A long-running phishing operation has turned GitHub Pages into a low-cost staging ground for fake banking portals aimed at customers of financial institutions operating in Mexico, harvesting logins, payment card details and customer identifiers through a modular kit built for fast redeployment. The campaign, tracked as GitBait, has been active for nearly three years and has impersonated at least a dozen banks and financial services providers. Its […]
SHANGHAI, CHINA – Media OutReach Newswire – 15 June 2026 – ACE ROBOTICS today announced that its open-source Kairos world model has achieved leading results across four global embodied-intelligence benchmarks: RoboTwin 2.0, LIBERO-Plus, WorldModelBench Robot and DreamGen. Kairos ranked first among evaluated world models and vision-language-action (VLA) systems on these benchmarks’ public leaderboards as of 12 June 2026, leading across the core capabilities of embodied intelligence, including complex robotic manipulation, scene-level generalization, physical-world modeling and zero-shot transfer. The project is openly available on GitHub, Hugging Face and ModelScope, giving researchers and developers a public reference point for the model, benchmark results and technical materials.
Tops Four Leading Benchmarks in World Generation & Prediction
Embodied intelligence faces a fundamental challenge: generalization. A robot must operate reliably in environments it has never seen, adapting to new lighting, layouts, objects, embodiments and noisy real-world conditions. While VLA models have become a prevailing approach by directly mapping perception and language inputs to robot actions, ACE ROBOTICS believes world models offer a more scalable path by explicitly learning the underlying dynamics of the physical world and predicting how environments evolve. Kairos is designed to validate that approach.
Leading scene-level generalization on LIBERO-Plus
One of Kairos’ most significant results comes from LIBERO-Plus, a scene-level generalization benchmark proposed by the Shanghai Innovation Institute with Fudan University, Tongji University and the National University of Singapore. It evaluates robustness under seven real-world variables: camera angle, robot embodiment, language instruction, lighting, background, sensor noise and spatial layout.
Kairos achieved an overall score of 89.0, ranking first among all evaluated world models and VLA systems. It surpassed leading VLA models including ACoT-VLA (88.0), Pi 0.5 (85.7) and ProGAL-VLA (85.5), as well as the Being-H0.7 world model (84.8). It also showed strong environmental robustness, with near-ceiling performance on lighting (97.7), noise (96.8) and background (95.8), and ranked highly on camera angle and language instruction.
According to ACE ROBOTICS, this marks the first time a world-model approach has outperformed leading VLA systems on LIBERO-Plus for scene-level generalization, pointing to a path where robots adapt to homes, factories, retail spaces and other environments with far less environment-specific retraining.
A compact model with strong physical modeling efficiency
On WorldModelBench Robot, a physical-modeling benchmark proposed by researchers from UC Berkeley, UC San Diego, NVIDIA and MIT, Kairos-4B achieved an overall score of 9.30, ranking first on the benchmark. With only 4 billion parameters, it outperformed larger systems including 28-billion-parameter Lingbot, 16-billion-parameter Cosmos 3, 14-billion-parameter Abot-PhysWorld and 5-billion-parameter Wan 2.2, setting a new record for parameter efficiency in embodied world models.
Kairos matched the top instruction-following score (2.36) of the 16-billion-parameter Cosmos 3 with about one quarter of the parameters, a fourfold efficiency gain. It scored 4.96 on physics adherence, with perfect marks on Newtonian mechanics and gravity, and a perfect score on temporal quality, reflecting strong temporal consistency and visual continuity over long horizons.
A unified architecture, not a modular pipeline
ACE ROBOTICS attributes Kairos’ performance to its native unified “multi-modal understanding-generation-prediction” architecture. Unlike modular approaches that stitch together separate components for world understanding, generation and prediction, Kairos integrates these within a single backbone that shares one global world state, reducing the information loss and coordination latency between modules for more consistent physical modeling, stronger long-horizon prediction and more reliable action planning.
