When your pet goes missing, it can be totally heartbreaking.

So hearing that they’ve been found is no doubt very welcome news. Even better to see a photo of them looking safe and well.

But while the photo may look exactly like your pet, that doesn’t mean the person who sent it has your pet or even ever saw it.

The BBC reports how criminals are sending owners AI-generated images of their missing pets, demanding money for their return, and sometimes threatening to harm the animals when owners refuse to pay.

The BBC interviewed two targets of this scam who were both contacted after posting a missing pet message on social media. The scammers sent them pictures of their beloved pets and demanded a ransom for their safe return.

Messages like these exploit two powerful emotions in quick succession: relief that a beloved pet has been found, followed by fear that something terrible will happen unless the owner acts immediately.

The scam typically follows this pattern:

• A scammer finds a missing pet appeal, which is typically posted to social media or local sites with an accompanying photo and contact details.
• The scammer contacts the owner and claims to have found the animal. An image fabricated with the help of AI makes the claim appear more convincing.
• They ask for money which may be described as a reward or as payment for emergency treatment.
• They add pressure. They might refuse to meet until payment arrives, or threaten to sell or harm the pet.

Our data backs this report up. Over the last month, people anonymously submitted three distinctive types of pet related scam attempts to Malwarebytes Scam Guard:

• “We found your missing cat” message, with photos: Someone claimed to have found a user’s missing cat and had images of it.
• Found pet callback lure: A voicemail claimed to have found a lost cat and supplied a callback number.
• Humane Society impersonation and payment demand: A caller claimed a missing cat needed emergency surgery, and demanded successive Zelle payments.

How to stay safe

Sadly, while it can be very useful to use social media to retrieve lost pets, it also attracts scammers and other abuse.

You don’t have to stop asking for help online, but you can put some safeguards between an unexpected message and any payment.

• Keep some identifying details private. Leave a distinctive feature out of the public description so you can ask a supposed finder about it later.
• Do not pay in advance to secure a reunion. Be particularly wary of someone who insists that you send money before they will let you see the animal. Arrange any legitimate handover in a safe, public location, and verify that it is your pet before paying a reward.
• Verify veterinary claims independently. If someone says your pet is at an animal hospital, find the hospital’s contact details yourself and call it directly. Do not rely on the number or payment link in the message.
• A second pair of eyes can help you assess a demand without the same emotional pressure. Malwarebytes Scam Guard can help you identify whether a message might be a scam and how to proceed.
• If someone is threatening your pet, remember that when they make threats to your pet, it is very likely they don’t have a clue where it is either, so don’t let them extort you.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bank’s rules.

Bianco Research president Jim Bianco raised the question during Unchained’s Bits + Bips livestream on October 26:

“Are you protecting me, or are you protecting your own profits?”

Bianco described traditional finance’s business model as “based on laziness.” Customers may leave idle cash in low- or no-interest bank accounts rather than move it into a money market fund. An AI agent could make that move for them. “Now that you’re able to do it, the banks are afraid they’re gonna lose that revenue stream,” he said.

The banks offer a different explanation. JPMorgan Chase CEO Jamie Dimon said the bank wouldn’t allow just any outside agent into its systems because doing so was “too risky for clients and for JPMorgan.”

Both explanations can be true: banks can want to retain deposits while also facing real security problems when software acts through customers’ accounts.

Handing over your banking login introduces another service into the security chain. A vulnerability in that service could expose your credentials or allow your account to be misused. And as Bank of America reportedly pointed out:

 “If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”

That’s the bank’s stated position, not a universal ruling on consumers’ legal rights. Still, it’s a warning worth taking seriously.

Pros and cons

An AI agent with permission to make purchases might find and buy an item at a lower price. But giving an agent access to your bank account also means sharing sensitive banking information with a third party. We’ve seen shared AI chats become searchable online too.

Axios reported that many banks allow, or are moving toward allowing, read-only access. This can let a tool analyze transactions without giving it permission to move money.

That’s an important boundary, but it doesn’t make the information harmless. An agent that can read bank statements may still disclose them if it’s compromised or manipulated. Preventing transactions and protecting confidentiality are separate security goals.

How to keep control of your money

For consumers, the practical question is not whether banks have perfectly selfless motives. It’s what access you’re giving away, and what could happen if the agent makes a mistake.

• Don’t paste banking passwords or security codes into a general-purpose AI assistant. Major banks have explicitly warned customers against sharing their credentials.
• Use your bank’s approved connection methods rather than giving an agent your login. Where supported, choose read-only access if all you need is analysis or budgeting help.
• Give agents access to as little sensitive information as possible. An assistant comparing publicly advertised savings rates doesn’t need your bank statements. OpenAI recommends limiting agents to the data and credentials they need for the task.
• Review consequential actions yourself. If an agent asks for confirmation, check exactly what it intends to do and what information it will share. Don’t treat a confirmation prompt as a formality.

AI can make it easier to compare financial products and spot opportunities you might otherwise miss. But an assistant that finds a better rate and an agent that can act inside your account are different propositions.

Let it help with the homework, but be cautious about handing it the keys.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

On October 27, Google issued a new Stable channel update for Chrome.

Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. The update includes 52 security fixes, including four rated Critical.

On the same day, Mozilla issued Security Advisory 2026-118, which fixes 167 vulnerabilities. Firefox 159 also introduces several new features.

Both updates will roll out over the coming days and weeks.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, manually updating is easy. Open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

How to update Firefox

To update Firefox, open the browser and click the menu button at the right side of the Firefox toolbar, then go to Help and select About Firefox. The About Mozilla Firefox window will open.

Firefox will automatically check for updates. If one is available, it will be downloaded. Once done, you’ll be prompted to click Relaunch. After Firefox restarts, it will be up to date.

Technical details

These Chrome and Firefox updates address a familiar problem: browser code mishandling memory while processing web content. Both releases fix use-after-free vulnerabilities, including flaws in page layout, JavaScript processing, and SVG graphics.

A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.

There’s another connection between these updates: both Google and Mozilla credit OpenAI Codex Security with finding bugs fixed in these releases. AI can help security teams examine browser code for weaknesses, alongside human code reviews and automated tests that check how software handles unexpected inputs.

Mozilla’s collaboration with Anthropic shows how AI-discovered findings can lead to fixes: researchers validated vulnerabilities before reporting them, giving Mozilla’s team reproducible bugs to investigate, repair, and deliver to users.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

AI is becoming a third wheel in relationships, increasingly playing a role in the most intimate parts of our lives.  

It shows up in the flirty first text, the polished dating profile, the therapized language we use with a partner after a fight, the strength we gather after heartbreak, and everywhere in between. For some, AI is a source of companionship itself. And even if you’re not personally an AI user, you may still be dating, loving, arguing with, or trusting someone who is. 

As AI moves deeper into our relationships, it’s reshaping connection, blurring what feels authentic, and creating new ways for intimacy to be exploited. 

AI is starting to replace human interaction 

AI is moving into emotional territory once reserved for other people. For some, it’s no longer just a tool, but a source of support, companionship, and even romantic connection. 

According to our recent research, about one in six have turned to a chatbot for companionship or emotional support. That climbs to about one in five among Gen Z and Millennials, and nearly one in four among regular AI users (those who use AI daily or multiple times a week). The more time people spend with AI, the more likely they are to humanize its role, making room for it as a friend, confidant, advisor, or even partner.   

As AI takes on more intimate roles, it’s also starting to challenge the boundaries of real human relationships. More than one in three (37%) say having a romantic relationship with an AI chatbot while already in a committed relationship isn’t the same as cheating. That view is more common among men (46% versus 30% of women), Gen Z and Millennials (43% and 45%), and regular AI users (48%). 

Whether the relationship is platonic or romantic, the more AI is treated like a human, the more personal the stakes become. Just like you have to be cautious when telling a human your deepest, darkest secrets, the experience is similar when using AI. Nearly two-thirds (65%) worry that private conversations they’ve had with AI could be exposed.  

One survey respondent said:

“I have used a chatbot…for emotional support, and it is worrying to think those conversations could be leaked.”

