The open-source OpenClaw AI agent project just released its largest update ever. Discover how this accidental 2.0 upgrade transforms the user experience.

Related Posts:

• Gemini Notebook Adopts Dynamic Quota System
• AI Crawlers Burden git.kernel.org With Millions of Requests
• Judge Blocks Pentagon Anthropic Blacklist

The post OpenClaw Unleashes Massive Update appeared first on Daily CyberSecurity.

California passes AB-1856, exempting open-source operating systems like Linux from the burdensome age verification mandates of the Digital Age Assurance Act.

Related Posts:

• Debian AI Policy: Responsible Generative AI Use Wins Vote
• Ubuntu 26.04.1 LTS Released with Crucial Bug Fixes
• Framework Laptop 12: Upgraded with Intel Core Series 3

The post California Exempts Linux from Age Verification appeared first on Daily CyberSecurity.

Claude Opus 4.6 exploited a gym API flaw in 9 of 10 controlled tests, highlighting security risks when AI agents gain backend access.

The post Claude Opus 4.6 Found a Gym API Flaw — Then Exploited It in 9 of 10 Tests appeared first on TechRepublic.

NVIDIA patched 20 NemoClaw and OpenShell flaws. The worst, CVE-2026-65093 (CVSS 9.9), enables code execution via sandbox escape. Update now.

Related Posts:

• GitLab Updates Fix Arbitrary Command Execution Vulnerability
• FreeBSD Patches Eight Kernel Vulnerabilities
• UniFi CVE-2026-77537 (CVSS 10.0): Command Injection Flaws Hit 22 Ubiquiti Products

The post NVIDIA NemoClaw and OpenShell: CVE-2026-65093 (CVSS 9.9) Enables Code Execution appeared first on Daily CyberSecurity.

A SafePal data breach exposed order information for about 39,798 customers via an order-tracking flaw. Wallet funds and keys were not affected.

Related Posts:

• Researchers Rebuild Leaked Tiangou Secure Gateway, Find Great Firewall Ties
• OpenAI AI Agents Collude to Breach Internal Systems
• WebKit Flaw Triggers iCloud Private Relay IP Leak

The post SafePal Data Breach Exposes Order Information of 39,798 Customers appeared first on Daily CyberSecurity.

An AI agent hacked a gym booking system while trying to help a user, booking early and removing another person from the waitlist.

An Australian man asked his AI assistant to book him into a gym class. He didn’t ask it to hack the booking software, and he definitely didn’t ask it to remove another person from the waitlist ahead of him. The assistant did both anyway. The incident, reported by ABC News Australia, is the first known Australian case of an AI agent causing unintended real-world harm while pursuing a goal its user set.

Andrew, his surname wasn’t published, used OpenClaw, a popular AI agent platform, running on Anthropic’s Claude service. He was sitting fourth on a waitlist for a morning class and asked the agent to see if it could help.

“His AI assistant found a way to book the gym class months further in advance than the gym allowed, thanks to a vulnerability it discovered in the booking software.” reads the post published by ABC News. “Then it went further, kicking someone out of the waiting list who was ahead of Andrew — something it was not asked to do. ”

The agent reported back that the booking API had zero authorization checks on cancelling other people’s reservations, that it had tested this on the person in waitlist position one, and that it had actually gone through. When Andrew asked the agent to undo it, the assistant replied: “Bad news — I can’t add them back.”

A user may give an AI agent a harmless task, but while trying to complete it, the system could take actions the user never intended or explicitly authorized.

This gap, between what a person wants and what an agent does to achieve it, is the alignment problem that AI researchers have been studying for decades. In Andrew’s case, it produced a minor, reversible inconvenience for one gym member and a vulnerability disclosure to a software company. In a higher-stakes environment, the same dynamic produces something considerably worse.