ACE ROBOTICS first introduced this architecture in December 2025, and the broader industry is now converging on a similar path: NVIDIA’s Cosmos 3.0, introduced in 2026, adopts a comparable single-system design that brings vision reasoning, world generation and action prediction into one architecture. Built on this foundation, Kairos-4B is, in ACE ROBOTICS’ description, the first embodied world model able to drive a physical robot directly on-device, closing the perception-to-action loop without intermediate translation latency.
Leading on synthetic data transfer and complex robot manipulation
Kairos also ranked first on DreamGen Bench, a benchmark led by NVIDIA with the University of Washington, UC Berkeley and UCLA that measures how well synthetic data generated by world models transfers to unseen objects, behaviors and environments, a key predictor of downstream robot-training value. Kairos ranked first on both average physics adherence (AVG_PA 0.538) and overall average score (AVG_Score 0.618), and led globally on new-behavior execution and new-environment adaptation.
On RoboTwin 2.0, a demanding dual-arm manipulation benchmark proposed by Shanghai Jiao Tong University and the University of Hong Kong with Shanghai AI Laboratory, Kairos scored 96.1% — a state-of-the-art result on the benchmark’s public leaderboard as of 12 June 2026. Across the benchmark’s 50 complex two-arm tasks it scored 96.9% in clean scenarios and 95.2% in randomized scenarios, ahead of VLA models such as G0.5 (93.2) and starVLA (88.3) and world models including AIM (93.1), Fast-WAM (91.8) and MotuBrain (96.0).
From benchmark leadership to commercial deployment
Together, these results validate Kairos’ technical direction across the core dimensions of embodied intelligence, from physical-rule understanding and zero-shot generalization to environmental robustness and fine-grained dual-arm manipulation, supporting ACE ROBOTICS’ aim to move robots beyond task imitation toward physical-world understanding, long-horizon reasoning and real-world execution.
The results come as ACE ROBOTICS accelerates commercialization. The company says it has raised several hundred million U.S. dollars across financing rounds in the first half of 2026, including a recent Angel+ round backed by investors such as Geely Capital, Dachen Caizhi, Shenzhen Capital Group and the Shanghai Sci-Tech Innovation Fund, with existing shareholder SenseTime’s Guoxiang Capital increasing its stake. The proceeds will support continued world-model research and integrated hardware-software solutions for sectors including smart retail, security and inspection, tourism and hospitality.
“Embodied intelligence is the next era of AI, and a world model is the key to unlocking it,” said Wang Xiaogang, Chairman of ACE ROBOTICS. “Our mission is to give every robot a capable brain.”
The issuer is solely responsible for the content of this announcement.
About ACE ROBOTICS – Equipping robots with intelligent “brains” and engaging “souls”
ACE ROBOTICS is a pioneering robotics company dedicated to advancing the field of embodied intelligence. Through breakthrough technological innovations and deep insights into embodied intelligence scenarios, we aim to empower robots with the ability to autonomously understand and explore the physical world, thereby accelerating their commercial implementation.
The company pioneered the ACE R&D paradigm and built a vision-based “environmental data engine, real-world cognition, embodied interaction generalization” technology chain. Using full spatiotemporal and multi-perspective environmental capture as its engine, along with Kairos 3.0 – China’s first open-source and commercially applicable world model – plus the Embodied Foundation Model as its technical backbone, ACE ROBOTICS addresses core industry challenges such as data scarcity, common sense gaps, poor generalization, and limited versatility. Simultaneously, the company unveiled its flagship A1 Embodied Super Brain Module, accelerating the large-scale commercial deployment of embodied intelligence across diverse scenarios.
ACE ROBOTICS is both a technology pioneer and an ecosystem builder. Through strategic cooperation with top hardware manufacturers, cloud service providers, and vertical scenario partners, we have broken through the “model-hardware-scenario” industrial deadlock, providing standardized and customized solutions that are driving the development of China’s embodied intelligence industry.