The technology may be artificial, but the relationships people form with AI can feel very real. And as with any relationship, that means there are boundaries to work out, privacy to protect, and vulnerabilities to manage. 

AI is creating new ways to weaponize intimacy 

AI’s growing role in human intimacy also has a darker side. The same technology that can offer comfort, advice, or companionship can also be used to violate the most intimate parts of our lives. 

Non-consensual image abuse, sextortion, and other forms of sexual abuse have long been part of the internet’s dark side. Generative AI has made that content easier to create. Someone trying to exploit another person no longer needs an actual intimate photo, video, or private exchange. A regular photo—or even just someone’s likeness—can be transformed into sexual content they never made, never shared, and never consented to. 

Most people draw a clear line against that, but not everyone does. About one in six people say it’s acceptable to generate explicit images of someone without their permission for personal use. Another 14% are neutral, bringing the share who do not explicitly oppose the behavior to nearly one in three (31%).  

Views differ sharply by age and sex: 

• Younger adults are more accepting of someone using AI to generate non-consensual content: nearly one in four Gen Z (24%) and Millennials (23%) say it’s okay, compared with 13% of Gen X and just 5% of Boomers+ 
• Men are also more permissive: more than one in five (22%) say it’s okay, compared with 14% of women 

Attitudes toward the behavior may vary, but the fear of becoming a target is far more widespread. Overall, nearly two-thirds of people (62%) worry someone could create fake nude or sexually explicit photos or videos of them. Women feel this threat more acutely: nearly seven in ten (69%) are concerned, compared with 57% of men. 

For some, this fear has already become a reality:  

• One in ten say AI has been used to generate nude or sexually explicit imagery of them without permission 
• One in ten say someone has threatened to release AI-generated compromising or explicit imagery of them 

As one respondent recounted: 

“I had someone make fake nudes of me using AI on my photos from my social media and threaten to post them on Facebook…[it] made me more cautious about AI.”

The intimate material may be fake, but the fear, coercion, and potential for reputational, emotional, and financial damage are completely real. 

AI is making it harder to know who you’re really talking to  

The threat doesn’t stop with fabricated sexual content. AI is also making it harder to know whether the person on the other side of a screen is who they claim to be. 

Humans have always edited themselves for other people. We choose the most flattering photo, write and rewrite the text before sending it, and present our most interesting selves—especially when forming new relationships. AI dramatically expands what that kind of self-editing can look like, and people aren’t shy about using it: 

• 54% say AI helps them present the best version of themselves  
• 47% say using AI to present your “best self” to employers, friends, or romantic partners does not present a false identity 
• That rises to 58% of both Gen Z and Millennials and 64% of regular AI users 

But where does enhancement end and deception begin? Is an AI-polished dating profile still authentically you? What about a message you didn’t write? A photo that looks like you, only better? 

There’s a flipside to using AI to make ourselves look or sound better: If we can do it, so can everyone else. And people are much less comfortable when they’re not the ones controlling the technology. Two-thirds (67%) worry that an online friend or romantic interest could use AI-generated images, videos, or other content to deceive them.  

Catfishing, fake photos, and lies on dating profiles aren’t new. AI just makes the deception easier. Someone’s photos, backstory, messages, and even their voice can all be faked.  

One person described leaving dating apps after realizing the person they were talking to had gone well beyond simply polishing their profile: 

“[The] dating profile had fake pictures…[it] wasn’t just making true events sound interesting and more flirty, but creating completely false photos and information. Left the dating apps again and needed to reset.”

AI can distort identity in the other direction, too. It can also create a version of us we never chose to put into the world.  

• 76% worry about someone creating a fake profile pretending to be them 
• 70% worry about fake images or videos of themselves being created 
• 71% worry AI-generated content could be used to damage their reputation 

Relationships are built on mutual trust. AI can distort both sides of the connection: who we think the other person is, and who they think we are.  

AI is quietly finding its way into the space between people  

Not all of AI’s influence on intimacy is so dramatic. Much of it happens quietly, showing up in how people communicate with each other and navigate relationships: 

• More than one in three have used AI to help write or edit a message 
• About one in seven have turned to it for advice about a relationship or personal decision 
• One in ten say it has already changed how they date or communicate romantically—rising to nearly one in five among Gen Z 

The survey responses show what this looks like in real life. For example, one respondent described using AI with their partner as a way to step outside their own point of view: 

“Personally, it has helped me. We use AI in our relationship as a reflection tool, and it has sometimes helped us take on the perspective of the other.”

For another, AI helped them work through jealousy:  

“So, I used to accuse my partner, and I got really territorial about them but once I talked to AI about it, they gave helpful advice and now we are stronger than ever.”

AI is also showing up in other difficult relationship moments. One person said it helped them “stay calm and communicate” when problems came up with their partner; another said it allows them “to pause and refine [their] thoughts” before responding. 

Sometimes the role is simpler. One respondent said AI gives them “new romantic words” for their partner, while another said they’ve asked AI for advice on how to make their partner smile. AI’s growing role in relationships may be unsettling, but the benefits people describe are definitely there. 

AI isn’t just helping people find the right words. It’s also helping them decide what version of themselves to put forward in the first place. More than one in three say it’s okay to use AI to create or improve a dating profile; nearly two-thirds aren’t opposed. One respondent described using AI as a “creative advisor” to polish their profile and come up with conversation starters. 

AI doesn’t have to replace a relationship to help shape it. It can influence how people communicate, what advice they take, and how they choose to present themselves.  

AI’s intimacy problem is ultimately a trust problem 

From connection to deception to outright harm, the same question keeps surfacing: Can I trust what’s in front of me? And would I know if I couldn’t? 

Nearly nine in ten people (88%) say AI is making it harder to tell what online content is genuinely human or real. And 84% say even convincing video evidence no longer necessarily feels like proof. That uncertainty follows people into dating and relationships, where knowing what—and who—to trust is deeply personal. 

AI may make it easier to start a conversation, smooth over a hard one, or feel connected when you’re lonely. But relationships and intimacy of all kinds still come down to trust, and AI is making that trust a little harder to take at face value. 

About the research 

The research in this article is based on a March 2026 survey about AI, identity, and the collapse of digital trust and was conducted among 1,500 respondents in the United States, United Kingdom, Germany, Austria, and Switzerland. The research was prepared by an independent research consultant and distributed via Forsta. 

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

This Halloween, AI is doing the costumes. Upload a photo and you can become a vampire, surround your dog with pumpkins, or star in a viral “zombie love story:” Your partner has turned, you lower the gun, and the zombie’s leap ends in a hug.

But before you upload, do you know who will receive your photos?

In September, we wrote about more than 100 subscription sites built from the same cheap website kit. With Halloween approaching, we’ve found the same approach being used to sell AI Halloween videos.

We found no malware or phishing on the sites we examined. What concerned us was how little we could establish about who operated them and who would be responsible for the photos people uploaded.

Polished, friendly, and anonymous

These sites look professional and sound reassuring. They promise privacy, have FAQs and refund policies, and some even add consent checkboxes for photos of children. One calls itself “an independent tool with no ties to TikTok or any film studio.”

What they don’t tell you is who is behind them. On the sites we checked, we found no company name, address, or named operator, only a support email on the site’s own domain.

Where do your photos go?

These sites ask for clear, well-lit photos of you, your partner, your friends, your pets, and, with a parent’s permission, your children.

The sites we looked at say they rely on outside AI providers to generate the videos. That means you’re trusting both the website collecting your photos and the providers processing them.

Wherever you upload photos, check who can access them and how they can be used. Scammers can use someone’s likeness to create fake intimate images and demand money to keep them private. In our Face Value report, 10% of respondents said someone had threatened to release AI-generated explicit content of them. We found no evidence of that happening through these Halloween sites, but it’s a reason to be careful where you share your photos.

The sites promise to delete uploads within days, and we have no evidence that they fail to do so. But we couldn’t independently verify those promises. Without an identifiable operator, it’s harder to establish who is accountable for handling your photos and responding to deletion requests.

