PortSwigger, the company behind the Burp Suite of security testing tools, swallows $112M

by with No Comment Tech

Blue binary code on black background interspersed with open and closed locks.

Image Credits: JuSun / Getty Images

Sometimes the most successful startup ideas come from people building tools to solve their own needs. Such was the case with Dafydd Stuttard, a security expert who goes by Daf. 

Nearly two decades ago, living in the small market town of Knutsford in Cheshire in the northwest of England, Daf was working as a security consultant for different clients. 

On the side, he built apps that he could use himself to speed up some of the more routine parts of his work. He would give each tool a random name, use it for a while and move on; sometimes he would tell others in his community about the tools in case they were useful. (Daf already had a reputation as an ethical hacker and author in the security community so there was a ready audience for that.)

One day, tooling that he built to assist with penetration testing — named Burp for no specific reason at all — was one of his creations that he shared with others. It caught on, fast, and Daf decided to see how much further he could take it. 

Fast-forward to today and you can see the fruits of Daf’s instincts on the value of the tool. 

Burp is now Burp Suite, which is the centerpiece of a startup called — playing on the drinking theme — PortSwigger. It has more than 20,000 organizations as customers across 170 countries, with 80,000 individuals and “well over” 1,000 enterprises and organizations using its paid enterprise edition. (The enterprises include Microsoft, Amazon, FedEx, Salesforce and more.) Another operation under the PortSwigger umbrella, an educational platform called Web Security Academy, has more than 1 million users. And yes, there are now dozens more employees besides Daf.

PortSwigger, at 17 years old, has been bootstrapped and profitable from the start. Now, for the first time, Daf has decided to take on a substantial outside investment of $112 million to take the company to the next level. Brighton Park Capital from the U.S. is the sole investor. 

“We need more expertise to achieve our ambition,” Daf said in an interview. “The market is getting bigger and more complicated and our customers’ needs are getting bigger.”

“But capital wasn’t the biggest driver since we are cash-flow positive, and we had our pick of firms to work with,” he continued. That inbound interest came not just from investors but potential acquirers. 

The company owes some of its success to Daf’s own reputation and modest accessibility.

(“Got an email from Daffyd Stuttard @portswigger today in response to a question about burp extender,” someone noted once on Twitter, now known as X. “Kinda feel like god just sent me an eml.”

But its rise also comes at the same time that cybersecurity has taken on a much bigger profile.

There are a number of point solutions provided by vendors across a vast, complex and rapidly evolving security landscape — a landscape that has been formed out of the fact that security breaches and vulnerabilities are rising at record rates and causing more damage than ever before, not least because of the injection of AI into the equation — and that has led to the creation of yet more applications and approaches to tackle that. 

But one constant in that mix has been the role of individuals with deep area expertise: ethical hackers and human testers continue to play a major role in how problems get identified and fixed. 

But these individuals need assistance and tooling, and that is where a company like PortSwigger comes in. 

There are others like HackerOne and Bugcrowd that have aimed to productize the role of individual white hat hackers in security operations. Daf notes that these are not competitors to PortSwigger: they partner and his startup provides tooling to those platforms and others like them, which in turn get used by their users. 

Longer term, it will be interesting to see what impact newer technologies and architectures will have on the role of individuals in tackling and solving security problems. 

Although you might assume that a newer innovation like AI might present a threat in that regard, that is not the case, at least for now. Daf notes that there are a number of repetitive actions that penetration testers might perform that can be improved with automation. 

Its sole investor agrees.

“We believe that despite automation, pen testers are still going to be required,” Tim Drager, a partner at Brighton Park, said in an interview. “Experts really understand. The attack surface has grown massively, and APIs have become prime targets, but when you couple that with the shortage of cyber professionals who have deep domain expertise… that’s why you need tools to help those who know what to do be more efficient. We see this as a prime area for growth. PortSwigger gives them super powers.”

Data breach exposes US spyware maker behind Windows, Mac, Android and Chromebook malware

by with No Comment Tech

render of a data breach with computer folders over blue, green and purple spilling data squares

Image Credits: Bryce Durbin / TechCrunch / Getty Images

A little-known spyware maker based in Minnesota has been hacked, TechCrunch has learned, revealing thousands of devices around the world under its stealthy remote surveillance.

A person with knowledge of the breach provided TechCrunch with a cache of files taken from the company’s servers containing detailed device activity logs from the phones, tablets, and computers that Spytech monitors, with some of the files dated as recently as early June. 

