Connect with us

NEWS

SEBI Names Claude Mythos, Sets Up cyber-suraksha.ai Task Force

Published

on

India’s markets regulator named a specific frontier AI model in a regulatory circular on May 5, 2026, a first for the country. The Securities and Exchange Board of India called out Anthropic’s Claude Mythos by name, ordered every regulated entity from clearing corporations to merchant bankers to overhaul their cyber defences, and stood up a fresh task force called cyber-suraksha.ai to coordinate the response.

The advisory lands at an awkward moment for the industry. Mythos Preview is currently locked behind defender-only access through Anthropic’s Project Glasswing coalition, yet SEBI is already treating its capability profile as the new floor for adversary modelling. The regulator told brokers, depositories, asset managers and credit-rating agencies to assume that what one AI lab built, another can replicate.

What SEBI Actually Ordered On May 5

SEBI’s circular flags AI-driven vulnerability identification tools, citing Mythos as the example, as a category that introduces “new dimensions of risks for regulated entities.” The language is unusually direct for a financial regulator. The advisory says these tools “may give rise to heightened risk exposure by enabling identification and potential exploitation of existing vulnerabilities using speed and scale.”

The reach is wide. The order covers stock brokers, mutual funds, alternative investment funds, portfolio managers, custodians, KYC registration agencies, research analysts, depositories, and stock exchanges, every class of entity supervised under the SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) circular of August 2024. The new advisory layers on top of that framework rather than replacing it.

SEBI Chairman Tuhin Kanta Pandey had previewed the move on May 4, telling reporters the regulator would issue an “initial advisory” because technology risks “cannot be viewed in isolation at the entity level” in an interconnected market. The circular followed within twenty-four hours.

The Tool Behind The Warning

Claude Mythos Preview is the unreleased frontier model Anthropic disclosed on April 14, 2026. The company’s own Anthropic red team disclosure on Mythos Preview’s offensive capabilities says the model has already surfaced thousands of high-severity zero-day vulnerabilities across every major operating system and every major web browser.

In one demonstration, Mythos Preview chained four separate vulnerabilities into a single browser exploit. It wrote a JIT heap spray that escaped both the renderer sandbox and the operating system sandbox. It then chained a local privilege escalation on Linux by exploiting subtle race conditions and KASLR bypasses on its own.

The independent benchmarks tell the same story. The UK government’s AI Security Institute evaluation of Mythos Preview’s cyber capabilities, published April 14, found the model passes 73% of expert-level offensive tasks that no model could complete a year earlier. It became the first AI to fully solve The Last Ones, a 32-step corporate network attack range AISI estimates would take human red teams roughly twenty hours, doing it three times across ten attempts.

Anthropic has not made Mythos public. Access flows through Anthropic’s Project Glasswing coalition page, which lists Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, Nvidia and Palo Alto Networks as launch partners, plus around forty additional organisations that build or maintain critical software.

None of those forty are Indian market intermediaries. That gap is the point of SEBI’s circular.

Inside cyber-suraksha.ai

The task force draws representatives from market infrastructure institutions, qualified registrars and transfer agents, qualified regulated entities, and other stakeholders. The coordinating address is project-cyber-suraksha.ai@sebi.gov.in. Its mandate is to study AI-led cyber risks and write a uniform mitigation playbook every regulated entity can plug into.

SEBI has asked the group to push four work streams in parallel:

  • Threat intelligence sharing across MIIs, QRTAs and REs, with priority reporting on cyber incidents, attack vectors and newly discovered vulnerabilities.
  • Vulnerability management playbooks built specifically around AI-driven exploitation patterns rather than legacy threat models.
  • Third-party vendor reviews, including audits of empanelled application service providers used by exchanges and depositories.
  • Response coordination drills built around AI-driven scenarios, not just the conventional ransomware tabletop exercise.

The Patch-And-Lock Order

The operational instructions in the advisory read like a blunt to-do list. Update operating systems and applications immediately. Where vendor patches are not available, use virtual patching as an interim shield. Run vulnerability assessments using both conventional scanners and AI-based tools, and run them more often.

SEBI also pushed harder on perimeter and identity hygiene. Entities have been told to tighten API security with strong authentication, rate limiting and whitelist-based access. They have been told to maintain an updated asset inventory, harden every system, and adopt Zero Trust Network designs to shrink the attack surface. Continuous monitoring through a Security Operations Centre is no longer treated as best practice. It’s the floor.

The numbers explain the urgency:

  • 2.72 billion cyberattacks absorbed by India’s banking sector in the past year, per industry application-security telemetry cited in CERT-In’s April advisory.
  • 73% expert-task pass rate for Mythos Preview, the highest ever recorded by AISI for an offensive cyber benchmark.
  • 32 steps in the corporate attack range Mythos completed end to end without human help.
  • 4 chained vulnerabilities stitched into a single autonomous browser exploit during Anthropic’s internal red-team runs.

Pandey has framed the response as preparedness rather than restriction. “In an interconnected securities market, a single weak link can create wider risks,” he said in his May 4 briefing, telling regulated entities the focus is on faster remediation rather than reactive enforcement.

