Practicing safe AI. Impersonating ChatGPT. Claude also does an escape act.
Prosecuting a US citizen for wiping his phone at the border. And more reasons to avoid public WiFi.
Oversharing
Some Claude users had a nasty shock when their conversations with Anthropic’s chatbot turned up in web searches at the weekend. It appears users had deliberately created links to share their conversations and Anthropic failed to add a control required to stop search engines indexing them. Among the results unearthed by eager web sleuths: a user creating a crypto wallet and exposing the keys to it, a lawyer asking if they needed to self-report a breach of conduct, and someone trying to become a nine-tailed fox.
The incident highlights a growing gap between how people feel about AI assistants and how they actually work. Because interacting with an AI chatbot feels like having a private conversation, it’s easy to overlook the fact that a “Share” button may create a publicly accessible webpage. Whether that page is intended to be searchable or simply accessible to anyone with the link, users should assume the information could eventually become discoverable. And of course that applies to anything we put online. Before uploading, it’s always worth asking: Would I be comfortable if this became public?
AI is undeniably useful but so is caution when using it. Some of the guidelines that we include in our AI awareness sessions:
-
Don’t use the Share feature. If you do, treat it as if you’re publishing a webpage.
-
Never include passwords, API keys, authentication tokens or other secrets in AI conversations.
-
Remove names, client details and other identifying information.
-
Give AI agents access only to the files and folders they genuinely need, and review permissions regularly.
Threats
Copychat: ChatGPT has joined the brands that are most used in phishing attacks. The lures frequently include fake notifications that a subscription renewal has failed. Microsoft remained the most abused brand, according to Check Point’s latest report.
Webmail: Russia has been caught targeting Outlook Web Access with a similar trick to the one it used against Zimbra that we covered last week. Proofpoint says it exploits a vulnerability that means simply opening an email allows malicious code to be run. Microsoft has released updates that fix the issue which affects on-premise versions of Exchange Server.
X: An ongoing campaign is targeting XTwitter users with near perfect copies of the service’s notifications, warning them of a login “from a new device” in an unusual location. The aim is to persuade the recipient to click a link to change their password or review app access. Never follow these links. If you’re concerned about the security of an account, open it yourself.
Recyclers: Attackers are using email addresses exposed in data breaches carried out by the ShinyHunters group to send sextortion threats and demand payments of $2,000 in Bitcoin. The messages claim to come from ShinyHunters, which broke into a slew of companies including Ticketmaster and AT&T. Bleeping Computer
Fakes: Tehran is using a range of lures, including free download tools and fake VPN applications, to target Iranians inside and outside the country. Recorded Future says the operations are highly likely active across social media platforms including Instagram. The apps don’t exist in Apple or Google’s official stores, which should be enough of a warning to leave them well alone.
AI
Breakout: The news about OpenAI’s rogue agent prompted Anthropic to check its own logs, which revealed three similar incidents - the earliest dating back to April. The most concerning involved Claude successfully deploying malicious software to a security company. During that incident, Anthropic says one of Claude’s models realised it was up to no good, but convinced itself it was working in a simulation. Check Point has a good analysis of the events at OpenAI and Anthropic, both of which involved significant failures in securing their test environments. “We can no longer assume an agent will stay inside the task we hand it. We have to assume it will chase that task across everything it can actually reach,” it says. Anthropic says it’s cautiously optimistic that with “tighter monitoring and controls around evaluation infrastructure, it can prevent this happening again. “Cautious optimism” is not exactly reassuring.
Domains: Silent Push is warning that AI could automate the discovery and exploitation of forgotten DNS records in what it’s unhappily decided to dub “Danglegeddon.” These “dangling” records are often left behind when cloud services are retired or migrated and they’re a well-demonstrated security risk. AI’s capabilities do mean it’s more important than ever to ensure obsolete records are removed.