GitHub has moved security scanning closer to the developer’s keyboard with a new Copilot CLI command that reviews code changes before they are committed, expanding the role of generative AI from code assistance into early-stage vulnerability detection. The /security-review slash command, introduced as an experimental public preview for GitHub Copilot CLI, allows developers to run an AI-driven security check inside the terminal. The feature is designed to […]
AI coding agents can be manipulated into running attacker-chosen code through ordinary-looking bug reports, exposing a fresh security gap in the fast-expanding market for autonomous software development tools. Tenet Security researchers have described a technique they call “agentjacking”, in which a hostile actor plants malicious instructions inside a fake software error report and waits for a coding agent to read it during routine debugging. The attack does […]
A newly disclosed Microsoft Defender exploit has raised fresh concern among security teams after researchers said it could allow a local attacker to gain SYSTEM-level privileges on fully patched Windows machines. The vulnerability, named RoguePlanet by its publisher, was released with proof-of-concept code under the alias MSNightmare, adding to a turbulent sequence of Windows and Defender disclosures that have tested Microsoft’s patching process and the wider debate […]
A fast-moving malware campaign tied to Shai-Hulud has expanded its attack on software developers through newly weaponised Python Package Index artefacts, raising concern that poisoned open-source dependencies are being used to steal credentials, compromise build systems and spread across trusted code repositories. The latest wave adds 23 malicious PyPI package-version artefacts to an operation already linked to Mini Shai-Hulud, Miasma and Hades activity. The broader campaign now […]
Open-source maintainers and software manufacturers are heading towards the European Union’s first Cyber Resilience Act enforcement milestone with deep gaps in awareness, preparedness and legal clarity, after new OpenSSF research found that about two-thirds of practitioners remain unready or unaware of the compliance timetable. The finding has sharpened concern across the software supply chain because the CRA’s vulnerability and incident reporting duties begin on 11 September 2026, […]
Software developers across close to 100 organisations have been targeted by a likely North Korea-linked hacking operation that used fake recruitment and code-review tasks to steal cryptocurrency, browser credentials and wallet data. The campaign, tracked by security researchers as UNK_DeadDrop, unfolded over April and May and reached targets in technology, finance, cryptocurrency, education, business services and other sectors. More than 250 phishing emails were sent during a […]
Microsoft has warned that Anthropic’s Claude Code GitHub Action could expose CI/CD workflow secrets when AI agents process untrusted GitHub content, raising fresh concerns over how autonomous coding tools operate inside software delivery pipelines. The issue centres on the way Claude Code Action handled file-reading capabilities inside GitHub Actions runners. While subprocess paths such as Bash were subject to environment scrubbing and sandboxing controls, the agent’s Read […]
Security teams are facing a fresh warning over enterprise use of AI coding agents after researchers identified a man-in-the-middle attack path that can redirect Claude Code traffic, capture OAuth tokens and preserve access to connected software-as-a-service platforms. The technique targets the way Anthropic’s Claude Code interacts with Model Context Protocol servers, a fast-growing mechanism used to connect AI agents with external systems such as Jira, Confluence, GitHub, […]
Attackers are increasingly abusing legitimate system utilities and widely used administrative tools to deliver malware, move through networks and avoid detection, forcing security teams to rethink defences built mainly around blocking suspicious files. The tactic, commonly described as “living off the land”, relies on trusted tools already present inside corporate environments. PowerShell, Windows Management Instrumentation, certutil, mshta, rundll32, regsvr32, scheduled tasks, remote monitoring software and JavaScript execution […]
Kairos-HomeWorld is purpose built for embodied intelligence and represents the first unified framework capable of generating a complete, fully interactive home environment from a single text prompt. Extending indoor scene generation beyond individual rooms, it enables whole-home simulation in which every object is fully manipulable within an integrated simulation engine.