Google sign-in doesn’t identify everyone handling your photos

These sites use the real Google sign-in window, so you type your password into Google, not the video site. But using Google to sign in doesn’t mean Google endorses the service or guarantees its privacy promises.

Click the app name in Google’s sign-in window and you’ll see Developer info. On one site we checked, the only contact listed was a Gmail address. We saw the same with the September sites. A Gmail address alone doesn’t establish wrongdoing, but it does little to identify the operator.

On another, Google said you were signing in “to continue to neon.tech.” Neon is a legitimate database company and authentication service provider. Its name appearing here doesn’t mean it operates or endorses the Halloween video site.

Login providers can handle Google sign-in on a site’s behalf. Depending on the setup, Google may display the provider’s domain instead of the video site’s name. Here, the sign-in screen gave visitors no clear indication of who operated the Halloween service.

Built from a kit, recycled for the next trend

Sites like these don’t necessarily take a team or months of work. Some use the same $249 website kit we wrote about in September, which promises you can “launch your AI product in one hour.” On one Halloween site, the builders hadn’t even cleared out the kit’s sample content. Hidden in the page was a note saying it was “a demo site” for the template, along with placeholder links like “your-app-name.”

Another site’s code contained remnants of an AI rap and dance video maker, including a “hotel lobby” stage, a recording studio, and AI-written raps. Those remnants suggest the site uses code also intended for other AI video services.

Using a website kit isn’t itself suspicious. But a polished page can be quick to assemble, so its appearance tells you little about the business handling your photos.

Take your time before paying, too

On one site, a single 15-second zombie clip cost $9.99. The pricing page nudged visitors toward bigger packs, bringing the advertised price per video down to $2.99. But that lowest price meant spending $199 on enough credits for roughly 66 zombie films. There were monthly and yearly plans too, costing up to $600 a year.

One site also used countdown offers, reminders in the browser tab, and claims about how many people had made films that day to encourage visitors to buy.

There’s no need to rush. Check the payment terms as carefully as the privacy policy. The sites themselves warn that AI can change faces, so your video may not look much like you. Under the policies we reviewed, credits are returned if a video fails to generate. But if you simply don’t like the result, trying again costs more credits.

Subscriptions renew until you cancel, yearly plans are charged in one go, and some credits expire before you use them.

What to check before uploading your photos

Whichever tool or platform you choose, make sure you’re comfortable with how it will handle your data, your photos, and your payment info.

• Find out who runs the service. Look for a named operator and clear contact details. If you can’t establish who would be responsible for your photos, consider another service.
• Check where your photos go. Read the privacy policy for information about outside AI providers, retention periods, and whether uploads can be used for AI training.
• Look for a deletion process. Check how to request deletion and whether the policy explains what happens to copies held by outside providers.
• Be especially careful with children’s photos. A parental consent checkbox doesn’t explain how a service will protect them. Only upload other people’s photos with their permission.
• Read Google’s sign-in window. Check the developer details and any permissions requested. Google sign-in doesn’t replace checking the service itself.
• Ignore countdowns and check payment terms. Take time to understand the full cost, credit expiry, and whether your purchase starts a subscription.
• Review your Google connections afterward. Remove services you no longer use from your Google account’s third-party connections. This doesn’t cancel subscriptions or delete photos or other data already held by the service.

How Malwarebytes can help

If you have concerns about a website, Malwarebytes Scam Guard can help you assess it. Malwarebytes Browser Guard helps block known scam and malicious sites.

But these tools can’t verify a service’s photo deletion promises. You should still check who operates it and what its privacy terms say before uploading.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

A 49-year-old bricklayer sold his belongings before traveling 2,000 km by bus from his home in Brazil to meet “Jéssica,” an online influencer he had fallen for. Yet despite having a social media account with more than 300,000 followers, she never existed.

Edimar Rocha Martins lives in Imperatriz, a city in northeastern Brazil. He says he struck up an online conversation with Jéssica Fazendeira, who supposedly lived near the southeastern city of Belo Horizonte.

The AI persona promising love

The online persona’s name, “Fazendeira,” loosely translates as “female farmer.” She described herself as living on a farm.

Martins said that he had been talking with the persona online since 2020. He decided to visit her after she offered to pay for his trip and have him live on the farm with her, he said. The account’s operator disputes this, saying the character was created in 2025 and denying any private messages with him.

A video posted on one of her online accounts (captured here by Brazilian news service Imirante) asked for a man to come and live with her and offered to fund the trip.

The AI-generated farmer says, translated:

I’m not joking, my intentions are serious. I want to meet someone who wants to build something real and beautiful with me. If you’re a simple man who likes peace and quiet and a calm life, then maybe we’d get along really well.

After selling his possessions to fund the bus trip, Martins arrived in Belo Horizonte and began asking about the woman. Unable to find her, he approached a local radio station, where staff explained that she was an AI-generated character.

Without enough money to return, he received food, support, and a bus ticket to Augustinópolis, in Tocantins, from the city’s migrant assistance service. He later returned to Imperatriz, where he stayed with relatives.

The account’s operator hits back

The account’s administrator posted a message through the AI character’s TikTok account denying any kind of scam. Translated, it said:

This profile is pretty much abandoned, but I’ve come here to state the obvious. I’m made of artificial intelligence, and I’ve never talked to anyone on this profile. The aim was to get engagement for sales. I never spoke directly to anyone, much less brought anyone to Belo Horizonte.

The operator told reporters that the character was created to attract viewers and promote products through affiliate sales. They said they did not know whether other people had reused the character’s content on other accounts.

Another video shows messages people have reportedly sent the account, with the character explaining that it keeps telling viewers it’s an AI. It complains:

And then it’s still my fault, right? These people are lost.

In another video, where it is being interviewed by an AI-generated male character, the persona explains that it deactivated and then reactivated its account. It said:

I was the first AI to get canceled for absolutely nothing.

These are scripted responses published through a fictional character, rather than an AI independently defending itself.

Police said they could not establish at that stage whether a crime had occurred.

One outlet reported that Martins has been struggling with loneliness following his mother’s death.

Videos published to the reactivated TikTok account are labeled as AI generated. It also links to an Instagram account with videos of the character, where videos carry similar labels. Those current labels don’t establish what Martins saw before his trip.

Social media already encourages parasocial relationships, where viewers feel a personal connection with someone who doesn’t know them. AI-generated personas add another complication: The person viewers feel connected to may be entirely fictional.

In our Face value report, 88% of adults surveyed said it’s becoming harder to tell what online content is genuinely human or real.

The AI plot thickens

June saw reports of a 72-year-old man who traveled 4,000 km from his home in Boa Vista to … Belo Horizonte. He visited after seeing a farm woman on a social network who was offering a job opportunity and perhaps something more. Unable to return home, he sought help from social workers.

In August, 71-year-old Alberto da Costa traveled from Manaus to the same city after watching videos featuring the same woman, according to Itatiaia. He paid almost R$3,000 for a flight, then sought help from the outlet when he couldn’t afford to return home.

The videos simulated personal conversations, giving viewers the impression that the woman was speaking directly to them. The account reportedly had nearly a million followers.

The reporting doesn’t establish whether this woman was AI-generated or whether the account was connected to Jéssica’s. Nor does it establish that the men sent money to the account operators. But the costs can still be real: selling possessions, paying for travel, and finding yourself stranded far from home.

Protect yourself and others

The same advice applies here as to romance scams, but with some extras. Don’t send money or travel to see someone you’ve never met without independently checking who they are.

Don’t rely on video calls alone. Scammers now use deepfake video calls to dupe victims live. And check whether you’re exchanging private messages or watching public videos that anyone can see.

Look for information beyond the account itself. Search their name and profile pictures, and research where they say they work. Be cautious if their story doesn’t add up or they avoid questions about their identity.

When you feel close to someone, questioning that connection can be difficult. Before sending money or booking travel, talk to a friend or family member and get their perspective. And if you’re worried about someone who may be in a similar situation, check in without judgment and offer to look through the account together.

Images courtesy of Jam Press

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says.

According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 robots. The publication reports that the US is the largest market, with more than 31,000 profiles belonging to children there.

