I recently had the opportunity to sit down with Francis de Souza, COO of Google Cloud, backstage at an event in Los Angeles. Amid the din around us, de Souza, who speaks in the calm, measured manner of a university professor, offered useful advice for companies navigating the AI security moment we’re all living through, noting that “there’ll be a transition period, and then I think we get to this better place.”

He wasn’t speaking about Google at that moment, but it’s clear that even Google is still figuring things out.

De Souza’s core message was one security professionals have been trying to get executives to internalize for years, now made urgent by AI: security can’t be an afterthought. “As companies embark on this AI journey, they need to take a platform approach,” he said. “Security is not something you can bolt on later, and it’s not something you can leave up to employees to do on their own.” He warned specifically about “shadow AI” — employees reaching for consumer tools without organizational oversight — and argued that companies need to demand security, governance, and auditability from their platforms from the start. “There’s no such thing as an AI strategy without a data strategy and a security strategy. They need to go hand in hand.”

Worth noting: he wasn’t pitching Google Cloud alone. When I observed that his advice sounded like a Google advertisement, he pushed back. Google, he said, is committed to a multicloud approach, and he made the case that companies that think they’re operating on a single cloud almost certainly aren’t. “Even if they pick a single cloud, they’re relying on SaaS applications, there are business partners that may be using different clouds,” he said. “It’s important for companies to have a security posture that is consistent across clouds, across models.”

He also made the case that the threat landscape has changed so fundamentally that old defensive models are too slow. He noted that the average time between an initial breach and the handoff to the next stage of an attack has dropped from eight hours to 22 seconds, and that the attack surface has expanded well beyond the traditional network perimeter. “In addition to your usual estate, you have models now. You have data pipelines used to train the models. You have agents, you have prompts. All of this needs to be protected.”

One threat de Souza flagged that doesn’t get enough attention: agents moving through a company’s internal systems can surface forgotten data repositories that nobody has thought about in years. “A lot of organizations have old SharePoint servers [and access controls] they haven’t really updated, but it didn’t matter because nobody really knew where they were. But agents roaming your enterprise will find those data assets and will expose the data on them.”

The answer, in his view, is to meet machine speed with machine speed. “We’re now seeing the emergence of an AI-native, fully agentic defense where organizations can run agents driving their defense,” he said. “Instead of having a human-led defense or even a human in the loop, you can now have humans overseeing a fully agentic defense.” He added that this has become a leadership issue, not just a technology one. “This is a board-level issue and an executive team issue. It’s not just a security team’s issue.”

But even as AI takes on more of the defensive workload, the people qualified to oversee it are in short supply — and the vulnerabilities that AI itself is introducing are multiplying faster than security teams can address them. “We’re going to need people to deal with the bug-pocalypse,” LinkedIn’s chief information security officer Lea Kissner told the New York Times this week, adding that she doesn’t expect the industry to understand AI security in any sustainable long-term way for at least several years.

Which brings us back to the platform providers themselves. The Register has published a series of reports over the past several weeks documenting a wave of Google Cloud developers hit with five-figure bills following unauthorized API calls to Gemini models — services many of them had never used or intentionally enabled. The cases followed a familiar pattern: API keys originally deployed for Google Maps, placed publicly per Google’s own instructions, had quietly become capable of accessing Gemini after Google expanded their scope without clearly disclosing the change.

Rod Danan, CEO of interview-prep platform Prentus, said his bill hit $10,138 in roughly 30 minutes after attackers exploited his compromised API key. Isuru Fonseka, a Sydney-based developer whose account was similarly compromised, woke up to charges of roughly AUD $17,000 despite believing he had a $250 spending cap in place. What neither knew was that Google’s automated systems had upgraded their billing tiers based on account history, raising their effective ceilings to as high as $100,000 without explicit consent.

Google refunded both after The Register published its initial report. Still, Google told The Register it has no plans to change its automatic tier-upgrade policy, saying it prioritizes preventing service outages over enforcing users’ stated budget preferences.

