Regulating technology. Business Email Compromise on the up. AI ubiquity.
Surveillance in the US. Geopolitical instability and unpreparedness. And the Chinese app that checks whether you're dead.
Grok
The furore over the use of Elon Musk’s AI chatbot Grok to create vile images encapsulates pretty much everything that’s wrong with the introduction, use, and governance of new AI tools. Everyone agrees that using AI to “undress” real people and to generate child sexual abuse material is wrong. X is full of such material and yet both the X app and the Grok app continue to be available in the Apple and Android app stores. Activist groups have signed an open letter detailing some of the sexualised content produced by Grok and demanding the companies take action. The collective response so far has been silence.
For its part, Musk’s artificial intelligence company xAI says it has imposed further restrictions on Grok’s image generation feature. These will “prevent the Grok account from allowing the editing of images of real people in revealing clothing such as bikinis.” Frankly, we’re not sure what that means since it doesn’t address the reality of much of what Grok has been doing. And in any case, as The Verge has demonstrated, the restrictions don’t work. For his part, Musk has stated that he isn’t “aware of any naked underage images generated by Grok.”
There’s an obvious solution to address the abuse of Grok’s image generation feature; just turn it off. Failing that, governments could follow the lead of Indonesia and Malaysia and ban Grok altogether. And they could force Apple and Google to abide by their own policies and remove it from their app stores. But such a solution seems beyond the capabilities of governments and technology giants alike which, as we said, pretty much sums up where regulation of technology sits today.
Threats
BEC: Business Email Compromise remains a significant threat for all organisations (we received a targeted example yesterday). SpiderLabs reports a 15% increase in this type of email in 2025 compared to 2024. It also saw new tactics, including attempts to obtain private contact details by impersonating corporate finance departments. The most important defence against these attacks is to have cast-iron approval checks for any payment.
Instagram: If you have an Instagram account, you’ve most probably received an email asking you to confirm a password reset. This is because the platform had a vulnerability that allowed anyone to request the change even it wasn’t for their own account. There were reports of a data breach at Instagram but these appear to be incorrect and refer to a previous incident in 2022 when criminals accessed user information for some 17.5 million accounts. Security Week
Religion: WIRED reports that fraudsters are impersonating pastors and other religious figures in order to scam congregations. They appear to be targeting people based on their social media content.
Invitations: Messages that appear to come from Paperless Post are being used to steal account information. The fake emails will usually ask you to download a file or login to an existing online account in order to open the invitation. Real messages will never ask you to do that. Paperless Post
DocuSign: And a reminder to exercise an abundance of caution with messages that appear to come from DocuSign. Joe Security has an example that shows just how sophisticated these emails can be. In this case case, the giveaway was a link that pointed to docu[.]sign-platform[.]app/ instead of www.docusign.com/.
LinkedIn: Scammers are adding fake comments to posts warning users of bogus policy violations and urging them to visit an external link. The warnings claim the user has “engaged in activities that are not in compliance” with the platform’s policies and so their account has been temporarily restricted. Bleeping Computer
Provocation: “Rage bait” was the Oxford University Press word of 2025 (even though it’s not hyphenated and appears to our simple minds to be two words). It’s defined as “online content deliberately designed to elicit anger or outrage by being frustrating, provocative, or offensive. Although commonly used to drive traffic to web content or social media pages, scumbags are also exploiting it to tempt people into responding to their lures.
AI
Ubiquitous: Little by little, AI tools are creeping into every crevice of online activity. This week, Google announced Personal Intelligence which allows its AI assistant to use data from various apps to customise its responses. It’s being trialled in the US to begin with, and Google has a complicated assurance that user data won’t be use “directly” to train its model. And by default it will be turned off. Meanwhile, Anthropic announced a preview version of Claude Cowork which is designed to automate office tasks. It’s only available to some users and comes with a hefty warning about “unique risks due to its agentic nature and internet access.” Agentic means it can do things without user intervention, so Anthropic warns users to take care about what files and websites Cowork can access. To underline the importance of caution, researchers at Varonis have shown how to extract user data from Microsoft Copilot using a single malicious weblink. The underlying issue, which affected personal accounts, has now been fixed.
Jobs: Research from Oxford Economics casts doubt on the narrative that AI is causing job losses. According to its analysis (R), “firms don’t appear to be replacing workers with AI on a significant scale.” Instead, it suggests organisations may be using AI as a convenient excuse for more traditional layoffs.