TechCrunch verified the data as authentic in part by analyzing some of the exfiltrated device activity logs that pertain to the company’s chief executive, who installed the spyware on one of his own devices. 

The data shows that Spytech’s spyware — Realtime-Spy and SpyAgent, among others — has been used to compromise more than 10,000 devices since the earliest-dated leaked records from 2013, including Android devices, Chromebooks, Macs, and Windows PCs worldwide.

Spytech is the latest spyware maker in recent years to have itself been compromised, and the fourth spyware maker known to have been hacked this year alone, according to TechCrunch’s running tally.

When reached for comment, Spytech chief executive Nathan Polencheck said TechCrunch’s email “was the first I have heard of the breach and have not seen the data you have seen so at this time all I can really say is that I am investigating everything and will take the appropriate actions.”

Spytech is a maker of remote access apps, often referred to as “stalkerware,” which are sold under the guise of allowing parents to monitor their children’s activities but are also marketed for spying on the devices of spouses and domestic partners. Spytech’s website openly advertises its products for spousal surveillance, promising to “keep tabs on your spouse’s suspicious behavior.” 

While monitoring the activity of children or employees is not illegal, monitoring a device without the owner’s consent is unlawful, and spyware operators and spyware customers both have faced prosecution for selling and using spyware.

Stalkerware apps are typically planted by someone with physical access to a person’s device, often with knowledge of their passcode. By nature, these apps can stay hidden from view and are difficult to detect and remove. Once installed, the spyware sends keystrokes and screen taps, web browsing history, device activity usage, and, in the case of Android devices, granular location data to a dashboard controlled by whoever planted the app.

The breached data, seen by TechCrunch, contains logs of all the devices under Spytech’s control, including records of each device’s activity. Most of the devices compromised by the spyware are Windows PCs, and to a lesser degree Android devices, Macs and Chromebooks. 

The device activity logs we have seen were not encrypted.

TechCrunch analyzed the location data derived from the hundreds of compromised Android phones, and plotted the coordinates in an offline mapping tool to preserve the privacy of the victims. The location data provides some idea, though not completely, where at least a proportion of Spytech’s victims are located.

A world map showing hundreds of Android devices compromised by Spytech's spyware plotted on a world map, with large clusters in the U.S. and across Europe, and scattered dots throughout the rest of the world.
Hundreds of Android devices compromised by Spytech’s spyware plotted on a world map.
Image Credits: TechCrunch

Our analysis of the mobile-only data shows Spytech has significant clusters of devices monitored across Europe and the United States, as well as localized devices across Africa, Asia and Australia, and the Middle East. 

One of the records associated with Polencheck’s administrator account includes the precise geolocation of his house in Red Wing, Minnesota. 

While the data contains reams of sensitive data and personal information obtained from the devices of individuals — some of whom will have no idea their devices are being monitored — the data does not contain enough identifiable information about each compromised device for TechCrunch to notify victims of the breach. 

When asked by TechCrunch, Spytech’s CEO would not say if the company plans to notify its customers, the people whose devices were monitored, or U.S. state authorities as required by data breach notification laws. 

A spokesperson for Minnesota’s attorney general did not respond to a request for comment.

Troy Hunt, who runs data breach notification site Have I Been Pwned, said he notified more than 5,000 individuals whose email addresses were found in the dataset, and added the data set to his site’s catalog of past data breaches.

Spytech dates back to at least 1998. The company operated largely under the radar until 2009, when an Ohio man was convicted of using Spytech’s spyware to infect the computer systems of a nearby children’s hospital, targeting the email account of his ex-partner who worked there.

Local news media reported at the time, and TechCrunch verified from court records, that the spyware infected the children hospital’s systems as soon as his ex-partner opened the attached spyware, which prosecutors say collected sensitive health information. The person who sent the spyware pleaded guilty to the illegal interception of electronic communications.

Spytech is the second U.S.-based spyware maker in recent months to have experienced a data breach. In May, Michigan-based pcTattletale was hacked and its website defaced, and the company subsequently shut down and deleted his company’s banks of victim’s device data rather than notify affected individuals. 

Data breach notification service Have I Been Pwned later obtained a copy of the breached data and listed 138,000 customers as having signed up for the service.

If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware has resources if you think your phone has been compromised by spyware.

Updated with addition of data to Have I Been Pwned.

Blue binary code on black background interspersed with open and closed locks.

PortSwigger, the company behind the Burp Suite of security testing tools, swallows $112M

by with No Comment Tech

Blue binary code on black background interspersed with open and closed locks.

