Google has been all-in with Gemini for the last several years, and despite some animosity online, the bet is paying off. CEO Sundar Pichai announced today that Gemini has reached 1 billion monthly active users (MAUs), an important milestone for any Google product. While 13 other Google products have managed that feat, Gemini has done it faster than any other.

Gemini has wormed its way into virtually every Google product and service, powering email organization in Gmail, document summary in Drive, and much more. Gemini is also core to Google's flagship search experience, with AI Mode and AI Overviews becoming increasingly hard to avoid. The 1 billion-user metric has nothing to do with any of that, though.

These 1 billion users may also be encountering Gemini in all those places, but that's not the MAU metric. Pichai is talking only about people who are opening the Gemini app or visiting the Gemini web interface to enter a prompt or access Gemini Live. If you used Gemini only once in the past month, you are part of this cohort.

Josh Woodward, Google's VP overseeing Gemini, has expanded on Pichai's announcement with additional tidbits about how people use the chatbot. Apparently, an impressive 63 percent of Gemini's active users are using voice input, and an increasing number of them are "voice-only" users. Of the people who use Gemini Live, 20 percent are sharing their camera feeds and screens with the robot to get help.

It's no secret that students use AI models to do their work (sometimes too much). Woodward says that 38 percent of school-related requests include an attachment, so Google is working on a new batch of study tools to be released in the coming weeks to better support that.

On the image-generation front, Google is burning tokens like never before. Those billion users are turning to Google's AI to make a staggering 150 million images every day. Woodward alleges that businesses love these Nano Banana images to make marketing materials, but plenty of them are probably memes and jokes being spread around the Internet. They're all watermarked with SynthID, but that might not help us know what's true in the future.

Getting a billion people to do anything is a major accomplishment, but Google does have some notable advantages. Virtually every Android phone in the world right now ships with the Gemini app and multiple features that guide people toward using the AI. It's not all due to Google's software, though. Woodward says that more than 100 million of Gemini's MAUs are on iOS, where they would have to manually download the Gemini app in addition to (or instead of) something like ChatGPT or Claude.

An upward trend or a blip?

So Gemini has clearly seen huge success over the past two years, at least as far as user numbers go. Google doesn't break out AI in its earnings reports, but we know the company's spending on AI infrastructure has pushed its cash flow into negative territory for the first time ever. It's throwing a lot of money at AI to get those numbers up, and who knows if they'll stay there.

Google's progress in AI models was impressive throughout 2025, but there's a sense that its efforts may be hitting a wall. The company has lost several key scientists and researchers in recent months, and DeepMind cofounder Demis Hassabis has stepped down from his leadership role. While he's still at Google, reports suggest he's not very interested in the hyperscaling route that Google is taking with AI.

This internal shakeup may have contributed to slowing progress with Gemini. At I/O this year, Google promised it would release Gemini 3.5 Pro, its latest frontier model, in June. However, that window came and went with no word. Last month, Google said it was still working on Gemini 3.5 Pro and had already started training Gemini 4. Reports have indicated that Google is unhappy with Gemini Pro's coding performance, which lags OpenAI and Anthropic models. At this point, it's unclear if we'll ever see Gemini 3.5 Pro.

Gemini is still capable enough for most users, but the cracks are beginning to show. Even Google's dominant market presence may not be enough to prop up Gemini's numbers if it underperforms the competition for long enough.

Read full article

Comments

When car companies attempt to reach younger, trendier audiences through cross-promotional lifestyle branding, the result is usually a branded hoodie, an overpriced wristwatch, or perhaps a sleek electric scooter that nobody asked for.

Nissan’s motorsport division, NISMO, has decided to leap straight past the conventional swag bag and instead head directly for dental cosmetics.

As it bids to celebrate the finale of the ABB FIA Formula E World Championship in London this weekend, NISMO has partnered with London-based custom jeweler LOUD MOUTH LDN to craft a set of bespoke “grillz” inspired by iconic Nissan performance cars.

While it reads like a rejected April Fool’s gag, this collaboration is literally putting grilles on your grill as it takes the front ends of four well-known performance and motorsport Nissan machines and reinterprets them for your front teeth.

Ordinarily, grillz are silver- or gold-based tooth jewelry, and there are pretty wild designs out there, some even with precious gems embedded in them. These four Nissan pieces are much more brightly colored than the norm though, based on the subject matter.

That begins with the bright blue of the R34 Skyline GT-R, with Bayside Blue enamel laid over the silver base. The design includes the intakes of the lower front end and little amber accents to mark the indicators on the only set inspired by a road car.