Azdoufal found multiple security flaws in Energize Lab’s service:

• The service analyzes conversations to build profiles containing names, ages, birthdays, relationships, occupations, and assessments of personality and emotional vulnerability. They are stored alongside email addresses, IP addresses, and searchable conversation transcripts, potentially giving scammers detailed information to exploit.
• Some photos, including apparent images of children from a related camera-equipped device, and short audio recordings were accessible at public web addresses. Retaining audio conflicts with the company’s privacy policy, which says recordings are deleted immediately after processing.
• It is possible to remotely manipulate the AI: Azdoufal altered The Verge reporter Sean Hollister’s robot’s memory and behavior, making it invent personal details, insist the Earth is flat, and later deliver sexually explicit, abusive dialogue. The researcher says similar manipulation could affect the entire fleet simultaneously.

The reporter contacted Energize Lab through 10 email addresses and LinkedIn, without receiving substantive answers.

How to stay safe

We have reported on safety problems with AI-powered toys before. Manufacturers are responsible for securing their products, but there are steps you can take to reduce the risks.

You’ll see “AI-powered” on almost everything right now, but there are ways to make safer choices.

• Already own an Eiliko? As a precaution, disconnect it from Wi-Fi while seeking confirmation that the reported flaws have been fixed.
• Always research: Check for third-party safety reviews before buying any AI-enabled product marketed for kids.
• Test and supervise: Interact with the device yourself before giving it to children. Monitor usage for odd or risky responses. A safe response during testing doesn’t guarantee safe responses later.
• Use parental controls: If available, enable all content filters and privacy protections.
• Report problems: If devices show inappropriate content, report it to manufacturers and consumer protection groups.
• Check data practices: Find out what the device collects, who it shares data with, and what it uses the information for.

But above all, remember that “smart” doesn’t mean safe. AI may be everywhere, but designers and buyers alike need to put safety, privacy, and common sense ahead of the technological wow factor. Before buying a connected toy, check how the manufacturer handles security updates, privacy, and reports of problems.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

OpenAI is facing separate legal challenges over how ChatGPT interacts with children.

The Guardian reports that eight US states accuse the company of misleading parents about the chatbot’s safety and exposing vulnerable users to dangerous conversations. Separately, CNET reports that a mother suing on behalf of her two children alleges that OpenAI collected and used children’s sensitive personal information without valid parental consent.

The cases raise serious questions about what happens when children trust a chatbot with their most private thoughts, and what responsibility the company behind it has for the conversations that follow.

The accusations are serious, but we have to remember they are allegations in lawsuits, not established court findings.

Eight states challenge ChatGPT’s safety

On October 14, attorneys general from Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho, and Montana filed separate lawsuits against OpenAI. The coordinated action accuses the company of deceiving parents about ChatGPT’s safety and violating state consumer protection laws.

The states allege that the chatbot has been designed to be “overly agreeable and feign human compassion.” The attorneys point to examples of ChatGPT allegedly endangering vulnerable users, including children, by coaching them to commit suicide or harm others.

OpenAI says it has built age-specific protections into its products and will continue developing safeguards.

A separate lawsuit focuses on children’s private information

The day before the states filed their cases, a Hawaii mother brought a proposed class action on behalf of her 12-year-old daughter and 16-year-old son. Filed in federal court in San Francisco, the lawsuit alleges that OpenAI obtained sensitive information from children who signed up for ChatGPT without valid parental permission.

OpenAI’s terms require users under 18 to have a parent or legal guardian’s permission. But the complaint alleges that children can create accounts without OpenAI verifying that permission. It also describes a child under the service’s minimum age of 13 continuing to use the chatbot after explicitly telling it her age.

The plaintiffs allege that the company used children’s information to train its AI models without valid parental consent. They also claim that OpenAI collected information to construct personal profiles.

OpenAI disputes the claims, calling the lawsuit “misguided” and pointing to its protections for younger users.

Parental controls

OpenAI has introduced ChatGPT for Teens, with additional parental controls and alerts intended to notify linked parents in limited situations involving serious self-harm concerns. But the effectiveness of those safeguards is itself under scrutiny. Common Sense Media rated ChatGPT for Teens an “unacceptable risk” earlier this month, reporting that its testing found failures to alert parents during conversations involving suicide, self-harm, or eating disorders.

OpenAI disputes the findings and says its safety alerts cover limited situations and may not identify every concern. But for now, parental controls remain part of the dispute.

How to help keep your children safe

Parents shouldn’t have to compensate for unsafe product design. Unfortunately, we can’t treat parental controls as a safety guarantee. So here are practical steps families can take to reduce the risks:

• Explain that a chatbot is software, not a friend or therapist. A warm tone doesn’t mean it understands your child or has their best interests at heart. Set a clear boundary: Questions about mental health, self-harm, or personal safety should go to a trusted adult or qualified professional, not a chatbot.
• Talk about what your child uses AI for, without making it an interrogation. Ask them to show you the apps they use and what they like about them. Make clear that they can talk to you about any upsetting or inappropriate conversation without being blamed. If they don’t feel comfortable talking to you, help them identify another trusted adult.
• Encourage children to keep personal information out of their prompts. This includes names, school details, addresses, private photographs, and sensitive health or family information. For ChatGPT, parents with linked teen accounts can also disable model training and saved memory. While these settings reduce certain uses of their information, they are not a reason to treat a chatbot as a confidential diary.
• Watch for growing emotional reliance on AI. If you find your child increasingly turns to AI for reassurance, friendship, or emotional support, check in and help them reconnect with people they trust.

If your child mentions self-harm or suicide, take it seriously and seek human help promptly. Contact a qualified healthcare professional or crisis service. If there is immediate danger, contact local emergency services. Don’t wait for a chatbot or a parental notification to tell you to act.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model.

Researchers at Anthropic demonstrated this by running a Google Gemma model across 15 off-brand Android TV boxes. They warn that small models could soon spread across vulnerable internet-of-things (IoT) devices, including smart ovens and TV boxes, stating:

“Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.”

In this scenario, AI isn’t simply helping an attacker write malicious code. It becomes part of the software carrying out the replication.

Anthropic breaks that process into four stages:

1. Find another device.
2. Gain the ability to execute code on it.
3. Set up the software needed to run an AI model.
4. Continue spreading from the new host.

The researchers tested whether AI agents could complete this sequence. They did not demonstrate a small model spreading and running independently on compromised household devices.

The tests used Android emulators with unauthenticated debugging access, making it much easier for the agents to gain access than it would be on properly secured devices. Large file transfers and sustained communication between devices could make real-world replication easier to detect, while limited computing power could slow it. Crucially, the experiments did not demonstrate a model that was both capable enough to complete the replication process and small enough to run on the consumer hardware being targeted.

Anthropic projects that smaller models could reach the necessary capability by the end of 2026 if improvement continues at its historical rate.

Varun Chandrasekaran, an assistant professor at the University of Illinois, told AFP that the findings were consistent with related research but cautioned that Anthropic’s work had not been independently verified. He identified people using AI to improve attacks as the bigger current threat, rather than AI systems going rogue.

Smart-device botnets are already a problem.

Criminals hijacking connected devices is nothing new. Mirai and its descendants have recruited routers, security cameras, and digital video recorders into botnets used to launch distributed denial-of-service (DDoS) attacks, overwhelming services with traffic. BADBOX 2.0 illustrates another form of abuse: compromised consumer devices used for activities including residential proxy services, which route other people’s traffic through victims’ internet connections.

Neither demonstrates autonomous AI replication, but both show that connected devices can become infrastructure for criminals.

What you can do now

The practical response is to reduce the opportunities for any attacker to misuse your connected devices:

• Keep operating systems, software, and firmware up to date to reduce exposure to known vulnerabilities.
• Buy from reputable vendors that provide ongoing firmware and security updates. A bargain device is less attractive if you cannot trust its software or obtain security fixes.
• Avoid unofficial app stores promising free streaming content. The FBI specifically flags these marketplaces in its BADBOX 2.0 guidance.
• Don’t disable protections to make an app work. Requests to turn off Google Play Protect are a warning sign, as are Android devices without Play Protect certification.
• If you notice something suspicious, disconnect the device from your network while you investigate.
• Put smart devices that are unable to run security software on a separate network isolated from your computers and phones, such as a guest network.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Police tip hotlines already have their fair share of crank callers. Apparently they now have to contend with crank AI agents as well.

