Google PAC memory ships with holes, Gemini TTS 3× cheaper, MJWarp 310× in beta

TL;DR

• Google’s Private AI Compute now stores memory server-side, ending its stateless design.
• Trail of Bits flagged 10 PAC issues, with 2 high-severity and 1 open at launch.
• Gemini 3.8 Flash TTS lists at ~$33/M characters, roughly 3× under ElevenLabs v3.
• MJWarp posts 310× manipulation and 152× locomotion speedups vs MJX on an RTX 4090.
• MJWarp remains Beta with missing solvers and a Warp EULA blocking copyleft integration.

Today’s three tech ships each land the marquee capability gain the vendor wanted, then pair it with a structural caveat the announcement understated. Google’s Private AI Compute grew a cross-device memory layer, but Trail of Bits found ten audit issues inside it and TEE.Fail broke the SEV-SNP attestation PAC’s hardware root of trust depends on. Gemini 3.8 Flash TTS genuinely undercuts ElevenLabs by roughly 3×, yet developers hit metallic artifacts past two to three minutes and occasional mid-sentence voice swaps. MJWarp posts a real 310× manipulation speedup over MJX — inside a single kinematic tree under 60 DoF, in a Beta build with missing solvers and a Warp EULA that blocks copyleft integration.

The pattern is worth naming: the top-line claims here are honest. The boundary conditions each one holds under are the actual story, and each feature is written around those boundaries.

Google’s Private AI Compute adds memory, loses statelessness

Source: deepmind-blog · published 2026-09-23

TL;DR

• Google’s PAC now stores memory server-side across devices, ending the stateless model earlier private-cloud AI relied on.
• Trail of Bits flagged 10 issues in the memory layer — 2 high-severity, one still open at launch.
• TEE.Fail broke SEV-SNP attestation weeks earlier with a sub-$1,000 DDR5 interposer, undermining PAC’s hardware root of trust.
• Apple’s PCC lets researchers run the server binary on their own hardware for verification.

What Google actually shipped

Private AI Compute (PAC) already ran Gemini requests inside hardware-enforced enclaves. The new piece is a persistent, per-user memory store — a “secure digital vault” that lets a task started on a phone resume on smart glasses with full context. The keys that decrypt that vault live on the user’s devices; Google’s servers hold ciphertext and process it only inside Trusted Execution Environments that a client can cryptographically attest before sending anything sensitive.

That’s the pitch. It’s also a deliberate departure from the stateless model that made confidential AI easy to reason about.

Two audits, two verdicts

Google commissioned two independent reviews and the results diverge sharply. NCC Group’s 100-person-day engagement covered the Oak Session Library, the attestation and encryption protocols, the IP-blinding relay, the T-Log transparency system, and a source review of the PAC frontend — a broad architectural sign-off ¹. Trail of Bits, brought in specifically for the memory layer, found ten issues including two high-severity vulnerabilities “in the key release and persistent-state boundaries, which could potentially allow an attacker to bypass hardware enclave protections under specific conditions” ². Eight were remediated. At publication, one high-severity finding remained open and external attestation verification was still internal-only.

The hardware root of trust just cracked

PAC’s isolation rests on AMD SEV-SNP and Google’s custom TPUs. In October 2025 — weeks before this launch — researchers demonstrated TEE.Fail, using a sub-$1,000 DDR5 interposer to exploit deterministic AES-XTS encryption and extract ECDSA attestation keys from Intel TDX, AMD SEV-SNP, and Nvidia’s Confidential Computing GPUs ³. Intel and AMD classify physical interposition as out-of-scope for their threat model, which is convenient framing but doesn’t change the math: the “cryptographically verifiable” attestation chain PAC leans on has a demonstrated $1,000 break. For ephemeral prompts, the blast radius is one session. For persistent cross-device memory, it’s your history.

Apple made the opposite bet

The comparison to Apple’s Private Cloud Compute is where the design choice becomes visible.