Image Credits: JuSun / Getty Images

Sometimes the most successful startup ideas come from people building tools to solve their own needs. Such was the case with Dafydd Stuttard, a security expert who goes by Daf. 

Nearly two decades ago, living in the small market town of Knutsford in Cheshire in the northwest of England, Daf was working as a security consultant for different clients. 

On the side, he built apps that he could use himself to speed up some of the more routine parts of his work. He would give each tool a random name, use it for a while and move on; sometimes he would tell others in his community about the tools in case they were useful. (Daf already had a reputation as an ethical hacker and author in the security community so there was a ready audience for that.)

One day, tooling that he built to assist with penetration testing — named Burp for no specific reason at all — was one of his creations that he shared with others. It caught on, fast, and Daf decided to see how much further he could take it. 

Fast-forward to today and you can see the fruits of Daf’s instincts on the value of the tool. 

Burp is now Burp Suite, which is the centerpiece of a startup called — playing on the drinking theme — PortSwigger. It has more than 20,000 organizations as customers across 170 countries, with 80,000 individuals and “well over” 1,000 enterprises and organizations using its paid enterprise edition. (The enterprises include Microsoft, Amazon, FedEx, Salesforce and more.) Another operation under the PortSwigger umbrella, an educational platform called Web Security Academy, has more than 1 million users. And yes, there are now dozens more employees besides Daf.

PortSwigger, at 17 years old, has been bootstrapped and profitable from the start. Now, for the first time, Daf has decided to take on a substantial outside investment of $112 million to take the company to the next level. Brighton Park Capital from the U.S. is the sole investor. 

“We need more expertise to achieve our ambition,” Daf said in an interview. “The market is getting bigger and more complicated and our customers’ needs are getting bigger.”

“But capital wasn’t the biggest driver since we are cash-flow positive, and we had our pick of firms to work with,” he continued. That inbound interest came not just from investors but potential acquirers. 

The company owes some of its success to Daf’s own reputation and modest accessibility.

(“Got an email from Daffyd Stuttard @portswigger today in response to a question about burp extender,” someone noted once on Twitter, now known as X. “Kinda feel like god just sent me an eml.”

But its rise also comes at the same time that cybersecurity has taken on a much bigger profile.

There are a number of point solutions provided by vendors across a vast, complex and rapidly evolving security landscape — a landscape that has been formed out of the fact that security breaches and vulnerabilities are rising at record rates and causing more damage than ever before, not least because of the injection of AI into the equation — and that has led to the creation of yet more applications and approaches to tackle that. 

But one constant in that mix has been the role of individuals with deep area expertise: ethical hackers and human testers continue to play a major role in how problems get identified and fixed. 

But these individuals need assistance and tooling, and that is where a company like PortSwigger comes in. 

There are others like HackerOne and Bugcrowd that have aimed to productize the role of individual white hat hackers in security operations. Daf notes that these are not competitors to PortSwigger: they partner and his startup provides tooling to those platforms and others like them, which in turn get used by their users. 

Longer term, it will be interesting to see what impact newer technologies and architectures will have on the role of individuals in tackling and solving security problems. 

Although you might assume that a newer innovation like AI might present a threat in that regard, that is not the case, at least for now. Daf notes that there are a number of repetitive actions that penetration testers might perform that can be improved with automation. 

Its sole investor agrees.

“We believe that despite automation, pen testers are still going to be required,” Tim Drager, a partner at Brighton Park, said in an interview. “Experts really understand. The attack surface has grown massively, and APIs have become prime targets, but when you couple that with the shortage of cyber professionals who have deep domain expertise… that’s why you need tools to help those who know what to do be more efficient. We see this as a prime area for growth. PortSwigger gives them super powers.”

Data breach exposes US spyware maker behind Windows, Mac, Android and Chromebook malware

by with No Comment Tech

render of a data breach with computer folders over blue, green and purple spilling data squares

Image Credits: Bryce Durbin / TechCrunch / Getty Images

A little-known spyware maker based in Minnesota has been hacked, TechCrunch has learned, revealing thousands of devices around the world under its stealthy remote surveillance.

A person with knowledge of the breach provided TechCrunch with a cache of files taken from the company’s servers containing detailed device activity logs from the phones, tablets, and computers that Spytech monitors, with some of the files dated as recently as early June. 

TechCrunch verified the data as authentic in part by analyzing some of the exfiltrated device activity logs that pertain to the company’s chief executive, who installed the spyware on one of his own devices. 

