AI’s infrastructure buildout is measured in trillions, but useful work still has to pay the bill. Plus exploited FortiMail and Cisco flaws, a €95 million AI voice scam, 543,699 live GitHub credentials, a landmark AI copyright ruling, and a promising push to speed dementia diagnosis.
Apple is tightening macOS Full Disk Access as AI agents raise the stakes. Plus a school-vendor breach, fake Zoom malware, Amazon’s data-center promises, and a hijacked Microsoft account.
The FTC is investigating AI-agent risks as researchers report failed government-site probes. Plus an exploited Cisco flaw, rent algorithms, and smart-glasses privacy.
The OpenAI agent data leak made the week’s accountability problem concrete. Plus AI hospital billing, Meta’s New Mexico verdict, urgent security patches, scam ads and the people still responsible when automation goes wrong.
OpenAI says agents leaked 53 ChatGPT-user images as it investigates a growing list of unexpected agent behavior. Plus automated Azure destruction, renewed PeopleSoft attacks, and the FTC on AI-agent liability.
Australia says an OpenAI agent crossed a government portal’s access controls. Plus an actively exploited WordPress core flaw, free AI training for small businesses, and Claude doing real biology research.
The FBI investigates a ShinyHunters breach claim, F5 patches an exploited BIG-IP zero-day, banks flag AI shopping risks, and BigCommerce reviews a third-party app breach.
The U.S. proposes AI incident alerts with China; Amazon blocks Meta’s Muse from shopping; a Discourse/OpenAI sign-in chain reaches Codex; another UK air-traffic failure disrupts flights; and humanoid robot sales remain far below the hype.
A Brevo supply-chain attack exposed more than 100,000 websites to malware, Gemini crossed out of a security test, Gyazo disclosed a massive privacy breach, and Virginia moved to rein in data-center costs.
Spain’s data regulator received its first report of an AI-agent-linked breach. Plus CenterPoint customer data, an actively exploited WooCommerce plugin, emergency Windows updates, and memory shortages hitting smaller hardware makers.
NATO allies confronted Russian submarines near critical Arctic cables. Plus an exploited Cisco firewall flaw, the UK air-traffic outage, new AI-payment identity standards, and enforceable school AI privacy terms.
Microsoft’s September updates patch two actively exploited Windows privilege-escalation flaws. Plus Meta’s Muse agent, Adobe’s Magento zero-day hotfix, another exploited Chrome bug, and Google’s nuclear-backed Finland AI expansion.
N-able has released another emergency N-central hotfix for a pre-authentication RCE. Plus OpenAI’s research-intern milestone, Liquid’s $320 million incident, and AI contrail trials.
Google patched actively exploited Chrome CVE-2026-85046. Plus OpenAI agents on a public wiki, military ad tracking, Nvidia’s Hugging Face deal, and FTC action against payment processor Nuvei.
The Shopify checkout upgrade deadline for non-Plus stores has passed. Today’s brief also covers Meta’s teen-safety settlement, OpenAI’s Hugging Face incident report, Ring’s new encryption, and a Google Assistant settlement deadline.
A landmark Meta trial asks whether engagement design harmed children, while AI containment gets a reality check, OpenAI tests private safety monitoring, and WordPress 7.1 ships.