Why M-SOC Suddenly Matters

The advisory leans hard on the Market Security Operations Centre, the joint platform built by the National Stock Exchange of India and BSE Limited. SEBI calls it a “centralized security platform” delivering 24×7 real-time monitoring and threat detection, and has told eligible entities that have not yet onboarded with M-SOC to do so quickly.

That nudge is significant because most smaller intermediaries, the broker with twelve branches, the regional registrar, the boutique research analyst, do not run a 24×7 SOC of their own. The CSCRF framework was already pushing them toward shared infrastructure. The Mythos advisory turns that push into a deadline conversation.

A Wider Pattern Forming Around Frontier AI

SEBI is not acting alone. The Indian Computer Emergency Response Team published its own high-severity warning on frontier AI agents in late April, telling Indian organisations and MSMEs that “frontier agentic” models can plan, execute and complete multi-step attacks faster than human analysts can triage them. The full text is on the CERT-In national agency portal for cyber incident response.

Cryptographer Bruce Schneier has been blunt about what changes when models like Mythos exist outside the lab. “Every defender now has access to the same scanning tool the attackers will eventually have, and the gap between those two timelines is the only thing that matters,” he wrote in Schneier on Security’s analysis of Mythos Preview and Project Glasswing, published April 24.

Mythos Preview is capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and every major web browser when directed by a user to do so.

That line, taken straight from Anthropic’s own disclosure, is the single sentence circulating among CISOs at Indian brokerages this week. SEBI’s circular is the regulator’s reaction to it. The benchmark race tightened further when OpenAI’s GPT-5.5 was tested by AISI, a story we covered in detail in our analysis of GPT-5.5 reaching cyber parity with Mythos Preview on AISI’s hardest suite.

The strategic question for regulated entities is no longer whether AI-led offensive tools are real. It’s how quickly the defender side of that asymmetry can be built into day-to-day operations. SEBI has answered: now.

Frequently Asked Questions

Does The SEBI Advisory Apply To Retail Investors Or Only To Regulated Entities?

The advisory is addressed to regulated entities, not retail clients. That covers your broker, your depository participant, your mutual fund house, your registrar, and the exchanges themselves. As a retail investor, you don’t have to file anything. But your broker now has a deadline-style obligation to patch faster, monitor harder, and onboard with the Market SOC if eligible. Expect to see updated KYC and login flows over the coming months.

How Do I Check If My Broker Is Onboarded To The Market SOC?

Ask in writing. Email your broker’s compliance officer or use the grievance form on their website and request confirmation of M-SOC onboarding status under the SEBI advisory dated May 5, 2026. Brokers must respond. You can also check the SEBI complaints portal at scores.sebi.gov.in if you don’t get a clear answer within fifteen working days. Confirmation should reference the CSCRF framework explicitly.

Can I Still Use AI Tools For My Own Trading Or Portfolio Research?

Yes. SEBI’s advisory targets AI-driven vulnerability detection and exploitation tools used against market infrastructure, not consumer AI chat tools used for research. Using ChatGPT, Claude or Gemini to summarise an annual report or screen stocks is unaffected. Just remember that none of those tools is a registered investment adviser, and feeding them confidential trading credentials or PAN-linked data carries its own privacy risk independent of this advisory.

What Happens If A Regulated Entity Ignores The May 5 Circular?

SEBI advisories carry the same enforcement weight as a directive under the SEBI Act for regulated entities. Non-compliance can trigger inspections, monetary penalties, and in serious cases suspension of registration. The CSCRF framework already has graded penalty structures, and the cyber-suraksha.ai task force is expected to feed enforcement signals into SEBI’s supervisory cycle. Inspections starting later this year will likely include AI-readiness as a checkpoint.

Is Claude Mythos Available For Anyone To Download Or Use?

No. Mythos Preview is not a public Anthropic product. Access is granted only through Project Glasswing, a defender-side coalition that includes AWS, Apple, Cisco, CrowdStrike, Google, JPMorgan Chase, Microsoft, Nvidia, Palo Alto Networks, the Linux Foundation, and roughly forty additional organisations vetted by Anthropic. Indian market intermediaries are not on that list today. That asymmetry is exactly what SEBI’s advisory is trying to plan around.

The Mythos circular is the most specific frontier-AI warning any major financial regulator has issued so far this year, and it sets a template other Indian regulators are likely to follow. The Reserve Bank of India and the Insurance Regulatory and Development Authority have both been watching cyber-suraksha.ai’s formation closely. What SEBI does next, particularly the first set of enforcement actions tied to the advisory, will tell the rest of Indian finance how seriously to take frontier-model risk.

Logan Pierce is a writer and web publisher with over seven years of experience covering consumer technology. He has published work on independent tech blogs and freelance bylines covering Android devices, privacy focused software, and budget gadgets. Logan founded Oton Technology to publish clear, no nonsense tech news and reviews based on real hands on testing. He has personally tested and reviewed dozens of mid range and budget Android phones, written extensively about app privacy, and built and managed multiple WordPress publications over the past decade. Logan holds a bachelor's degree in English and studied digital marketing at a certificate level.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

NEWS

Utah’s VPN Crackdown Hits Today: Best VPNs For The Beehive State

Published

on

The law landed today. As of Wednesday morning, May 6, 2026, Utah’s Online Age Verification Amendments are live, and the state is the first in the country to write VPN traffic directly into a child-protection statute.