The data shows that Spytech’s spyware — Realtime-Spy and SpyAgent, among others — has been used to compromise more than 10,000 devices since the earliest-dated leaked records from 2013, including Android devices, Chromebooks, Macs, and Windows PCs worldwide.

Spytech is the latest spyware maker in recent years to have itself been compromised, and the fourth spyware maker known to have been hacked this year alone, according to TechCrunch’s running tally.

When reached for comment, Spytech chief executive Nathan Polencheck said TechCrunch’s email “was the first I have heard of the breach and have not seen the data you have seen so at this time all I can really say is that I am investigating everything and will take the appropriate actions.”

Spytech is a maker of remote access apps, often referred to as “stalkerware,” which are sold under the guise of allowing parents to monitor their children’s activities but are also marketed for spying on the devices of spouses and domestic partners. Spytech’s website openly advertises its products for spousal surveillance, promising to “keep tabs on your spouse’s suspicious behavior.” 

While monitoring the activity of children or employees is not illegal, monitoring a device without the owner’s consent is unlawful, and spyware operators and spyware customers both have faced prosecution for selling and using spyware.

Stalkerware apps are typically planted by someone with physical access to a person’s device, often with knowledge of their passcode. By nature, these apps can stay hidden from view and are difficult to detect and remove. Once installed, the spyware sends keystrokes and screen taps, web browsing history, device activity usage, and, in the case of Android devices, granular location data to a dashboard controlled by whoever planted the app.

The breached data, seen by TechCrunch, contains logs of all the devices under Spytech’s control, including records of each device’s activity. Most of the devices compromised by the spyware are Windows PCs, and to a lesser degree Android devices, Macs and Chromebooks. 

The device activity logs we have seen were not encrypted.

TechCrunch analyzed the location data derived from the hundreds of compromised Android phones, and plotted the coordinates in an offline mapping tool to preserve the privacy of the victims. The location data provides some idea, though not completely, where at least a proportion of Spytech’s victims are located.

A world map showing hundreds of Android devices compromised by Spytech's spyware plotted on a world map, with large clusters in the U.S. and across Europe, and scattered dots throughout the rest of the world.
Hundreds of Android devices compromised by Spytech’s spyware plotted on a world map.
Image Credits: TechCrunch

Our analysis of the mobile-only data shows Spytech has significant clusters of devices monitored across Europe and the United States, as well as localized devices across Africa, Asia and Australia, and the Middle East. 

One of the records associated with Polencheck’s administrator account includes the precise geolocation of his house in Red Wing, Minnesota. 

While the data contains reams of sensitive data and personal information obtained from the devices of individuals — some of whom will have no idea their devices are being monitored — the data does not contain enough identifiable information about each compromised device for TechCrunch to notify victims of the breach.  

When asked by TechCrunch, Spytech’s CEO would not say if the company plans to notify its customers, the people whose devices were monitored, or U.S. state authorities as required by data breach notification laws. 

A spokesperson for Minnesota’s attorney general did not respond to a request for comment.

Spytech dates back to at least 1998. The company operated largely under the radar until 2009, when an Ohio man was convicted of using Spytech’s spyware to infect the computer systems of a nearby children’s hospital, targeting the email account of his ex-partner who worked there.

Local news media reported at the time, and TechCrunch verified from court records, that the spyware infected the children hospital’s systems as soon as his ex-partner opened the attached spyware, which prosecutors say collected sensitive health information. The person who sent the spyware pleaded guilty to the illegal interception of electronic communications.

Spytech is the second U.S.-based spyware maker in recent months to have experienced a data breach. In May, Michigan-based pcTattletale was hacked and its website defaced, and the company subsequently shut down and deleted his company’s banks of victim’s device data rather than notify affected individuals. 

Data breach notification service Have I Been Pwned later obtained a copy of the breached data and listed 138,000 customers as having signed up for the service.

If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware has resources if you think your phone has been compromised by spyware.

kia ev9 close up press drive

Flexport taps Shopify for cash, behind the wheel of the Kia EV9 and where Amazon wants to invest

by with No Comment Tech

kia ev9 close up press drive

Image Credits: Kirsten Korosec

TechCrunch Mobility is a weekly newsletter dedicated to all things transportation Sign up here — just click TechCrunch Mobility — to receive the newsletter every weekend in your inbox. Subscribe for free.

Welcome to TechCrunch Mobility – the same weekly newsletter you’ve been reading, but with a new name and a few changes.

Don’t worry, this is still your central hub for news and insights on the future of transportation. This week, read about Amazon, EV startup Fisker, electric boats, a bunch of new funding deals and my time driving the all-new Kia EV9.