Kairos-HomeWorld employs a four-stage hierarchical architecture encompassing floorplan generation, 2D-to-3D lifting, recursive refinement, and manipulable object placement. This approach enables the production of globally coherent, physically accurate, and simulation-ready scenes. Each environment contains more than 15 manipulable objects and achieves a Footprint Object Density of 4.16, the highest among compared methods.
The accompanying open-source dataset is purpose-built for Chinese households, pairing 300,000 real residential floor plans with 5,000 fully furnished, simulation-ready homes and 50,000 physics-enabled interactive object assets. Already deployed in ACE ROBOTICS’ daily robot training, it significantly accelerates the simulation-to-reality transfer cycle.
SHANGHAI, CHINA – Media OutReach Newswire – 5 June 2026 – ACE ROBOTICS, in collaboration with the Multimedia Laboratory at The Chinese University of Hong Kong (CUHK) and Shenzhen Loop Area Institute, today announced the open-source release of Kairos-HomeWorld, the industry’s first unified World Model framework capable of generating full home-scale, object-level interactive 3D environments from a single text prompt. The solution addresses longstanding limitations in indoor scene generation, which has typically been restricted to single-room outputs with weak global consistency and limited interactivity. Kairos-HomeWorld overcomes these constraints by delivering structurally coherent, physically plausible, and functionally complete residential environments. These high-fidelity, large-scale simulations provide a robust foundation for advancing embodied intelligence applications and accelerating real-world robot training.
The long-term vision for embodied intelligence is the home environment. However, residential settings are inherently diverse and highly personalized, requiring robots to be trained across a broad range of realistic and differentiated scenarios before they can reliably operate in even a single household. High-fidelity simulation offers the most practical pathway to achieving this at scale, yet existing approaches typically involve a trade-off: synthetic environments lack realism, while scanned real-world scenes offer limited interactivity. Kairos-HomeWorld, together with its accompanying dataset, is designed to bridge this gap, delivering both realistic and interactive environments within a unified framework.
A four-stage architecture for whole-home, object-level generation Conventional approaches to indoor scene generation remain constrained to single-room outputs, often exhibiting weak global consistency, frequent physical inaccuracies, and limited or no interactivity. Kairos-HomeWorld takes a fundamentally different approach. It decomposes whole-home generation into a structured, four-stage process, redefining the underlying architectural paradigm from the ground up.
Stage 1 — Floor Plan Generation. A K-D tree-based approach translates real-world floor plans into a hierarchical text representation that can be efficiently processed by large language models (LLMs). This method mitigates common issues in conventional layout generation, including room overlaps and fragmented topologies, resulting in more coherent and structurally consistent spatial configurations.
Stage 2 — 2D-to-3D Lifting & Furniture Layout Generation. A “top-down global initialization combined with a first-person detail walkthrough” approach anchors the process to the 3D building shell generated in Stage 1. This methodology mitigates the geometric drift commonly associated with conventional 2D-to-3D lifting techniques, enabling more stable and spatially consistent scene generation.
Stage 3 — Recursive Refinement. A fine-tuned vision-language model performs iterative validation and correction, automatically identifying and resolving physical inconsistencies, such as obstructed doorways or object collisions. This recursive process materially reduces spatial errors, achieving among the lowest reported furniture-collision rates in the industry.
Stage 4 — Manipulable Object Placement. A surface-centric placement algorithm assigns each object detailed physical properties, including material composition, density, friction, and structural support relationships. Each generated scene incorporates an average of more than 15 manipulable objects and achieves a Footprint Object Density (FOD) of 4.16, a metric reflecting the concentration of items across furniture surfaces. All objects are natively compatible with simulation engines, enabling direct interaction for tasks such as grasping, movement, and stacking.
