Communications of the ACM

For 20 years, the economics of publishing on the open Web rested on a measurable exchange. A search engine crawled your pages and sent you visitors, and you had instruments for both sides of the trade: server logs on one end, referrer headers and Search Console on the other. You could see what you gave and what you got back, down to the query.

The quest for self-sufficiency is as old as humanity. Tribes, city-states, and nations have long sought to bolster their independence. Now, amid growing geopolitical instability and supply chain uncertainty, the European Union (EU) is exploring ways to reduce its dependence on outside powers.

When people talk about modernizing enterprise systems, the conversation almost always starts with a list of things to rip out. Legacy databases move to the cloud. Batch jobs become real-time pipelines. Flat files become APIs. And fax machines usually top the list of technologies that should have died a decade ago. That’s a fair take if you’re looking at the industry from a distance. It gets a lot less fair once you’re the person responsible for keeping a healthcare process running on top of it.

It was a Monday morning, coffee still too hot to drink, when I opened my AI usage dashboard and just stared at it for a second. The number at the top wasn’t wrong, exactly—it was just bigger than anything I’d let myself expect. Month over month, it had been creeping up so quietly that I’d never stopped to really look at it. That morning, I finally asked myself: where is all this money actually going? I didn’t have a good answer. So I started digging. It didn’t take long to find the culprit.

AI model architecture is usually discussed through layers, attention mechanisms, parameter counts, training objectives, and benchmark scores. These remain important ways to describe how a model is built and evaluated. But they no longer explain whether a model can work well in a real system. For many applications, a model is incomplete if it cannot be trained, served, evaluated, updated, or used at a reasonable cost.

Article 40 of the Digital Services Act (DSA), enacted by the European Union (EU) in 2022, aims to improve platform transparency by enabling independent researchers to study electoral interferences, algorithmic biases, privacy issues, and public health implications. To this end, Article 40 allows vetted researchers to access platform data. Significant efforts have been made in the past years to implement this process.

Abstract Happens before-based dynamic analysis is the go-to technique for detecting data races in large-scale software projects due to the absence of false positive reports. However, such analyses are expensive, since they employ expensive vector clock updates at each event, rendering them usable only for in-house testing. In this paper, we present a sampling-based, randomized race detector that in the worst case processes only a constant number of events from the execution trace being analyzed.

I have spent the past 14 years working at a federal regulatory agency. That experience has left me with a durable conviction about the importance of governance and of recording processes and decisions—not only in regulated sectors, but for any team that intends to preserve continuity and adherence to its processes, whether those processes are defined by internal policy or by law.

The current dialogue on AI—in the media, in academia, in industry, in government commissions, and around dinner tables—often seems untethered to reality. The discussion tends to focus on whether one should be on the side of hype or hysteria—AI will either solve humanity’s most pressing problems and usher in a new era of plenty, or it will destroy or enslave the human species.

In late August 2025, threat actors began exploiting CVE-2025-7775, a critical remote code execution (RCE) flaw in Citrix NetScaler, as a zero day. Within hours of disclosure, Check Point researchers spotted underground forums discussing HexStrike-AI, an AI orchestration framework built to automate penetration testing, as a way to exploit it at scale. The attackers’ claim: they’d cut exploit development from days to under 10 minutes.