Let’s go!

A little bird

blinky cat bird green

A little bird pointed us to a new website with some electric trucks that sure do look familiar.

Remember Lordstown Motors, the EV startup that went public via a SPAC and has since filed for bankruptcy protection? Steve Burns, who founded and was then ousted from Lordstown Motors, is back with a new EV startup called LandX Motors.

The new LandX Motors website prominently displays the same electric Endurance pickup truck he once promised would beat Tesla, Ford and General Motors to market.

A person familiar with the company’s plans told TechCrunch that it’s not so much about the Endurance truck, but the underlying platform, software and engineering behind it. Still, with the former Lordstown trucks playing a starring role on company’s website and video, it’s unclear just how developed this plan is.

Want to reach out with a tip, comment or complaint? Email Kirsten at [email protected] or [email protected]. If you prefer to remain anonymous, click here to contact us, which includes SecureDrop (instructions here) and various encrypted messaging apps.

Deal of the week

money the station

Supply chain logistics startup Flexport had a rather tumultuous 2023 that included founder Ryan Petersen ousting his hand-picked successor and taking back the CEO spot and then acquiring the assets of shuttered digital freight network Convoy.

The startup is kicking off 2024 by shoring up its business with a $260 million “uncapped convertible note” from Shopify, a deal that was announced by Petersen in a series of posts on social media site X.

As a reminder, Shopify and Flexport are already attached. Flexport acquired in 2023 Shopify’s logistics arm. The deal gave Shopify 13% equity stake in Flexport and a seat on the board.

Other deals that got my attention …

Electra, the Paris-based EV charging startup, raised $330 million in a Series B round led by Dutch pension fund service provider PGGM and Bpifrance’s Large Venture fund. Eurazeo, RIVE Private Investment, the SNCF group through 574 Invest and Serena also participated.

Franziska Bossart, the new head of the Amazon Industrial Innovation Fund, spoke to me about how the $1 billion fund is evolving. Tl;dr: She’s expanding its geographic focus to Asia and Europe, and homing in on three areas, including AI.

International Battery Company, a startup developing lithium-ion battery cells for EVs, raised $35 million in a pre-Series A round led by RTP Global.

Land Moto, the Cleveland-based electric motorcycle startup, raised $3 million in a round led by a special purpose venture vehicle called Nunc Coepi Ventures.

Lightship, an all-electric RV startup, raised $34 million in a Series B round co-led by Obvious Ventures and Prelude Ventures. Other new investors include Allegis Capital and global RV manufacturer THOR Industries and its investment partner TechNexus Venture Collaborative.

Northvolt, the Swedish battery startup, secured a $5 billion debt deal to help pay for the expansion of its first gigafactory. As TC+ reporter Tim de Chant writes: “Northvolt’s $5 billion loan won’t be enough to guarantee success, but it should be enough to help ramp up its production to a targeted 60 gigawatt hours.”

Uber shut down alcohol delivery service Drizly three years after the cab-hailing company acquired it for $1.1 billion.

Notable reads and other tidbits

Autonomous vehicles

TuSimple will delist itself from the Nasdaq stock exchange as it moves forward with its plan to fully exit the U.S. market.

Electric vehicles, charging & batteries

BMW’s future growth depends on EVs, and it’s finally going all in, TC+ reporter Tim de Chants writes.

Fisker’s electric Ocean SUV is under investigation by federal regulators over braking loss complaints.

GM recalled 66 electric delivery vans made by its BrightDrop subsidiary after the front drive units in at least two of them caught fire late last year. The cause appears to be related to a manufacturing defect.

Navier, the electric boat startup, has launched a pilot program for its hydrofoiling watercraft via a partnership with Stripe to bring passengers from San Francisco’s outskirts to the downtown area.

Future of flight

Wing, the drone-powered delivery company operated by Alphabet, intends to introduce a larger craft capable of delivering heavier packages to customers.

This week’s wheels

kia ev9 press drive
Image Credits: Kirsten Korosec

I headed to Napa Valley to try out the Kia EV9 – an all-electric SUV with three rows that many believe will bring a whole new batch of EV customers into the market.

Before I give some abbreviated thoughts on what I did and didn’t like, here are a few specs. The Kia EV9 comes in five trims with the cheapest — the rear-wheel drive EV9 Light — starting at $54,900. I tested the GT-Line trim, an all-wheel drive top-of-the-line version that has a range of 270 miles and starts at $73,900 (For comparison, the Rivian R1S, which is AWD, comes with standard with  260 miles of range and starts at $78,000. The Kia EV9 Light RWD trim equipped with the bigger battery has the best range of 304 miles.