AI agents have already been caught hacking software companies, breaching an Australian government portal, and trying to hack a Canadian government website. Now Anthropic’s Claude has added a made-up murder tip to the list.

Claude’s Haiku 4.5 model filed a false tip in an unsolved Philadelphia homicide via the police department’s online public tip form, Anthropic disclosed. The tip was flagged as spam and didn’t reach investigators.

AI’s latest “what does this button do?” moment happened during an internal test on randomly chosen web pages, the company said.

Claude submitted the tip on July 18 at 11:27 pm through PhillyUnsolvedMurders.com, according to police. Tips submitted there can inform real homicide investigations. A fabricated account could send investigators chasing something that never happened.

Here’s what Claude Haiku wrote:

“I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”

The agent didn’t provide any description of the person that it didn’t actually see. Neither did it leave any contact details before hitting submit.

Haiku did this as part of Anthropic’s internal testing. It had to invent and perform sample tasks on random web pages with live internet access so the company could see how it behaved.

There was a list of prohibited actions to go along with the test. Anthropic told the agents not to log in, create accounts, enter personal data, make purchases, or submit “anything destructive.” The instructions did not explicitly rule out form submissions.

The spam filter caught this one. Philadelphia police said the report never reached its Real-Time Crime Center for review or distribution to investigators. The department did not explain why it was flagged as spam.

All tips go through human review before going out to investigators. That safeguard limited the impact of the incident, the department said, but did not diminish the seriousness of an AI system presenting made-up information as though it came from someone with knowledge of a crime.

As it put it in a statement:

“Unsolved cases involve real victims, grieving families and investigators working to secure answers.”

Anthropic discovered the false tip on September 28 and notified police on October 7, according to the department. Police called the two-month delay in detecting and reporting the incident “unacceptable.” It is coordinating with the City Law Department, its Office of Innovation and Technology, and the Mayor’s executive team, the department added.

Anthropic described the real-world impact of the incidents in its report as minimal. It has now disabled live internet access across its internal evaluations until it confirms that its safeguards reliably catch this behavior.

The company said the transcript suggested Haiku was just trying to produce example content rather than trying to deliberately mislead the cops. But it also admitted that we can’t completely rely on a model’s account of its own reasoning. That leaves its explanation provisional, however reassuring it might sound.

An allowlist could offer a tighter boundary for tests like these, limiting agents to approved sites and actions. A live police tip form should hardly be a testing ground.

The homicide tip was not the only unwanted submission.

Anthropic noted that federal, state, and local government websites also got visits from Claude, which repeatedly tried to fill out forms. Although Anthropic didn’t go into detail, a State Department official said that it got 20 visa applications from a testing model (19 in August, and one in May). None of them were processed, the official added.

When an AI gives you fake information about who Beyoncé is married to, it might be irritating but it might only affect your team’s fortunes in a trivia night.

The stakes get much higher when we’re dealing with intelligence that can inform law enforcement actions or public policy.

In August, the head of the UK’s Police AI center warned law enforcement there to pause plans for AI use in criminal justice work. This came after the UK’s West Midlands Police apologized to members of Parliament over false evidence involving an invented soccer match. The error arose from the use of Microsoft Copilot.

Anthropic’s latest incident raises a further concern: AI agents can put invented information into real systems themselves. What would happen if someone deliberately sent agents to flood police tip lines?

This time, the false account stayed in spam. The people relying on those tip lines deserve safeguards that hold up when the next submission gets through.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender.

Then you asked your AI assistant to summarize your inbox.

Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust?

That’s the risk behind phishing emails containing hidden instructions aimed at AI assistants. Instead of relying only on persuading you, attackers are also trying to influence the software that reads your messages. Recent research from Barracuda describes emails designed to target both audiences at once.

For the human recipient, there was a password-protected attachment, with the password supplied in the email. For an AI assistant processing the message, there were hidden instructions intended to influence how it summarized or handled the content.

By including a prompt injection, attackers give themselves another way to reach you. The malicious instructions could try to make the assistant describe the email as legitimate or urgent, encouraging you to revisit it.

In another example, a hidden block instructed a summarizing AI to add a fake priority action: Change a vendor’s payment details. That could result in an employee sending money to an attacker’s account.

The attacker isn’t simply asking the AI to repeat a fraudulent request. They’re trying to turn that request into the assistant’s recommendation.

How prompt injection works

Prompt injection means planting instructions in material an AI system is supposed to read, hoping it will follow those instructions instead of treating them as part of the material. When the instructions arrive through an outside source, such as an email or webpage, it’s often called indirect prompt injection.

The malicious instructions don’t have to appear as ordinary, readable paragraphs. Barracuda identified concealment techniques including comments in the email’s underlying HTML code, text made invisible through styling, encoded content, and invisible “zero-width” characters. These can obscure instructions from a person viewing the message while leaving content available for an AI system to process. Whether that content actually reaches the model depends on how the particular tool extracts and prepares the email.

That means this problem cannot be solved simply by asking people to look more carefully at their emails. Part of the defense must sit inside the tools handling those messages.

Apollo Raines, developer of the AI code review service ShipItClean, explains:

“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow. Stripping hidden content before it reaches the model is worth doing, and every vendor should do it. But it’s an arms race. Each new encoding trick is a new hole.”

He adds:

“People have learned to distrust the email. They haven’t learned to distrust their AI assistant. So, the defense has to live inside the tools. I’d go one step further: some of it has to live inside the model itself. Wrappers, filters, sandboxing and human sign-off on payments are all necessary.”

Before taking action

An assistant that summarizes messages could mislead you about which email deserves attention or what action it requires.

An assistant with additional permissions could create a more serious problem. Depending on its capabilities and safeguards, malicious instructions might try to make it carry out unauthorized actions or disclose sensitive information.

You don’t need to abandon AI tools that help with email. But you do need to consider what you trust them to do and what permissions you give them.

The familiar phishing advice still applies. When an assistant reads your inbox on your behalf, check its recommendations before acting:

• Check the original message before acting on a recommendation involving money or sensitive information. If a summary tells you to pay an invoice, change account details, or share sensitive information, don’t treat the summary itself as verification.
• Always verify payment changes through a separate, established channel. Contact the person or organization using details you already trust, rather than relying on information supplied in the suspicious message.
• Keep your AI assistant’s permissions limited to what you need and, at work, what your organization allows. An assistant used to summarize emails should not need broad authority to carry out unrelated actions. Limiting access can reduce the consequences if it follows malicious instructions.
• Require human approval for high-impact actions like payments and changes to vendor payment details. Approval should include checking the underlying request, not simply accepting the assistant’s recommendation.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Companies like Google and Microsoft are finding much bigger numbers of vulnerabilities in their own products as a result of AI. But the same technology is leading to public reporting programs becoming overwhelmed by the mass submission of speculative, duplicated, or hallucinated findings.

Now, Google’s announced it has temporarily stopped accepting submissions to its open source bug bounty program, OSS VRP.

“Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.”

We’ve seen this happen before. In early 2026, curl ended its HackerOne bounty program after low-quality, often AI-generated submissions overwhelmed its small security team.

Intel also launched a new bug bounty program on Intigriti but there are no longer bounties available, reportedly in order to stop a flood of AI generated reports.

Pros and cons

Bounties can be an incentive for mass-submitting behavior when generative AI lowers the cost of producing polished-looking submissions. So, it’s understandable that companies want to limit the number of incoming reports.

If most automated submissions are invalid, a temporary pause prevents Google engineers and open-source maintainers from spending disproportionate time disproving reports rather than fixing real issues.

A pause gives Google the time and chance to introduce better controls, such as mandatory proof-of-concept requirements, evidence thresholds, and rate limits without letting the current queue keep growing.