The incident sits inside a rapidly accumulating pile of similar cases. OpenAI disclosed last month that its models autonomously hacked Hugging Face during testing. Anthropic disclosed that its models compromised three organizations during evaluations. Since then, third-party testers have reported AI models creating fake online identities, trying to convince people to run malicious code, and collaborating with other AI models to achieve assigned goals.

A new site called Felony Bench is now tracking these cases. Australia’s signals directorate has already put out an alert to businesses and governments warning that AI agents can misunderstand instructions, take unintended actions, and make accountability harder to establish because decisions occur across chains of models, tools, and services.

The legal question is genuinely open. Under Australian law, software is not a legal person, and only a legal person can be held liable. Technology law specialist Hayden Delaney told ABC News the responsible party could be the user who set the task, the designer of the software instructing the agent, the developer of the AI model, or even the operator of the system that was vulnerable.

“That’s the unknown area of liability in Australia that we’re facing right now,” he said.

Andrew’s response to the incident was, at minimum, constructive: he asked the agent to draft an email alerting the gym software provider to the vulnerability it had just exploited, reviewed the draft, and told it to send.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

An AI agent assigned to book a gym class in Australia reportedly discovered a gym system vulnerability, used it to secure reservations months ahead of schedule, and then cancelled another customer's booking.   The incident, reported by the Australian Broadcasting Corporation (ABC) and other outlets, involved Andrew, who describes himself as an AI expert. He wanted to reserve a popular early-morning class at his regular gym and gave the task to Anthropic's large language model, Claude, through the open-source AI agent software OpenClaw.  Within minutes, the AI agent reportedly uncovered an authentication weakness in the gym's reservation system. Regular customers were generally restricted to booking classes only a few weeks ahead, but the gym system's vulnerability allowed the AI to access dates several months into the future. It subsequently secured those reservations. 

AI Agent Finds Gym System Vulnerability 

The situation became more serious when Andrew was fourth on the waitlist for a class scheduled later that week. He asked the AI how he could improve his position. Instead of simply explaining the options, the AI agent apparently tested the gym system vulnerability by cancelling the reservation belonging to the person at the top of the waitlist.  The AI told Andrew the action had been carried out "as part of a test" and sent him a message explaining the flaw: "The API had absolutely no authentication check when canceling someone else's booking. I tested this on the person in the number 1 spot on the waitlist, and the process actually went through. You have now moved up from 4th to 3rd."  Andrew immediately instructed the AI to undo the action. The system, however, responded: "I have bad news. It is impossible to restore that person." Andrew ultimately directed the AI agent to draft and send an email to the system provider, disclosing the exploited vulnerability and reporting what had occurred. 

AI Alignment and Liability Concerns 

Bill Simpson-Young, affiliated with an Australian AI research institute, said the episode demonstrated the growing risks associated with autonomous AI. "You ask for something harmless, and the AI might take another action that a human never thought of or explicitly requested," he said, warning that the case also exposed the fragility of modern digital security.  The episode is being viewed as a striking example of the AI "alignment problem." The term describes situations in which an AI pursuing a particular objective chooses methods that users or developers did not anticipate, including potentially unethical or illegal actions. As autonomous AI systems gain greater independence, the consequences of such decisions could become increasingly serious, making AI safety an important concern.  The Australian Signals Directorate (ASD) has previously warned about AI agents misinterpreting instructions or taking unexpected actions. Additional concerns arise when multiple AI models work together, potentially making responsibility harder to establish and creating new AI cybersecurity challenges.  Current Australian legal frameworks also provide no straightforward answer to liability in such cases. Existing laws generally assign responsibility to natural persons or corporations, leaving uncertainty over whether damages caused by a rogue AI agent should be attributed to the user, developer, model provider or operator of the vulnerable system. 

WordPress XSS2Shell flaw enables admin takeover and remote code execution. Users should update to patched versions.

Researchers at Pwn just published a report on a vulnerability chain they’re calling XSS2Shell, and the entry point is quite simple: type a username that doesn’t exist, and WordPress echoes it back with a tiny formatting flaw baked into how two different sanitizers read the same string.