A second R34 features on a yellow set, based on the Pennzoil livery of the two-time champion GT500 race car from the All-Japan Grand Touring Championship (JGTC) series. This slightly less complex design features the race car’s deeper air dam and the stripes of the livery complemented by sponsor-inspired roundels.

There’s a red set taking its cues from the more modern Nissan Z GT500, used in the successor Super GT series. This set looks like it includes the Z’s headlights and something that could be an attempt to replicate the front wing stays.

Finally there’s the most relevant vehicle, the outgoing Gen.3 Evo Formula E of the NISMO team, with a detailed design featuring the car’s sakura livery, #23 race number, and a full front wing assembly. This car is in with a chance of securing a second successive driver’s title for Barnsley-born Oliver Rowland in the season-ending double-header, though he currently sits in fourth.

Before you run out to schedule a dental impression kit, there is a catch: Nissan is treating this absurdly detailed project as a one-off artistic showcase rather than something destined for even limited production.

The collection will be put on public display at the Westfield Stratford City mall before moving a couple of miles down the road to ExCeL London for the Formula E race weekend (August 15-16), where attendees will have a chance to win a custom piece created by the jeweler.

There’s been some strange promotional automotive tie-ins, but NISMO placing Super GT styling cues directly onto your teeth feels like a high-water mark for factory-backed weirdness.

It may not add horsepower, but it gives new meaning to “smiles per gallon.”

Top graphic image: NISMO

The post Nissan Just Created The Weirdest Merch But Doesn’t Have The Guts To Sell It appeared first on The Autopian.

Last week a researcher outlined what he said was a “novel attack surface” in passkeys, the new authentication paradigm that offers a more secure alternative over password-based methods. In fact, the attacks demonstrated in the post are neither novel nor unique to passkeys. This distinction is important because the research has generated confusion among end users and security professionals as they assess whether this new mechanism is truly safe to use.

The attack is called Pass-ta-key—a blending of the word passkey with the phrase “pass the key” and a nod to a plate of pasta. Arie Olshtein, a researcher at security firm Palo Alto Networks, described in a post last week how Pass-ta-key could obtain all passkeys stored in the Google Password Manager app (GPM) for Windows when it’s running on a machine infected with malware.

This came as a surprise to many people because they believed passkeys are stored exclusively in the trusted platform manager (TPM), the locked-down enclave in a hardened silicon chip that’s reserved for storing cryptographic keys and other highly sensitive information on Windows machines. If passkeys are stored in the TPM, then how was Pass-ta-key able to extract the entire set of passkeys stored by the app, they wanted to know.

Local passkey storage is OK, with one exception

The answer is that, contrary to common belief, the FIDO 2 specifications—managed by the industry group FIDO Alliance—don’t mandate that passkeys be kept in TPMs, or any other sort of dedicated piece of hardware (they go by different names, depending on the platform, including secure enclaves, trusted execution environments, and StrongBoxes). In fact, most platforms and third-party software for managing passkeys do not store passkeys in such dedicated hardware. Virtually the lone holdout is Microsoft, which gives users the option to store passkeys in the Windows TPM. The company mainly recommends this choice to enterprises, not consumers.

Unbeknownst to me until I began research for this article, all platforms other than those running Windows store passkeys locally on the device. The shift to local storage came a few years ago after OS and third-party application developers realized that passkeys had no chance of gaining widespread usage unless they could easily be synced to all of a user’s devices. Requiring TPM storage made syncing impossible. The only way to load them into the TPM of a new device would be to re-create each one individually.

Ultimately, architects of the FIDO specifications decided that it was generally safe to store passkeys on the devices. The thinking was that app permissions are so granular that malware lurking on the device would have no ability to access the private keys that form the lynchpin of passkey security. Malware installed on a device running macOS, iOS, and Android, for instance, has no ability to defeat this isolation unless the OS itself is compromised through some sort of exotic zero-day exploit. So far, these assumptions have been proven correct in real-world practice.

The lone exception is Windows. Unlike all the other platforms, Windows apps generally run with all the privileges of the user, whereas other platforms encourage the restriction of the privileges of each application by default. While Windows provides some sandboxing protections designed to isolate apps, it doesn’t prevent unsandboxed apps, such as malware, from accessing the data of a sandboxed app. That is, the sandbox only protects in one direction. Sandboxing technologies on other platforms are much more protective.

That means Windows malware has decidedly fewer problems accessing data used by a separate app. Passkey architects have been keenly aware of this difference, which is largely necessary for Windows backward-compatibility reasons. With no confidence that passkeys stored on a Windows device won’t be harvested in the event of a malware infection, many third-party developers opted for a new design—storing the passkeys in end-to-end encrypted blobs located in the cloud. Server-stored passkeys are now the design used not just by GPM for Windows, but 1Password, Dashlane, and other third-party apps for the Microsoft OS as well.