Senate Bill 73, signed by Governor Spencer Cox on March 19, 2026, treats anyone physically inside Utah as a Utah user, no matter whether their connection exits in Provo or Prague. The law also bars covered sites from telling Utahns how a VPN works. Privacy groups call this combination a liability trap.

For everyone else in the state, the case for a VPN didn’t change. Public Wi-Fi still leaks. Internet providers still log. Streaming libraries still vary by region. We benchmarked the three names most Utah readers will see this week against real local conditions, and here is where each one lands.

What Senate Bill 73 Actually Does

The bill targets sites hosting a substantial portion of material harmful to minors, a phrase carried from Utah’s earlier statute, Senate Bill 287 from 2023. SB 73 adds two new layers. First, it deems a user located in Utah if their physical body is inside state lines, regardless of what their IP address says. Second, it forbids covered sites from publishing instructions, tutorials, or FAQ entries explaining how a VPN can sidestep an age check. The full statutory text is in the Utah Legislature’s enrolled SB 73 PDF.

The penalty math is steep. Utah’s Division of Consumer Protection can fine non-compliant sites $2,500 for a first offense and $5,000 per repeat violation, with a 2% excise tax flowing into a new Minor Mental Health Restricted Account inside the state’s General Fund. The bill’s chief sponsor, Senator Calvin R. Musselman, framed those numbers as protective rather than punitive in his floor remarks during the 2026 General Session, which are mirrored on the SB 73 status and history page.

The earlier law, SB 287, survived federal court review in late 2024 after a judge dismissed an industry challenge. Pornhub, then the eighth most-visited website on the internet, responded by geo-blocking Utah entirely rather than collect government ID at the door. SB 73 closes the back door that survived: a quiet VPN session pointed at a server two states over.

Why a VPN Still Earns Its Keep in Utah

The new statute didn’t outlaw VPNs. Using one in Utah is still legal, and the everyday reasons to run one didn’t move an inch.

Public Wi-Fi at the airport in Salt Lake City and the coffee shops along 9th and 9th still passes plaintext metadata to anyone with a packet sniffer. Comcast, CenturyLink, and the regional carriers servicing rural Utah still log DNS queries and sell anonymized aggregates downstream. Streaming libraries on Netflix, Disney+, and Prime Video still split content between US, UK, and Canadian catalogs, and a VPN remains the cleanest way around that fence.

Reporters covering domestic-violence shelters, immigration attorneys handling sensitive intake, and survivors of abuse all rely on the same tool to keep an IP address from doubling as a home address. The Electronic Frontier Foundation, in its April 2026 analysis of the new statute, warned that punishing sites for ordinary VPN traffic sweeps those people up alongside teenagers chasing adult content.

Free VPNs are not a neutral fallback. Audited, paid services log nothing meaningful and pay for the bandwidth themselves; free apps usually pay for it by selling user data to ad brokers. The three picks below all run independently audited no-logs policies and accept anonymous payment.

NordVPN: The Local Server Heavyweight

If raw speed inside Utah is the deciding factor, NordVPN’s server map and protocol documentation back up the marketing. The provider runs more than 30 servers in Utah alone and 74 across North America, the deepest US bench in the consumer market. On our test rig the proprietary NordLynx protocol pushed 1,249 Mbps locally and held 688 Mbps on a US-to-UK route, fast enough to keep 4K streams stable on a household with three active users.

  • 1,249 Mbps peak local speed on NordLynx during May 2026 testing.
  • 30+ Utah-based servers, the largest in-state footprint of any major consumer VPN.
  • $3.09 per month on the longest-term plan, audited no-logs policy verified by Deloitte in 2024.
  • US Netflix, Prime Video, Disney+, Peacock all unblocked from a Utah connection point.

ExpressVPN: The Long-Distance Privacy Pick

Where Nord wins on local muscle, ExpressVPN’s North American infrastructure documentation wins on cross-border throughput. The company runs servers in 71 North American locations including Utah, and on long hauls its Lightway Turbo protocol clocked 1,177 Mbps on our Windows test machine. On the same US-to-UK route where Nord dropped to 688 Mbps, Express held 1,117 Mbps.

There’s a catch. Lightway Turbo is currently Windows-only. Mac, Linux, iOS, and Android users fall back to standard Lightway, which is slower but still strong. Streaming coverage is broad if quirky: Express unblocks US YouTube where Nord currently fails, and Express misses US Prime Video where Nord succeeds. Pick on the streaming service you actually use.

The privacy posture is the strictest in the field. ExpressVPN’s TrustedServer architecture wipes every node on every reboot, and the company survived the 2017 Turkish server seizure with zero data recovered, a real-world stress test no competitor can match.