What did I like? It remained well planted on winding roads, even if I pushed the vehicle a bit. It’s also quiet, has the kind of interior details one might expect in a premium-priced SUV, the seats are comfortable and the advanced driver assistance system is easy to engage. The third row isn’t exactly spacious, but certainly better than many three-row SUVs I have been in.

There were a few misses. I do think that Kia missed an opportunity by not giving the EV9 rear-wheel axle steering and I’m not sure if the battery range, which is between 230 miles and 304 miles depending on the trim, is enough for buyers. Finally, the layout of the interior cabin is almost there, but I’m still not sure I love the placement of the start button and gear shifter (it’s a stock tucked behind the steering wheel).

Microsoft, X throw their weight behind KOSA, the controversial kids online safety bill

by with No Comment Tech

X CEO Linda Yaccarino

Image Credits: BRENDAN SMIALOWSKI/AFP / Getty Images

On the eve of Wednesday’s Big Tech hearing (both Big Tech and a big hearing — five CEOs are testifying as we speak), Microsoft stepped up to back a controversial bill that aims to protect children from the dangers of social media. In the early hours of the hearing, X CEO Linda Yaccarino also climbed aboard.

“Senator, we support KOSA and we’ll continue to make sure that it accelerates and make sure to continue to offer community for teens that are seeking that voice,” Yaccarino said when asked if X, formerly Twitter, will support the Kids Online Safety Act (KOSA). The question came when KOSA co-sponsor Senator Richard Blumenthal (D-CT) went down the line of tech CEOs asking if each company would back his legislation.

The answer was strangely worded given that KOSA is not yet law, but Yaccarino didn’t offer any of the qualifiers of her more reluctant peers. In a statement to TechCrunch, X confirmed the company’s backing for the bill. “We support the Kids Online Safety Act and will work to preserve freedom of speech for all groups,” X spokesperson Joe Benarroch said.

Snap’s Evan Spiegel restated his company’s previous commitment to supporting the new proposal to regulate social media apps. “Senator, we strongly support the Kids Online Safety Act and we’ve already implemented many of its core provisions,” Spiegel said.

Meta, Discord and TikTok all demurred, pointing to groups that have criticized the bill or stating that they support some of its parts and not others. “Senator, with some changes we can support it,” TikTok CEO Shou Chew said. “We are aware that some groups have raised some concerns.”

Mark Zuckerberg similarly agreed with the “basic spirit” of the bill while declining to endorse it. Discord’s Jason Citron said his company supported “parts” of the proposal but declined to say yes, stating that Discord would prefer to support a national privacy standard.

In spite of some revisions, the bill’s many critics have warned that KOSA would dangerously sanitize the internet, empower censorship and isolate young LGBTQ people in the process. Security, privacy and free press advocates have also called attention to the bill’s potential threat to encryption. The bill was revised last year in response to some criticisms, but many concerns persist.

While X and Snap are popular social apps, they’re on the fringe compared to the heft of a company like Microsoft. Microsoft, now worth roughly $3 trillion, is currently the most valuable company in the world and a sophisticated operator in the world of policy that’s been around long enough to know how to play the game.

While X and Snap are likely hoping that their KOSA support will either generally endear them to regulators or have a much worse impact on rival companies, Microsoft probably has its sights set on a different issue entirely. Unlike its peers testifying on Capitol Hill, Microsoft doesn’t own a traditional social media network steered by algorithms (Discord is also a notable exception here). For Microsoft, AI is the name of the game — and throwing support behind a bill that will change the rules for social media companies might buy it some regulatory goodwill where it counts.

Fan fiction writers rally fandoms against KOSA, the bill purporting to protect kids online

OpenAI Sora

Diffusion transformers are the key behind OpenAI's Sora — and they're set to upend GenAI

by with No Comment Tech

OpenAI Sora

Image Credits: OpenAI

OpenAI’s Sora, which can generate videos and interactive 3D environments on the fly, is a remarkable demonstration of the cutting edge in GenAI — a bona fide milestone.

But curiously, one of the innovations that led to it, an AI model architecture colloquially known as the diffusion transformer, arrived on the AI research scene years ago.

The diffusion transformer, which also powers AI startup Stability AI’s newest image generator, Stable Diffusion 3.0, appears poised to transform the GenAI field by enabling GenAI models to scale up beyond what was previously possible.

