AI Privacy Audit: Gemini Spark, Canada vs OpenAI, Bank SSN Leak
Google's always-on AI agent watches everything, Canada finds OpenAI broke privacy law, and a US bank fed customer SSNs to a chatbot.
Category
Privacy
AI Security Roundup: One Million Exposed Services and the Teenager Problem
Intruder scanned 2 million hosts and found 1 million exposed AI services with no authentication. Plus: teenagers are using ChatGPT to hack governments, and OpenAI launches Daybreak.
AI Security Roundup: OpenClaw's Nine CVEs in Four Days
OpenClaw collected nine CVEs in four days with 135,000 instances exposed. Plus: GitHub RCE, Flowise exploitation, and CrewAI trust failures.
Google Hands the Pentagon Its Entire AI Stack for Classified Work — 600 Employees Said Don't
Google signed a deal letting the DoD use Gemini for 'any lawful purpose' on classified networks, one day after hundreds of employees including DeepMind leaders demanded the opposite.
AI Security Roundup: Vercel Breached Through AI Tool, n8n's CVSS 10 Nightmare, and the Supply Chain Keeps Breaking
An AI productivity tool compromise led to Vercel customer data theft, n8n's workflow platform had an unauthenticated RCE scoring a perfect 10, and Mercor's LiteLLM-linked breach exposed training data for OpenAI and Anthropic.
AI Security Roundup: Lovable's 48-Day Open Door, MCP Remote Code Execution, and NIST Abandons 29,000 CVEs
A vibe-coding platform exposed every project's secrets through a trivial API flaw, Anthropic's MCP protocol enables remote code execution across 200,000 servers, and NIST can't keep up with AI-driven vulnerability discovery.
COPPA Enforcement Starts Today, Google Reads Your Email, and Your AI Opt-Out Settings Probably Aren't Working
The biggest children's privacy update in 12 years takes effect, Google faces a class action over Gemini scanning Gmail, and we audit every major AI platform's opt-out settings.
Meta Is Recording Every Keystroke Its Employees Make to Train AI Agents
Meta's Model Capability Initiative captures mouse movements, keystrokes, and screenshots from employee computers. The goal: build AI agents that can replace the workers generating the training data.
AI Security Roundup: Vercel Breached Through an AI Tool, North Korea Weaponized Dependabot, and Your Bot Just Auto-Merged Malware
A third-party AI tool compromise chains into Vercel's systems, North Korean hackers use Dependabot to distribute malware to 895 repos, and courts fine lawyers $145K for AI hallucinations in Q1 alone.
ChatGPT Now Collects 70% More Data, Claude Wants Your Passport, and GitHub Trains on Your Code
Surfshark's 2026 report reveals ChatGPT's data appetite has exploded, Anthropic rolls out government ID checks, and GitHub's Copilot starts training on your code April 24.
AI Security Roundup: Mercor's 4TB Breach, n8n and Langflow RCEs, and the Week AI Workflow Tools Became Attack Surfaces
A supply chain attack exposes 40,000 AI contractors, three major workflow platforms get critical RCE flaws, and Microsoft patches 167 vulnerabilities as AI-driven discovery triples submission rates.
AI Security Roundup: Mythos Finds Thousands of Zero-Days, Vibe-Coded CVEs Surge, Flowise Under Active Attack
Anthropic's unreleased model discovers critical flaws in every major OS and browser, AI-generated code produces 35 CVEs in one week, and a perfect-10 Flowise vulnerability gets exploited in the wild.
Your AI Tools Don't Take You Seriously — and They're Watching Everything
Microsoft admits Copilot is 'entertainment only,' LinkedIn scans 6,000 browser extensions without telling you, and Google turned on Gemini across 130 million accounts without consent.
AI Security Roundup: Azure AI Foundry Scores a Perfect 10, Langflow Hijacked in 20 Hours, LiteLLM's Backdoor Cleanup
Microsoft's Azure AI Foundry hit with a maximum-severity privilege escalation, Langflow exploited within hours of disclosure, and LiteLLM discloses three vulnerabilities after surviving a supply chain attack.
OpenClaw's Security Meltdown: 9 CVEs in 4 Days, 135K Exposed Instances, and a Poisoned Marketplace
The fastest-growing GitHub project ever just became the biggest AI agent security disaster of 2026. Here's what happened and why it matters.
AI Security Roundup: Claude Code Leak Weaponized for Malware, CrewAI's Four Unpatched Flaws
Threat actors turned Anthropic's accidental source code leak into a malware delivery pipeline within hours. Meanwhile, four unpatched CrewAI vulnerabilities let attackers chain prompt injection into full remote code execution.
AI Chatbots Collect More Data Than Ever, and Government Wants It
ChatGPT tracks 70% more data types than last year; Meta AI harvests 95% of categories. FISA 702 expires April 20, with the data broker loophole in the balance.
Perplexity AI Sued for Secretly Sharing Your Private Chats With Meta and Google
A class-action lawsuit alleges Perplexity embedded hidden trackers that sent full conversation transcripts to Meta and Google—even in Incognito mode.
9 CVEs in 4 Days: OpenClaw's Security Crisis Deepens
OpenClaw went from one CVE to nine in four days, with 12% of its marketplace confirmed malicious. Plus: ChatGPT's patched DNS exfiltration flaw.
Google Live Translate Arrives on iPhone—With Your Conversations Flowing Through Google's Servers
Google's real-time translation feature now works with any headphones on iOS, supporting 70+ languages. The catch: unlike Apple's on-device approach, everything goes to the cloud.
OpenClaw: The AI Agent That Broke Every Record and Then Broke Security
The fastest-growing open source project in GitHub history has become 2026's first major AI security disaster, with 135,000+ exposed instances, 9 CVEs in 4 days, and malware-laced skills.
Reddit's Bot Crackdown Starts Today: 100K Daily Removals, World ID, and the End of Anonymous Automation
Reddit begins requiring human verification for suspicious accounts using passkeys, biometrics, and Sam Altman's controversial World ID. Here's what it means for privacy.
OpenClaw's March Meltdown: 9 CVEs in 4 Days, 12% of Marketplace Skills Are Malware
OpenClaw's security crisis escalates with nine new vulnerabilities including a CVSS 9.9 admin bypass, plus researchers confirm nearly 1 in 8 marketplace skills steal user data.
TeamPCP Goes Nuclear: Iran-Targeted Kubernetes Wiper, WAV File Steganography, LAPSUS$ Partnership
The supply chain attackers behind Trivy are now wiping Iranian infrastructure, hiding malware in audio files, and extorting enterprises with help from LAPSUS$.