At a simplified level, here’s how it works: When a Windows GPM user wants to use a passkey to log in to a site, the device retrieves a user and/or device key from the TPM and presents it to Google’s backend authenticator. Presentation of the key, combined with the device already being signed in to the user’s Google account, triggers the Google server to present an authentication assertion to the site the user wants to log in to. The assertion is signed with the private key, which is stored in encrypted form on the Google server. With that, the user is logged in. Again, most other third-party apps for Windows work the same way.

Those same apps for other platforms, by contrast, store passkeys locally on the device. When a user wants to log in using a passkey, the local device—not the one in the cloud—presents an authentication assertion. It’s signed by the private key, which is also stored in encrypted form on the local device.

When your device is infected, all bets are off

The malware in the Pass-ta-key attacks uses its access to the Google account—and in some cases, the user or device key stored in the TPM—to obtain the secret passkeys. The most powerful of the three attack variants causes the infected Windows machine to masquerade as an iPhone. This triggers a synchronization capability in GPM that allows users to transfer all stored passkeys to a new device. The keys are now transferred to the infected Windows device.

Olshtein described Pass-ta-key as a “novel” attack that targets the attack surface in the passkey ecosystem. The reality is more nuanced. The stakes of this attack would be much the same if an infected Windows machine was fully authenticated into other sensitive apps. The attacker on the other side of the keyboard would likely be able to activate the mechanisms in the credential management app to log in to a site or download all the passwords.

This risk has always been present and is the reason some people regard password managers as unsafe to use. Based on Olshtein’s write-up, it’s possible that GPM lacks some protections found in password managers like 1Password, such as calling OS APIs to restrict other processes from reading its memory. Generally speaking, though, it is universally accepted that it’s game over whenever an infected device is logged in to a sensitive account. In other words, Pass-ta-key is a fact of life that has existed for as long as computing security has. There’s nothing novel here, and the attack surface extends to any data that requires authentication for access.

The purpose of passkeys is to eliminate a shared secret that can be phished or obtained through server breaches. Passkeys aren’t intended to withstand physical attacks against the devices that store them. It’s not surprising that Pass-ta-key can extract keys when a Windows device is compromised. The research may not be novel, but it will be helpful nonetheless if it helps users understand that once a device—particularly one running Windows—is compromised while it’s logged in to an account, all data stored there is free for the taking.

Read full article

Comments

Social media scuttlebutt about Mark Zuckerberg’s $300 million super yacht failing to assist stranded boaters off the coast of Alaska was partly corroborated by ship-tracking data—and eventually prompted responses from both the US Coast Guard and a spokesperson for Zuckerberg.

The incident was made public when Michael Love, a passenger aboard the replica steamship Wilderness Legacy during an Alaska cruise, posted about it on the social media platform Bluesky. The ship detoured to rescue a stranded 21-foot skiff with two women, a child and a dog, after the US Coast Guard had supposedly first radioed Zuckerberg’s superyacht, Launchpad, for help without success.

“There was near unanimous booing when the captain announced this,” Love wrote in describing the Alaska cruise passengers’ response to the lack of help from Zuckerberg’s ship.

The US Coast Guard described being hailed for assistance by the stranded boat located near Point Highland, Alaska, at 9:32 pm on August 3, in a statement shared by Halifax Shipping News. After the Coast Guard determined the vessel was not in distress, it issued a marine assistance request broadcast asking for voluntary help from nearby mariners.

This is an important distinction because it means nearby vessels were not legally obligated to respond. If the Coast Guard had determined the stranded boat was in distress, then both international maritime law and US law would have legally required ship captains to render assistance.

Although Launchpad and its $30 million support ship, Wingman, were not legally obligated to assist in this case, it may have represented a missed opportunity to do a little bit of good, according to Love, the passenger aboard the Wilderness Legacy.

“Frankly, if I was Mark Zuckerberg I would be absolutely ecstatic at a chance to do something helpful for someone in need and maybe get some good PR out of it,” Love told the Alaska Beacon in a Bluesky message.

Mark Zuckerberg and his family were not aboard the super yacht at the time of the incident, according to a spokesperson for the Chan Zuckerberg Initiative in a statement shared with Halifax Shipping News and the Alaska Beacon.

What the ship-tracking data shows

Ship-tracking data using AIS transponder data actively broadcast by each vessel shows that Zuckerberg’s 387-foot super yacht was initially moving ahead of the 192-foot Wilderness Legacy at a slightly faster speed. But then Launchpad slowed to a stop and allowed Wilderness Legacy to pass it.