Apple’s Virtual Research Environment lets outsiders run the server software on their own hardware and compare; Google does not offer equivalent reproducibility ⁴. Apple also stayed stateless deliberately, preserving what SimpleMDM calls “non-targetability” — no stable per-user record to subpoena, leak, or repurpose ⁴. Google has traded that property for the feature.

Cryptographer Matthew Green frames the underlying critique:

As servers accumulate long-term “context” about a user’s life, the security model shifts from protecting a single query to protecting a permanent, centralized digital twin. ⁵

The claim to watch

The cryptographic architecture is genuinely stronger than typical cloud AI, and NCC’s review is substantive ¹. But three gaps the DeepMind post glosses over — unresolved high-severity findings in the memory layer ², attestation hardware broken in the lab pre-launch ³, and no reproducibility parity with Apple ⁴ — mean the “same privacy as on-device” line is marketing, not engineering. Persistent memory is a product decision. It is not a free one.

---

Gemini 3.8 Flash TTS undercuts ElevenLabs 3× on price

Source: simon-willison · published 2026-09-23

TL;DR

• Gemini 3.8 Flash TTS lists at ~$33 per million characters — roughly one-third ElevenLabs v3 at $100/M.
• Willison’s playground generated 78 seconds of two-speaker dialogue for 2.74¢ in about 20 seconds.
• Voice cloning demands a second consent recording that is voiceprint-matched to the 30-second sample before a clone unlocks.
• Developers report metallic artifacts past 2–3 minutes plus mid-sentence voice swaps and repeated tokens.

The price is the story

Simon Willison’s bring-your-own-key playground for gemini-3.8-flash-tts is a fun artifact — vibe-coded with GPT-6 Astra, state-encoded in the URL, two pelicans arguing about Pacifica Pier for 2.74 cents — but the number under the demo is what matters. OrcaRouter’s normalized comparison puts Google at about $33 per million characters against ElevenLabs Eleven v3 at $100/M, roughly a 3× discount at comparable Speech Arena quality ⁶. ElevenLabs pre-empted the launch by repositioning around a multi-modal “Studio 4.0” bundle rather than matching on raw TTS cost — a tell that the incumbent expects the floor to keep dropping.

Google backs the price with credible quality signals: Artificial Analysis ranks it #1 on pronunciation robustness, and the API’s multi-speaker mode (each speaker gets a voice ID plus a free-form delivery style like “excited and gossipy”) is genuinely differentiated versus stitching single-voice calls together.

Consent verification, not a checkbox

The “30-second sample” line Willison quotes undersells the actual gating. To enable a custom voice, Google requires a second recording of the voice owner verbally granting permission, and the system voiceprint-matches the consent clip against the reference sample before the clone activates ⁷. Outputs then carry SynthID watermarks and C2PA credentials.

That is a real step past checkbox consent — but two caveats bite. Voice replication is geofenced out of the UK, EEA, India, Texas and Illinois entirely, so anyone shipping a product against this API needs a region-aware fallback ⁸. And SynthID’s robustness is contested: SRI Lab researchers report the watermark is “easier to scrub” than competing schemes, with the UnMarker tool hitting ~79% strip rates against some variants ⁹. Provenance is a compliance story, not a guarantee.

Demos hide the long-form failure modes

Willison’s clip is 78 seconds — comfortably inside the model’s stable zone. Push further and the wheels wobble. Developers on r/google_antigravity report metallic degradation past 2–3 minutes of continuous generation, plus multi-speaker hallucinations where the model swaps voices mid-sentence or repeats filler tokens like “Alo” several times in a row ¹⁰. The obvious workaround — chunk the script, stitch the audio — introduces prosody drift between segments.

Continuous speech generation exceeding 2–3 minutes often results in ‘metallic’ artifacts or robotic distortion.

For interactive assistants, IVR, or short-form dialogue (the playground’s sweet spot), none of this matters. For audiobooks or long podcasts, expect meaningful engineering overhead before the pricing win shows up on your invoice.

