Google Engineer Charged With Insider Trading on Polymarket Prediction Bets

The day's clearest story was a Google engineer allegedly playing a prediction market like a personal ATM funded by his employer's nonpublic data — but running through everything else is a more structural shift: AI is reshaping how enterprise infrastructure is priced, how social platforms monetize, and which hardware ecosystems win.

Security

Researchers have identified a new class of browser-based surveillance technique with no obvious precedent: monitoring SSD activity patterns from JavaScript to infer what a user is doing on their machine. The method works by timing storage I/O operations that propagate through browser APIs — specifically by inducing read/write pressure and measuring latency variance against known application signatures. The result is a side-channel capable of detecting which software is running, what files are open, and potentially which sites a user has recently visited, without requiring any exploit, elevated permission, or browser extension. The attack requires only a loaded page.

What makes this uncomfortable is that the mitigation path is genuinely unclear. NVMe SSD latencies vary enough across consumer hardware that reliable detection requires calibration, but the researchers demonstrate it's practical across a wide range of devices. The APIs being exploited are dual-use: they exist for legitimate performance measurement, so blanket removal would break real functionality. Browser vendors will need to decide whether to add jitter or resolution limits to storage timing APIs — a pattern they've already applied, with mixed results, to high-resolution timers after Spectre. For now there is no fix, and no defense short of aggressive browser hardening that most users will never apply.

AI

The headline from the benchmarking world: frontier LLMs score below 50% on ITBench-AA, the first benchmark specifically targeting agentic enterprise IT tasks. Produced by IBM Research and Artificial Analysis, the benchmark covers multi-step incident triage, configuration change management, automated runbook execution, and cross-system diagnostics — representative of L2 operations work that AI vendors are actively promising to automate. The results apply to leading models from all major labs.

A sub-50% pass rate matters because it puts a concrete number on a real gap. It isn't that these models lack impressive capabilities; it's that "impressive in demo" and "reliable in production ops" remain very different bars. Enterprise customers being pitched on AI-assisted IT operations now have something to point at besides intuition. The benchmark itself — reproducible, structured, task-specific — is arguably as valuable as the results it produced.

The counter-thread: a preprint describes a multi-agent LLM system designed for automated vulnerability discovery and reproduction. The asymmetry is worth sitting with. Models may be faster at finding exploitable conditions in real systems than at reliably resolving a broken configuration. That gap cuts in an uncomfortable direction for anyone reasoning about AI risk in infrastructure contexts.

Tech

The dominant story: a Google software engineer has been federally charged with fraud after allegedly using nonpublic information about Google's 2025 Year in Search campaign to bet on Polymarket and net approximately $1.2 million on a $2.7 million stake. The DOJ's legal theory — that a prediction market bet can constitute fraud when materially informed by nonpublic corporate data — is novel. Securities law has never been cleanly applied to prediction markets, which don't involve corporate equity. But if the prosecution succeeds, the implications extend well beyond this one employee: anyone with access to internal data that influences publicly-observable outcomes could face insider trading-style exposure when placing correlated bets. That's a large and poorly-mapped category that extends far beyond finance.

Snowflake had a day that erased a lot of accumulated doubt. Shares jumped 33% after earnings showed real traction in AI product adoption, then the company formalized a $6 billion, five-year infrastructure commitment to AWS built around Graviton chips. The Graviton angle is the detail worth tracking: it's a large-scale, contractual bet by a major cloud-dependent company that AI inference workloads can route through ARM CPU silicon rather than GPU clusters. Nvidia absorbed the signal in its own way — Jensen Huang announced plans to invest $150 billion in Taiwan over the coming years, positioning Taiwan rather than the United States as the intended center of the AI hardware ecosystem. It's a direct contradiction of the current administration's domestic chip manufacturing ambitions, delivered without apparent concern about the political friction.

Meta formalized what it's been testing for months: paid subscription tiers across Instagram, Facebook, and WhatsApp, rolling out globally under the "Meta One" brand with AI-enhanced features as the premium upsell. YouTube separately announced it will automatically label AI-generated video content — though the policy carves out exceptions for animated, stylized, or "unrealistic" content, which is precisely where most generative AI video production lives. The label will land on a narrower slice of AI content than the announcement headline implies.

Cognition, the coding agent startup behind Devin, raised $1 billion at a $26 billion valuation — making it one of the most richly capitalized private AI companies, despite production adoption of autonomous coding agents remaining limited. The round reflects investor conviction in the category's trajectory more than its current enterprise penetration.

Two hardware notes: Valve restocked the Steam Deck OLED after months of unavailability, but raised prices by more than $200 — the 512GB model now starts at $789, up from $549. Rivian confirmed its R2 SUV deliveries begin June 9, a vehicle CEO RJ Scaringe has called the most consequential product launch in the company's history.

The Polymarket case will move slowly through the courts, but its first ruling will matter far beyond this one defendant — prediction markets have never had to reckon with insider trading law at this scale, and there are a lot of people watching who have similar access to similar data.

Also yesterday

• UK Visa Portal Actively Leaking Passport Photos and Selfies — Still Unfixed
• CISA Orders Federal Agencies to Patch Exploited cPanel LiteSpeed Plugin in 4 Days
• Gitea Flaw Lets Anyone Pull Private Container Images Without Authentication
• Malicious npm Package Found Exfiltrating Claude AI User Files
• Active Cryptojacking Campaign Targets GPUs via SEO Poisoning and AI Chatbots
• UK Visa Portal Exposed Thousands of Passports and Selfies — and Hasn't Fixed It