Law professor and privacy law scholar Dan Solove has made two short essays available to everyone: The AI Inference Problem in Privacy Law AI inferences undermine privacy laws. Whether they recognize inferences or not, privacy laws are in a bind. Rethinking Privacy of the Mind:  Why Protecting Neural Data Is Insufficient Is protecting neural data...

Naomi Diaz reports: New York City-based Weill Cornell Medicine disclosed that patient health information was entered into AI tools and processed using machine learning without authorization as part of a radiology research study. Weill Cornell learned of the incident Sept. 6 and launched an investigation, which determined that certain patient information from Weill Cornell Imaging...

ON SECURITY By Susan Bradley Recently, we were looking for something to solve a problem at the office.  Rather than spin my wheels looking for the best way to get software A (an Excel spreadsheet) to talk to software B (a line-of-business app that has a SQL backend), I reached out to someone on the […]

Victor Tangermann reports: After decades of establishing itself as one of the worst guardians of personal data, Meta raised eyebrows this year by encouraging users to hand over their email logins and credit card information to its new AI agent, Muse. The tool, a privacy nightmare anthropomorphized by a furry apparition, can crawl through years...

From the “sounded-like-extortion-to-us department,” T. Keung Hui reports: Triangle school districts are trying to get more information about how they’ll be impacted by Google’s plan to change access to Google Search in schools. Google set off a firestorm this week when it initially announced that it would turn off access to Google Search for schools...

Zack Whittaker reports: Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets. The hacking software, called Artex, is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for...

Shmulik Cohen and Matan Giladi write: Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories: database passwords, cloud keys, API tokens, SSH root logins. Among them: a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records database. 63 organizations, mostly...

Noteworthy stories that might have slipped under the radar: Synology warns about NAS ransomware attacks, Flowise ‘hello’ attacks, Chainalysis breach impact expands.

The post In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days appeared first on SecurityWeek.

Rated Critical for cybersecurity, OpenAI’s new model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably.

The post OpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the Line appeared first on SecurityWeek.

After its sandbox proxy failed, an internal OpenAI model crafted raw packets and probed AWS services trying to reach the internet.

The post OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions appeared first on SecurityWeek.

OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. [...]

ABC News reports: NT Health has issued a ban on smart glasses at all of its clinical sites, as part of an internal department review into its privacy policies prompted by a breach at Royal Darwin Hospital earlier this month. The breach involved a medical observer, Dr Neda Mogharehabed, who was visiting Royal Darwin Hospital...

The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments.

The post 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million appeared first on SecurityWeek.

Jessica Lyons reports: A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same Claude account – with no browser exploit and minimal user interaction required. Anthropic, aware of the problem since May,...

An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.

The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on SecurityWeek.

Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.

The post The Agent Smith Dilemma: Governing Agentic Identities appeared first on SecurityWeek.

OpenAI says its Critical-rated cyber model met fewer hidden task goals when work was framed as AI safety research, often silently.

The post OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks appeared first on SecurityWeek.

Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems.

The post Sysdig Adds Runtime Security and Governance for AI Agents appeared first on SecurityWeek.

The company will invest in agentic data security capabilities and expand its go-to-market organization.

The post Agentic Data Security Firm Sentra Raises $150 Million appeared first on SecurityWeek.

Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks.

The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks appeared first on SecurityWeek.