What can investigative journalists and anonymous whistleblowers do when they are tracked down and searched for revealing secrets?

PlugOS 1.7.13 is now available for all supported devices.
This update adds new security features based on user feedback and fixes several known issues.
Key Updates of PlugOS:
1. Support compatibility mode for iOS hosts
2. Support client-side background audio playback
3. Improved launcher compatibility
4. Fixed known bugs
Note: The compatibility mode and background audio playback introduced in this update requires the latest Android and iOS client to function properly.
PlugOS Update Steps:
Step 1. Connect your PlugMate to a host device with sufficient power supply, then boot into PlugOS.
Step 2. Open PlugOS Settings, go to System Update, check for updates, and install the available release.

If you encounter any issues during the update or require further assistance, please submit feedback via PlugOS Settings > Feedback, or send an email to: support@trustkernel.com

New PlugOS Playstyle: Solving Low RAM Issues on Phones
Your phone isn’t broken. It’s just out of RAM.
Every app you’ve installed is crammed onto the same desk: messaging, work tools, browser, games. They’re all fighting for memory. Open WhatsApp and the browser reloads. Launch the camera and Spotify stops playing. At that point, you start thinking it’s time for a new phone.
PlugOS changes the game. It’s not an app—it’s a tiny independent computer, about the size of a USB drive, with its own processor, memory, and fully encrypted storage. Plug it into your phone and it runs on its own hardware instead of stealing your phone’s resources.
You can move your messaging apps, social accounts, work stuff, and media files over to it. Suddenly your phone feels fast again because those memory-hungry apps are no longer competing on the same device.
Have you ever kept using your phone well past the usual two-year upgrade window? What made you stick with it?

AI Agent: "Strongest Assistant" or "Legal Virus"
Real incidents:
On July 10, OpenAI’s GPT-5.6 Sol launched. Investor Matt Shumer tested it. A shell variable bug triggered rm -rf. It nearly deleted all his local Mac files.
On April 24, a startup (PocketOS) used Cursor + Claude Opus 4.6. In just 9 seconds, it wiped their entire production database — including all backups. The business was down for 30 hours.

They run on the same device as your banking apps, private photos, and every chat. One prompt injection, one bad update, or one corrupted memory file could let it reach everything.

The solution:
Give your AI a separate “external brain.” PlugMate uses hardware isolation to keep the risk in a box. It’s a complete standalone Android device — 8-core processor, 4GB RAM, 128GB encrypted storage — yet it’s only the size of a USB drive.
Move your AI assistant to PlugMate. It runs, thinks, and works on its own hardware. It never touches your phone data, photos, or banking apps.

Virtual peripherals are key for anti-tracking and dodging data collection.
PlugMate delivers the same capability. It creates a fully isolated secure environment through system-level firewalls, zero trust architecture, end-to-end encryption, and hardware isolation. PlugMate is a pocket-sized Android privacy device shaped like a USB drive. Below is a quick overview of its virtual peripheral features.

Your keyboard sees every password, every late-night text, every search. Before you hit send.

Not a bug. It's architecture. A keyboard sits below the app layer, above the OS, so every keystroke passes through it first.
2022: Trinity College Dublin found Gboard & SwiftKey quietly reporting word length, typing speed, even which app you're in.
2017: a keyboard's exposed database leaked 580GB. Emails paired with passwords.
2016: SwiftKey users got strangers' emails in their predictive text.

The fix isn't a settings toggle you have to trust. It's cutting network access at the OS level. That's exactly what PlugOS does: keyboard input stays on-device, and its firewall lets you kill any app's internet access with one tap.

Blog post details:
https://plugos.net/blog/2026/07/what-does-your-keyboard-know-about-you/

From 2021 to 2025, far-right groups in the United States systematically doxed investigative journalists on Telegram. They exposed home addresses, private photos, and phone numbers.

This kind of doxing doesn't only happen to journalists who protect their sources. It also happens to outspoken whistleblowers and activists from marginalized communities. It happens to LGBTQ+ people, ethnic minorities, and even people who have already survived harassment once before.