Saining Xie, a computer science professor at NYU, began the research project that spawned the diffusion transformer in June 2022. With William Peebles, his mentee while Peebles was interning at Meta’s AI research lab and now the co-lead of Sora at OpenAI, Xie combined two concepts in machine learning — diffusion and the transformer — to create the diffusion transformer.

Most modern AI-powered media generators, including OpenAI’s DALL-E 3, rely on a process called diffusion to output images, videos, speech, music, 3D meshes, artwork and more.

It’s not the most intuitive idea, but basically, noise is slowly added to a piece of media — say an image — until it’s unrecognizable. This is repeated to build a dataset of noisy media. When a diffusion model trains on this, it learns how to gradually subtract the noise, moving closer, step by step, to a target output piece of media (e.g. a new image).

Diffusion models typically have a “backbone,” or engine of sorts, called a U-Net. The U-Net backbone learns to estimate the noise to be removed — and does so well. But U-Nets are complex, with specially designed modules that can dramatically slow the diffusion pipeline.

Fortunately, transformers can replace U-Nets — and deliver an efficiency and performance boost in the process.

OpenAI Sora
A Sora-generated video. Image Credits: OpenAI

Transformers are the architecture of choice for complex reasoning tasks, powering models like GPT-4, Gemini and ChatGPT. They have several unique characteristics, but by far transformers’ defining feature is their “attention mechanism.” For every piece of input data (in the case of diffusion, image noise), transformers weigh the relevance of every other input (other noise in an image) and draw from them to generate the output (an estimate of the image noise).

Not only does the attention mechanism make transformers simpler than other model architectures but it makes the architecture parallelizable. In other words, larger and larger transformer models can be trained with significant but not unattainable increases in compute.

“What transformers contribute to the diffusion process is akin to an engine upgrade,” Xie told TechCrunch in an email interview. “The introduction of transformers … marks a significant leap in scalability and effectiveness. This is particularly evident in models like Sora, which benefit from training on vast volumes of video data and leverage extensive model parameters to showcase the transformative potential of transformers when applied at scale.”

Generated by Stable Diffusion 3. Image Credits: Stability AI

So, given the idea for diffusion transformers has been around a while, why did it take years before projects like Sora and Stable Diffusion began leveraging them? Xie thinks the importance of having a scalable backbone model didn’t come to light until relatively recently.

“The Sora team really went above and beyond to show how much more you can do with this approach on a big scale,” he said. “They’ve pretty much made it clear that U-Nets are out and transformers are in for diffusion models from now on.”

Diffusion transformers should be a simple swap-in for existing diffusion models, Xie says — whether the models generate images, videos, audio or some other form of media. The current process of training diffusion transformers potentially introduces some inefficiencies and performance loss, but Xie believes this can be addressed over the long horizon.

“The main takeaway is pretty straightforward: forget U-Nets and switch to transformers, because they’re faster, work better and are more scalable,” he said. “I’m interested in integrating the domains of content understanding and creation within the framework of diffusion transformers. At the moment, these are like two different worlds — one for understanding and another for creating. I envision a future where these aspects are integrated, and I believe that achieving this integration requires the standardization of underlying architectures, with transformers being an ideal candidate for this purpose.”

If Sora and Stable Diffusion 3.0 are a preview of what to expect with diffusion transformers, I’d say we’re in for a wild ride.

Digitally generated image of multi coloured vertical bars. Concept of fintech technology, new banking and investment. Clean design.

DataStax acquires the startup behind low-code AI builder Langflow

by with No Comment Tech

Digitally generated image of multi coloured vertical bars. Concept of fintech technology, new banking and investment. Clean design.

Image Credits: Eugene Mymrin / Getty Images

DataStax made a name for itself by commercializing the open source Apache Cassandra NoSQL database, but these days, the company’s focus is squarely on using its database chops to build a “one-stop GenAI stack.” One of the first building blocks for this was to bring vector search capabilities to its hosted Astra DB service last summer. Since then, it’s built out more of its stack for building GenAI applications backed by Retrieval-Augmented Generation (RAG) and today, the company announced the next stop in this direction by announcing that it has acquired Logspace, the company behind Langflow, a low-code tool for building RAG-based applications.

DataStax did not share the price of the acquisition.

Logspace launched in 2022 with a mission to help businesses adopt machine learning. Early on, the company was more of a consultancy than a product company. Logspace co-founder and CEO Rodrigo Nader previously worked on machine learning problems at enterprise AI company Bitvore, together with co-founder and CTO Gabriel Luiz Freitas Almeida. They self-funded the company and by 2023, the founding team had launched Langflow, which quickly gained some traction as an early open source low-code/no-code tool for creating GenAI apps.