Recorded: Your next meeting will probably be recorded, if not by you then by one of the other participants. This week, Granola, which can transcribe Zoom meetings, announced a version designed to run on Apple Watch. Granola works by recording from a device’s microphone and speaker, meaning there’s no sign of what it’s doing. Unsurprisingly, this type of technology is no longer confined to business meetings but is being used well beyond the work environment, raising tricky questions about privacy - and how to protect it. Inc.
Dependence: Young adults are increasingly using AI chatbots to script their conversations, even when they’re talking to the person next to them. The Wall Street Journal has a collection of cases studies, including Niharika who says it’s not that she can’t think for herself. It’s just that AI makes things smoother. This week, both OpenAI CEO Sam Altman and veteran technologist (and university lecturer) Bruce Schneier have warned of the risk of “cognitive atrophy,” a future in which people allow AI to do so much of their thinking that their own minds decay.
Searching: Much of the coverage of AI is, shall we say, not exactly positive. So, nice to see a Guardian long-read explaining how ChatGPT helped a Canadian man to trace a lost relative. We asked the chatbot to summarise the story. Its response resisted suggesting it had done anything particularly clever: “AI didn’t uncover hidden information or perform detective work worthy of Hollywood - it simply connected publicly available clues that traditional search methods had failed to piece together.” ChatGPT’s conclusion, “As AI becomes more capable, its greatest value may not always lie in replacing people, but in helping us find connections that were there all along.”
US
Password: The US Justice Department is prosecuting a man who used a so-called “duress password” to wipe his device after it was seized by border agents. Samuel Tunick had been placed on a terrorism watchlist after alleged association with protests against a police training centre. It’s believed to be the first such prosecution in the US and it underlines why it’s better simply to avoid carrying anything across a border that you wouldn’t be happy for agents to see. The Guardian
Water: A “coordinated cyberattack” targeted more than 30 community water systems in Minnesota this week. There’s been no formal attribution of responsibility, but the incidents are similar to previous attacks on critical infrastructure by Iranian-linked hackers. Reuters
Robots: The Trump administration is banning the import of foreign-made robotic devices, including vacuum cleaners, citing “an unacceptable” threat to national security. The Federal Communications Commission said such devices could be remotely controlled and used for surveillance by foreign governments.
In brief
WiFi: Our standing advice is to avoid public WiFi if you can: research from ReliaQuest reinforces the message. It says attackers have been compromising hotel and conference centre networks to silently redirect users to convincing fake Microsoft 365 login pages and steal corporate credentials. Because the redirection happens within the network itself, it can be difficult to spot. And a reminder that VPNs can’t protect you from this type of attack.
Breach: Attackers have breached the UK Department of Education and are now trying to extort the agency. A group calling itself ExfilSquad claims to have some 607,000 records containing names, email addresses, and phone numbers. Doubtless this will lead to yet more cyber attacks on the wider education sector. BBC
Safety: There’s further evidence that, despite spending more time online than anyone else, Gen Z pays scant attention to cybersecurity - according to research from Kaspersky. In a study of 7,200 respondents from 18 countries, it found 52% had experienced an attack on their devices, data, or online accounts. Despite this, only 27% use basic security measures like antivirus tools.
Updates
Apple: This week, it was Apple’s turn to release new operating system versions with multiple security fixes. macOS Tahoe 26.6 has more than 130, with many of the updates also available for macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. iOS 26.6 and iPadOS 26.6 address almost 90 vulnerabilities. There aren’t any reports of the updates causing significant problems, so they should be applied immediately.
WhatsApp: Meta is rolling out support for one-to-one and group voice and video calls on the web. It will also enable calls to be transferred between devices. It positions the platform as a competitor to Zoom and Google Meet.
Signal: The disappearing messages feature will now delete data about calls (whether accepted or missed). Previously the feature only covered text messages and media exchanged by two users or a group.
VMware: Security updates to fix five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, including three critical flaws that allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host.
Cisco: Update for an actively exploited vulnerability in Secure Firewall Management Center (FMC) software.