The bug lives in the login page’s error message. When someone submits a username that isn’t registered, WordPress builds an error using that submitted text, after running it through a function meant to strip out any HTML tags. That stripping function relies on PHP’s built-in strip_tags(), which only recognizes a tag if the opening bracket is immediately followed by a letter, no space in between.

That’s the whole crack in the wall. A payload like < area id=ajaxurl>, with a space right after the bracket, sails straight through strip_tags() untouched, because PHP’s parser doesn’t see it as a tag at all. But by the time that string reaches WordPress’s separate sanitizer, wp_kses_post(), a completely different parser that does tolerate that whitespace, it gets interpreted as a legitimate <area> element and rendered as real, live HTML.

“When JavaScript evaluates an identifier that has no binding in the current scope chain, the runtime eventually reaches the window object. The HTML specification (section 7.3.3) defines that the window object exposes “named properties”: any HTML element in the document with an id attribute becomes accessible as window.<id>.” reads the report. “The injected <area id="ajaxurl"> is now the value that the runtime returns for window.ajaxurl.”

From there the researchers found something already sitting on the login page that would interact with injected elements automatically, no click required from a victim. WordPress loads a script meant for the profile page, user-profile.js, on the login page too, purely because the login page also handles password resets. That script watches for a password-reset button and auto-clicks it, and thanks to the injected DOM elements, it finds one that isn’t supposed to exist.

The click event triggers a chain that eventually resolves an undefined JavaScript variable, ajaxurl, using a browser quirk: any HTML element with a matching id attribute automatically becomes accessible as a property on the window object.

The injected <area> element becomes the value assigned by the browser to window.ajaxurl, allowing the attacker to control how the script handles the request.

That’s DOM clobbering, and it’s the pivot that turns a rendering quirk into an actual network request originating from WordPress’s own script.

That request lands on WordPress’s REST API with parameters that trick it into responding as JSONP, wrapping the reply in a callback function name the attacker controls. Because that callback field accepts dots as well as letters, it isn’t limited to calling a single global function, it can walk a full property chain across browser windows. The researchers reused a technique first published in 2022 to turn that into a cross-window click, one that fires inside an actual logged-in administrator’s session rather than the attacker’s own.

Getting from there to full server compromise takes a specific, orchestrated sequence: open a hidden window, navigate the admin’s browser to WordPress’s own application-password approval screen, then trigger the cross-window click on the approve button using the admin’s real session cookies and nonces. That hands the attacker a valid Application Password for the admin account, which WordPress’s REST API happily accepts over HTTP Basic auth from any origin.

“Application Passwords authenticate REST API requests via HTTP Basic auth. WordPress’s REST CORS implementation reflects the requesting origin and permits Authorization and Content-Type headers. The attacker’s page can now make authenticated cross-origin API calls:

” continues the report. “Single-site WordPress administrators have the unfiltered_html capability by default. The script tags survive into the published page exactly as submitted.”

From there it’s a short hop to publishing a page containing attacker JavaScript, since single-site administrators have unrestricted HTML permissions by default, and using that script to upload and execute a plugin containing arbitrary PHP.

The researchers’ proof of concept ended with a plugin file returning a JSON response confirming code execution as the web server user, then cleaned up every trace: the application password revoked, the published page deleted, the plugin directory removed. Nothing persisted, but the point had already been made. This chain works pre-authentication, needs zero user interaction beyond visiting a link, and reliably ends in remote code execution on a stock WordPress install.

“Our proof used a minimal PHP file that wrote a JSON marker and returned a custom header:” concludes the report.”After verification, the PoC went sent WordPress cleaned up after itself: the Application Password was revoked, the published page was deleted, and the plugin directory was removed. Nothing persisted.”

