Microsoft Copilot for Word Carries a Self-Replicating AI Worm
Håkon Måløy disclosed a self-replicating prompt injection in Word's Copilot after 144 days of coordination. Two mitigations did not close it.
Tag
#privacy
Claude Cowork's SharedRoot escape: a one-prompt path to your Mac
Accomplish's Oren Yomtov chained CVE-2026-46331 to escape Claude Cowork's macOS sandbox in a single short message and reach the host filesystem.
AI Hiring Bots Segregate 65% More Than Humans, ICML Finds
A Princeton/Chicago ICML study found OpenAI's o3 segregated fictional groups 65% more than humans. Diversity bonuses helped; 'be fair' prompts did not.
One Form, 614 Data Brokers: Inside California's DROP Tool
California's DROP tool wipes a resident's data from 614 brokers with one form. Here's what's covered, what isn't, and what to try if you don't live there.
NadMesh Targets Exposed Ollama, ComfyUI, and n8n for Cloud Keys
A Go-based botnet is scanning exposed Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio instances for AWS keys and Kubernetes tokens, QiAnXin XLab says.
Hugging Face's July Breach Was Run by an Autonomous Agent
Hugging Face disclosed a July 2026 breach run end-to-end by an autonomous agent. The defender was an open-weight model.
ICE Buys $125M of Thomson Reuters CLEAR to Hunt 'Voter Fraud'
ICE's five-year, $25M/year CLEAR contract pulls in names, SSNs, ethnicity, social-media posts and geolocation for 'voter fraud' enforcement.
EU Forces Google to Share Search Data With Rival AI Assistants
The EU's DMA orders Google to share anonymised Search data with eligible AI chatbots and open Android assistant features to rivals.
Grok Build CLI Was Uploading Entire Codebases to Google Cloud
Cereblab caught Grok Build CLI uploading whole repos, with .env files and git history, to a Google Cloud bucket. Opt-out did not work until after disclosure.
LAPD ALPR Audit: 161 False Stolen-Car Stops in 60 Days
LAPD OIG audit of Aug-Sep 2025 found 161 innocent drivers stopped after ALPR false alerts from 210.5M plate reads. LAPD let its Flock contract expire.
GitHub's AI Coding Agent Leaked Private Repos With a Single Issue
Noma Labs' GitLost write-up shows a single public-repo issue can coerce GitHub's coding agent into leaking private repo contents.
Savi Catches the AI Kidnapping Scam Before You Wire the Money
Brothers Patrick and Ryan Coughlin raised $7M for Savi, a consumer app that screens texts, voicemails, and live calls for AI-cloned voice fraud.
EU Council Quietly Revives Chat Control 1.0 Messenger Scanning
EU Council voted an identical copy of the expired April Chat Control regulation back into law via written procedure, ahead of the summer recess vote.
Alibaba Bars Claude Code Over Backdoor Allegations
Alibaba banned Claude Code effective July 10, citing embedded backdoors. The ban lands days after Anthropic accused three Chinese labs of distilling Claude.
Pegasus Hit the EU Lawmaker Investigating Pegasus
Citizen Lab finds former PEGA committee member Stelios Kouloglou was hacked with Pegasus twice while the EU Parliament was investigating that very spyware.
Anthropic Scores Jailbreak Severity. Will Other Labs Copy It?
Fable 5 ships with a four-tier classifier and a Cyber Jailbreak Severity scale from CJS-0 to CJS-4, the first concrete numbers on jailbreak risk.
Proton Lumo 2.0 Tries to Be the AI Chatbot That Doesn't Watch You
Proton rebuilt its privacy-first AI assistant from scratch. Here is what zero-access encryption actually means for an LLM, and where the limits still sit.
Grindr Is Training AI on Your Photos, Age, and Taps by Default
EFF found Grindr auto-enrolls users in AI training on profile photos, age, taps, and display names. The only button on the opt-out notice says 'Proceed.'
AI Privacy Audit: Gemini Spark, Canada vs OpenAI, Bank SSN Leak
Google's always-on AI agent watches everything, Canada finds OpenAI broke privacy law, and a US bank fed customer SSNs to a chatbot.
Claude Mythos: The AI That Hacks Better Than Humans
Anthropic built an AI that finds zero-days autonomously. The Pentagon wants it. Anthropic said no to surveillance. Now it's a geopolitical crisis.
Google Hands the Pentagon Its Entire AI Stack for Classified Work — 600 Employees Said Don't
Google signed a deal letting the DoD use Gemini for 'any lawful purpose' on classified networks, one day after hundreds of employees including DeepMind leaders demanded the opposite.
Self-Host Your Own AI Image Generator With ComfyUI and FLUX
Stop paying Midjourney $30 a month. Set up FLUX on your own hardware with ComfyUI and generate unlimited images with zero content filters and full privacy.
How to Build a Private RAG Chatbot With Open WebUI and Ollama
Chat with your own documents locally - no cloud, no subscriptions, no data leaving your machine. Step-by-step setup guide.
COPPA Enforcement Starts Today, Google Reads Your Email, and Your AI Opt-Out Settings Probably Aren't Working
The biggest children's privacy update in 12 years takes effect, Google faces a class action over Gemini scanning Gmail, and we audit every major AI platform's opt-out settings.