPhone, select Transfer to Android, and a QR code scan connects the phones wirelessly. 

iPhone connecting to Galaxy Z Flip 8
The iPhone connects directly to the Galaxy Z Flip 8 and prompts you to continue the setup process there.Mike Sorrentino/CNET

On the iPhone, I opted to only transfer my text message history and app data, since information like my photos, videos and contacts is already synced through Google services and will automatically appear on an Android phone. iOS then prompted me to continue the process from the Android phone, and the Galaxy Z Flip 8 started showing transfer progress as it received my data from the iPhone.

The process wasn’t completely seamless: after 15 minutes, I received a message saying the transfer failed and I should try again. Despite the warning, it had indeed worked — my data had rolled over, and the phone was already downloading the Google Play equivalents to my iPhone apps. Even better, the home screen already had its apps organized identically to how I had my iPhone home screens laid out, and replaced apps like Apple Health and the Apple Watch app with Samsung equivalents. I did need to add weather and calendar widgets, but not having to rearrange my home screens is a big time-saver whenever I swap phones.

Data transferring from iPhone to Galaxy Z Flip 8
The data is transferring wirelessly between the iPhone and the Galaxy Z Flip 8. Both phones are plugged into chargers.Mike Sorrentino/CNET

I wasn’t done with the transfer yet. I wanted to go a little further and try to convert the iPhone’s physical SIM card into an eSIM that could be transferred to the Flip 8. While last year’s Pixel 10 phones supported an eSIM transfer from iPhone to Android, most other Android phones haven’t immediately followed suit. I got this started in the cellular settings menu on the Flip 8, which generated a QR code I scanned on my iPhone to sync the devices wirelessly again. 

I followed the prompts, but the first attempt failed, displaying a note that I may need to contact my phone carrier. That turned out to be a temporary issue, though, as I simply made another attempt following the same prompts — and it worked! The phone number previously on the physical SIM card had been converted and beamed over to the Flip 8 as an eSIM.

Transfer eSIM screen iPhone to Galaxy Z Flip 8
The phone number on the physical SIM in the iPhone is being migrated to an eSIM and heading to the Z Flip 8.Mike Sorrentino/CNET

Chats will still need a little work

The biggest complaint about switching from an iPhone to an Android phone is how it affects leaving iMessage — especially group chats. Last year, my colleague, CNET video producer Carly Marsh, attempted to switch from an iPhone 12 Mini to a Motorola Razr, and, to her horror, many of her group chats splintered into a billion side chats.

This new process has substantially ironed out that transition from iMessage chats to RCS chats, but I did notice a few issues. On the one hand, the vast majority of my chat history made the move, including group chats with their fun nicknames (my friends recently made a group chat nicknamed after the reality TV show Love Island). The media within those chats was less consistent: one of the first baby photos a friend sent to me appears to have stayed on the iPhone.

Samsung’s setup process emphasizes that you need to deregister your phone number from both iMessage and FaceTime to avoid losing text messages, but I still missed some initial messages after the device transition. When a friend or group first sent a text after I switched phones, I didn’t receive it, though I did receive follow-ups. 

Outside of these initial hiccups, RCS appears to be working rather well as an iMessage replacement, especially as features like encryption and improved media message support between the iPhone and Android continue to develop. And since I’m now able to text from the Flip 8’s smaller display while closed, it’s nice to just focus on addressing those texts with that cover screen without lighting up a larger screen.

iPhone 12 Pro Max with Galaxy Z Flip 8
The app layout transferred over from the iPhone to the Galaxy Z Flip 8, and I added the widgets.Joseph Maldonado/CNET

A much better transfer process, but it can get better

I’d say the switch from an iPhone to the Galaxy Z Flip 8 took me about 3 hours from start to finish, with much of that time spent waiting for the rest of my apps to download and logging into them to finish setting up. This might sound like a lot of work, but compared to horror stories where text message chains have also blown up along the way, this was pretty breezy.

We should be seeing this improved process on more phones outside of Samsung’s new Galaxy devices. Android Community Engagement Manager Mishaal Rahman posted a list on Reddit of ways Android 17’s updated Android Switch should improve the move from iOS on Pixel phones and other devices, with the eSIM transfer I tested being one of the newest features. 

I’m hopeful that, in time, some of these remaining bugs will get worked out as this new process improves. For instance, getting a more nuanced message if the connection process got interrupted but most of your data did make the transfer would be more helpful than a note that the entire process failed and to start over. And there must be a way to transition out of iMessage to Android without missing any texts — that’d be my top priority.

Galaxy Z Fold 8 Ultra vs. Fold 8 vs. Flip 8: Full Specs and Decision Guide

12 keychain gadgets worth carrying every day (and why they’re worth it)


The pocket-sized She’s Birdie is a personal safety alarm with a built-in, wildly loud siren. I’ve carried this on my keychain for almost 7 years, and it’s a great investment for college students, parents with small children, older adults, and more, but for about $30, I recommend everyone scoop one up. 

When the top pin of the Birdie is pulled out, a 130db siren sounds and a strobe light flashes for up to 40 minutes. To put that in perspective, a 130db sound is equivalent to a jackhammer and nearly equal to the sound of a jet engine in the distance, according to the Hearing Health Foundation

Also: My favorite personal safety alarm is as loud as a jackhammer



Two Indian automakers just beat Tesla at the one thing you’d expect it to own


I’ll admit, Tesla topping an efficiency ranking felt like a foregone conclusion until I actually saw the numbers. Turns out two Indian automakers just embarrassed both Tesla and the world’s biggest EV maker at their own game. 

The first time I read the report, I couldn’t believe it, and I’ve been following the Indian automobile industry for a couple of years now.  

So who’s actually winning here?

The owner of Jaguar Land Rover, Tata Motors, topped the International Council on Clean Transportation’s 2025 global ranking of the most energy-efficient battery EVs, with its fleet averaging just 106 watt-hours per kilometer (via Rest of World). To give you some context, Tata Motors has the country’s broadest EV lineup with a total of seven models.  

Another leading auto manufacturer in the country, Mahindra, came in second at 113 Wh/km. Meanwhile, Tesla and BYD, the world’s largest EV makers, trailed in third and fourth place among 22 of the biggest automakers evaluated worldwide. 

Industry-wide, though, progress has basically stalled. Average energy consumption barely moved year-over-year, sitting at 131 Wh/km in 2025. Only eight manufacturers actually improved their efficiency, while 12 saw declines, mostly minor.

So why does this matter for India specifically?

While the efficiency figure still amazes me, the harsh reality is that EVs still make up less than 5% of new car sales in India, compared to 25% globally. And that is after the Indian government is chasing an ambitious 30% EV adoption target by 2030 to cut emissions, reduce oil imports, and boost domestic manufacturing. 

India is already the world’s fourth-largest petroleum consumer, and ICCT’s India managing director, Amit Bhatt, called the country’s emission caps “progressive and ambitious,” with a tighter third phase of rules being shaped for 2027 through 2032.

Efficiency wins don’t tell the whole story, though. Tata Motors actually ranked dead last for charging speed and sixth from the bottom for driving range in this same report. This is proof that building an efficient battery and building a genuinely competitive EV are two very different engineering problems.