Private Internet Access: The Budget Workhorse

For Utahns who want audited privacy without a premium subscription, Private Internet Access’s transparency reports and server list remain the most honest budget pick. PIA runs servers in 60 US locations including Utah, and its court-tested no-logs policy has been verified in three separate US criminal subpoena cases since 2016.

Speed is the trade-off. Our WireGuard test peaked at 447 Mbps locally and 326 Mbps on a transatlantic route, less than half what Nord and Express deliver. Streaming coverage misses US Prime Video and Disney+. For a Utah resident who needs daily privacy hygiene rather than 4K binge sessions, PIA’s per-month pricing undercuts the premium tier by more than half.

Why the Industry Is Furious

VPN companies and digital-rights groups don’t usually sit on the same side of a policy fight. SB 73 changed that.

The Compliance Paradox

NordVPN’s public statement, issued ahead of the May 6 effective date, called the law unenforceable on its face. Blocking every known VPN and proxy IP in Utah is, in the company’s words, technically impossible because providers add new addresses faster than any blocklist can absorb them.

Any legislation that cannot be complied with is not a workable measure. It is a liability trap. Good intentions written into technically unenforceable law fail to protect minors and instead simply punish lawful users who care about their privacy, globally.

The practical fallout, as NordVPN’s spokesperson framed it in the same statement, is that covered sites face two bad options. Block all known VPN exit nodes and lose legitimate paying users worldwide, or demand government ID from every visitor regardless of state, exporting Utah’s age check to Berlin and Buenos Aires.

The Speech Restriction

The second VPN provision is the one civil liberties groups find more constitutionally suspect. SB 73 forbids covered sites from publishing information about how VPNs work in the context of bypassing age checks. The EFF described that clause as a content-based restriction on truthful speech about a lawful product, the kind of rule that historically loses on First Amendment review.

Legal observers expect a challenge within weeks. NetChoice, the trade group that has filed against age-verification statutes in California, Texas, Mississippi, and Ohio, has not formally announced action on SB 73 but rarely sits out a state-level speech case. The EFF has signaled it will support any plaintiff that draws Utah into federal court.

Utah Senator Calvin R. Musselman, the bill’s chief sponsor, has defended the speech provision as narrow and tailored to commercial pornography sites rather than general internet speech. The law’s text supports that reading, but the line between a covered site and a non-covered site is what courts will fight over.

Tighten Your Setup This Week

Whichever provider you pick, three settings carry most of the privacy load. Skip them and the rest of the subscription stops mattering.

  1. Switch to a modern protocol. WireGuard, NordLynx, or Lightway in your client settings. The legacy OpenVPN options still work, but they’re slower and easier to fingerprint at the network layer.
  2. Turn the kill switch on. If the VPN tunnel drops for a tenth of a second, the kill switch cuts your internet rather than letting your real IP leak to whatever site you were reading. It’s the single most important checkbox in any VPN app.
  3. Enable auto-connect on launch. Set the client to start with your operating system and connect automatically. Two seconds of unprotected traffic at boot is enough for an ISP, an analytics broker, or a public-Wi-Fi attacker to pin a profile to your device.

Frequently Asked Questions

Is It Illegal To Use A VPN In Utah After May 6?

No. SB 73 doesn’t ban VPNs and doesn’t penalize you for running one. The law puts the legal liability on websites that host adult content, not on individuals using a privacy tool. You can install NordVPN, ExpressVPN, PIA, or any other audited service in Utah today and use it for streaming, banking, and travel exactly as before.

Will Adult Sites Still Work In Utah If I Use A VPN?

It depends on the site. Pornhub and most major adult platforms have geo-blocked Utah outright since 2023 rather than verify IDs. Some sites will now layer global ID checks on top of those blocks to limit liability. Routing through a non-Utah VPN server may still reach those sites, but expect more identity prompts and more dead ends than before.

Does SB 73 Affect Non-Adult Websites?

Not directly. The statute only covers commercial entities hosting a substantial portion of material harmful to minors. Mainstream sites like YouTube, Reddit, and Netflix sit outside that definition. The constitutional concern raised by the EFF is that the speech restriction could chill broader VPN coverage online if other sites self-censor to avoid being swept in.

What Happens If My VPN Connection Drops Mid-Session?

Without a kill switch, your device falls back to your real IP for whatever fraction of a second the tunnel is down, exposing your location and traffic to your ISP and any site you’re connected to. With a kill switch enabled, your internet is cut entirely until the VPN reconnects. Turn the kill switch on inside your VPN app’s settings before doing anything sensitive.

Are Free VPNs Safe Enough For Utah?

Usually no. Independent audits of free VPN apps have repeatedly found embedded ad trackers, weak encryption, and shared data pipelines with brokers. Run a reputable free tier from a paid provider (Proton VPN’s free plan is the common pick) rather than a no-name app from a phone store. The audited paid services start under $4 per month on annual plans, which is cheaper than the cost of a serious data leak.