Regulators are catching up

The launch lands mid-legislative-cycle. The NO FAKES Act of 2026 cleared Senate Judiciary unanimously and would create the first federal IP right in voice and likeness, with a DMCA-style takedown regime ¹¹. Read Google’s consent-verification flow and SynthID stack as pre-compliance with the bill that is very likely to pass, not as goodwill. The tech is priced to win; the safety architecture is priced to survive the next twelve months of policy.

---

MJWarp hits 310× MJX speedup but stays beta-grade

Source: huggingface-blog · published 2026-09-23

TL;DR

• Independent benchmarks confirm 152× locomotion, 310× manipulation speedups vs. MJX on an RTX 4090.
• Gains collapse above ~60 DoF in a single kinematic tree — classic CPU MuJoCo wins there.
• Still Beta: missing IMPLICITFAST/PGS/noslip solvers, manual buffer tuning, float32 NaNs at low friction.
• NVIDIA Warp’s EULA blocks copyleft integration and “competing products,” unlike Apache-2.0 Brax.

What the tutorial ships

The HuggingFace/NVIDIA walkthrough is a clean migration guide: swap mujoco.mj_step(m, d) for mjw.step(m, d), add a leading nworld dimension to your data, capture a CUDA graph to amortize dispatch, and a single-CPU pick-and-place task on the SO-101 arm becomes a 2,048-world batched training environment. It correctly emphasizes the two things beginners get wrong — tightly sizing nconmax/njmax to avoid buffer overflows, and using DLPack to keep tensors resident on-device between the physics loop and the policy network. The “Gate” parity harness that checks a single-world GPU run against the CPU baseline (cube-center error ≤ 0.015m) is the right engineering discipline.

That’s the good news. The rest of the ecosystem tells a more qualified story.

Where the speedups actually hold

MJWarp’s throughput numbers are real but regime-specific. Independent measurements on an RTX 4090 report 152× over MJX for locomotion and 310× for manipulation ¹², and Newton-level stacks claim 70–100× on humanoid tasks ¹³. The catch: performance collapses once a single kinematic tree exceeds ~60 DoF, at which point classic C-based MuJoCo on CPU is faster for low-latency single-world control ¹². The “scale to 2,048 worlds” framing works for swarms of small manipulators; humanoid-scale scenes need Newton’s sleeping-island partitioning to stay competitive, which the tutorial doesn’t mention.

Put differently: MJWarp wins when you can saturate the GPU with many independent small worlds. If your workload is one big robot, you may be regressing.

The caveats the tutorial skips

The PyPI page itself lists MJWarp as Beta with no IMPLICITFAST integrator, no PGS or noslip solvers, and manual nconmax/njmax tuning required ¹⁴. Open issues on google-deepmind/mujoco_warp go further: the Newton Cholesky solver runs in float32, so sliding friction values around 0.001 trigger NaN cascades because the Hessian’s condition number blows past float32 precision. The convex box-box narrowphase misses shallow contacts, producing deep-penetration explosions. And reset_data leaves stale island state that leaks between RL episodes — a silent correctness bug in exactly the loop the tutorial is selling ¹⁵.

The mjlab framework, which pairs Isaac Lab’s manager-based API with the MJWarp backend, inherits the same tradeoffs: float32 by default (vs. MuJoCo’s double), no high-fidelity RGB rendering, and no determinism guarantee across GPU runs due to atomics ¹⁶. Warp 1.15+ offers opt-in deterministic mode, but downstream wrappers don’t always propagate it.

The licensing footnote

The tutorial talks about Warp as if it were straightforwardly open source. It isn’t. Sections 2.6 and 2.7 of the NVIDIA Warp EULA prohibit using it to build “competing products or technologies” and bar integration into copyleft projects ¹⁷. For a commercial simulation vendor or a GPL-licensed research stack, that’s a material adoption blocker that Apache-2.0 alternatives like Brax and upstream MuJoCo don’t have.

