The warning no one expected from Microsoft’s CEO

Satya Nadella has never been one for dramatic pronouncements. The Microsoft CEO is known for his calm, almost clinical demeanor. So when he published a blog post on Sunday that reads like a warning shot at the very industry he’s helped build, people noticed.

His message to companies using AI is blunt: you’re paying twice. Once with money for tokens. And again with something far more precious—your proprietary knowledge.

“You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful,” Nadella writes. “The better you want the model to perform, the more of that knowledge you have to feed it!”

This isn’t a fringe concern. Venture capitalists like Jason Calacanis and Palantir CEO Alex Karp have been sounding similar alarms for months. But when the CEO of a company that has poured billions into OpenAI and Anthropic says it, the conversation shifts.

What Nadella means by “paying twice”

Here’s the core of his argument. When your company uses a proprietary AI model, you’re not just renting intelligence. You’re training it.

Every prompt your employees write. Every correction they make when the model gets something wrong. Every tool the agent touches. Nadella calls this “exhaust,” and he says it gets distilled into institutional know-how.

“Every correction is distilled into institutional know-how,” he writes. “This is the kind of knowledge a competitor could never buy.”

Think about that for a second. You’re teaching a model the nuances of your business—your pricing strategies, your customer pain points, your internal workflows. And the model maker gets to keep all of it. The concern is that labs like OpenAI and Anthropic could one day use that knowledge to compete against their own customers.

The distillation double standard

Nadella’s solution is as elegant as it is pointed. He argues that if AI companies get to scrape the entire internet to train their models, then enterprises should have the right to study those models in return.

“Distillation” is the practice of using a model’s outputs to train a cheaper, more efficient model. In February, Anthropic accused Chinese open source models of sending millions of prompts to Claude to improve their own systems. The company urged the U.S. government to crack down on export controls.

Nadella sees hypocrisy here. “While the great innovation that comes from model providers having fair use rights to train models on public data is needed, I find it ironic that the status quo is to then turn around and impose restrictive terms on distillation,” he writes.

You can’t have it both ways, in other words. If the world’s data is fair game for training, your model’s outputs should be fair game for learning.

What Nadella wants companies to do

His advice is exactly what you’d expect from the CEO of a giant cloud provider. He wants companies to:

• Retain ownership of all data—prompts, feedback, everything
• Build proprietary learning environments on the cloud (where your data likely already lives)
• Create “orchestration layers” that let you switch between AI models easily

That last point is key. Instead of being locked into one provider, companies should be able to route requests across multiple models. Tools called AI “gateways” are already doing exactly this, and they’re growing fast.

Nadella never says the words “open source” in his post. But the subtext is unmistakable.

The on-prem shift is already happening

Here’s the thing: enterprises aren’t waiting for permission. Many of them are already moving to open source models installed on their own servers.

Idit Levine, CEO of Solo.io, which makes networking and security software for enterprise AI systems, says she’s seeing this shift play out in real time. Her customers start with proprietary models, then start asking questions.

“Can I take an open source model and run it on-prem? It will do almost 90% of what the big one’s doing. It will cost way less,” Levine told TechCrunch. “They understand that, and they can control it.”

Solo.io’s technology powers the Linux Foundation’s Agentgateway project. Its customers include T-Mobile, ADP, and SAP. Levine sees on-prem open source models as the next big wave in enterprise AI.

She’s not alone. Vercel, the web hosting platform that recently added AI model-switching tools, and OpenRouter, which helps developers route requests across AI models, are both seeing surges in traffic to open models. Last month, open models accounted for 29% of all traffic routed through Vercel’s gateway.

What this means for the future of enterprise AI

When the CEO of Microsoft—a company with deep financial ties to both OpenAI and Anthropic—openly urges companies using AI to be wary of proprietary models, something has shifted.

The economics are compelling. Open models are getting close to proprietary performance at a fraction of the cost. And the data ownership argument is getting harder to ignore. Why would you hand your competitive advantage to a model maker when you could keep it in-house?

Nadella’s closing line sums it up: “In consuming intelligence, you are creating intelligence. And what you create should belong to you.”

Whether you agree with him or not, the trend is clear. Companies are waking up to the hidden cost of proprietary AI. And they’re starting to look for alternatives.

For more on how to protect your data when working with AI, check out our guide on AI data ownership best practices. And if you’re evaluating model options, our breakdown of open source vs proprietary AI models can help you decide.

Your phone’s lock screen is supposed to be a wall. This Gemini bug just kicked a hole in it.

Since May, researchers have been quietly reporting the same troubling scenario to The Register: someone grabs your Android phone, taps the lock screen, and starts sending texts through Google Gemini — no PIN, no fingerprint, nothing. The flaw affects Android 16 devices where Gemini can be summoned directly from the lock screen.

It’s a narrow exploit, sure. But it’s nasty enough that Google has already confirmed a fix is on the way. In fact, the company says the full patch is scheduled to roll out this week.

How the Gemini lock screen bug works

The trick hinges on a specific, awkward timing move. Normally, if you’ve revoked Gemini’s access to Messages, asking it to send a text from the lock screen forces you to open the app — and that’s where your PIN gets checked. But there’s a loophole.

Press Continue at the exact same moment Gemini’s Add Attachment button appears, and the authentication check simply never fires. The SMS goes through as if you’d unlocked the phone yourself.

It gets worse from there. Typing @WhatsApp into Gemini’s text field can silently reconnect apps you had previously disconnected — again, no PIN required. Afterward, checking your settings would show WhatsApp linked to Gemini as if you’d approved it with your own thumb.

