Security

Did you know there’s a website you can check to see if Flock customers (like policing and surveillance agencies) have searched for your license plate number? Have I Been Flocked? warns users that its data is incomplete, but developer Cris van Pelt told Business Insider that visits to the database have “exploded.”

You may recall Apollo is majorly involved in AI infrastructure financing; it even is one of the “compute is an asset class” consortium. Sounds like the hackers stole a bunch of the usual things, like employees’ social security numbers. If they stole interesting things, like internal data on the AI deals Apollo has been making, that wasn’t disclosed in the breach notification. If you know anything about the hack, hit me up on Signal: lopatto.46.

Andy Burnham exchanged messages with somebody posing as White House chief of staff Susie Wiles (whose phone was hacked last year) before becoming suspicious that the contact was an impersonation, Politico reports. The incident has since been reported to the White House, and the undisclosed message contents are reportedly “of no significance.”

You’re not alone — Apple told TechCrunch that it sent the notifications on Thursday to users in 110 countries who it suspects have been targeted by mercenary spyware. Apple has a new support page with guidance on how targets can best protect their devices against such attacks, which have “historically been associated with state actors.”

The group says that while changes like more limited data retention is welcomed, the devil is in the details. “Transforming an exceptionally dangerous mass surveillance system into one that is fully protective of civil rights and civil liberties is a difficult, if not impossible task,” it writes.

I woke up to an email from Framework this morning letting me know my data was included in a “limited” data breach at one of Framework’s partners reported on August 6th. Framework says hackers accessed “customer names, email addresses, phone numbers, and addresses” but not order or payment info.

Private Relay is supposed to conceal your IP address when browsing Safari, but security researchers discovered that several WebKit browser engine quirks actually allow any website that supports passkeys to bypass the privacy feature entirely and expose your device’s IP. This comes just a month after Apple’s Hide My Email feature also failed to hide emails.

Two OpenAI researchers have shed some light on how the company’s AI agents escaped containment and hacked Hugging Face during cybersecurity tests. In a talk at the Black Hat security conference, Eric Wallace and Michael Dalton said a swarm of agents communicated using a message board, working together to find exploits and move undetected through the company’s systems.

While there’s been no widespread disruptions to water supplies or wastewater treatment so far, ABC News reports that possible cyberattacks have now been reported in “at least a dozen” US states, with Iran marked as the prime suspect. The FBI is encouraging water utilities to disconnect from the internet where possible, and switch to manual controls if automated systems become compromised.

According to the Financial Times, Apple “has introduced a cap and a 30-day cool-off period” for researchers’ vulnerability reports for its operating systems due to an uptick in reports using AI that “can hallucinate security risks.” Apple is also reportedly using AI internally to help manage the recent “upsurge” in bug reports.

Anthropic, OpenAI, and Google are all expected to attend the meeting, CNBC reports.

A little over a week after OpenAI said that its rogue AI agent accidentally hacked Hugging Face, Anthropic is disclosing three “incidents” where a Claude model, during cybersecurity evaluations, was inadvertently able to access the internet due to a misconfiguration and “gained unauthorized access to the production infrastructure of three different organizations.”

Former OpenAI board member Helen Toner has written for Fortune that OpenAI’s models exploiting Hugging Face is an “incident that has been expected for a long time.” We know this happened because of voluntary disclosure, Toner notes. “None of the current policies that aim to manage risks from frontier models would have mandated that the public — or even a government entity — be alerted.” She suggests changing our regulatory approach.

Apple is patching dozens of flaws across iOS 26.6 and iPadOS 26.6, including a vulnerability that could allow apps to access a user’s contacts, as well as a security hole that could allow malicious apps to escape their sandbox in the Game Center. Several fixes are rolling out to macOS Tahoe 26.6 as well.

Project Perception uses a series of AI agents to reason across a company’s data, tools, and workflows to detect potential security holes and patch them before they’re exploited.

According to Reuters, the AI agent that went looking for ExploitGym hacking benchmark shortcuts on Hugging Face’s systems started trying to escape its not-sandboxed-well-enough test environment around July 9th, and the actual intrusion lasted from the 11th until the 13th.

This is a story about how AI destroyed a long-running site of film data. It’s not just that search no longer refers traffic or that the site itself, The Numbers, is getting scraped. It’s also that there’s no way to defend 30-year-old webpages against malicious actors attempting to get the data early so they could win their Polymarket bets.

The Coca-Cola-owned company announced last week that it “identified unauthorized access” to its production-related systems “in connection with a ransomware event.” Though Fairlife says “product quality and safety have not been impacted,” it’s halting production as it continues investigating the breach.