In the meantime, there is the separate question of what happens when a developer tries to shut things down. The Register reported this week on research by security firm Aikido finding that even developers who catch a compromised key and immediately delete it may not be safe. According to Aikido’s findings, attackers can apparently continue using that key for up to 23 minutes because Google’s revocation propagates gradually across its infrastructure. Aikido researcher Joseph Leon told The Register that during that window, success rates are unpredictable — in some minutes over 90% of requests still authenticated — and attackers can use the time to exfiltrate files and cached conversation data from Gemini.

Leon also noted that Google’s own newer credential formats don’t appear to have the same problem: service account API credentials revoke in about five seconds, and Gemini’s newer AQ-prefixed key format takes about a minute. “Both run at Google scale,” he wrote in Aikido’s related paper. “Both suggest this is technically solvable for Google API keys, too.” In short, according to Leon, the 23-minute window isn’t an engineering constraint but a matter of priorities for the company.

That’s worth considering when reading de Souza’s advice, which is sound and should be taken very seriously. He’s not wrong, but there is currently a gap between the platforms are prescribing and how fast they are themselves adapating, and it’s good to be aware of this, too.

The smart glasses industry has long been a tortured dream of Silicon Valley. The premise is appealing enough: What if, to enjoy the benefits of mobile computing, people didn’t have to stare at their phones all day long and could, instead, simply wear a lightweight computing device on their face? Science fiction fans (a demographic that is strong in the tech industry) can see this vision perfectly.

However, the industry has — for much of the last decade — resembled a financial black hole into which gargantuan investments have been sunk and from which little to no profit has ever emerged.

“Everybody’s losing money,” said Chi Xu, the founder and CEO of the smart glasses company Xreal, which is a longtime partner of Google. I met Xu at Google’s I/O conference in Mountain View last week, where he was promoting Xreal’s Project Aura. That’s its latest effort to create a set of functional XR glasses that people actually want to use.

“That’s because it’s very hard, what we’re doing,” he said.

For much of the industry’s existence, the problems of smart glasses have seemed somewhat obvious: bulky, uncomfortable, and socially awkward form factor, paired with negligibly beneficial software. Now, however, industry insiders — including Xu — feel like their business has turned a corner and may be reaching an inflection point.

That supposed inflection point has something to do with Meta, whose 2023 partnership with Ray-Ban launched one of the first lines of models that has actually managed to sell a lot of units. (It’s worth noting, however, that the division responsible for the glasses, Reality Labs, still operates at a massive loss.)

Now, as form factors shrink and software improves, Xu feels that Xreal can finally become a leader in the space. “You need all the key pieces ready — you need the hardware ready, the operating system needs to be ready, and then you need a great user interface,” Xu said.

Xreal’s newest model Aura is wired smart glasses that have OLED displays embedded within them, meaning that you can watch high-resolution videos within the frames themselves. Somewhat awkwardly, Aura comes tethered to a “puck” — essentially a phone-shaped mini-computer that powers the experience behind the glasses. When using it, you can ostensibly just slip it into your pocket.

But in exchange for the awkwardness of the puck, the user gets a wider variety of fun experiences with the glasses, including an immersive Google Maps app, VR YouTube videos, and a “painting app” that lets you — via the powers of hand tracking — create holographic imagery that only you can see. There are also reportedly games, playable (again) via hand tracking, and basic web surfing functionality.

“Whether you are following a floating recipe while cooking, setting up a private workspace at a coffee shop or on a flight, or watching a movie on a virtual big screen at home, the experience is seamless,” the company promises.

Xu also says that he imagines the device being used not just by the casual consumer but by professionals as well. “It’s not just about watching the NBA game in a hologram type of format, you could also go to a coffee shop and do some work,” he said.

Currently, the glasses are only available for developers, but the plan is for them to launch commercially later this year. Xreal is also working on an IPO that is expected to take place before 2026 is over, although Xu declined to say much about it.

In the meantime, the company is working on that whole turning-a-profit thing. Xu notes that his company has been raising its gross margin while lowering its costs for marketing and sales. “Next year is the year when we could actually break even,” he says.

