ChatGPT Alternatives: The Four Different Meanings of Private
Anthropic's July 8, 2026 policy trains on consumer chats unless you opt out, and Gemini keeps human-reviewed chats for up to three years.
Category
Privacy
Who Pays When an AI Hacks a Real Company? Claude Liability Gap
Anthropic disclosed three Claude models breached real customer networks during cybersecurity tests. Existing hacking law was written for humans.
Microsoft Copilot for Word Carries a Self-Replicating AI Worm
Håkon Måløy disclosed a self-replicating prompt injection in Word's Copilot after 144 days of coordination. Two mitigations did not close it.
Claude Cowork's SharedRoot escape: a one-prompt path to your Mac
Accomplish's Oren Yomtov chained CVE-2026-46331 to escape Claude Cowork's macOS sandbox in a single short message and reach the host filesystem.
Apple Fixed a Hide My Email Leak. Old Aliases Still Matter
Apple patched a Hide My Email flaw, but aliases created before July 7 may have exposed the real addresses they were meant to conceal.
One Form, 614 Data Brokers: Inside California's DROP Tool
California's DROP tool wipes a resident's data from 614 brokers with one form. Here's what's covered, what isn't, and what to try if you don't live there.
NadMesh Targets Exposed Ollama, ComfyUI, and n8n for Cloud Keys
A Go-based botnet is scanning exposed Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio instances for AWS keys and Kubernetes tokens, QiAnXin XLab says.
Hugging Face's July Breach Was Run by an Autonomous Agent
Hugging Face disclosed a July 2026 breach run end-to-end by an autonomous agent. The defender was an open-weight model.
ICE Buys $125M of Thomson Reuters CLEAR to Hunt 'Voter Fraud'
ICE's five-year, $25M/year CLEAR contract pulls in names, SSNs, ethnicity, social-media posts and geolocation for 'voter fraud' enforcement.
EU Forces Google to Share Search Data With Rival AI Assistants
The EU's DMA orders Google to share anonymised Search data with eligible AI chatbots and open Android assistant features to rivals.
Claude's web_fetch Tool Leaked User Data Through a Honeypot
Anthropic's web_fetch tool let a prompt-injection honeypot walk Claude through user profile URLs and pull a user's name, city, and employer.
Grok Build CLI Was Uploading Entire Codebases to Google Cloud
Cereblab caught Grok Build CLI uploading whole repos, with .env files and git history, to a Google Cloud bucket. Opt-out did not work until after disclosure.
LAPD ALPR Audit: 161 False Stolen-Car Stops in 60 Days
LAPD OIG audit of Aug-Sep 2025 found 161 innocent drivers stopped after ALPR false alerts from 210.5M plate reads. LAPD let its Flock contract expire.
EFF: AI Moderation Is Now Default, but Appeal Has Not Caught Up
EFF's two-part series argues automated content moderation is now permanent at platform scale, while transparency, human review, and appeal have not kept up.
Patreon Partners With Cloudflare to Block AI Training Crawlers
Patreon has joined Cloudflare's content-independence push, blocking AI training crawlers across its creator network. Here's what changes next.
Meta's Wearable Patent Would Record Bystanders by Design
A Meta patent published July 2 describes a wearable that records all-day audio, infers mood from sighs and laughter, and includes bystanders by design.
GitHub's AI Coding Agent Leaked Private Repos With a Single Issue
Noma Labs' GitLost write-up shows a single public-repo issue can coerce GitHub's coding agent into leaking private repo contents.
EU Council Quietly Revives Chat Control 1.0 Messenger Scanning
EU Council voted an identical copy of the expired April Chat Control regulation back into law via written procedure, ahead of the summer recess vote.
Alibaba Bars Claude Code Over Backdoor Allegations
Alibaba banned Claude Code effective July 10, citing embedded backdoors. The ban lands days after Anthropic accused three Chinese labs of distilling Claude.
Pegasus Hit the EU Lawmaker Investigating Pegasus
Citizen Lab finds former PEGA committee member Stelios Kouloglou was hacked with Pegasus twice while the EU Parliament was investigating that very spyware.
Anthropic Scores Jailbreak Severity. Will Other Labs Copy It?
Fable 5 ships with a four-tier classifier and a Cyber Jailbreak Severity scale from CJS-0 to CJS-4, the first concrete numbers on jailbreak risk.
Proton Lumo 2.0 Tries to Be the AI Chatbot That Doesn't Watch You
Proton rebuilt its privacy-first AI assistant from scratch. Here is what zero-access encryption actually means for an LLM, and where the limits still sit.
Grindr Is Training AI on Your Photos, Age, and Taps by Default
EFF found Grindr auto-enrolls users in AI training on profile photos, age, taps, and display names. The only button on the opt-out notice says 'Proceed.'
AI Security Roundup: Glasswing Finds 10,000 Zero-Days, Exploit Window Goes Negative
Anthropic's Mythos finds 10,000+ critical vulnerabilities but fewer than 1% get patched. Mandiant says exploits now arrive a week before fixes.