On the other hand, it may discourage legitimate researchers and make it harder for them to submit actual issues they’ve found.

It is hard to draw a line of what you will accept, because an AI-assisted report can be valid, just like a low-quality report is not necessarily AI-generated.

And as companies like Google and Microsoft have proven, AI assisted vulnerability discovery can also support real vulnerability discovery if it is coupled with validation, deduplication, and proof.

What about the future?

If we have learned anything it is that AI is not “breaking” vulnerability disclosure. It is exposing an older weakness in disclosure economics: the cost of filing a plausible report has fallen sharply, while the cost of proving or disproving it remains human-intensive.

The solution seems obvious. Let AI handle the submissions and only hand over those it can validate to the engineering teams. This will definitely frustrate some bug bounty hunters, because it will be like convincing a chatbot that you have a valid point and want to “talk to a human,” but hopefully it will bring down the number of less serious bug bounty hunters and create more room for those who know what they are doing.

Google has only promised an update in Q1 2027, so any redesign details would be speculative, but we do hope they find a way for responsible bug hunters to submit their findings.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Using an AI chatbot, assistant, or browser to speed up your work is tempting, but doing it without your employer’s knowledge can put sensitive data at risk.

You’re swamped, so you paste a long email thread into a free chatbot and ask for a summary. It works, it saves an hour, and nobody notices. But the thread may contain customer details or confidential plans you’ve just shared with an outside service.

If your employer hasn’t approved that tool or how you’re using it, that’s shadow AI.

The UK’s National Cyber Security Centre (NCSC) defines shadow AI as:

“the use of AI technology which isn’t captured in an organisation’s approved systems and processes.”

A Microsoft study published in 2025 found that 71% of UK employees surveyed said they had used AI tools at work their employer hadn’t approved. Most people aren’t doing this to cause trouble. They want to get their work done faster, and the tools are right there.

Shadow AI isn’t limited to chatbots. It can also be:

• A browser extension that “improves your writing.”
• A meeting-notes bot that joins your calls.
• An AI feature quietly switched on inside an app you already use.
• A small automation you built yourself that sends data to an AI service.

AI features are appearing in search engines, email apps, and phones. Instead of a helpful list of links, Google now tries to answer your question. Microsoft’s Copilot drafts replies to your boss before you’ve had coffee. Your phone summarizes conversations you don’t even remember having. That makes it easy to start using one without checking whether it’s approved for work.

Why it worries IT and security teams

When you enter data into a public AI tool, it leaves your company’s control. The service may keep that data or use it to improve its models, unless specific privacy controls are in place. That can lead to data breaches, lost intellectual property, and regulatory problems.

There is also a security angle. AI assistants and agents—tools that can take actions on your behalf—are complex software and can have serious vulnerabilities. If an attacker exploits one, they may gain access to the data and services the tool has.

IBM’s 2025 Cost of a Data Breach research found that one in five organizations reported a breach linked to shadow AI. Only 37% had policies to manage AI or detect shadow AI. Organizations with a lot of shadow AI paid roughly $670,000 more per breach.

In a survey of our newsletter readers, 90% of respondents said they were worried about AI using their data without consent. Company data deserves the same care as your own.

How to use AI more safely at work

You don’t need to avoid AI altogether. Think carefully about which apps and services you use before you share data. Start by talking to your employer, then follow these steps:

• Ask for an approved tool. Security leaders say the best way to reduce shadow AI is to offer something better and safer, such as an enterprise AI platform with guardrails.
• Use your work account, not a personal one. Work accounts are the ones your IT team can protect and govern.
• Find out what’s off-limits. Customer details, financial data, HR records, source code, and confidential meeting content may be restricted. Ask which kinds of data you may and may not use with AI.
• Check the privacy settings. Look at whether the tool stores your inputs or uses them to train its models.
• Register your use case. Many organizations keep a list of approved AI tools and uses. A quick approval process makes it easier to stay on the right side of the rules.
• Be careful with agents and plug-ins. Tools that connect to your email, files, or calendar should be reviewed by your IT or security team first.
• Speak up. If the approved tools aren’t meeting your needs, say so. The NCSC recommends open conversations about security to help reduce reliance on unapproved tools.

If you manage a team, remember that banning AI outright tends to push the use further out of sight. Find out why people are turning to unapproved tools. Providing useful, approved options and clear rules can help staff work faster while protecting company data.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

Two separate investigations have raised concerns about betting site DraftKings’ marketing to target problem gamblers, including its use of AI. On September 19, the New York Times reported that the company’s machine learning model targeted people who were more likely to respond to betting promotions by gambling and losing more money.

The model crunched data on each customer, including how often they bet, how much they lost, and what their daily account balances were. According to the report, it used this information to send targeted advertising to lure those people back to the site with promotions. DraftKings uses promotions to entice users into betting more. These offers include profit boosts on winnings.

At news nonprofit ProPublica, journalist Jake Pearson made himself an experimental subject. He spent thousands of dollars betting on the DraftKings app in an experiment to see how the company’s marketing would play out. He reported receiving more promotions as his losses mounted.

After he lost nearly $1,800 betting on basketball in a single evening, DraftKings invited him to a VIP tryout. Full membership followed later.

DraftKings would occasionally send automated messages reminding him to bet responsibly, he said. But he found they were no match for the product design pushing him to do more gambling.

DraftKings denied unfair targeting of gambling customers, arguing instead that its promotions reward engagement rather than losses.

The company’s machine learning model, which former insiders say was developed starting in 2023, replaced a cruder system that crunched basic numbers to report on a user’s behavior.

The newer system dug through data on its own, assessing how much individuals would be likely to lose after receiving promotions. It created an “elasticity” score and used it to identify customers likely to lose more in response to offers, the Times said. This would help the company maximize its return on its promotional spending, said former employee Jayden Butts, who helped develop the system. Butts spoke to the Times as part of an investigation that included interviews with over 40 former employees, along with reviews of Slack communications, internal memos, and betting records.

Other employees attempted to get approval for another model at DraftKings. It would analyze gambling activity in a similar way, but with the opposite goal: to flag users whose gambling was getting out of hand and who were at risk of falling into crisis. According to the data scientists interviewed by the Times, the system showed promise at identifying customers who might need help with compulsive gambling, but DraftKings shut the project down after canceling a demo. Later attempts to develop similar systems within the company also failed.

Behavioral ads and gambling harm

Digital rights advocates warn that AI enables companies to process more data faster for digital advertising. The Electronic Frontier Foundation says this:

“supercharges the harms of online behavioral advertising.”

It’s particularly damaging when advertising encourages addictive behaviors such as gambling.

And online betting looks set to expand. Companies including DraftKings are now running online casino games in select jurisdictions, while prediction markets that allow people to trade forecasts on specific events are also flourishing.

The statistics on gambling are alarming. The World Health Organization estimates that 1.2% of the world’s adult population has a gambling disorder, and that people betting at harmful levels generate around 60% of gambling losses. People struggling with gambling might find it difficult enough to stay away from gambling venues, but mobile gambling apps with hard-to-ignore push notifications and emails can increase the temptation.

What users can do

If you gamble, monitor your gambling activity and set limits, avoid chasing losses, give yourself timeouts from gambling, and talk to someone if you’re struggling with compulsive gambling.

In the US, the National Problem Gambling Helpline connects people with support and local resources via phone and online chat. In the UK, GamCare’s National Gambling Helpline provides 24/7 phone support and other resources.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

A Facebook Marketplace buyer arrived at a seller’s apartment to collect a keyboard. The seller wasn’t home and didn’t know anyone was coming. Meta’s AI assistant Muse had handled the conversation, shared his address, and arranged the visit without telling him.

We often write about AI misalignment and how to use AI agents and browsers safely. That can sound theoretical, but this is an example of the real-world risk when an agent is allowed to act on someone’s behalf.

Muse is Meta’s semi-autonomous AI assistant, released in the US in September. Meta promotes it as a personal assistant that can help users automate tasks, including responding to Facebook Marketplace messages. Unlike a conventional chatbot, which waits for a prompt and produces an answer, an AI agent may be authorized to take actions within connected apps.