Recently, the biggest trend in kitchen gadgets has been “hands-free” and AI-powered devices that act as automated countertop assistants. There are plenty of devices that exist now for people who want to cook more (or at least look like someone who has their life together) but don’t always have the energy for a full kitchen marathon after work. 

From a robot stirring your soup to a bread machine that kneads your dough while you watch TV, here is a list of gadgets that may make you feel like you’ve won adulthood. Or at least make cooking feel much less intimidating.

The Nosh Chef Robot is a huge upgrade from a slow cooker or Instant Pot, as it can manage much of the cooking process autonomously. 

The AI-powered robot dispenses exact amounts of oils, spices, and ingredients from reusable ingredient cartridges. Users still need to load ingredients beforehand, but once everything is in place, the robot can roughly chop, stir, sauté, portion, plate, and self-clean after meals. However, it can’t bake, roast, or steam, so there are limitations, but the company says it supports more than 500 dishes, such as stir-fry and curry.

The system runs on NoshOS, a proprietary AI trained on thousands of recipes and cooking techniques. Built-in sensors monitor moisture, texture, and browning levels in real time, adjusting heat and seasoning throughout the cooking process. It can even recognize ingredients already loaded into the device and recommend meals based on what’s available.

The Nosh One is currently available for preorder on Kickstarter, with shipments expected in summer 2026.

An automatic soup stirrer sounds unnecessary until you use it once, and suddenly you’re hooked.

Instead of standing over the stove painstakingly stirring soup, sauce, risotto, pudding, or oatmeal, the StirMate Automatic Pot Stirrer rotates around the pot for you while you prep other ingredients, answer emails, or scroll on your phone. 

It could also serve as a helpful accessibility tool for people with mobility issues or chronic pain.

Developed by father-and-son company StirMate, the third-generation model launched recently and includes a stronger motor, adjustable speed settings, and redesigned paddles for thicker recipes. It can run for up to 10 hours on a single charge and recharges in about an hour.

Modern bread machines have evolved far beyond basic sandwich bread. This newer smart model from KitchenArm automates the mixing, kneading, proofing, and baking process, turning homemade bread into a mostly hands-off experience. Just add ingredients, select a setting, and let the machine do the work.

The KitchenArm Smart Bread Machine includes 29 automatic programs with 21 bread settings, including white, French, whole wheat, rye, and sweet breads, plus non-bread options for yogurt, jam, and cake. There’s also a fully customizable “Homemade” mode for adjusting kneading and rising times manually.

Morning routines are significantly easier when your coffee machine remembers your order and the usual time you want to drink it. 

The De’Longhi Rivelia is a newer option and has recently garnered attention for its smart personalization features. In addition to grinding beans, brewing espresso, and frothing milk automatically, the Rivelia supports up to four user profiles, remembers favorite drinks and strength preferences, and adapts recommendations over time based on usage habits. Its “Coffee Routines” feature can even suggest beverages depending on the time of day.

While it’s definitely expensive, it’s widely considered one of the most popular high-end espresso machines currently available. 

Store-bought oat milk prices alone are enough to push some people into making their own. The Nama M1 automates the entire process of making almond, oat, soy, or cashew milk, eliminating the old method of soaking, blending, and then straining that previously made homemade plant milk feel like a full-time job.

Newer nut milk makers have become faster, smarter, and much easier to clean, and the Nama M1 is one of the more widely reviewed examples currently on the market. Using centrifugal force, it can produce creamy plant milk in a few minutes with minimal prep work.

The KitchenArt Auto-Measure Spice Carousel is one of the simplest products on this list, but it solves a very real problem: accidentally dumping half a container of garlic powder into dinner because the spice lid suddenly betrayed you. This rotating carousel stores up to 12 spices and dispenses measured amounts in 1/4 tsp amounts or poured normally through the built-in spouts. 

No apps, no AI, no complicated setup. Just a genuinely practical kitchen tool.