Every time your phone connects to a network, it leaks a hardware fingerprint. Websites leave behind traces that cross-check your activity. Apps collect telemetry data you never agreed to share. Someone trying to find you doesn't need your name. They just need enough scattered pieces of information.

PlugMate provides virtualized device identifiers. Apps and websites see changing parameters instead of your real hardware information. Once you unplug the device, no data is left behind on the host machine.

Have you ever considered that smoke detectors, lamps, and even air conditioner vents in your hotel room could potentially become eavesdropping devices?

A 2026 Solace Global Risk security report directly recommends: always assume your room is being monitored. In 2025, Samsung flagship models (S22-S24) were also found to have spyware implanted through a single WhatsApp image—the user was completely unaware, yet was remotely controlled.

Antivirus software, VPNs, encrypted chat… these "security measures" we take for granted are all ineffective when the host itself is untrusted.

We wrote an article discussing why the premise of "trusting the host" is inherently problematic, and what differences physical isolation can bring. It's suitable for corporate security managers, frequently traveling executives, and anyone concerned about device privacy.

Learn more: https://x.com/TrustKernelTech/status/2079514298561245253

In 2024, Firefox (the "privacy first" browser) was caught quietly sending user data to ad-tracking firm Adjust. It took public backlash before Mozilla removed it in August.

Then in Feb 2025, Mozilla's first formal user agreement sparked outrage over near-unlimited rights to user input. They rewrote it twice in one week.

Lesson: a "privacy toggle" only works if you trust the vendor's word.

PlugOS took a different approach: no telemetry code compiled in, high-risk Web APIs disabled by default, strict cookie isolation, and a system firewall that audits every connection and blocks third-party trackers in real time.

Real privacy isn't a bigger "off" button. It's having nothing to turn off.

Official Whitepaper: https://plugos.net/

PlugOS 1.7.14 is now available for all supported devices.

This update resolves several known issues and improves system stability.

Key Updates of PlugOS:
Improved system stability
Fixed some known issues

PlugOS Update Steps:
Step 1. Connect your PlugMate to a host device (such as a PC) with sufficient power supply, then boot into PlugOS.
Step 2. Open PlugOS Settings, go to System Update, check for updates, and install the available release.

If you encounter any issues during the update or require further assistance, please submit feedback via PlugOS Settings > Feedback, or send an email to: support@trustkernel.com

learn more: https://discuss.plugos.org

The Android version of PlugOS Client are now updated.
This update fixs several known issues.
Update Notes:
Fixed several known issues

Installation Method:
Update or install PlugOS from Support –Support – PlugOS Help, Guides and Troubleshooting or on Google Play.

If you have any feedback or encounter issues while using the PlugMate, you can submit via the built-in feedback function in PlugOS Client or email us at support@trustkernel.com.

"Is my phone listening to me?" It's the question almost everyone has asked at some point, especially after seeing an ad for something you just talked about out loud.

But why has the "listening" theory been repeatedly debunked by regulators and researchers?

In our latest blog post, we dig into how device fingerprinting, browsing data, and real-time ad bidding quietly build a profile of you that's far more accurate than any "listening" ever could be, all without touching your mic or camera permissions.

This is also why we designed PlugOS from the very beginning to never collect any data — zero data upload.

But we also cover what actually works to protect yourself (and what doesn't, looking at you, VPN-only setups).

Read the full breakdown here: https://plugos.net/blog/2026/07/why-personalized-ads-persist-despite-disabling-mic-and-camera/

What's your take, do you think your phone is listening, or is it something else entirely?

What would someone find if they scrolled through your phone right now?

Probably nothing dramatic. But if you're a journalist, a lawyer, or work in finance, one leaked message doesn't just embarrass you, it can cost you everything.

Your most private conversations shouldn't just be encrypted. They shouldn't even live on your phone unless you want them there.