Utah just put a flag in the ground that no other US state has tried, and the legal sequel will play out in federal court rather than the legislature. The practical question for Utah residents this week is narrower. The privacy tool you already had is the same privacy tool you have today, and the three picks above cover the speed, security, and budget ends of the field. Set up the protocol, the kill switch, and the auto-connect, and the rest sorts itself out.

Disclaimer: This article is for general informational purposes and does not constitute legal advice. Utah’s Online Age Verification Amendments may be amended, enjoined, or interpreted differently by the courts after publication. Specific provisions, fines, and enforcement practices cited reflect public sources as of May 6, 2026 and may change. Readers with specific compliance, employment, or legal questions about Senate Bill 73 should consult a licensed Utah attorney before acting.

Continue Reading

APPS

Audible Faces Nationwide Class Action Over Expiring Credits

Published

on

Audible customers asked a federal judge in Seattle this week to certify a nationwide class action over audiobook credits that vanish after twelve months. The motion, filed in Hollis v. Audible Inc. in the U.S. District Court for the Western District of Washington, could put Amazon on the hook for every U.S. subscriber whose credits expired since December 4, 2020.

Plaintiffs say Audible’s credits qualify as gift certificates under RCW 19.240.030’s prohibition on expiring vouchers. Individual losses run from about $20 to $380. The judge already rejected Audible’s first attempt to dismiss. If granted, certification would bundle millions of forfeited credits into a single damages claim.

That matters because Audible has a lot riding on it. The $14.95-a-month subsidiary controls roughly two-thirds of U.S. audiobook revenue. It is also fighting an antitrust case in Manhattan and a separate California complaint over what “buying” an audiobook actually means. The credit case is the cheapest one for Amazon to lose.

What the Class Certification Motion Asks the Court to Do

Four named plaintiffs led by Jonathon Hollis filed the certification motion in early May, asking to represent every U.S. resident who lost an Audible credit after December 4, 2020. The proposed class covers both monthly subscribers and annual members who paid Audible directly, not through an app store.

The motion presses the theory that survived dismissal: credits are vouchers exchangeable for audiobooks, and Washington bans expiring vouchers. Plaintiffs are represented by Jonas Jacobson, Simon Franzini, Gabriel Doble and Stephen Ferruolo of Dovel & Luner’s class action practice, a Los Angeles firm that says it has won more than 85% of its trials and arbitrations.

Plaintiffs seek classwide damages, attorney fees, and treble damages under Washington’s Consumer Protection Act. The proposed class is tied to the original Hollis complaint filed in December 2024, which framed the credits as classic gift certificates dressed up in subscription clothing.

Why Washington’s Gift Certificate Law Is the Hammer

Washington’s gift certificate statute is one of the strictest in the country. The law makes it unlawful to issue or enforce a gift certificate carrying an expiration date, with narrow carve-outs for genuine loyalty rewards and donations to charity.

The definition is what bites Audible. A gift certificate is any voucher exchangeable for goods or services. The statute does not require a fixed cash value. It does not require transferability. That broad reach is the door plaintiffs walked through, and it is the door Audible cannot close on appeal without a legislative change.

Numbers in the case explain the urgency:

  • $20 to $380: the per-class-member damages range plaintiffs estimate
  • December 4, 2020: the start date for the proposed class period
  • 12 months: the lifespan of a Premium Plus credit before it disappears
  • $25,000: Washington’s cap on the treble multiplier per Consumer Protection Act violation

The CPA gives plaintiffs a parallel path to liability. RCW 19.86.090 on civil damages and treble damages lets injured consumers recover actual losses, attorney fees, and up to three times their damages, capped at $25,000 per violation. Treble damages do not require malice. They require a showing the unfair practice harmed the public interest.

Audible’s expiration policy is buried in its membership terms. Plaintiffs argue most subscribers never see it until a credit they paid for is gone, which is the kind of opaque practice the CPA was written to police.

The App Store Loophole That Complicates Audible’s Defense

Audible’s own help center contains a quirk that cuts against its position in court. Credits do not expire when users subscribe through the Apple App Store or Google Play. Apple and Google’s billing rules forbid expiring digital balances, so Audible adapts. Subscribe to Audible’s Premium Plus membership benefits page directly, and the same credit dies after twelve months.

That asymmetry is awkward. It shows Audible can run a no-expiration model. The company chooses not to on the channel where Apple and Google are not forcing its hand.

  • Apple App Store subscribers: credits never expire
  • Google Play subscribers: credits never expire
  • Direct audible.com subscribers: credits expire after 12 months

Inside the Class and the Money at Stake

The proposed class is large and easy to identify. Audible’s billing system already records every credit issued, redeemed, or expired by user. Plaintiffs argue that internal data alone proves commonality and predominance under Federal Rule 23, the threshold for nationwide certification.

The damages calculation works like this. A Premium Plus monthly credit costs roughly $14.95 in cash terms. A subscriber who lost two credits before redemption is out about $30. Annual plan members who let unused credits roll into a 24-credit pile and then forfeited eight of them sit closer to the $380 ceiling cited in the complaint.

