ChatGPT Is Building Detailed Psychological Profiles of Its Users

Chatbots are building “algorithmic self-portraits” of users as they retain information for a hyper-personalized experience, a study warns. A recent study, conducted by a coalition of scientists in Germany, India and the Netherlands and presented at the ACM Web Conference 2026, investigated the ways that OpenAI’s ChatGPT has tracked and made sense of user inputs to develop comprehensive digital profiles of users.

Source: futurism.com

Independent Labs Crack Google's Secret Cryptography Work

Google quantum researchers found an ECC vulnerability too risky to detail publicly. A startup beat its results in 3 days with AI agents and crowdsourcing. A quantum computer capable of breaking the codes that help secure today’s internet became dramatically more possible in March, when Google scientists and their colleagues unveiled new research. Usually, cybersecurity researchers share information about how attacks work to help prevent them. This group, however, believed its discovery posed enough of a security risk for them to use an unprecedented strategy to conceal how exactly to replicate their research.

The Art of the Deal: Jared Kushner’s Hacked Phone Revealed More Than $700 Million in Transfers

An exclusive excerpt from ‘Princes and Thieves: Jared Kushner and Mohamed bin Zayed’s Secret Plot to Remake the Middle East’ examines how bank accounts linked the president’s son-in-law—and former senior adviser—to Israel, the UAE, and Saudi Arabia. In late spring 2020, a source I knew to be reliable called me with a story. The Dutch government had hacked into Jared Kushner’s phone and monitored him as he accessed a Dubai-based bank account. What was odd, the source said, was that the money in the account—hundreds of millions of dollars—had come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary and a one-time hit man. The story sounded preposterous, I told my source. And yet.

LLMs are making formal software verification feasible at a much larger scale

Claude formally proved security properties in the compiled code of 123 open-source libraries. Along the way, it found bugs that had eluded detection for years. Even mature, heavily tested software contains bugs, and LLMs are increasingly adept at finding them. The Linux kernel—one of the most well-tested pieces of software today, deployed on billions of devices worldwide—recently had over 1,000 vulnerabilities disclosed. With frontier models becoming more capable of chaining seemingly benign bugs into critical exploits, we need techniques that can detect and fix these bugs before they can be exploited in the wild.

Someone Knew About PHP's Critical Flaws Four Days Before the Public Did and Amazon Can't Explain How

Amazon’s chief information security officer, CJ Moses, reported that the earliest PHP2Shell exploit attempt was detected on 17 October, four days before public disclosure. The request came from an anonymised IP address geolocated to Australia, but the operator’s identity remains unclear.

Source: techtimes.co.uk

The Internet goes on high alert after discovery of 8 compromised TLS certs

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

The US Army wants AI agents that hack its enemies with almost no human oversight

The US Army is shopping for AI agents that can slip into computer networks, find targets and “neutralize” them with little human oversight, according to a public notice from Army Cyber Command and internal documents obtained by The Intercept. The program is called ECHOTRIBBLE.

Source: madrobot.blog

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

Source: krebsonsecurity.com

The Cloudflare Appstore (Appflare) Malware Audit

An agent-assisted review of Appflare’s app catalog traced a password-reset token leak and private note data sent to upstream services. The process, evidence, and limits. A link shortener’s password-reset page should be a fairly boring place. You open the link, choose a password, and get back to work. In one app we reviewed, opening that page also handed the reset token to an upstream analytics service. That was the most serious result of an agent-assisted audit of Appflare, an app store for your own Cloudflare account. I asked Codex to look through the catalog for code that had no business running in an app someone would install. The brief was deliberately narrow: credential theft, hidden data collection, backdoors, unrelated account changes. A list of routine hardening suggestions wouldn’t answer it.

‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising. On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a worst-case scenario found in the wild: spyware silently infecting targets as they browse past ads in their daily digital lives. Dubbing the attacks “AdFection,” the researchers documented a campaign in which an Israeli-registered advertising firm allegedly connected to the servers linked to a spyware company and infected dozens of devices with its invasive malware. Citizen Lab believes this to be the first detailed technical evidence made publicly available of sophisticated spyware infecting devices via digital ads.

Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects

Anthropic’s opt-in OSS Scanner offers free, periodic AI vulnerability scans for open-source projects, with no human review required for reports The AI company said it has identified more than 29,000 candidate vulnerabilities in some of the world’s most important software projects, out of which a little more than 6,000 flaws have been reported to maintainers. These have resulted in 584 advisories as of October 2, 2026.

Source: thehackernews.com

REA: Reverse Engineering for Your Coding Agent

Reverse engineer apps, binaries and browser behavior with your coding agent. Follow clear guides and try interactive examples with REA. Set up REA Copy this into your coding agent: Your coding agent Copy ›Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.

Source: rea.tools

FBI Arrests Executive at Ransomware Negotiation Firm

Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.

Hackers obtain counterfeit TLS certificates for Google and other large services

The attackers launched a series of attacks on the .gh, .sl, and .as country code top-level domains (ccTLDs) and then modified authoritative DNS records for selected domains within those namespaces. By controlling those DNS records, the attackers were able to pass automated domain control validation checks and obtain unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services.” Google said it updated Chrome to block all certificates it identified as unauthorized, and worked with the issuing certification authorities to ensure the unauthorized certificates for Google properties were revoked.

Florida woman used Claude as a diary, then Anthropic reported an entry to police

What just happened? Another incident has taken place that illustrates the need to be careful what you tell AI. A Florida woman is facing felony charges after she used Claude as a diary and allegedly wrote that she planned to “shoot up” the Sheriff’s office. After a human reviewer examined the statements, they were reported to police.

Source: techspot.com

Our approach to EU text provenance rules

Content provenance helps people understand where content came from, how it was created or edited, and whether it contains signals associated with our models. We’ve already made tools publicly available to identify images and audio generated by our models. Today, we’re sharing our approach to text watermarking in response to the EU AI Act, and how it fits into our broader work.

Source: openai.com

German Police Are Using Linked Devices to Read Messages from Messaging Apps Without Cracking the Encryption

A document by Netzpolitik reveals that German police are sneakily abusing the linked devices feature in messengers to access the messages of suspects using encrypted messengers like Signal without needing to crack the encryption.

Source: privacyguides.org

Self-replicating prompt injections exist · OpenAI Alignment

Research on aligning AI with human values and intent, and reports documenting model failures. We show the existence of a new variety of prompt injection, which can self-propagate akin to a computer worm. No impact was observed outside of the simulated tool calls in training and evaluation; we are sharing this due to the novel nature of the prompt injection, not because of any incident.

Source: alignment.openai.com

Flock Cameras Are Moving From Roads to Watching as Drones From the Sky

Some cities across the country are utilizing drones to aid law enforcement, while others are pumping the brakes due to privacy concerns. A company that blanketed American roads with license-plate-reading cameras is now sending drones into the sky. Cities across America are grappling with their own debates about aid to law enforcement, coupled with concerns about privacy and surveillance.

Source: military.com

How Much Watermark Can You Hide in AI Text?

A deliberately simple watermark model shows how much room a text watermark has: the entropy available at each token, how a small bias becomes detectable, and why length matters.

Source: blog.gaborkoos.com