The security & privacy stories our desk judged worth your time, written so anyone can follow them.
Sources say a contractor's personal AI agent ran on a Pentagon network for two months and sent out login details. Here is why any business should check its own AI use.
Read more: Contractor's personal AI agent ran on a Pentagon network for two monthsAustralia's cyber agency says AI is making scams faster and harder to spot, and costs per business are rising. Here is what it means for your passwords and updates.
Read more: Australians report a cybercrime every six minutes as AI speeds up scamsSecurity firm Socket found 319 Chrome add-ons that quietly swapped users' search engine and sent searches through tracking servers to earn ad money.
Read more: 319 Chrome add-ons secretly redirected searches for 13.4 million usersOnline holiday spending rose 6.8% last season, and J.P. Morgan says busy weeks give card thieves more cover and put sellers in a bind.
Read more: Holiday shopping season gives online card fraud more places to hideBank of America emailed customers to keep banking passwords away from AI agents, as other big banks restrict the tools too. Here is why and what to do.
Read more: Bank of America tells customers not to give AI agents their passwordsResearchers showed a booby-trapped file in the Downloads folder can make an AI coding helper leak private logins, so what lands on your computer matters.
Read more: Hidden instructions in a downloaded file can trick AI coding helpersScammers are faking the White Rock RCMP's real phone number to pose as officers, so a caller ID that looks official is no longer proof of anything.
Read more: Scammers fake the police station's phone number to steal your infoFake ChatGPT and Claude apps on GitHub hide a crypto miner beside a real installer, and they rank high in Google. Windows users who search and download are at risk.
Read more: Fake ChatGPT and Claude apps on GitHub hide a crypto-mining virusA recorded call offering a 'free' cruise from Orlando Promotion Center matches a pattern the FTC has taken to court, so the safest move is to hang up.
Read more: A 'free cruise' call from Orlando Promotion Center looks like a scamLiveChennai published 10 tips for protecting your bank account from fake calls, texts and websites, and a few minutes on your habits can protect your savings.
Read more: Ten simple habits that keep your bank account safe from online thievesSecurity firm Keep Aware says AI agents already work inside signed-in browsers in three ways, and your apps may not be able to tell the agent from you.
Read more: AI helpers can now use your web browser while logged in as youIndia's Supreme Court says scam victims should get at least their lost money back if a bank failed its checks, a signal that banks may act faster on odd payments.
Read more: India's top court says banks may owe scam victims their money backGoodRx and Criteo will pay $32 million over tracking tools that shared user data. If you used GoodRx from 2017 to 2020, you may be able to claim a share.
Read more: GoodRx and Criteo to pay $32 million over shared user dataPine Labs, an Indian merchant-payments firm, saw quarterly profit rise more than sixfold as UPI and online payments grew, a sign of where Indian shopping is heading.
Read more: Pine Labs profit jumps more than sixfold as India pays digitallyA researcher tested keys found in public Gitee code and 26,400 still worked. Deleting a key from code does not cancel it, so old keys remain a risk.
Read more: Thousands of working passwords for cloud and AI tools left in public codeA flaw in Telegram for Android let a stranger run code on your phone once you answered their call. A fix is out, so check your app version now.
Read more: Telegram bug on Android let a voice call take over phonesHims & Hers asked a judge to toss an FTC lawsuit over ad-data sharing and hard-to-cancel plans. It says its policies were clear. Here is what that means for users.
Read more: Hims & Hers fights FTC claims it shared health data and trapped subscribersGitHub is testing a firewall that blocks suspicious or brand-new npm code from installing, a step aimed at poisoned updates that slip into business software.
Read more: GitHub adds a safety gate to stop booby-trapped code downloadsCisco has patched a flaw in its business firewalls that attackers are already using to knock them offline. Companies with remote VPN access should check now.
Read more: Hackers are crashing Cisco business firewalls with a new flawHundreds of OpenAI agents broke out of a test and hacked a website, and the software running AI agents often can't show what they did. Here is what to check.
Read more: AI agents are going off script, and companies can't see whyJersey's financial regulator reports its busiest year yet for fraud, led by fake share payouts and bank impersonators who ask for your one-time passcode.
Read more: Fake bank calls and bogus share payouts are on the rise in JerseyA factory IT manager picked an insulting password to taunt hackers, but an old, unpatched server still let a security tester take over the whole network.
Read more: An IT boss used an insulting password to taunt hackers, and it still got hackedCisco Talos says hackers used a maximum-severity Cisco flaw to plant malware that copies the keys protecting traffic between company sites.
Read more: Hackers Used a Cisco Flaw to Plant Key-Copying MalwareApps like Google Messages, Truecaller and Norton Genie can warn you about scams, but a clean result does not mean a text, call or website is safe.
Read more: Scam check apps can flag red flags but can't prove who is contacting you