Police: For a perfect example of how not to use AI, look no further than West Midlands Police. It has admitted that it banned Maccabi Tel Aviv fans from a soccer match last year on the basis of an intelligence report compiled with the help of Microsoft’s Copilot. Amongst Copilot’s contributions was reference to a non-existent match between West Ham and Maccabi. As we said last week, when it comes to AI assistants the motto must be ’don’t trust and do verify.” BBC
Trump
Tracking: US Immigration and Customs Enforcement is doing its best to demonstrate the full capability of online surveillance. Freedom of Information requests have revealed two tools that it has bought to track people’s locations without a warrant. And 404 Media reports on a system being developed by Palantir that “populates a map with potential deportation targets, brings up a dossier on each person, and provides a ‘confidence score’ on the person’s current address.”
Raid: The FBI searched a Washington Post journalist’s home and seized her work and personal devices despite her not being the object of an investigation. Attorney General Pam Bondi said the raid was part of a probe into “illegally leaked information from a Pentagon contractor.” The reporter has led The Washington Post’s coverage of US government job cuts. By seizing her devices, the FBI will now have potential access to all her other work and to details of her contacts and her communications with them. Until now, such actions have been extremely rare in the US; journalists working there should take note and revise their threat model accordingly. Ars Technica
In brief
Confidence: Amid extraordinary geopolitical volatility, a World Economic Forum survey suggests people have a growing lack of confidence in their nation’s ability to respond to major cyber incidents. 31% of respondents said they had low confidence compared to 26% for the previous year. The Global Cybersecurity Outlook “explores how accelerating AI adoption, geopolitical fragmentation and widening cyber inequity are reshaping the global risk landscape.” Its verdict; “AI is supercharging the cyber arms race,” and “Cyber-enabled fraud is threatening CEOs and households alike.”
Scanning: A plug for a useful tool from the Electronic Frontier Foundation. Dangerzone takes potentially dangerous PDFs, office documents, and images and converts them to a safe PDF. It does this by rendering the file as pixels and then reconstructing it.
Congress: It’s emerged that China succeeded in hacking email accounts used by congressional staff on powerful committees in the US House of Representatives. The breaches appear to be part of an extensive cyber espionage campaign known as Salt Typhoon. For its part, Beijing says basically, “Nothing to do with us, guvnor.” In the context of such attacks, experts told a congressional hearing that the US needed to implement more effective offensive cyber capabilities.
Spyware: Mexico, Venezuela, and Myanmar are among the customers of a previously unknown South Africa-based spyware provider, according to Intelligence Online. It says (R) the zero-click tool could access contact lists, call logs, text messages and other data. For a higher price, it could also control a camera’s device and record calls.
Touts: Dutch police have set up a website to sell fake tickets for football matches and concerts to highlight the risks of ticket fraud. It’s convincing and comes complete with contact information and a 4.8 Trustpilot rating. So far, 3,432 people have tried to buy tickets through the site (they’re presented with a page explaining the stunt). Ticket fraud is effective, not least because it plays on our emotions. Scepticism is essential, as is the use of a payment method with purchase protection.
Memory: As we’ve written before, there’s a global shortage of computer memory - driven by the demands of AI data centres. The result will be higher prices for computing devices, and IDC says this will disproportionately affect budget smartphones. But looking to the future and a potential conflict over Taiwan, The Register argues that higher memory prices are the least of the world’s potential problems. Given global dependence on Taiwan’s memory manufacturing, “the world is one bad decision away from a silicon ice age,” it declares.
Dead: Cheering news from China. The top paid app is called ’Are You Dead?” It requires the user to check in with it every two days to confirm they’re alive. If not, it will advise an emergency contact. The BBC says its popularity has been driven by young people in big cities, many of whom live alone.
Updates
Apple: A new bundle of Apple’s creative apps brings with it the introduction of subscription pricing. Creator Studio includes Final Cut Pro, Pixelmator Pro, Keynote, Numbers, Pages, and Freeform at an annual cost of $129 in the US. Individual apps will still be available for sale at a one-off price but you won’t be surprised to hear that they won’t include some “premium content.” The same goes for any existing purchases. Apple’s net income for its 2025 fiscal year was $112 billion.
Microsoft: Monthly security updates include fixes for 114 issues, among them three previously-unknown ‘zero-day’ vulnerabilities. There’s already a problem for some Windows 11 users. “After installing the January 13, 2026, Windows security update, some PCs with Secure Launch are unable to shut down or enter hibernation. Instead, the device restarts,” Microsoft says.
Patch Tuesday: Also security updates fromAdobe, IBM, Dell, SAP, Fortinet, VMware, and Netgear.
Proton: Customers have been warned to check the dates of any manual OpenVPN configuration files they’re using. If they’re older than September 2023 they should be refreshed for security reasons. But Proton is also urging anyone using the OpenVPN protocol to replace it with newer solutions.