Four stories are moving the tech world today: Microsoft and Nvidia headline a launch event in San Francisco built around local AI, OpenAI starts invisibly watermarking ChatGPT text in the EU, Google freezes its open-source bug bounty under a flood of AI-generated junk reports, and ASOS confirms a breach after hackers hijacked its own app notifications.
Microsoft and Nvidia’s RTX Spark event lands today
Microsoft’s Windows and Surface event takes place today, October 7, at 10 a.m. PT in San Francisco, with Satya Nadella, Windows chief Pavan Davuluri, and Nvidia CEO Jensen Huang sharing the stage. The headline act is RTX Spark, Nvidia’s Grace Blackwell superchip platform, and the pricing and availability details Microsoft has held back until now.
Nvidia introduced RTX Spark in May, and Microsoft previewed two machines built on it in early June: the Surface Laptop Ultra, billed as the most powerful Surface laptop ever, and a developer-focused RTX Spark Dev Box. Both remain pre-release, with the laptop listed as “later this year” and contingent on regulatory approval. Today is when buyers expect the missing commercial facts: prices, configurations, and on-sale dates.
Nvidia says the first wave of RTX Spark Windows PCs arrives in October, with six OEM machines named so far: the ASUS ProArt P16, Dell XPS 16, HP OmniBook Ultra 16, Lenovo Yoga Pro 9n, Microsoft Surface Laptop Ultra, and MSI Prestige N16 Flip AI+. The unified memory is the headline spec: up to 128GB shared between CPU and GPU, which is what lets a laptop hold large models locally instead of offloading to the cloud.
| RTX Spark platform (announced spec) | Value |
|---|---|
| CPU | 20-core Nvidia Grace (Arm) |
| GPU | Blackwell RTX, 6,144 CUDA cores, fifth-generation Tensor cores (FP4) |
| CPU–GPU interconnect | NVLink-C2C |
| Unified memory | Up to 128GB LPDDR5X, shared between CPU and GPU |
| Claimed AI performance | Up to 1 petaflop (FP4) |
| Claimed local-model capacity | Up to 120-billion-parameter models |
| Confirmed devices | 6 laptops from ASUS, Dell, HP, Lenovo, Microsoft, MSI |
| Pricing | Not announced (expected at today’s event) |
Why it matters: this is Microsoft’s parallel track to the Qualcomm-based Copilot+ line from May 2024, betting that on-device inference (lower latency, better privacy, no cloud dependency) is the next PC differentiator. One thing the event is not expected to deliver: Windows 12. Reporting from Windows Latest says the focus is AI features and hardware inside existing Windows builds. The 1-petaflop figure is a vendor theoretical number (FP4 TOPS with sparsity), not a benchmark, and no independent RTX Spark benchmarks exist yet — treat it as a claim until review units ship.
OpenAI starts watermarking ChatGPT text in the EU
OpenAI announced Monday that it will embed an invisible statistical watermark into eligible ChatGPT and Codex text and code outputs in the European Union, rolling out over the coming weeks to users on all plans. The system, called textGrain, is compliance with the EU AI Act’s transparency rules, which require machine-readable markers identifying AI-generated content.
The watermark is not a visible symbol: it subtly nudges the model’s word choices against a secret key, leaving a pattern a detector can find but readers cannot see. Because the signal lives in the words themselves, it survives copy and paste. OpenAI says the watermark does not identify the user and that it saw no meaningful change in model performance with it switched on.
The catch is durability. In OpenAI’s own tests, replacing 10% of words with synonyms dropped detection from about 92% to 66%, and replacing 25% brought it down to 17%. Detection under ideal conditions runs about 80% on 200-token passages and 95% on 400-token ones, but short text, math answers, and translated text resist detection. Because of those limits, detector access goes only to approved researchers and expert organizations at launch, and OpenAI warns that a missing watermark does not prove a human wrote the text.