Plug in. Your private account and chats load instantly.

Unplug. The entire app disappears — not hidden, completely gone.

Plug back in with two-way encrypted authentication. Everything returns exactly as you left it.

Have you ever wondered just how much information your phone reveals to apps?

Location history, timestamps, places you visited last week—all of this is quietly recorded in the background.

If you can't change the current situation where you're forced to grant permissions to apps you want to use, then give them false information.

PlugMate's virtual GPS location feature allows your apps to see only the information you choose to show them.

The device is equally easy to use; simply plug it into your phone or computer anytime, anywhere.

PlugMate doesn't let you share your phone's clipboard. It doesn't let the host machine take screenshots either. Annoying? Sure. But that's the point.

Clipboard and screenshots aren't just convenience features. They're data exfiltration paths. Every major desktop OS lets apps read the system clipboard. Any process with screen-capture permission can silently drop images into your screenshots folder. That's not a bug. It's just how these OSes were designed, for convenience rather than airtight security.

PlugMate runs its own processor, its own memory, its own encrypted storage. The phone it plugs into is just a display and a keyboard. The host machine has zero access to what's inside PlugMate. That boundary is the whole point of the device.

Turning on clipboard sharing means punching a hole in that boundary, wiring PlugMate's trusted environment straight into the host's memory. Turning on screenshots means permanently writing everything on PlugMate's screen to a machine you've explicitly decided not to trust.

Ever wonder while scrolling social media how to stop your online behavior from being tracked?

When you open the Facebook app and browse your latest posts, your device's fingerprint, location, network environment, sensor data, and more are being quietly collected and used to build your personal profile.

This is certainly unsettling for privacy-sensitive users and high-risk groups.

PlugMate provides a systematic way to counter data collection by Facebook and similar platforms.

Block device fingerprinting: Replace serial numbers, SIM info (IMSI/ICCID), MAC addresses and other hardware IDs with random values so platforms can’t access your real device details.

Simulate location & network: Drag a map to set any virtual location and customize network status.

Firewall control: View and one-tap block Facebook plus related ads and analytics SDKs.

Using social media doesn’t mean social media has to see through you.

When they force you to unlock your device...what happens?

PlugMate instantly wipes your real data on repeated wrong password attempts—turning everything into unreadable gibberish.

Even under duress? Enter your special panic password and it quietly erases your actual files while showing a clean, fake desktop.

Only the real password reveals your true data.

Suitable for journalists, whistleblowers, high-risk individuals, and anyone facing surveillance, tracking, or coercion.

Why does PlugOS block file sharing with your host device by default?

Here's the thing: spyware, malware, supply chain attacks, zero-day exploits. Any one of these can compromise your computer without you knowing. And once that happens, everything you plug in afterward, your phone, your external drive, gets pulled into the blast radius.

Most devices trust the host automatically. They mount themselves, open up read/write access, and just sit there waiting. Attackers don't need to break into your peripherals directly. An always-open file channel does the work for them.

PlugOS treats your host as untrusted by default. No auto file sharing. You decide what gets in and out. Your security boundary, your call.

The iOS version of PlugOS Client are now updated.

This update fixes several known issues and supports iOS 27 Beta 4 and above.

Update Notes:
Fixed several known issues
Improved system compatibility

Installation Method：
Update or install PlugOS on App Store.

If you have any feedback or encounter issues while using the PlugMate, you can submit via the built-in feedback function in PlugOS Client or email us at support@trustkernel.com.

We are pleased to announce that PlugMate and PlugOS have been recognized as 2026 Community Choice Winners by the Cybersecurity Excellence Awards, presented by Cybersecurity Insiders, across three categories:
PlugMate – Hardware-Isolated Secure Workspace Platform
PlugOS – Privacy
PlugOS – Security Platform
This honor is more than proof that our product has withstood expert scrutiny. It carries the trust of top-tier customers and partners across the industry. We're doubling down on building secure, privacy-first computing solutions for organizations worldwide.