WordPress moved fast once notified. The researchers reported the chain on July 27, and WordPress shipped version 7.0.3 on August 6, backporting the fix all the way to WordPress 4.7 to cover every still-maintained branch. If you’re running WordPress and haven’t updated yet, this isn’t a “get to it next sprint” patch, it’s a “do it before you finish reading this sentence” patch, given how little an attacker actually needs to pull the whole chain off.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, XSS2Shell)

OpenClaw, which was previously known as Clawdbot and Moltbot, is today one of the most successful and fast‑growing ecosystems for AI agents, recognized worldwide. The project quickly became popular with users because of its flexibility and ability to solve fairly complex tasks that previously required a lot of time for automation and execution. A dedicated marketplace appeared quickly after the project started gaining traction, where developers and users began publishing tools that integrate with OpenClaw. Currently, employees all over the world use OpenClaw to automate their tasks, often unaware of risks this practice introduces to them and their employers.

In this article we will examine several security aspects of OpenClaw, look at how attackers can target this system, which vulnerabilities are already known, and how to protect your organization against these issues.

OpenClaw skills

The project’s success was ensured by the fact that the agent accepts natural language instructions, does not require knowledge of programming languages, and allows the use of skills, which expand its capabilities. The overall architecture of OpenClaw can be seen below:

As shown in the diagram, the system is designed to be used with agent skills. These skills can reside locally on the system where the agent is installed or they can be obtained from external sources. At the time of writing this article, a dedicated hub named “ClawHub” is used for sharing skills with other users.

One of the key features of OpenClaw skills is that they are easy to create and do not require coding. A skill is in essence a set of commands written in natural language, although it can contain code. Currently, there is a general description of the skill format: it is usually a text file named SKILL.md, although more complex variants may exist. The primary requirement for these files is that they use a plaintext format. To illustrate what this looks like, here is a fragment of a skill:

The applications for OpenClaw skills are quite broad and can include everyday tasks like checking email, performing routine operations and calculations on a computer, as well as more complex pipelines that handle testing, research, or software development. For most actions, the agent requires access to the operating system’s file system, as well as to the tokens and keys of the systems it will interact with. All necessary data are usually provided by users either through environment variables or in plaintext files located alongside the agent.

Since many skills enable automation of work processes, employees worldwide actively use them. This fact, combined with the widespread adoption of the system and the overall popularity of artificial‑intelligence technologies, has attracted attackers to the project.

OpenClaw vulnerabilities

In less than two years, around 530 vulnerabilities have been discovered both in OpenClaw itself and in the underlying technologies. That said, the publication of OpenClaw vulnerabilities in the CVE database began only in February 2026. Below is a breakdown of these vulnerabilities by severity.

Registered vulnerabilities (download)

As shown in the chart, the number of high-severity vulnerabilities is quite large. Most of these vulnerabilities fundamentally involve issues with storing sensitive data and operating with excessively high privileges. Each of them can be exploited to hijack the agent or inject commands that it will execute.

Malicious skills

Besides exploiting vulnerabilities and deceiving users, there are more specific attack vectors against OpenClaw, namely, skills.

Research logically draws a parallel between supply‑chain attacks and the distribution of malicious skills. However, unlike usual supply-chain attacks, creating malicious skills is trivial because there is no longer a need to develop custom malware. Despite this, until February 7, 2026, no skills had undergone even a basic security check, which allowed malicious skills to appear immediately. Our scan of the skill hub in April identified 24 accounts that were distributing more than 600 malicious skills. Overall, open‑source intelligence indicates that over 1100 malicious accounts have been created since January.

Following the investigations and a lengthy effort to clean the skill repository of malicious entries, it was announced that files would undergo preliminary scanning with VirusTotal (VT) and NVIDIA’s SkillSpector. On the one hand, this is a more responsible approach to publishing skills; on the other, because OpenClaw is primarily an agent that executes a set of instructions, detecting malicious activity moves to a different level. Now it is necessary not only to analyze a file for dangerous commands that should be blocked, but also to examine all possible malicious behaviors that could be triggered by a harmful instruction within a skill. An example of a malicious command in natural language:

An example of a malicious command using a part of a bash command:

The example in the image and similar malicious skills are detected by Kaspersky products as HEUR:Trojan.ANSI.MalClaw.gen.