The resulting environments move beyond “viewable but not actionable” outputs. Their coherent spatial structure enables seamless, continuous navigation across multiple rooms, while objects embedded with realistic physical properties allow robots to simulate complex household tasks end-to-end. Taken together, this approach addresses key limitations in existing data pipelines, resolving the scarcity of high-quality 3D simulation data, the lack of realism in synthetic environments, and the limited interactivity of scanned scenes within a single unified framework.
The dataset: 300,000 real floor plans, 5,000 fully interactive homes, built for Chinese households ACE ROBOTICS and CUHK are open-sourcing a dataset of 300,000 structurally annotated residential floor plans, sourced from real-world listings and processed through a multi-stage automated pipeline. The pipeline vectorizes and labels key spatial elements, including door and window positions, room geometry, functional zoning, and connectivity. By comparison, widely used benchmarks such as RPLAN and ResPlan contain approximately 80,000 and 17,000 floor plans, respectively, underscoring the scale and comprehensiveness of the Kairos-HomeWorld dataset.
Building on this foundation, the dataset also includes 5,000 fully furnished residential environments, each featuring a complete furniture layout and an average of more than 15 physics-enabled, manipulable objects, powered by the PhysX-Omni model. All assets are sim-ready and can be directly imported into a simulation engine, enabling immediate use in interactive training scenarios.
Most existing open indoor-scene datasets are centered on North American and European residential formats, typically featuring open-plan kitchens, the absence of service balconies, and layouts and design elements that capture only a narrow segment of global housing. As a result, robots trained on these datasets often exhibit limited transferability when deployed in environments outside their scope. Kairos-HomeWorld ‘s dataset is purpose-built for Chinese households, with deliberate coverage of historically under-represented housing typologies. It spans a wide range of unit sizes, from approximately 30 m² (around 320 sq ft) studio apartments to residences exceeding 200 m² (approximately 2,150 sq ft). The dataset accurately reflects key architectural features common in these settings, including north-south cross-ventilated layouts, enclosed kitchens, dedicated service balconies, wet-and-dry-separated bathrooms, and entryway storage, as well as the irregular room configurations often found in older housing stock.
The dataset is being openly released to both academic and industry communities. Going forward, the team plans to expand its scope to include additional regions, interior styles, and interaction scenarios, further lowering barriers to real-world-ready training for embodied intelligence.
See it in action: one prompt to a fully interactive home Kairos-HomeWorld runs the full end-to-end pipeline, from initial text input to a fully interactive home environment, delivering global spatial consistency, physical realism, and seamless interactivity from a single prompt.
The system begins with a single-line prompt: “Generate a 90 m² (approximately 970 sq ft) two-bedroom apartment in neo-Chinese style.” Leveraging real floor plan data and its K-D tree representation, Kairos-HomeWorld first constructs an empty spatial layout aligned with real-world living patterns, incorporating cross-ventilation and well-defined functional zoning. Building on this foundation, a hierarchical “global layout plus first-person detail” approach furnishes the environment with stylistic coherence, while a PhysX-Omni rendering pass assigns full physical properties to all surfaces and objects, including articulated behavior, ensuring the scene is fully interactive and sim-ready.
A single natural-language instruction, “tidy the whole home”, is decomposed by the robot into a variety of discrete sub-tasks, executed sequentially along a complete navigation path spanning the living room, bedrooms, kitchen, bathroom, and dining area. The robot recognizes objects, plans efficient routes, and performs precise manipulation tasks, including articulated-object interactions for opening refrigerator and cabinet doors, fluid interactions for pouring laundry detergent, soft-body interactions for drawing curtains, irregular-object interactions for grasping apples, and gravity-based physical interactions for placing snacks.
Conventional simulation environments typically support navigation-focused training in isolation. By contrast, Kairos-HomeWorld integrates globally consistent spatial structures with objects that embody realistic physical properties. This enables robots to interact naturally with more than 15 object types, accurately modeling real-world dynamics such as collision, gravity, and friction, and to rehearse the full lifecycle of complex household tasks entirely within a virtual environment.