Net take

MJWarp is genuinely the fastest path to batched MuJoCo on GPU, and for RL researchers training small-manipulator policies at 2,048-way parallelism the speedups are transformative. But the tutorial reads like a launch post: it undersells the DoF ceiling, the float32 fragility, the missing solvers, and the license. Treat the Gate parity check as mandatory, not optional — and read the EULA before you ship.

Round-ups

Fable 5.1 one-shots an interactive shadow roots CSS tutorial

Source: simon-willison

A single prompt to Fable 5.1 Medium — “build an artifact to explain shadow roots in CSS with interactive examples” — produced a working explainer tool, another data point on model-generated educational artifacts replacing hand-built demos for niche web platform concepts.

TikTok creator pinpoints the real tell of AI-written scripts

Source: simon-willison

Beyond the familiar “not X, it’s Y” tics and staccato cadence, @therealcornpop argues the giveaway in AI-drafted TikTok and YouTube scripts is absence of a point of view — the writer clearly holds no opinions about the subject they’re covering.

Footnotes

1. NCC Group public audit report — https://www.nccgroup.com/research/public-report-google-private-ai-compute-review/

   100-person-day engagement involving ten consultants… Stage 1 performed a cryptographic assessment of the Oak Session Library and the attestation/encryption protocols… Stage 2 expanded to include the security of the IP-blinding relay, the T-Log system, and a source code review of the PAC frontend server.

   ↩ ↩²

2. Help Net Security — Trail of Bits findings — https://www.helpnetsecurity.com/2026/09/24/google-private-ai-compute-server-side-memory/

   Trail of Bits… identified ten findings, including two high-severity vulnerabilities… in the key release and persistent-state boundaries, which could potentially allow an attacker to bypass hardware enclave protections under specific conditions.

   ↩ ↩²

3. BleepingComputer — TEE.Fail attack — https://www.bleepingcomputer.com/news/security/teefail-attack-breaks-confidential-computing-on-intel-amd-nvidia-cpus/

   Researchers… demonstrated that the deterministic AES-XTS encryption used by Intel (TDX/SGX) and AMD (SEV-SNP) allows attackers to correlate memory traffic with secret data… using a low-cost (<$1,000) interposition device… to extract ECDSA attestation keys and compromise AI workloads in Nvidia’s GPU Confidential Computing.

   ↩ ↩²

4. SimpleMDM analysis of Apple PCC vs Google PAC — https://simplemdm.com/blog/apple-intelligence-how-secure-is-private-cloud-compute-for-enterprise/

   Apple’s PCC allows researchers to run the server software on their own hardware for verification, [while] Google’s implementation is perceived as harder to independently audit… Apple’s stateless model offers superior ‘non-targetability’ (making it impossible to single out one user’s data).

   ↩ ↩² ↩³

5. Matthew Green critique (via Medium analysis) — https://medium.com/@meshuggah22/googles-private-ai-compute-the-architecture-that-attempts-to-solve-cloud-ai-s-privacy-problem-f82cbf4b2e8b

   Cloud enclaves offer no physical way for an outsider to confirm that the code being audited is the exact code running on the production server… as servers accumulate long-term ‘context’ about a user’s life… the security model shifts from protecting a single query to protecting a permanent, centralized digital twin.

   ↩

6. OrcaRouter benchmark comparison — https://www.orcarouter.ai/blog/gemini-3-8-tts-vs-elevenlabs

   Gemini 3.8 Flash TTS is approximately one-third the price of ElevenLabs’ flagship models when normalized for character count… roughly $33.00 per million characters, whereas ElevenLabs Eleven v3 costs $100.00 per million characters.

   ↩

7. TheNextWeb — https://thenextweb.com/news/gemini-tts-3-8-flash-voice-design-cloning

   The system requires ‘consent verification,’ where users must provide a separate recording of the voice owner granting permission… The model then matches the verbal consent against the 30-second reference sample to ensure they originate from the same speaker before allowing the clone to be generated.