Image Credits: Logspace/DataStax

“This acquisition will provide current Langflow developers and current DataStax developers additional resources and integrations to elevate their applications to match the scale of their ambitions,” said Chet Kapoor, CEO and chairman of DataStax. “Langflow is focused on democratizing and accelerating generative AI development for any developer or company, and in joining DataStax, we’re working together to enable developers to put their wild new generative AI ideas on a fast path to production.”

The DataStax team argues that this acquisition effectively completes its effort to build a one-stop generative AI stack. After all, it can now offer its users a single tool that combines built-in connections to DataStax’s own Astra DB and tools like the LangChain toolkit and LlamaIndex for connecting different data sources, with an easy-to-use visual editor for building GenAI chatbots for internal and external use.

Langflow will continue to operate as a separate entity, so existing users shouldn’t notice any immediate changes.

“We couldn’t be more excited about joining the DataStax team and supercharging our ability to grow the Langflow platform, bringing it to more researchers, developers, enterprises and entrepreneurs working on generative AI applications,” said Nader. “With DataStax, we will be fully focused on the execution of our product vision, roadmap and community collaboration, and will continue to add to the greatest breadth of integrations across different AI ecosystem projects and products — including more data sources and databases, models, applications and APIs.”

DataStax brings vector search to its Astra DB database service

OpenAI logo with spiraling pastel colors (Image Credits: Bryce Durbin / TechCrunch)

OpenAI offers a peek behind the curtain of its AI's secret instructions

by with No Comment Tech

OpenAI logo with spiraling pastel colors (Image Credits: Bryce Durbin / TechCrunch)

Image Credits: Bryce Durbin / TechCrunch

Ever wonder why conversational AI like ChatGPT says “Sorry, I can’t do that” or some other polite refusal? OpenAI is offering a limited look at the reasoning behind its own models’ rules of engagement, whether it’s sticking to brand guidelines or declining to make NSFW content.

Large language models (LLMs) don’t have any naturally occurring limits on what they can or will say. That’s part of why they’re so versatile, but also why they hallucinate and are easily duped.

It’s necessary for any AI model that interacts with the general public to have a few guardrails on what it should and shouldn’t do, but defining these — let alone enforcing them — is a surprisingly difficult task.

If someone asks an AI to generate a bunch of false claims about a public figure, it should refuse, right? But what if they’re an AI developer themselves, creating a database of synthetic disinformation for a detector model?

What if someone asks for laptop recommendations; it should be objective, right? But what if the model is being deployed by a laptop maker who wants it to only respond with their own devices?

AI makers are all navigating conundrums like these and looking for efficient methods to rein in their models without causing them to refuse perfectly normal requests. But they seldom share exactly how they do it.

OpenAI is bucking the trend a bit by publishing what it calls its “model spec,” a collection of high-level rules that indirectly govern ChatGPT and other models.

There are meta-level objectives, some hard rules and some general behavior guidelines, though to be clear these are not strictly speaking what the model is primed with; OpenAI will have developed specific instructions that accomplish what these rules describe in natural language.

It’s an interesting look at how a company sets its priorities and handles edge cases. And there are numerous examples of how they might play out.

For instance, OpenAI states clearly that the developer intent is basically the highest law. So one version of a chatbot running GPT-4 might provide the answer to a math problem when asked for it. But if that chatbot has been primed by its developer to never simply provide an answer straight out, it will instead offer to work through the solution step by step:

Image Credits: OpenAI

A conversational interface might even decline to talk about anything not approved, in order to nip any manipulation attempts in the bud. Why even let a cooking assistant weigh in on U.S. involvement in the Vietnam War? Why should a customer service chatbot agree to help with your erotic supernatural novella work in progress? Shut it down.

It also gets sticky in matters of privacy, like asking for someone’s name and phone number. As OpenAI points out, obviously a public figure like a mayor or member of Congress should have their contact details provided, but what about tradespeople in the area? That’s probably OK — but what about employees of a certain company, or members of a political party? Probably not.

Choosing when and where to draw the line isn’t simple. Nor is creating the instructions that cause the AI to adhere to the resulting policy. And no doubt these policies will fail all the time as people learn to circumvent them or accidentally find edge cases that aren’t accounted for.

OpenAI isn’t showing its whole hand here, but it’s helpful to users and developers to see how these rules and guidelines are set and why, set out clearly if not necessarily comprehensively.