Audible has not disclosed how many U.S. credits expired in the proposed class period, but the math compounds quickly. Audible holds 63.4% of U.S. audiobook revenue per Grand View Research’s 2024 audiobooks market analysis. If even one in twenty active U.S. subscribers lost a single credit, gross damages move past nine figures before any treble multiplier.

The class is also unusual for what it excludes. App Store and Play Store subscribers are out, because their credits never expire in the first place. That carve-out narrows the class to direct Audible billing customers, the channel where Amazon collects the full retail margin without paying Apple’s 15% to 30% cut.

The Argument Audible Tried That the Judge Threw Out

Audible’s central defense was that its credits cannot be gift certificates because they have no fixed cash value. A credit redeems for one audiobook regardless of that book’s list price. That elasticity, Audible argued, takes credits outside the statute. U.S. District Judge Tana Lin disagreed in her 2025 order denying the motion to dismiss, finding the statute requires neither fixed cash value nor transferability.

“Whether or not the Legislature intended for the gift certificate statute to only apply to vouchers which are transferable, it did not include such a requirement in its definition of ‘gift certificate.'”

Judge Lin’s order is the spine of the certification motion. If credits are gift certificates, expiration is unlawful. If expiration is unlawful, every forfeited credit since December 2020 becomes a damages claim. The certification fight is now whether one Seattle courtroom can resolve those claims in a single proceeding.

A Second Front in Amazon’s Audiobook Legal Battles

The credit case is one of three live legal threats stacked against Audible. In June 2025, U.S. District Judge Jennifer L. Rochon refused to dismiss an antitrust suit in Manhattan accusing Audible of monopolizing audiobook distribution. The complaint targets Audible’s exclusivity bonus, which pays a 40% royalty for 90-day exclusives and only 25% for non-exclusive titles.

A separate California class action alleges Audible misleads buyers into thinking they own the audiobooks they purchase when they receive only a license. That case revives a familiar argument from the Kindle and PlayStation worlds: when a digital store says “buy,” what is the consumer actually getting?

Audible’s broader response has been to diversify its subscription menu. The company recently launched a cheaper Standard tier at $8.99 a month that gives access to the Plus catalog without per-title credits. Standard sidesteps the credit-expiration problem entirely. It does not, however, fix the credits already lost by Premium Plus members for the past five years.

What Subscribers Should Do With Their Credits Right Now

Whatever the court does, the practical move for Premium Plus members is to clear the queue. Credits are most valuable when redeemed for higher-priced titles, and any credit older than eleven months is days from disappearing.

Audible’s customer support has historically restored expired credits on request as a one-time courtesy, but the policy is unwritten and discretionary. The litigation does not change that.

  1. Check your credit expirations: Sign in at audible.com, open My Library, and review the Credits tab for issue dates.
  2. Redeem oldest credits first: The first credit issued is the first to expire under Audible’s accounting.
  3. Use credits on premium titles: A credit applied to a $40 release captures more value than one used on a $9 sale title.
  4. Pause instead of canceling: A 90-day pause keeps existing credits intact, while cancellation forfeits them at cycle end.
  5. Save proof of expired credits: Screenshots and email receipts will matter if and when class notices go out.

For App Store and Google Play subscribers, none of this applies. Their credits sit indefinitely.

For everyone else, the expiration clock is still running. The class action, if certified, will sweep up past losses. It will not stop a credit issued today from disappearing on May 6, 2027.

Frequently Asked Questions

Do Audible Credits Really Expire After A Year?

Yes. Audible Premium Plus credits purchased directly from audible.com or Amazon expire 12 months after they post to your account, and the company’s help center confirms it. Credits bought through the Apple App Store or Google Play are an exception and never expire. To check your dates, sign in at audible.com, open My Library, and review the Credits tab.

How Do I Know If I Qualify For The Class Action?

You may qualify if you are a U.S. resident who held a direct Audible subscription and lost a credit to expiration anytime after December 4, 2020. App store subscribers do not qualify. The court has not yet certified the class, so there is nothing to file today. Watch the docket in Hollis v. Audible Inc., Case No. 2:24-cv-01999, or sign up for class notices through Dovel & Luner.

What Happens To My Credits If I Cancel Audible?

Any unused credits expire at the end of your final billing cycle when you cancel a direct membership. To save them, redeem them before the cycle ends, or pause your membership for up to three months instead. Credits earned through Apple or Google billing remain available regardless of cancellation, because both stores forbid expiring digital balances.

Can I Get An Expired Credit Restored Without Joining The Lawsuit?

Sometimes. Audible customer support has historically restored expired credits as a one-time courtesy when contacted within a reasonable window. Call 1-888-283-5051 or open the help chat at help.audible.com. There is no guarantee. A restored credit also carries a fresh 12-month clock, so redeem it quickly before it expires again.

The motion now sits with Judge Lin and could move on a multi-month timeline. Class certification rulings typically arrive 6 to 12 months after briefing closes, with discovery on Audible’s credit-expiration data running in parallel. Until then, every credit a Premium Plus member loses is one more entry in a record Amazon may eventually have to pay for.