Why it matters: OpenAI is not first here. Anthropic rolled out text watermarking for Claude models worldwide in August, and Google DeepMind’s SynthID-Text has shipped in products for longer. The interesting part is the precedent: a major lab now treats watermarking as a compliance feature, not an optional nicety, and the EU is where it is mandatory while the U.S. has no equivalent federal rule. Social reaction has been split between praise for transparency and predictions of bypass tools — both predictable, both probably right.
Google freezes its open-source bug bounty under AI slop
Effective October 1, Google stopped accepting product-vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP), the bounty program covering security flaws in Google-maintained open-source projects like Golang, Angular, Bazel, Protocol Buffers, and Fuchsia. The reason, in Google’s words: “a significant rise in automated submissions, the vast majority of which are not valid.”
The pause covers only product-vulnerability reports. Supply-chain reports keep running, outstanding submissions are unaffected, and researchers are pointed at Google’s other bounty programs or the Patch Rewards Program (up to $15,000 for high-impact fixes). Google says it is reworking the OSS VRP and will give an update in Q1 2027.
Why it matters: this is the cost of AI-assisted vulnerability hunting made concrete. Since launching its first bounty in 2010, Google has paid out over $81.6 million; 2025 was a record year at $17.1 million to more than 700 researchers, up 40% from $12 million in 2024. The OSS VRP itself launched in August 2022 with rewards of $100 to $31,337. Generative tools made report generation cheap, and the validation cost landed on maintainers — hours spent verifying hallucinated findings instead of fixing real bugs. The program’s own reward table now shows a dash where the product-vulnerability payouts used to be. Other bounty programs are watching how Google handles the triage problem, because they all face the same flood.
ASOS confirms hack after push notification hijack
On Tuesday morning, ASOS app users received a push notification addressed to “Dear Asos DPO and IT” claiming the hackers had “fully compromised the Snowflake instance” and demanding engagement “or we will leak it.” The message included a link to a Telegram channel run by a group calling itself “Xuanye,” meaning “Mysterious Splendour” — a name that matches no known hacking group.
ASOS said it is investigating unauthorized activity involving third-party platforms it uses to communicate with customers, and that “basic personal information including name and contact details may have been accessed.” The company said it does not believe payment-card information or account passwords were impacted, and its website and app kept operating normally. Shares in the FTSE 250 retailer fell as much as 14% to 432p after the alert. Snowflake said it had found no compromise of its platform.
Why it matters: the attack method is the story. Breaching a retailer’s push-notification system to extort the company in front of its entire customer base is brazen and, by the reporting so far, unprecedented. It is also the latest in a run of attacks on British companies: Marks & Spencer and the Co-op were hit in spring 2025, and Jaguar Land Rover’s August attack reportedly cost around £2bn across the company and its suppliers. Notification and marketing infrastructure is now a demonstrated attack surface — worth a hard look for anyone running customer communications through third-party platforms.
Key takeaways
- Today’s Microsoft event is the commercial launch of RTX Spark: prices, configurations, and availability for the Surface Laptop Ultra and five other laptops are the facts the industry is waiting for.
- AI text watermarking is now a compliance feature: OpenAI’s textGrain makes the EU the testbed; detection is real but fragile under editing (92% to 66% with 10% word swaps).
- Bug bounties have an AI-triage problem: Google’s OSS VRP freeze shows validation cost, not exploit novelty, is now the bottleneck for open-source security programs.
- Push notifications are an attack vector: the ASOS breach used the company’s own app to broadcast an extortion demand to every user.
References
- Microsoft and NVIDIA Confirm October 7 RTX Spark and Surface Hardware Event — Guru3D
- Microsoft Confirms October 7 Windows and Surface Event Featuring RTX Spark — GadgetReview
- OpenAI will start watermarking ChatGPT’s text in the EU — TechCrunch
- Google halts open-source bug bounty program amid AI spam surge — BleepingComputer
- ASOS ‘hacked’: app customers get alert suggesting data breach — The Times
- ASOS shares slide after hackers target online retailer — CNA
Was this useful?
Thanks for the feedback.
