Digital Colliers Daily Briefing — June 21, 2026
Frontier AI labs are reshuffling their top scientific talent, the UK is preparing to push facial age-estimation from web forms into immigration enforcement, and a long-scheduled Secure Boot certificate expiry on June 24 is about to test how well Microsoft, Linux distributors, and OEMs have handled a once-a-decade cryptographic transition. Today's briefing tracks a Nobel laureate's move from DeepMind to Anthropic, a UK Home Office plan to scan asylum seekers' faces despite an internal report flagging bias, and the impending Secure Boot deadline that will determine which PCs remain protected against UEFI bootkits.
1. Jumper's exit from DeepMind hands Anthropic a Nobel-tier science hire
What happened. John Jumper, who shared the 2024 Nobel Prize in chemistry with Demis Hassabis for AlphaFold, announced on Friday that he is leaving Google DeepMind for Anthropic after nearly nine years. In a post on X cited by TechCrunch, Jumper credited Hassabis with "tak[ing] a real chance letting me lead the AlphaFold team just six months after finishing my PhD." Bloomberg, as relayed by TechCrunch, reports Jumper had more recently been working on Google's coding tools — a product line the company has struggled to commercialize. His departure lands in the same week that Character AI co-founder Noam Shazeer left DeepMind for OpenAI.
Why it matters. AlphaFold is the most decorated example of AI applied to a hard scientific problem, and Jumper is among the small handful of researchers who can credibly lead a scientific-AI program at frontier scale. His move pushes Anthropic — historically focused on alignment, safety, and enterprise assistants — toward a more explicit play in AI-for-science, an area DeepMind had treated as a strategic moat. Paired with Shazeer's return to OpenAI, the week marks a visible redistribution of senior talent away from DeepMind toward its two principal rivals.
Who is affected. DeepMind loses scientific prestige and continuity on coding-tool work at a moment when Google is under pressure to convert research into revenue. Anthropic gains a recruiting signal that may pull additional structural-biology and computational-chemistry researchers. Pharma and biotech partners who have built around AlphaFold's roadmap will be watching whether Jumper's group at Anthropic produces a competing protein or molecular platform.
What to watch next. Whether Anthropic stands up a formal science division, how Google reorganizes the remaining AlphaFold team, and whether Isomorphic Labs — DeepMind's drug-discovery spin-out — retains its current leadership.
Sources:
2. UK to use facial age-estimation on asylum seekers despite internal evidence of bias
What happened. A joint investigation by WIRED, Lighthouse Reports, and The Independent, summarized by Ars Technica, reports that the UK government plans to deploy facial age estimation (FAE) at the border starting next year to help determine the age of asylum seekers arriving without documentation. An internal Home Office report obtained by the investigators found that the tested systems "regularly mistake children for adults" and exhibit bias problems that disproportionately affect the largest national group subject to age assessments in 2025. Ars Technica describes the deployment as the first known use of FAE in an immigration context.
In parallel, the Birmingham Mail reports that Technology Secretary Liz Kendall will return to Parliament in July with a statement on VPNs, as the government weighs whether to "age-gate" VPN use alongside its under-16 social media ban. Children's minister Josh MacAlister told the BBC that age-gating VPNs would be "really welcome," while Baroness Liz Lloyd cautioned that evidence on children's VPN use is "limited." Ofcom has told the government it still needs more work on "the effectiveness and accessibility of different methods" and the privacy trade-offs involved.
Why it matters. Online age-assurance tooling is moving offline and into decisions that affect liberty: misclassifying a child as an adult can place them in adult detention and strip safeguarding protections. The Home Office is proceeding with a technology its own evaluators have flagged as biased — a precedent likely to be cited by other states considering FAE at borders, in welfare offices, or in criminal proceedings. The simultaneous VPN consultation shows the same government extending an age-verification logic across the consumer Internet, raising questions about how circumvention will be policed without broader identity infrastructure.
Who is affected. Asylum seekers — especially unaccompanied minors — face direct, high-stakes consequences. Vendors of FAE systems (Yoti and its competitors) gain a reference customer but also fresh regulatory and litigation exposure. UK consumers, VPN providers, and platforms covered by the Online Safety Act face an expanding compliance perimeter. Civil-liberties groups and refugee NGOs are likely to mount legal challenges.
What to watch next. Publication of the Home Office's internal evaluation, procurement disclosures naming the FAE vendor, judicial review filings, and Kendall's July statement on VPN regulation and the age of digital consent.
Sources:
3. Secure Boot's 2011 certificates expire June 24, exposing un-updated PCs to UEFI bootkits
What happened. As Wired reports (via Ars Technica), three Microsoft-signed certificates dated 2011 that underpin Secure Boot expire on June 24, and are being replaced with 2023-dated equivalents. Secure Boot is the chain-of-trust mechanism that validates firmware loaded during system startup; without current certificates, machines lose protection against UEFI bootkits — malware that loads before the operating system and survives OS reinstallation. The refresh was forced by LogoFail, a 2023 class of image-parsing vulnerabilities in UEFI logo-rendering code that let attackers bypass Secure Boot on nearly every Windows and Linux system.
Microsoft is pushing the new keys through standard Windows 10 and Windows 11 monthly patches. Linux distributors are updating their "shims," the first-stage bootloaders that bridge Microsoft-signed Secure Boot keys and distro-specific bootloaders. Machines that miss the update will keep booting, but without protection against new UEFI threats. Users can verify status under Windows Security > Device Security > Secure Boot — a green checkmark indicates the keys have rolled.
Why it matters. The June 24 date is a hard cryptographic deadline affecting essentially every modern PC. Real-world UEFI implants — LoJax (APT 28, 2018), MosaicRegressor (2020), and successors including ESpecter, FinSpy, and MoonBounce — demonstrate that nation-state and criminal actors have operational interest in this layer. Older or out-of-warranty systems whose OEMs have stopped shipping firmware updates may be effectively stranded.
Who is affected. Enterprise IT teams managing large Windows and Linux fleets, OEMs facing support escalations from machines that fail to update cleanly, and Linux users on distributions slower to ship updated shims. Consumers on out-of-support hardware face the highest residual risk.
What to watch next. Post-deadline telemetry from endpoint vendors on the share of devices left on 2011 certificates, shim release cadence across major distros, and whether attackers move quickly to exploit the gap on un-updated machines.
Sources:
Today's items sit on three different axes — talent, governance, and infrastructure — but each turns on the same question of who absorbs the risk when frontier systems change hands. Anthropic and OpenAI are absorbing scientific capability that Google built; UK asylum seekers will absorb the error rates of a facial-recognition system the Home Office already knows is flawed; and IT departments will absorb the cleanup for any PC that misses the Secure Boot refresh. The week's through-line is that the consequences of AI and security decisions made in 2023 and 2024 — Nobel-winning research programs, online age-assurance regimes, LogoFail-driven key rotations — are arriving at their operational deadlines now.