The exact sequence that breaks the PIN check

• Open Gemini from the lock screen and ask it to send a message.
• When prompted, tap Continue and Add Attachment simultaneously.
• The app proceeds without authentication — SMS and even WhatsApp messages go out.

It’s a race-condition flaw, the kind that’s notoriously hard to patch perfectly. But Google says the fix is already being deployed.

How risky is this exploit really?

Let’s be clear: this isn’t a remote attack. Someone needs physical access to your phone to pull it off. That makes it less terrifying than, say, a zero-click exploit from a malicious website.

Still, researchers warn it’s a real problem for phone theft. A thief who grabs your unlocked — or even locked — device could fire off convincing messages to your contacts before you ever get a chance to lock it down remotely. Imagine your mom getting a text that sounds exactly like you, asking for money, sent from your actual number.

And it’s not just Pixel devices. Some users say they couldn’t reproduce the bug on Samsung phones, but Google hasn’t clarified which manufacturers or models remain vulnerable. That ambiguity is its own kind of risk.

What should you do right now?

Until the patch lands on your phone, the safest move is simple: turn off Gemini’s lock screen access entirely.

Here’s how to do it on most Android 16 devices:

1. Open the Google app.
2. Tap your profile picture and go to Settings.
3. Select Gemini.
4. Toggle off Lock screen access.

That kills the attack vector completely. You’ll lose the convenience of asking Gemini questions without unlocking, but honestly — that’s a trade worth making for the next few days.

If you’re curious about broader lock screen protections, check out our guide on Android lock screen security settings to see what else you might be missing. And for more on how Google handles these disclosures, read about Google’s Android security update process.

The bottom line

This bug is a reminder that your lock screen is only as strong as the code behind it. A single timing flaw can undo the whole thing. Google has acknowledged the issue and says the fix is rolling out this week — but until you see that update notification, keep Gemini off your lock screen.

It’s a small inconvenience for a big peace of mind. And honestly, do you really need Gemini to answer questions while your phone is still in your pocket?

Your AI assistant remembers your coffee order, your project deadlines, maybe even the way you sign off emails. That’s convenient. It’s also a liability.

Researchers at New Mexico State University have demonstrated a new attack called GhostWriter that plants false memories inside AI agents. The scary part? It doesn’t steal your data outright. It rewrites what the AI believes is true — and then lets that poisoned belief sit there, dormant, until the AI acts on it later.

This is a different kind of AI security vulnerability. Not a jailbreak, not a data leak. It’s memory manipulation, and it’s quietly becoming one of the most dangerous threats in the field.

How GhostWriter works: a two-stage ambush

The attack unfolds in two phases. First comes memory injection. Malicious content gets slipped into the AI’s long-term memory through hidden prompts or untrusted external content — a poisoned document, a crafted email, a compromised web page. The AI stores it without realizing anything’s wrong.

Then comes attack activation. Days or weeks later, you ask the AI something completely legitimate. It retrieves that corrupted memory and acts on it. You never see the attack. The AI never knows it was attacked.

The researchers found GhostWriter achieved a memory injection success rate of roughly 98%, with malicious memories triggering about 60% of the time against state-of-the-art AI agents. Those numbers should worry anyone building products on top of persistent memory.

Why AI memory is suddenly a prime target

Traditional chatbots forgot everything between sessions. Modern AI agents are different. They store information about you — your preferences, your ongoing projects, your habits — so future conversations feel personal and contextual.

That’s the selling point. Every major AI company is racing to build assistants that remember you over weeks, months, even years. Memory has become the industry’s biggest differentiator because it makes AI feel less like a search box and more like a colleague.

The flip side: memory is now an attack surface. As the researchers put it, attacking the model itself is no longer necessary. Attackers can simply target what the model remembers.

A concrete nightmare scenario

Imagine asking your AI to summarize emails from your bank. If its memory has been poisoned, it could be manipulated into forwarding those emails to an attacker instead. Or it might recall the wrong contact details, fake deadlines, incorrect preferences — all because someone altered what the assistant believed to be true.

Unlike conventional prompt injection, which usually poisons a single conversation, GhostWriter is built to persist. Once the false memory lands, it keeps influencing behavior across multiple future sessions until someone detects and removes it.

Why current defenses fall short

Most AI security today focuses on protecting the model from bad prompts or malicious inputs in a single exchange. That’s a different problem from protecting a memory store that accumulates data over time.

The NMSU team’s research suggests today’s memory architectures aren’t equipped to distinguish trustworthy information from manipulated inputs. The AI doesn’t know which memories are real and which were planted. It just retrieves what it has and acts on it.

A defense exists — but it’s early days

The researchers didn’t just sound the alarm. They also proposed a defensive framework called Agentic Memory Sentry (AM-Sentry). It combines memory screening with stricter memory management policies, and in their tests it significantly reduced GhostWriter’s success rate while keeping the AI useful.

That’s promising, but it’s a research prototype, not a deployed solution. Real-world adoption will take time, and attackers aren’t waiting.

What this means for the future of AI assistants

AI agents are already managing emails, scheduling meetings, writing code, making decisions on our behalf. As they take on more responsibility, the integrity of what they remember becomes as critical as the information they generate.

The next frontier in AI security may not be protecting models from bad prompts. It may be protecting their memories from being rewritten altogether.

For users, the takeaway is simple: be careful what you let your AI assistant read and store. For developers, it’s a wake-up call. Memory is a feature — but right now, it’s also a backdoor.