   ↩

8. Shattered.io regional-availability writeup — https://shattered.io/gemini-3-8-flash-tts-voice-design-2026/

   Voice replication is currently unavailable in the UK, EEA, India, and certain US states (Texas and Illinois) due to varying regulatory frameworks regarding biometric data and voice ownership.

   ↩

9. Forkast News on SynthID robustness — https://forkast.news/googles-gemini-3-8-thinks-out-loud-and-that-changes-how-ai-earns-trust/

   Security researchers at the SRI Lab reported that SynthID is ‘easier to scrub’ than other state-of-the-art schemes because its presence can be cheaply identified through black-box queries… independent benchmarks suggest [UnMarker] achieves success rates near 79% against some SynthID variants.

   ↩

10. r/google_antigravity developer thread — https://www.reddit.com/r/google_antigravity/comments/1wfy6jj/gemini_38_flash_has_a_dangerous_obsession_with/

    continuous speech generation exceeding 2–3 minutes often results in ‘metallic’ artifacts or robotic distortion… the model has been observed to ‘hallucinate’ shifts between distinct voices or repeat specific phrases (e.g., ‘Alo’) multiple times within a single sentence.

    ↩

11. Manatt legal alert on NO FAKES Act 2026 — https://www.manatt.com/insights/newsletters/client-alert/congress-reintroduces-the-no-fakes-act-what-s-new-in-the-2026-bill

    the U.S. Senate Judiciary Committee unanimously advanced the Nurture Originals, Foster Art, and Keep Entertainment Safe (NO FAKES) Act of 2026… aims to establish the first federal intellectual property right over an individual’s voice and visual likeness.

    ↩

12. Robotics Center — MuJoCo vs Isaac Sim — https://www.roboticscenter.ai/rl-environments/mujoco-vs-isaac-sim

    MJWarp can achieve up to 152x speedups over MJX for locomotion and 310x for manipulation on an RTX 4090, but performance degrades in single-kinematic trees exceeding 60 degrees of freedom, where classic C-based MuJoCo remains superior for low-latency single-environment control.

    ↩ ↩²

13. Robolabs — Newton physics engine analysis — https://www.robolabs.ai/resources/blog/newton-physics-engine-nvidia-deepmind-sim-to-real

    Newton is governed by the Linux Foundation with contributions from NVIDIA, Google DeepMind, Disney Research and TRI; Disney’s Kamino solver handles complex kinematic topologies for expressive characters while MJWarp serves as the rigid-body backend, with reported 70x speedups for humanoid locomotion and 100x for manipulation.

    ↩

14. PyPI mujoco-warp package notes — https://pypi.org/project/mujoco-warp/

    MJWarp remains categorized as Beta; missing features include the IMPLICITFAST integrator, PGS and noslip solvers, and users must manually tune nconmax and njmax buffer sizes to avoid overflows.

    ↩

15. GitHub issue google-deepmind/mujoco_warp #1517 — https://github.com/google-deepmind/mujoco_warp/issues/1517

    The Newton Cholesky solver fails when the Hessian’s condition number exceeds float32 precision — sliding friction values around 0.001 trigger NaNs, the convex box-box narrowphase misses shallow contacts causing deep penetration crashes, and reset_data leaves stale island states leaking between RL episodes.

    ↩

16. arXiv/Moonlight review — mjlab framework — https://www.themoonlight.io/en/review/mjlab-a-lightweight-framework-for-gpu-accelerated-robot-learning

    mjlab pairs Isaac Lab’s manager-based API with the MJWarp backend but defaults to float32 (vs MuJoCo’s double precision), excludes high-fidelity RGB rendering, lacks PGS and noslip solver support, and cannot guarantee determinism across GPU runs due to atomic operations.

    ↩

17. NVIDIA Warp license discussion (developer.nvidia.com) — https://developer.nvidia.com/warp-python

    Sections 2.6 and 2.7 of the Warp EULA prohibit use of the software to develop ‘competing products or technologies’ and bar integration into copyleft open-source projects, in contrast to Apache 2.0-licensed alternatives like Brax or MuJoCo.

    ↩