Wilderness Legacy appears to proceed with assisting the stranded boat, as described by the YouTube channel The Yacht Report in a video showing the AIS tracking paths. The Coast Guard confirmed that the ship towed the boat to Farragut Bay so that it could find safe anchorage, and the Alaska Beacon reported that Wilderness Legacy was able to refuel the skiff for the rest of its journey.

However, the Coast Guard statement made no mention of Zuckerberg’s superyacht, Launchpad.

Launchpad’s support ship, Wingman, is described by the publication YachtWorld as being equipped with deck space for carrying a helicopter, a Triton submarine that acts as a personal submersible for superyachts, water scooters, and multiple smaller boats.

Ship-tracking data shows that Wingman moved past both Launchpad and the Wilderness Legacy without stopping. It also shows that Launchpad finally resumed moving again after the Wilderness Legacy appeared to return from having assisted the small skiff.

The missed emergency broadcast

The Zuckerberg spokesperson offered an explanation for why Launchpad did not initially respond to the Coast Guard’s request for assistance.

“As the Coast Guard noted, the boat was not in distress, and by the time the crew reviewed the Coast Guard contact on a different radio channel from the one they were operating on, the assist was already underway,” the spokesperson said in the statement shared with news outlets. “We’re grateful all parties are safe.”

But Democrat Senator Sheldon Whitehouse of Rhode Island, himself a member of an elite sailing club, in a Facebook post criticized the lack of response from Zuckerberg’s super yacht. “Vessels are supposed to monitor channel 16 at all times, for this exact purpose,” Whitehouse wrote. “Billionaires don’t follow that rule either?”

The US government’s radio watchkeeping regulations require any vessel equipped with a VHF marine radiotelephone to maintain watch on channel 16—reserved for emergency messages—whenever the radiotelephone is not being used for communication. Marine radiotelephones typically have dual watch or even tri-watch features that specifically enable monitoring of multiple channels, with the transmissions on the emergency channel automatically taking priority.

That means any nearby ship monitoring the channel should have heard the stranded boaters asking the Coast Guard for help, along with hearing the Coast Guard’s follow-on request for assistance. It is also unclear why the crew of the support ship Wingman did not initially hear or heed the Coast Guard broadcast.

Zuckerberg’s super yacht has previously courted controversy for turning off its AIS transponder and “going dark” to avoid public ship-tracking services, according to YachtWorld. That is a tactic only used by “shadow fleet” vessels carrying sanctioned oil or gas, illegal fishing boats, and the high-profile owners of luxury yachts, such as Zuckerberg or Jeff Bezos.

But for safety of navigation reasons, the Coast Guard typically requires vessels to keep AIS activated in US waters. Such AIS tracking data helped shed a little more light on this latest controversy surrounding Launchpad.

Read full article

Comments

Talk of the affordability crisis may be penetrating corporate boardrooms. Hot on the heels of the name and starting price for Ford's new affordable electric truck, news leaked today that the sub-$30,000 Fathom isn't the only cheap Ford in the works. According to a report at Automotive News, the automaker is working on a new entry-level crossover that will start at around $25,000, although don't expect it in showrooms until 2029.

The leak is courtesy of an unnamed Ford dealer, which, together with its peers, was shown an early prototype described as resembling a first-gen Ford Escape. The crossover is said to have both hybrid and unelectrified powertrain options, and Automotive News notes that several sources have told it that Ford will assemble a hybrid crossover at its Hermosillo plant in Mexico in 2029, alongside the Bronco Sport and Maverick.

Additionally, Ford apparently showed off a four-door Mustang, which Automotive News compares to the Porsche Panamera in terms of size and styling, albeit with a sub-$40,000 price tag (making it almost a third the price of the cheapest Panamera). And a third nugget of news—the universal electric vehicle platform that will build the Fathom will result in four other electric Ford models as well.

2029 is far enough out that plenty could happen to the proposed small Ford before it reaches the streets. But average transaction prices* crept above $50,000 by the end of last year, and we're now left with a relatively small handful of new vehicles that can be purchased for less than $30,000. Even fewer if MSRP needs to be closer to $25,000. So an additional entry to that list ought to be welcome, especially if the starting price is about $25,000 in 2029 dollars. Even better would be other OEMs paying attention and following suit.

Ars reached out to Ford, which told us that it won't comment or speculate on future products.

*ATP is the statistic that the industry tracks rather than the more potentially informative median; take it up with the people who collect the statistics.

Read full article

Comments