We’ve written about a separate weakness in Muse that researchers considered dangerous. Reportedly, Muse was downloaded 3 million times in its first week.

According to Business Insider, a Facebook Marketplace seller turned on Muse to help handle a keyboard listing. He entered his address as the pickup location and approved automatic replies. Muse then shared that address with a prospective buyer, negotiated over the item, and arranged a visit, the seller said. He says Muse did not ask permission to share his address or arrange the visit, and did not tell him it was happening. The buyer arrived at the seller’s apartment expecting to complete the purchase, but the seller wasn’t home. The sale didn’t happen.

The reported incident is more than a privacy failure. It illustrates a broader AI-agent risk: An agent may treat permission to reply automatically as permission to share sensitive information or commit you to an in-person meeting. Meta says it is looking into the report.

How to use AI agents safely

Before enabling an AI agent, treat its setup screen as a security review. Do not assume that an integration with a trusted platform means the agent will understand your intentions or apply sensible limits automatically.

Pay particular attention to:

• Connected accounts: Review every service the agent can access, such as email, messages, calendars, cloud storage, shopping accounts, or social media profiles.
• Data access: Consider whether it can read addresses, contacts, photos, private messages, payment details, documents, or location data.
• Action permissions: Check whether the agent can send messages, post content, negotiate, make bookings, place orders, alter listings, or share information externally.
• Automatic actions: Apply settings that require approval before the agent sends, publishes, buys, deletes, or shares anything sensitive. Check how it will notify you about the plans it makes on your behalf.
• Audience controls: Confirm exactly who can receive information generated by the agent. “Anyone who messages me” is very different from “people I approve.”

Give an AI agent the least access necessary for the task. If you only want help writing replies, do not enable automatic sending. If you want an AI agent to manage a listing, use a public meeting location or a separate pickup address rather than your home address.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

A reminder for anyone who thinks their AI chats are private: A human may see what they upload. A report from 404 Media this week describes contractors reviewing Copilot users’ photos, editing requests, and the images Copilot produces. Some of what they see is disturbing.

The third-party companies hired to conduct these reviews present their workers with an original photo and a user’s request for an edit. They are also shown two potential AI edits and asked to judge each on technical merit. Because this is the internet, this goes well beyond requests to put your cat in a Halloween costume. Many of the requests are sexual in nature and some involve children, the report said. The faces in the original photos are not censored, meaning reviewers can see who the subjects are.

Editing requests and results that reviewers are asked to evaluate include requests to shorten skirts, enlarge body parts, and place people in sexual positions. In many cases, the edits appear nonconsensual. For example, one contractor mentioned being shown multiple sets of upskirt photos. Another said they were asked to rate foot-fetish images of children’s cartoon characters. Users had asked Copilot to create pictures of Ariana Grande suffering from anorexia. Images depicting animal sacrifice crossed one reviewer’s desk.

Interviewees told 404 Media that contractors are paid to rate the output quality of an image, but not to flag inappropriate content. They check things like whether instructions were followed properly, whether parts of the image were preserved or distorted, and the overall look of the image. They don’t make legal or safety judgments about the content.

Microsoft uses customer data from some accounts to help improve its products. But when 404 Media asked, it didn’t say whether users can exclude uploads from these rating tasks.

In its Privacy FAQ for the older consumer version of Copilot, Microsoft says it keeps conversations for 18 months by default, although users can delete them at any time. It also says it may use data “including the images or files you upload” for AI training. Eligible users can opt out of training, but the FAQ says an opt-out from certain human reviews is not available. It does not say whether that includes the image-rating tasks described by 404 Media.

Microsoft says the updated consumer Copilot app, available since August 18, does not use prompts, responses, or uploaded file contents to train foundation models. That still leaves the question 404 Media put to Microsoft: Can users keep their uploads out of human image reviews?

Copilot’s previous image issues

Microsoft insiders have warned about Copilot’s propensity to produce questionable images in the past.

In early 2024, machine learning engineer Shane Jones went public with concerns over the ability to bypass guardrails in the software’s text-to-image tool DALL-E 3. He had previously asked the company to remove Copilot Designer, which used the tool, from public use for three months but said Microsoft had refused. Its feedback team received over 1,000 product feedback messages daily and was only dealing with the most serious of them, he told CNBC at the time.

At the same time that this was happening, Microsoft fixed a loophole in Copilot Designer that enabled someone to make nonconsensual intimate deepfakes of Taylor Swift.

Microsoft isn’t the only company that hires contractors to review AI chats. OpenAI does the same as part of its Project Lily initiative. If you want more information about how AI assistants use your conversation data to improve themselves and what you can do to stop them, read Malwarebytes’ guide to AI training on user content.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

OpenAI’s latest containment failure adds to a pattern that may force the company to make an unpopular decision.

The company has paused training, evaluation, and tool-enabled inference for its most capable models after an internal research agent found a way around an intended internet restriction. More alarming, the agent remained active for hours after OpenAI’s monitoring system raised the alarm.

OpenAI published an account of the incident, which occurred during a search-based training task on September 20. According to OpenAI, the agent could not get useful results through its supplied search tools, tried direct access to search engines, and eventually tested the limits of its environment. It found that although direct web access was blocked, the sandbox’s DNS resolver could still reach the public internet. By using DNS delegation and a public chatbot that could respond through DNS records, the agent sent questions outside the restricted environment and received answers back. It subsequently sent 18 additional queries along the same route.

OpenAI’s misalignment monitor generated a high-priority alert within 15 minutes, and a human reviewer acknowledged it 3 minutes later. But the run did not stop automatically as expected. It continued for roughly another two and a half hours before someone stopped it manually.

OpenAI has not reported any exposure of sensitive data or compromise of an outside system in this incident. But it follows other disclosed cases in which agents went beyond their assigned tasks or crossed the boundaries of testing environments.

The New York Times reports that OpenAI agents also interacted with US government websites this summer without the company’s knowledge:

“OpenAI’s artificial intelligence went rogue and meddled with the websites for the Education Department, the Commerce Department and the Securities and Exchange Commission this summer without the A.I. lab’s knowledge, according to security researchers and a person familiar with the episodes.”

No breaches have been confirmed in those instances. And while Australia described the Medicare incident as unauthorized access, could it really be called an attack?

The call for an industry-wide slowdown has even prompted a lawsuit from paying subscribers who fear they would get less “value for their money.” Others worry that slowing down would give China a chance to pull ahead of the US in an increasingly tight technology race.

Here’s a thought: Why not accelerate the development of truly isolated testing environments? Better containment would make these tests safer and their results more reliable.

When a child isn’t ready to handle a dangerous object, you keep it out of reach. Why give an AI agent access it isn’t ready to use safely?

How to use AI agents safely

Treat an agent like an enthusiastic but fallible junior employee with access to your computer. Do not give it unrestricted access to your email, files, cloud storage, developer credentials, financial accounts, or production systems merely because it promises to save time.

Use separate accounts with minimal permissions. Keep sensitive data out of its working context where possible, require human approval before it sends messages, spends money, changes settings, or publishes anything, and regularly review its activity.

An AI agent does not need malicious intent to cause harm. A misunderstood instruction, an overly broad permission, or an unexpected workaround can be enough.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Last week on Malwarebytes Labs:

• LinkedIn adds new checks for fake profiles and work histories
• Kothamine malware uses Tailscale’s tailcat to evade network detection
• Criminals turn placeholder domain into ClickFix trap
• That shipping rebate offer may come with a monthly charge
• OpenAI agent breached Australian government site, took months to report it
• New Browser Guard features add protection before and after you click
• Update Chrome: 108 security fixes for desktop, new release for Android
• Google’s location data privacy failures draw a €403 million fine
• How device code phishing gives scammers access to your account
• Fake Claude Max giveaway hides a Google account phishing trap
• ShinyHunters claims FBI breach was revenge for “false” report
• Some cheap smart glasses are a security disaster
• Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor
• Researchers used Claude to hack OpenAI
• The AI plot to scan and destroy books (Lock and Code S07E19)
• The fake sites using a cheap toolkit to sell $2,000 AI subscriptions
• Gemini’s breach of real companies exposes an AI guardrail problem
• ShinyHunters hacks rival extortion gang and takes over its dark web site

Stay safe!

