Anthropic Project Glasswing guards critical infrastructure

Samantha: Welcome to The State of Tech, The European Edition, Saturday October ten, 2026. I'm Samantha Lawrence.

Bob: And I'm Bob Russell. Today: Anthropic launches a cyber mission to defend critical infrastructure, a massive GitHub credential heist hits thousands of repositories, GlobalFoundries and TSMC sign a two billion dollar US chip deal, Revolut plans to become a global tech company with its own AI, and to close out, two things you can actually use today: the Dutch inbox tool in-boxed, and the privacy-friendly weather app Meteoblue. Let's start with Anthropic.

Anthropic launches Project Glasswing to put Claude and engineers inside critical infrastructure defences.

Samantha: Anthropic has launched something it calls Project Glasswing, a dedicated cyber mission aimed squarely at power grids, water utilities and transport operators. The company is sending its Claude models and, importantly, on-site engineers into these organisations to help harden defences. On top of that, open-source projects get a free vulnerability scanner, though Anthropic is clear it comes unreviewed. This is one of the first times a frontier AI lab has stepped so directly into real-world cyber defence work.

Bob: What makes this unusual is the physical presence. Anthropic is not just handing over an API key and wishing utilities luck. Human engineers go on-site to pair with existing security teams, which is a very different model from the usual software-as-a-service pitch. The free scanner for open-source projects is interesting too, because so much critical software quietly depends on tiny volunteer-run libraries. The caveat matters though: unreviewed means you still need a human to judge the findings.

Samantha: The timing is not accidental. Water utilities in the US and Europe have been hit by state-linked intrusions over the past two years, and transport operators keep showing up in ransomware reports. Regulators have been pushing for stronger baseline security, but smaller utilities simply do not have the staff. An outside team with heavy AI tooling is one answer, though it also raises the question of how much defensive power you want concentrated in a handful of private labs.

Bob: And there is a competitive layer. Microsoft, Google and OpenAI all have their own security pitches, so Anthropic planting a flag in critical infrastructure stakes out territory before the others move in. For European utilities, the question is whether partnering with a US lab fits with NIS2 obligations and local sovereignty rules. Expect national cyber agencies in Germany, France and the Netherlands to want a close look at how data from these engagements is handled before anyone signs.

Samantha: For listeners outside the sector, the bottom line is this: the companies running your tap water and your trains are increasingly leaning on AI vendors to keep the lights on, literally. That is a shift from traditional security contractors to AI labs, and it will shape procurement decisions for years. The open-source scanner is the piece ordinary developers can engage with today, as long as they treat its output as a starting point, not a verdict.

A credential-theft campaign called GhostAction compromises over five hundred GitHub accounts and leaks thousands of secrets.

Bob: Security researchers have detailed a campaign they are calling GhostAction, which has hit more than five hundred GitHub accounts and injected malicious workflows into tens of thousands of repositories. The attackers compromised maintainer accounts on popular open-source projects, then used those to exfiltrate over three thousand three hundred secrets. That includes API keys for Anthropic and OpenAI, plus cloud and build-system credentials. It started in September 2025 and is still being cleaned up.

Samantha: The method is textbook supply chain. You do not attack the big companies directly, you attack the small libraries they all depend on. By slipping a workflow into a trusted repository, the attackers get code running inside the build systems of every project that pulls that dependency. The stolen AI keys are particularly worrying because they let whoever holds them run up large bills, or quietly use someone else's quota to generate content and code.

Bob: For European developers and companies, the practical step today is boring but essential: audit your GitHub workflows, rotate any secrets stored in CI/CD, and switch to short-lived tokens where you can. GitHub has pushed features like OpenID Connect federation precisely to avoid long-lived keys sitting in repositories, but adoption is uneven. Companies that process EU customer data also need to think about whether leaked keys count as a notifiable incident under NIS2 or GDPR.

Samantha: It also reinforces a point that keeps coming back: the open-source ecosystem that props up almost every modern application is defended by a handful of unpaid maintainers. One compromised laptop can cascade into thousands of downstream projects. That is exactly the gap Anthropic's free scanner, in our first story, is aimed at, and it is why European policymakers keep floating the idea of structural funding for critical open-source infrastructure. GhostAction will not be the last of its kind.

Samantha: Quick interruption. If you listen to The State of Tech regularly, hit that like button and subscribe, that way you'll never miss an episode. Okay, moving on.

GlobalFoundries and TSMC strike a two billion dollar deal for US silicon interposer production.

Bob: GlobalFoundries and TSMC have signed a two billion dollar multi-year deal to build silicon interposers in the United States. Interposers are the thin layers that sit between advanced chips and their packaging, and they are a critical bottleneck for the high-end processors used in AI and high-performance computing. GlobalFoundries will use its Malta, New York facility, with production ramping in the first half of 2028. It expands TSMC's CoWoS advanced packaging ecosystem onto US soil.

Samantha: The reason this matters is that advanced packaging, not raw chipmaking, has become the real squeeze point. You can print brilliant chips, but if you cannot package them properly, nothing ships. By bringing interposer capacity to New York, both companies hedge against Taiwan concentration risk and align with US policy pressure to localise. It is also a reminder that building this capacity takes years. Factories announced today start delivering in 2028 at the earliest, which is a long runway in a fast-moving market.

Bob: For Europe, the lesson is uncomfortable. The European Chips Act has mobilised real money, but packaging has received far less attention than fabrication. Analysts have pointed out that without domestic advanced packaging, European fabs still ship wafers abroad for the final critical steps. Expect this US deal to sharpen debate in Brussels about whether the next phase of chip policy needs to focus specifically on back-end capacity, not just more front-end fabs.

Samantha: There is also a geopolitical signal. TSMC committing capital to a US partner rather than keeping all advanced packaging at home shows how customer pressure, especially from Nvidia and AMD, is reshaping where the industry invests. European buyers of AI accelerators sit downstream of all of this. If capacity opens up in New York, it may ease supply for European data centres, but the pricing power still sits with a very small number of firms. That dependency is not going away.

Revolut plans to become a global tech company with its own AI models and data centres.

Bob: Revolut, one of Europe's most valuable startups, says it is going well beyond banking. CEO Nik Storonsky has laid out plans to turn the company into a global technology firm, with proprietary AI models trained on customer transaction data and its own data centres to support them. The vision includes AI agents that help with shopping and financial advice, and a broader set of consumer tech products aimed squarely at the territory currently dominated by US giants.

Samantha: Training on customer transaction data is the headline-grabbing part, and it will attract regulatory scrutiny. European data protection authorities have been clear that financial data counts as sensitive, and using it to train models requires a clear legal basis and strong user controls. Revolut operates across many EU jurisdictions, so this is not one conversation but many. How the company structures consent and opt-outs will be watched closely by regulators in Lithuania, Ireland and the UK in particular.

Bob: Strategically, this is Revolut trying to escape the margin trap that catches most fintechs. Payments and currency conversion are low-margin businesses, and once you have scaled, growth gets hard. Pivoting into AI shopping agents and advice puts the company in competition with the likes of Google and Amazon, which is bold given the gap in resources. Owning data centres is also expensive, so investors will want to see how much of this is strategy and how much is ambition.

Samantha: The European angle is genuinely interesting. Policymakers have been looking for homegrown tech champions, and a well-funded consumer platform building its own AI stack inside Europe fits that narrative. But the test will be execution. Users do not switch to a shopping agent because a bank built it, they switch because it works better. Revolut has pulled off big product jumps before, but moving from fintech into general-purpose AI products is a bigger leap than anything the company has attempted so far.

The Dutch tool in-boxed helps you find and unsubscribe from unwanted marketing emails in one go.

Samantha: Now to something you can actually try this weekend. in-boxed is a Dutch tool at in-boxed dot com that helps you find and unsubscribe from unwanted marketing emails in your Gmail or Outlook inbox. According to the maker, the scan runs in your browser, and inbox data is not stored on in-boxed's servers. There is no account and no ongoing subscription, just a one-off inbox reset. It is a small, concrete answer to a very common problem.

Bob: The broader point is worth sitting with. It takes one click to end up on a mailing list, and often ten clicks spread across three screens to get off one. That asymmetry is deliberate, and it adds up to a lot of noise, wasted attention and tracking across years of accounts you barely remember creating. Tools like this are a reaction to that imbalance, and it is notable that it comes from a Dutch maker rather than one of the big US inbox cleaners that have had their own data controversies.

Samantha: On the privacy side, the maker says the scanning happens client-side, which means in your browser rather than on their servers. Independent verification of that claim is not something we can do from here, so treat it as the maker's own statement and read the security page at in-boxed dot com slash security before you connect your inbox. Users who are cautious can always start with a secondary account to see how it behaves before pointing it at their main mailbox.

Bob: Practically, this is a one-off job rather than a subscription you forget about. You run the inbox reset, work through the unsubscribe suggestions, and then you are done until the next build-up of newsletters. Users who want to go further can combine it with mail rules that quietly route anything with the word unsubscribe into a holding folder, which stops the next wave from reaching the inbox at all. It is also a reminder that your inbox is a privacy surface worth tending, not just a to-do list.

Samantha: And it fits a wider European pattern of smaller, focused tools that try to give users back control over their digital attention, without demanding another account or another recurring charge. That alone is a useful filter when picking what to install.

Meteoblue is the free Swiss weather service with detailed forecasts, a clean website and a reputation for European accuracy.

Bob: To round things off, a non-AI pick that is quietly excellent. Meteoblue is a Swiss weather service, free to use on its website and in its mobile apps, that gives you detailed hourly and daily forecasts for practically any location you type in. It was founded in Basel and grew out of research at the University of Basel, so the focus has always been on solid modelling rather than flashy marketing. The layout is calm and readable, and the free version covers everything most people need.

Samantha: The thing that stands out, according to users who have reviewed it, is the depth of the information. Beyond the usual temperature and rain chances, you get clear wind, cloud cover and precipitation charts, plus its well-known multimodel forecasts that show how confident the prediction really is. For anyone who has been frustrated by free weather apps that give one number and no context, this is a straightforward upgrade. You can use it straight from the browser on any device, and there are apps for both Android and iPhone if you want it on your home screen.

Bob: It will not replace a professional radar tool for storm chasers, and some of the more specialised features, such as extended data for sailing, farming or mountain sports, sit behind a paid plan. But for everyday use, checking whether to grab a jacket or if the weekend bike ride is a bad idea, the free tier does the job and gets out of the way. Combined with a free weather widget on your home screen, you have the forecast at a glance with far more detail than the default app on your phone.

Samantha: Today we covered: Anthropic's new critical infrastructure cyber mission, the GhostAction GitHub credential theft, the GlobalFoundries and TSMC chip packaging deal, Revolut's plan to become a global tech company, and two things to try yourself: the Dutch inbox tool in-boxed, and the privacy-friendly weather app Meteoblue.

Bob: Want to know more or react? Visit stateoftech.eu or email us at info@doorzetters.net.

Bob: State of Tech, the tech world in 15 minutes.