Disclaimer: This article reports on pending litigation and is for informational purposes only. It does not constitute legal advice. Consumers who believe they may qualify as class members should consult a licensed attorney before taking action and watch the official court docket for class certification updates. Settlement amounts, eligibility criteria, and case outcomes can change as the case progresses, and any figures cited reflect publicly available filings as of publication.

Continue Reading

NEWS

Samsung’s 500 PPI Sensor OLED Reads Pulse And Blocks Snoopers

Published

on

Samsung Display revealed an upgraded Sensor OLED panel at Display Week 2026 on Tuesday in Los Angeles. The 6.8-inch screen reads heart rate and blood pressure through organic photodiodes baked into the panel, hides sensitive data from side viewers with Flex Magic Pixel privacy tech, and now hits 500 pixels per inch.

The pixel density climbed 33 percent in twelve months, up from last year’s 374 PPI prototype. That figure matters because it pushes a fully sensor-integrated phone screen close to a production-ready spec for the first time. Handset makers can now plan around it without rebuilding their hardware.

A Phone Screen That Reads Your Pulse

Samsung calls the panel Sensor OLED Display. It stitches OLED pixels and organic photodiode sensors into a single layer through a co-deposition process. The same manufacturing run produces both the picture-making layer and the light-detecting layer.

Place a fingertip on the screen and the display’s own emitted light bounces off the blood vessels in your finger. Some of that light returns to the panel. The OPD captures it, software reads the pattern as a photoplethysmography waveform, and the system extracts pulse and blood pressure off the rhythm.

The version Samsung Display showed press on May 5, 2026 also captures fingerprints anywhere across the screen rather than at a single anchor point. There is no separate ultrasonic module. The whole 6.8-inch surface becomes the sensor.

That is the point. The screen is not just showing data. It is collecting it.

From 374 PPI To 500 PPI In Twelve Months

Samsung Display’s previous Sensor OLED prototype, shown at Display Week 2025, ran at 374 pixels per inch. The new panel reaches 500 PPI. That’s a 33 percent jump inside a single product cycle, and it solves the practical problem that kept this technology in the lab.

At 6.8 inches across, the panel matches the screen size of every flagship Android device shipping today, including the Galaxy S26 Ultra released March 11, 2026. OEMs don’t need to rework their chassis tooling, their batteries, or their thermal layouts to adopt it.

  • 500 PPI: matches mainstream flagship AMOLED resolution
  • 6.8 inches: identical diagonal to the Galaxy S26 Ultra
  • 33 percent: PPI gain over the 2025 prototype
  • One layer: RGB and OPD pixels integrated through co-deposition

A Samsung Display spokesperson said in the company announcement that integrating two pixel types into a single layer was the central engineering challenge. Advanced panel design and precise process control technologies, the spokesperson said, are what unlocked the 500 PPI threshold.

Why Privacy Tech Is Riding Shotgun

A screen that reads your pulse is also a screen that displays your pulse. Samsung knows the data shown on a panel measuring health metrics is suddenly worth shielding. So the new Sensor OLED ships with Flex Magic Pixel embedded in the same panel.

The technology pairs narrow-angle and wide-angle subpixels. Switch on privacy mode and the wide-angle subpixels go dark, restricting the photon spread to a tight cone aimed at the user’s face. UL Solutions, an independent safety certifier, measured Samsung’s panel at 3.5 percent side-to-front brightness ratio at 45 degrees and below 0.9 percent at 60 degrees. Samsung Display’s UL Solutions privacy display verification announcement documented the test in February 2026.

The Galaxy S26 Ultra was the first commercial smartphone to ship with Flex Magic Pixel. The new Sensor OLED prototype takes the same idea further. Instead of darkening the entire screen at angle, FMP can selectively blur only the regions showing private data while leaving the rest visible. A glance from the next seat catches your wallpaper. The blood pressure number stays hidden.

Inside Samsung’s Display Week Lineup

The Sensor OLED was not Samsung Display’s only headliner at the Los Angeles Convention Center. The Korean panel maker walked into the I-Zone with a wider lineup that signaled where Galaxy and beyond are heading. “We are pleased to present our latest technologies and R&D achievements to global experts and industry leaders at SID 2026,” said Changhee Lee, Executive Vice President and Chief Technology Officer at Samsung Display, in Samsung Display’s official Display Week 2026 announcement.

Flex Chroma Pixel hit 3,000 nits in High Brightness Mode while covering 96 percent of the BT.2020 color gamut. Most commercial smartphone OLEDs cover roughly 70 percent today. Two EL-QD prototypes, an 18-inch and a 6.5-inch panel, pushed self-emissive quantum dot displays to 500 nits, a 25 percent gain on last year’s reference. A 200 PPI stretchable Micro-LED panel was pitched at automotive instrument clusters.

Here’s a quick scoreboard of the prototypes that matter most for phones and tablets.