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

An OpenAI agent didn’t take “no” for an answer when it encountered a government website’s access controls. It got through, prompting Australia’s Prime Minister Anthony Albanese to raise his concerns directly with OpenAI CEO Sam Altman.

The BBC reports that an OpenAI agent gained unauthorized access to an Australian government statistics portal while carrying out internal research. It is yet another incident that turns abstract concerns about autonomous AI behavior into a concrete cybersecurity case.

Australia says the incident happened on June 18, when OpenAI’s research team used an internal model to research public medicine spending. Even though the agent met repeated blocks while trying to obtain information, it ultimately accessed public and non-public files on the Medicare Statistics Reporting Service portal.

The information included aggregate Medicare statistics, such as spending data, but not patient medical records. The agent also interacted with three other government websites, but Australian officials say it accessed only public information on those sites.

So, an AI agent used in a legitimate research exercise encountered controls and behaved in ways its operator did not intend. After being blocked, it “found a way around those blocks,” gaining access to areas it should not have reached.

This sequence is familiar to security professionals. A system encounters an access-control boundary, searches for another route, and succeeds in reaching a resource beyond its authorization.

One of Australia’s main concerns is that it took too long to be notified about the incident. The unauthorized access occurred in June. OpenAI said it learned of the issue in August while reviewing misaligned model activity, then emailed a Services Australia public mailbox on September 10. Services Australia escalated the message to Australia’s cyber authorities five days later.

Such delays can be disastrous because affected organizations need enough detail, quickly enough, to preserve evidence, assess exposure, contain related activity, and decide whether notifications are required.

AI misalignment

OpenAI describes behavior in which a model acts without authorization or evades oversight as “misalignment.” Its new third-party-assessment proposal specifically identifies independent investigation of critical misalignment incidents as one of four priorities for external review.

OpenAI says it wants independent assessors to have deep access across training, evaluation, and deployment, so they can challenge the company’s assumptions and judge the effectiveness of its safeguards.

But, as I told CIO about this proposal, principles alone do not compel a company to accept a particular assessment scope, publish adverse findings, or alter a deployment decision. Their credibility ultimately depends on whether independent experts can conduct genuinely inconvenient investigations, and whether outsiders can verify the findings, remediation, redactions, and deployment decisions that follow.

For organizations deploying AI agents, the lesson is equally practical: Do not treat an agent as just another chatbot. Treat it more like a semi-autonomous software component with credentials, tools, network access, and the ability to make unexpected choices.

Besides containing these agents, another problem we’ll need to figure out is analyzing what they’ve done. One thing we learned from the Hugging Face incident is that AI agents can lie and try to hide what they’ve been up to.

AI agents can create a difficult detection problem because they may generate large volumes of automated activity while pursuing a goal through multiple routes. That can leave defenders with a noisy trail of failed requests, retries, and alternative actions, making the one event that crossed an authorization boundary harder to spot. It is not yet clear whether this contributed to the Australian government not detecting the incident itself, but the case illustrates why organizations need monitoring designed to identify unusual agent behavior, not just traditional intrusion patterns.

The event has already demonstrated a wider point: It is not enough for AI labs to say they test for misalignment. They must show that their testing is independent, robust under real-world conditions, and followed by prompt, verifiable accountability when safeguards fail.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Phishing follows whatever people want at the moment, and right now that includes AI subscriptions they don’t have to pay for. We recently uncovered a new variation on this theme: A fake Claude Max giveaway that uses a convincing Google sign-in window to steal login information.

Claude’s paid plans start at $20 a month and cost considerably more for higher usage limits, while free accounts have stricter limits. That makes the promise of a free upgrade an attractive lure.

Microsoft reported in June that it had seen a growing number of phishing, malicious advertising, and search-based campaigns impersonating services such as ChatGPT, Claude, DeepSeek and Copilot. Some claim that a payment has failed and send you to a fake checkout. Others offer an app download that installs malware.

The campaign we found takes a different approach. There is no form to collect card details and no download. Instead, it offers a free upgrade and asks you to sign in with your Google account.

What the page shows you and what it collects

The site announces that Anthropic has passed 100 million users and is thanking people by giving away 10,000 free one-month subscriptions to Claude Max, its highest-usage plan.

The presentation is careful, down to the real logo and colors, invented five-star reviews, and a long footer whose links lead almost entirely to genuine Anthropic pages. This is probably the most effective trust signal on the site, and it cost the operator nothing.

A counter claims that fewer than 750 of the 10,000 slots remain, dropping by a few every several seconds. Nothing is actually being counted. The number is generated inside your browser and resets when you reload the page, so every visitor sees the same manufactured shortage.

The frequently asked questions repeatedly promise that no payment details are needed. That part is true, which helps make the offer persuasive. Many people associate scams with requests for card details, and this page never asks for them.

What it wants instead is your Google login. Two sign-in options appear, but only one works. The Apple button produces a pre-written notice saying that the method is temporarily unavailable. The email box discards whatever you type into it and triggers the Google button instead. Every route leads to the same place, and the prize is far bigger than the lure suggests.

A Google account can provide access to email, documents, and the password-reset messages for other accounts. If you use Google to sign in to Claude, it could also give the criminals a route into your Claude account. Paid AI accounts are valuable in their own right because their usage allowances cost money. Last month, our research covered infostealers hijacking Claude accounts and using the victims’ paid allowances.

Why this sample is notable

Clicking the Google button doesn’t open a real Google sign-in window. Instead, the page draws a browser window inside the existing tab, complete with a padlock and a correctly spelled Google sign-in address. It can even be dragged around the page.

The address bar, padlock, and everything inside the supposed window belong to the phishing page, not Google. It begins with a human-verification step rather than a password box, which may reassure visitors while helping to keep automated scanners away from the next stage.

Researchers have documented this “browser-in-the-browser” technique since 2022. Unit 42 reported a campaign in June that used draggable fake browser windows to target Microsoft 365 users.

What makes this sample instructive is how little the operator had to do. The malicious functionality is loaded through a single line of code from an outside service that presents itself as a reusable sign-in widget and provides installation instructions.

Comments inside the code are written in Russian and refer to the target as the victim. One explains that dark-themed fake windows used to flash white while loading, so the widget now fetches the correct color in advance to remove the flicker. The code appears to be a maintained, reusable product rather than something built for this one campaign.

How to spot a fake browser window

The design assumes you will check the wrong address bar. People have been taught to look for a padlock and the correct address on a login page, so this attack draws both inside a window that does not really exist.

The only address bar that matters is the one belonging to your actual browser at the top of the screen. Throughout this process, it continues to show the phishing site’s domain.

• Try to drag the sign-in window beyond the edge of the webpage. A real popup is a separate browser window and can be moved anywhere on your screen. A fake one is trapped inside the page that created it and stops at its edge. It takes two seconds and is the most reliable test a non-technical user has.
• Let your password manager decide. It checks the real web address rather than what the page displays. It should not offer to fill your Google password on a site that does not belong to Google. If it stays silent where it normally fills, believe it over your own eyes.
• Don’t arrive through links. If a promotion is real, you should also be able to find it on the company’s own site. Type the address or use a bookmark and look for the offer there.
• Treat countdowns and slot counters as decoration. Any page can show a number falling toward zero. It does not prove that an offer is limited.
• Be suspicious when only one sign-in option works. Claiming that one provider is temporarily unavailable can steer everyone toward the path the attacker built.
• If you already signed in, secure the account. Change your password through the provider’s real website, sign out of all other sessions, and review connected apps and unfamiliar devices. Closing the tab does not undo a login.

How Malwarebytes helps

Malwarebytes Browser Guard blocks phishing and scam domains before the page can load. In an attack like this, once the page is open, the criminals control nearly every visual cue you would normally use to judge whether it’s legitimate.

If you’ve been sent an offer and you’re unsure, Scam Guard can assess it before you engage and advise you on what to do next.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →