Windows 11's New AI Feature Sends Screenshots of Your Apps to Microsoft's Cloud
Microsoft's 'Share with Copilot' taskbar feature is enabled by default and transmits visual snapshots of any open window to cloud servers for AI processing.
Category
Privacy
AI Security Roundup: 300 Million Messages Leaked, Microsoft Copilot Bug, and the Vibe-Coding Crisis
This week in AI security: Chat & Ask AI exposes 300 million messages, Microsoft patches Copilot email vulnerability, and vibe-coded apps prove trivially hackable.
Most AI-Generated Passwords Fail Basic Strength Tests
Kaspersky finds DeepSeek, Llama, and ChatGPT all produce password outputs that fail standard strength tests. Prediction capability makes LLMs bad at randomness.
Two Critical Flaws in Microsoft's AI SDK Could Let Attackers Hijack Enterprise AI Agents
Microsoft Semantic Kernel has back-to-back CVSS 10.0 vulnerabilities enabling remote code execution and arbitrary file writes through AI agent function calls
Critical vLLM Vulnerability Lets Attackers Take Over AI Servers With a Video Link
A CVSS 9.8 flaw in the popular AI inference engine allows unauthenticated remote code execution through malicious video URLs. Patch now if you're running multimodal models.
That 'Summarize with AI' Button Is Brainwashing Your Chatbot
Microsoft found 31 companies embedding hidden instructions in AI share buttons. One click poisons your assistant's memory, shaping every future recommendation without your knowledge.
ChainLeak: Critical Chainlit AI Framework Flaws Enable Cloud Environment Takeover
Two vulnerabilities in the popular Chainlit AI framework allow attackers to steal cloud credentials, API keys, and user data from enterprise chatbots.
Discord's Mass Exodus: Age Verification Sparks Privacy Crisis After 70,000 IDs Leaked
Discord announces mandatory facial scanning and ID uploads just months after a breach exposed 70,000 government documents. Users are fleeing to Matrix and TeamSpeak.
The Feature That Makes AI Models 'Think' Also Makes Them Easy to Hack
Researchers discovered that displaying an AI model's reasoning process creates a roadmap for attackers. OpenAI's o1 rejection rate dropped from 98% to under 2%.
PromptSpy: First Android Malware to Weaponize Generative AI at Runtime
ESET discovers Android malware that queries Google's Gemini AI in real-time to navigate infected devices and maintain persistence across any Android version.
AI Privacy Audit: What Eight Popular Assistants Collect
A source-by-source audit of eight AI assistants, what they collect, how training defaults differ, and which privacy settings users can change.
Android AI Apps Leaked 730TB: 72% Had Hardcoded Secrets
A Cybernews analysis of 1.8 million Android apps found most AI apps leak credentials in code. Over 200M files were exposed via misconfigured databases.
Copilot and Grok Abused as Malware Command Channels
Check Point demonstrated how web-browsing AI assistants can relay malware commands through legitimate traffic. Microsoft changed Copilot's behavior.
Researchers Prompt-Injected Google Translate's Gemini Mode
Researchers tricked Google Translate's Gemini-based Advanced mode into answering prompts, including requests for drug and malware instructions.
OpenClaw's Month From Hell: 40,000 Exposed Instances, Poisoned Marketplace, and Corporate Bans
The viral AI agent went from 135K GitHub stars to enterprise blacklists in three weeks. Here's what went wrong and why it matters for every AI agent.
Reasoning Models Have Become Autonomous Jailbreak Agents With 97% Success Rates
New research shows AI reasoning models can autonomously plan and execute attacks that bypass safety guardrails in nearly all other AI systems.
77% of Employees Are Pasting Company Data Into AI Tools - And Your Security Team Can't See It
The LayerX Enterprise AI Security Report reveals that AI has become the #1 data exfiltration channel in the enterprise. 82% of those leaking data use personal accounts. Traditional DLP can't stop copy-paste.
European Parliament Blocks AI Tools on 8,000 Devices Over US Data Fears
The EU Parliament disabled Microsoft Copilot and other AI features on lawmakers' devices, citing data sovereignty concerns and uncertainty about where sensitive information ends up.
Infostealers Are Now Stealing AI Agent 'Souls' and Identities
Malware caught harvesting OpenClaw configuration files, gateway tokens, and private keys - marking a shift toward AI agent identity theft.
BodySnatcher: The Most Severe AI Vulnerability Yet Let Attackers Hijack Fortune 500 AI Agents
A hardcoded credential and broken authentication in ServiceNow let attackers impersonate any user and weaponize AI agents to create admin backdoors.
After Teen Suicides, States Are Racing to Regulate AI Mental Health Chatbots
Tennessee made it a felony to train AI chatbots that encourage suicide. Virginia is banning AI therapist impersonators. A dozen states have bills moving through legislatures right now.
Link Previews Are Leaking Your Data to AI Agents Without a Click
Security researchers found that messaging apps' link preview feature turns AI agents into zero-click data exfiltration tools. Teams, Slack, Discord, and Telegram are all affected.
OpenAI Built a Bunker for ChatGPT Because It Can't Fix the Walls
ChatGPT's new Lockdown Mode protects against prompt injection data theft - but OpenAI admits the underlying vulnerability may never be solved. Here's what that means for agentic AI.
ICE Is Scanning American Faces on the Street With AI It Knows Doesn't Work as Advertised
DHS deployed facial recognition to 100,000+ field encounters without legally required privacy reviews. Internal records show the agency knew the app couldn't verify identities.