Prototype Size Headline Spec Use Case
Sensor OLED 6.8 in 500 PPI, OPD layer Phone health sensing
Flex Chroma Pixel smartphone class 3,000 nits, 96% BT.2020 Phone HDR and outdoor visibility
EL-QD 6.5 in / 18 in 500 nits self-emissive Tablets and monitors
Stretchable Micro-LED variable 200 PPI, deformable Auto dashboards

Samsung Display also collected SID’s Display of the Year award for its TriFold dual-folding panel, the screen anchoring its Galaxy Z TriFold from late 2025. The combined message at Display Week was uncomplicated. Korea’s panel duopoly intends to keep selling the most advanced screens money can buy in 2026.

The Cuffless Blood Pressure Race Just Got A Bigger Player

Samsung is not the first to claim a phone or wearable can read blood pressure without a cuff. The FDA cleared the Aktiia Hilo Band on July 24, 2025, the first cuffless OTC blood pressure monitor green-lit for U.S. consumers and rolling out in 2026 according to Aktiia’s PR Newswire FDA clearance announcement. Smartphone apps using camera-based optical sensing have already cleared the AAMI/ESH/ISO clinical accuracy bar in peer-reviewed work.

Researchers Kim, Lee and colleagues, writing in a February 2025 Nature Communications study on multi-point OLED photoplethysmography, reported that an array of organic photodiodes integrated directly into the display can match medical-grade devices in pilot trials.

The system offers easy usability with a sensing time of 15 seconds and supports multiple functions including high-accuracy screening for cardiovascular diseases and blood pressure monitoring from both fingers, with no restrictions when using a single smartphone.

What Samsung is signaling is structural integration rather than a separate accessory category. A wrist band measures the person wearing it. A panel embedded across every flagship handset measures hundreds of millions. If the next Galaxy or two ship with Sensor OLED, smartphones could become a primary cardiovascular screening tool.

When Could This Land On Your Phone

Samsung Display has not committed to a commercialization timeline for Sensor OLED. The 374 PPI prototype shown in 2025 never reached production. The 500 PPI version unveiled this week is closer to phone-ready than anything before it, but Samsung Electronics, the handset arm, still has to qualify the panel, build the regulatory case for any health claim, and price the panel into a flagship bill of materials.

The Galaxy S27 Ultra cycle, expected around February 2027, is the earliest realistic window. Even then the first commercial implementation may launch with heart rate only, leaving the trickier blood pressure feature for a later refresh once Samsung clears the FDA bar that in-display sensing rivals like Metalenz’s Polar ID under-display camera are also pursuing in 2026.

Frequently Asked Questions

When will Samsung phones get the Sensor OLED display?

Samsung Display has not announced a commercialization date. The 500 PPI prototype shown at Display Week on May 5, 2026 is engineering-ready, but Samsung Electronics still has to qualify the panel and clear health-claim regulators. The earliest realistic window is the Galaxy S27 Ultra in February 2027, and even that first wave may ship with heart rate sensing only and add blood pressure later.

How accurate is blood pressure on a phone screen compared to a cuff?

Independent peer-reviewed work suggests it can reach clinical-grade accuracy. Lausanne University Hospital’s OptiBP AAMI/ESH/ISO smartphone validation study reported a bias and standard deviation of 0.39±7.30 mm Hg systolic and -0.20±6.00 mm Hg diastolic against cuff references, inside the 5±8 mm Hg threshold. Samsung’s specific Sensor OLED panel has not yet been independently validated against the same protocol.

Does the Galaxy S26 Ultra already read blood pressure through the screen?

No. The S26 Ultra, released March 11, 2026, ships with the Flex Magic Pixel privacy display only. The blood pressure and heart rate sensing layer demoed at Display Week 2026 is a separate prototype panel that has not yet been integrated into a shipping Galaxy device. Samsung Health still uses the rear optical sensor and the Galaxy Watch for cardiovascular metrics.

Can someone next to me see my health data on a Sensor OLED screen?

No, not on the prototype Samsung showed. Flex Magic Pixel selectively blurs the regions of the panel displaying private data, including health metrics, while leaving the rest of the screen visible at front view. UL Solutions verified that side-to-front brightness drops to 3.5 percent at 45 degrees and below 0.9 percent at 60 degrees, effectively black from a shoulder-surfer’s angle.

Is reading heart rate through a phone screen safe?

Yes. The same OLED light that displays your wallpaper does the sensing. There is no extra laser or higher-intensity emitter, so the optical exposure is identical to normal screen viewing. The technology is the same class of measurement already used in the Galaxy Watch, the Apple Watch, and FDA-cleared cuffless monitors like the Aktiia Hilo Band.

Display Week 2026 turned screens into sensors first and viewports second. Samsung’s 500 PPI Sensor OLED is the highest-resolution take on that idea anyone has shown the press. The panel may not arrive in your pocket until the Galaxy S27 cycle, but the direction of travel is clear. Phones are about to start reading you back.

Disclaimer: This article reports on display industry announcements and peer-reviewed research and does not constitute medical advice. Cuffless and screen-based blood pressure technologies vary in accuracy, regulatory status, and clinical validation across markets. Anyone managing hypertension or other cardiovascular conditions should consult a licensed healthcare professional and continue to use medical-grade monitoring tools. Specifications, regulatory clearances, and product timelines cited are accurate as of publication and may change.

Continue Reading

Trending