Across the industry, the same structural bottleneck, the scarcity of home-scale training data, is being addressed through multiple approaches. For example, Figure AI’s collaboration with Brookfield focuses on collecting human activity data across more than 100,000 residential units. Kairos-HomeWorld addresses this challenge through on-demand synthetic generation, delivering scalable training environments enhanced with object-level physical realism, capabilities that real-world data capture alone cannot fully provide.
In contrast, Kairos-HomeWorld delivers significantly lower costs and higher efficiency for household robot training. Powered by its world model, it can programmatically generate diverse Chinese home simulation scenes and physics-enabled interactive objects at scale.
Robots can complete a full range of household tasks training entirely within the virtual environment. New scene generation incurs near-zero marginal cost, eliminating substantial real-world testing expenses such as site operation and maintenance and furniture damage. Meanwhile, unconstrained by the limited stock of physical residential properties, it outperforms real-world data collection approaches in both training efficiency and scalable expansion.
Kairos-HomeWorld is already deployed in ACE ROBOTICS’ embodied intelligence training workflows, enabling full-pipeline simulation of long-horizon household tasks, including cross-room navigation and multi-room tidying. By allowing robots to rehearse complete task sequences in a virtual environment, the platform significantly shortens the simulation-to-reality transfer cycle. This approach lowers barriers to developing embodied intelligence systems and supports the accelerated, large-scale deployment of home robotics, particularly within the Chinese market. Kairos-HomeWorld is now available on GitHub.Hashtag: #ACEROBOTICS
The issuer is solely responsible for the content of this announcement.
About ACE ROBOTICS
Equipping robots with intelligent “brains” and engaging “souls”.
ACE ROBOTICS is a pioneering robotics company dedicated to advancing the field of embodied intelligence. Through breakthrough technological innovations and deep insights into embodied intelligence scenarios, we aim to empower robots with the ability to autonomously understand and explore the physical world, thereby accelerating their commercial implementation.
The company pioneered the ACE R&D paradigm and built a vision-based “environmental data engine, real-world cognition, embodied interaction generalization” technology chain. Using full spatiotemporal and multi-perspective environmental capture as its engine, along with Kairos 3.0 – China’s first open-source and commercially applicable world model – plus the Embodied Foundation Model as its technical backbone, ACE ROBOTICS addresses core industry challenges such as data scarcity, common sense gaps, poor generalization, and limited versatility. Simultaneously, the company unveiled its flagship A1 Embodied Super Brain Module, accelerating the large-scale commercial deployment of embodied intelligence across diverse scenarios.
ACE ROBOTICS is both a technology pioneer and an ecosystem builder. Through strategic cooperation with top hardware manufacturers, cloud service providers, and vertical scenario partners, we have broken through the “model-hardware-scenario” industrial deadlock, providing standardized and customized solutions that are driving the development of China’s embodied intelligence industry.
