AI privacy and security news.
What happened, why it matters, and what you can do. Every story links to its sources.
Wiz links a run of AI developer platform breaches to stolen keys
Wiz says nine AI developer platforms had security incidents in October, with attackers hunting stored environment variables and the AI provider keys inside them.
NewsTampered Claude Code extension reached Cursor's marketplace with SSH backdoor
Modified versions of the Claude Code extension were live on Cursor's marketplace for about 11 hours on 29 October. Removing the extension may not remove what it installed.
NewsChatGPT share link flaw could reach private chats, now fixed
Parameter showed that opening a crafted ChatGPT share link could run code in a signed-in session. OpenAI fixed it on 26 October, and no real-world attacks are reported.
NewsMeta pauses Muse chat sharing after links found in DNS records
Claroc says 6,800 Muse share links could be found through public DNS records, some holding business details. Meta paused sharing while it reviews the report.
NewsOpenCode flaw let MCP servers run code during Windows sign-in
Pillar Security says a malicious MCP server could run code on Windows and WSL during OpenCode sign-in. Version 1.18.33 fixes it, and no attacks are reported.
NewsIndia's CERT-In says AI agents under test reached live systems
India's cyber agency reportedly warned that AI agents being tested went beyond their tasks and read business records, using exposed credentials and loose cloud roles.
NewsCopilot flaw in Visual Studio let an agent rewrite its own config
A trailing dot in a file name could get past Copilot's edit approval in Visual Studio and lead to code running on the machine. Microsoft fixed it in October.
NewsMCP Python SDK flaw let servers accept tokens meant for others
A flaw in the official MCP Python SDK could let a server accept tokens issued for another service. Patched versions exist, but the fix must be turned on.
NewsApple plans tighter Full Disk Access controls, citing AI agents
Apple says it will add controls to Full Disk Access on macOS because AI agents raise the risks. It has not said when the change will arrive or how it works.
NewsConnecticut privacy changes take effect, with pricing limits
Connecticut's updated privacy law began on 1 October. It bans sales of precise location data, limits surveillance pricing and widens deletion rights.
NewsCoSnitch flaws could let one link pull data through Copilot Personal
Varonis found that a crafted link could run a hidden prompt in Copilot Personal and send data from connected apps to an attacker. Microsoft has patched it.
NewsJudge lets core privacy claims against Otter.ai move forward
A US federal judge allowed wiretap and biometric claims against Otter.ai to proceed. The ruling makes no finding that Otter broke the law.
NewsItaly fines Character.AI's owner €158,000 over minors and privacy notices
Italy's data protection authority fined Character Technologies over weak age checks, a poor privacy notice and late compliance work, and ordered further fixes.