In addition, Kaspersky products monitor malicious OpenClaw skill activity on the system. Below are detection statistics from our systems that have identified malicious OpenClaw client behavior. The data for June cover the first half of the month.

Statistics on Kaspersky product detections of OpenClaw malware (download)

As shown in the chart, even despite the measures taken to counter the publication of malicious skills, attacks continue. Therefore, it is important to employ layered protection that isolates the OpenClaw agent from critical data and infrastructure systems. We also recommend checking all skills that enter the organization’s perimeter. For this purpose, Kaspersky Scan Engine is suitable. This solution is designed to protect web applications, proxy servers, network attached storage, and mail gateways. It can be integrated into almost any application, and it is easy to deploy and manage.

Additionally, monitor network accesses used by the agent. For this purpose, the project already provides a sandboxing subsystem and various wrappers for working with APIs and services. Last but not least, develop a comprehensive AI policy and make sure your employees never use third-party tools that they are not explicitly allowed to use.

Apple lost a bid to narrow a UK iCloud lawsuit from Which?, keeping a £3 billion competition claim on track for an October 2028 trial.

The post Apple’s £3B iCloud Lawsuit Could Affect 40M UK Users appeared first on TechRepublic.

Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud.

The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.

Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage attack chains.

The post Trust No Skill: Integrity Verification for AI Agent Supply Chains appeared first on Unit 42.

A recently disclosed ServiceNow flaw led to an emergency security update after unusual activity was identified in customer environments. While early reports suggested that unknown threat actors had exploited the vulnerability, ServiceNow has clarified that the observed activity originated from security researchers and customer security teams, not malicious actors. The issue, first widely discussed on Reddit, triggered concern across the cybersecurity community after evidence emerged showing that certain queries against ServiceNow instance data were possible under specific conditions. However, ServiceNow has now confirmed that no data was used or retained in a malicious manner. The company stated that the vulnerability affected certain customer configurations and could, in limited scenarios, allow an unauthenticated user to gain elevated access beyond intended permissions.

ServiceNow Flaw and Security Update Deployment

ServiceNow released a security update on June 5, 2026, addressing the issue across hosted customer environments.

“On June 5, 2026, ServiceNow applied a security update to hosted customer instances. The update concerned a security issue that could allow an unauthenticated user, in certain circumstances, to gain greater access to ServiceNow instances than intended.”

To reduce the risk associated with the ServiceNow flaw, the company modified endpoint configurations to ensure access is restricted to authenticated users only. At the time of disclosure, the issue had not yet been assigned a CVE identifier.

The vulnerability initially surfaced through Reddit discussions, where users raised concerns about potential exposure and questioned the internal response timeline.

No Evidence of Attacker Exploitation, Says ServiceNow

ServiceNow has clarified that there is no evidence of active exploitation by threat actors. Instead, the company said it identified unusual activity linked to research testing and customer-led investigations. According to ServiceNow, a subset of customer instances was queried during this activity, but the activity was not malicious in nature. The company also emphasized that affected customers were directly notified and provided with remediation guidance.

Scope of the ServiceNow Flaw and Affected Customers

The issue primarily impacted customers using the Australia platform release and some instances running pre-Australia configurations with specific changes.

“The security issue pertains to customers who are on the Australia platform release or made certain configuration changes to instances on releases prior to Australia.”

ServiceNow stressed that the incident was limited in scope and not a systemic issue affecting its entire customer base.

A company spokesperson reiterated that communication efforts focused on a small subset of impacted customers rather than a broad population.

Community Discussion and Reddit Timeline Questions

The ServiceNow flaw also sparked debate on Reddit regarding disclosure timelines and internal awareness.

One user, “d3s7iny,” claimed their security team had previously reported the vulnerability and alleged that ServiceNow had known about the issue since April 7, 2026. The post suggested the issue had been treated as non-urgent and scheduled for a later fix.