Developers using npm packages were put on alert after a fast-moving supply chain attack compromised at least 57 packages and pushed more than 286 malicious versions to the registry in less than two hours on June 3, exposing a fresh weakness in the way JavaScript projects handle native build files. The campaign began at about 23:30 UTC with the compromise of @vapi-ai/server-sdk, the official server-side software development […]
Arabian Post Staff -Dubai Microsoft has tested a wearable AI badge for office workers as part of a wider effort to move artificial intelligence agents beyond laptops, phones and traditional software applications. The device was shown at Microsoft Build 2026 in San Francisco under Project Solara, a new chip-to-cloud platform designed for hardware that runs AI agents instead of conventional apps. The badge concept resembles a workplace […]
Attackers have compromised Red Hat’s official @redhat-cloud-services namespace on npm, inserting credential-stealing malware into dozens of package releases used in cloud console development and software build pipelines. The breach, identified on 1 June 2026, affected at least 32 package releases across the Red Hat Cloud Services ecosystem, including frontend components, generated API clients and supporting developer tooling linked to the Red Hat Hybrid Cloud Console. The malicious […]
Hackers have used 34 malicious open-source packages across npm, PyPI and Crates. io to steal cloud credentials, crypto wallet data, SSH keys and developer secrets, exposing a widening security gap in software supply chains used by blockchain, artificial intelligence and cloud engineering teams. The campaign, tracked as TrapDoor, spans more than 384 package versions and artefacts. It targets developers working in cryptocurrency, DeFi, Solana, Sui, Move, AI […]
A malicious NuGet package posing as a Sicoob software development kit has exposed sensitive banking authentication data, intensifying concerns over attacks that exploit trust in open-source developer ecosystems. The package, published as Sicoob. Sdk, was presented as a C# SDK for integrations with Sicoob, one of Brazil’s largest cooperative financial systems. Versions 2.0.0 to 2.0.4 were found to collect client IDs, PFX passwords and base64-encoded PFX certificate […]
Trusted software development tools have become a prime attack channel as adversaries target the systems that programmers use to build, test and deploy code, exposing companies to stolen credentials, leaked source code and compromised software pipelines. The warning has sharpened after multiple campaigns hit developer ecosystems during May, including a poisoned Visual Studio Code extension linked to Nx Console and a large-scale GitHub Actions operation known as […]
Cybercriminals are shifting from crude misspellings of trusted software packages to more convincing names that appear to belong inside legitimate developer ecosystems, raising fresh concern across open-source security teams and enterprise software supply chains. The change marks a significant evolution in package impersonation attacks. Rather than relying only on a developer mistyping a package name, malicious publishers are creating packages that look like natural extensions, plugins, configuration […]
Microsoft is preparing to scale back internal use of Anthropic’s Claude Code and move thousands of developers towards GitHub Copilot CLI, marking a sharper push to consolidate AI coding work around tools it owns and governs more directly. The reported shift affects the company’s Experiences and Devices division, which covers major product groups including Windows, Microsoft 365, Outlook, Teams and Surface. Engineers using Claude Code have been […]
Developers using Angular’s official Visual Studio Code extension have been urged to update their systems after multiple high-severity flaws were found to expose workstations to remote code execution through malicious project files and dependencies. The vulnerabilities affect Angular Language Service, published as Angular. ng-template on the Visual Studio Marketplace, in all versions before 21.2.4. The patched release closes weaknesses that could allow an attacker to execute commands […]
Microsoft’s early lead in AI-assisted software development is coming under pressure as outages at GitHub, leadership changes, security incidents and fast-moving rivals reshape one of the most important contests in enterprise technology. GitHub Copilot gave Microsoft a commanding start in the AI coding race. It was launched before many competitors had mature developer products, and it benefited from GitHub’s position at the centre of global software collaboration. […]
Hackers have compromised the Laravel-Lang open-source ecosystem, turning trusted PHP localisation packages into a vehicle for credential theft and remote code execution across developer machines and build systems. The attack, detected on May 22, targeted packages used by Laravel applications to manage translations, attributes and HTTP status messages. Security teams tracking the incident identified malicious activity across laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes and laravel-lang/actions, with more than 700 historical […]
India’s rapid AI adoption is exposing weak points in software supply chain security, with enterprises expanding automated development faster than their ability to detect compromised packages, unsafe containers and unverified AI components.
A 2026 software supply chain security assessment shows that about 65 per cent of organisations in India cannot detect malicious packages, while 71 per cent do not use container security tools. The findings underline a widening gap between the speed of AI-led software development and the controls needed to secure code, dependencies, models and deployment pipelines before they reach production systems.
Security teams are facing a more complex threat environment as AI coding assistants, model registries, agent frameworks and machine-learning libraries become embedded in day-to-day software engineering. AI is no longer confined to application features or analytics layers. It is becoming part of the software supply chain itself, influencing how code is written, tested, packaged and deployed.
Enterprises in India have been quick to adopt AI tools to improve developer productivity, reduce repetitive work and accelerate product releases. Yet the same shift has increased reliance on open-source packages, pre-trained models, plug-ins and automated build systems. Each of these components can introduce hidden risks if provenance, integrity and behaviour are not continuously verified.
Global software repositories are now attracting sustained attacks because they provide a direct route into enterprise development environments. Malicious npm packages rose by 451 per cent during 2025, while more than 48,000 new Common Vulnerabilities and Exposures were disclosed worldwide, a rise of about 20 per cent from the previous year.
The pressure on security teams is being amplified by the volume of AI-generated code. Developers in India are spending about 51 per cent of their time reviewing, validating and hardening code produced by AI tools. About 53 per cent treat such output only as a starting point and review every line before use, while 11 per cent rewrite AI-generated fixes from scratch.
This shift has altered the economics of software engineering. AI may reduce the time needed to draft code, but it can also transfer effort to verification, testing and security review. Weaknesses such as cross-site scripting, SQL injection and missing authorisation checks can still be reproduced by automated tools, particularly when developers rely on generated code without adequate scrutiny.
Governance is emerging as another area of concern. Nearly 97 per cent of organisations surveyed said they had certified AI model governance programmes, but only 59 per cent claimed full provenance visibility across production environments. About 48 per cent still needed a week or longer to produce audit-ready compliance evidence.
That gap points to a difference between policy and enforceable control. Many enterprises have AI governance frameworks on paper, but fewer can prove where every model, library, container image and software artefact came from, how it changed, who approved it and whether it complies with internal policy.
CERT-In has also warned that software supply chain compromises are increasingly targeting developer tools and trusted repositories. Its April 2026 activity note referred to attacks affecting npm, PyPI, GitHub Actions and container registries, including incidents involving Checkmarx, Trivy, LiteLLM, Axios, Telnyx and npm packages linked to the CanisterWorm campaign. The payloads observed in these attacks included credential harvesting, data exfiltration, remote execution and persistence within developer systems.
Model registries have added another layer to the risk. Around 1.4 million new AI artefacts were published on Hugging Face during 2025, representing 58 per cent of all new software packages tracked in one assessment. Researchers identified 495 malicious AI models in public repositories with active payloads capable of credential theft, command execution and reverse-shell activity, along with 969 malicious AI-agent skills designed to exploit developer environments and automation workflows.
For enterprises in India, the challenge is sharpened by the country’s role as a major software engineering and global capability centre hub. Bengaluru, Hyderabad, Pune, Chennai and Gurugram host large engineering teams serving banking, retail, telecoms, manufacturing and cloud services. These centres are increasingly responsible not only for maintenance work but also for product development, AI integration and security-sensitive digital platforms.
Regulatory and customer expectations are also tightening. Buyers are asking for software bills of materials, vulnerability disclosure processes, provenance records and proof that build pipelines are protected. CERT-In’s technical guidance on SBOM, QBOM, CBOM, AIBOM and HBOM has emphasised regular updates, vulnerability exploitability exchange documents and staff training around software supply chain visibility.
Security leaders are therefore moving towards stronger controls across development pipelines. These include automated malicious package detection, container image scanning, secrets detection, signed artefacts, dependency pinning, model provenance checks, policy enforcement in CI/CD systems and continuous monitoring of developer environments.
The investment case is becoming harder to ignore. Software supply chain attacks can bypass perimeter defences because they enter through trusted development channels. Once inside, malicious packages can steal credentials, alter builds, move into cloud environments or compromise downstream customers. AI raises the stakes because it can accelerate both legitimate development and attacker experimentation.
https://www.linkedin.com/company/acerobotics/posts/?feedView=all&viewAsMember=true%EF%BD%9C
https://x.com/ace_robotics