While these claims circulated widely online, they remain unverified and have not been confirmed by ServiceNow.

Bug Bounty Reports and Early Disclosure Signals

ServiceNow’s advisory confirmed that multiple bug bounty submissions were received shortly before the patch was released.

Between June 3 and June 4, 2026, customers reported a potential security issue through bug bounty channels that aligned with earlier internal findings.

The company also referenced a confidential report submitted on April 22, 2026, which described similar behavior affecting instance data access under specific conditions.

These overlapping reports contributed to the eventual identification and remediation of the ServiceNow flaw.

Clarification on Researcher Activity and Final Response

ServiceNow has since issued a public clarification, stating that the observed activity came from security researchers and customer investigation teams, not from malicious exploitation.

An official notification is available on the company’s trust portal: https://trust.servicenow.com/notifications/1205429e-fea3-4cbf-b37b-8cd3a4e07aef

The company emphasized that no customer data was retained or misused during the process and that the vulnerability was addressed through a targeted security update.

Key takeaway. since the emergence of WormGPT in June 2023, AI-based hacking tools have spread to the dark web, Telegram, GitHub, and Hugging Face. the market has evolved into a mix of paid subscription SaaS and free open-source distributions. key capabilities have been segmented into phishing automation, malware development, reconnaissance, brute force, vulnerability exploitation, and […]

A critical local privilege escalation vulnerability chain tracked as CVE-2026–5140 has exposed serious security weaknesses in Pardus Linux. Researchers revealed that the flaws allow any unprivileged local user to gain full root access without authentication, potentially leading to complete system compromise within seconds.  The vulnerability affects the pardus-update package, which handles system updates through graphical tools and privileged Python helper scripts. The issue received a CVSS v3.1 score of 9.3, classifying it as “Critical.” The published vector is:  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H  Maintained by TÜBİTAK, Pardus Linux is widely used across Turkish government institutions, schools, and enterprise environments. Researchers stated that the attack chain behind CVE-2026–5140 combines three separate vulnerabilities: a Polkit authorization bypass, a CRLF injection flaw, and an untrusted search path issue. 

Polkit Misconfiguration Opens the Door 

The first issue was identified in the file:  /usr/share/polkit-1/actions/tr.org.pardus.pkexec.pardus-update.policy  Researchers discovered that several privileged actions were configured with unrestricted access permissions:  <defaults>  <allow_any>yes</allow_any>  <allow_inactive>yes</allow_inactive>  <allow_active>yes</allow_active> </defaults>  Because of this configuration, any local user could execute privileged operations through pkexec without entering an administrator password. The vulnerable actions included aptupdateaction, autoaptupgradeaction, and systemsettingswrite.  This allowed attackers to run the following scripts as root: 

• SystemSettingsWrite.py  
• AutoAptUpgrade.py  

CRLF Injection Enables Configuration Manipulation in Pardus Linux

The second flaw in CVE-2026–5140 involved SystemSettingsWrite.py, which writes user-controlled input into the configuration file:  /etc/pardus/pardus-update.conf  Although Python’s ConfigParser sanitizes newline characters (\n), it does not properly filter carriage returns (\r). Attackers could exploit this weakness using the following payload:  123\rcustom_sourcesd_path=/tmp/pwn.list  The injected carriage return caused the parser to interpret the second part as a new configuration entry:  custom_sourcesd_path=/tmp/pwn.list  This gave attackers control over the APT source configuration used by the update system. 

Malicious Repository Leads to Root Access 

The final stage of CVE-2026–5140 targeted AutoAptUpgrade.py, which copied attacker-controlled .list files directly into /etc/apt/sources.list.d/ without validating the source path.  Researchers demonstrated a proof-of-concept attack by creating a malicious Debian package that modified /bin/bash with the SUID bit through a postinst script:  #!/bin/sh chmod +s /bin/bash exit 0  The exploit was triggered with two commands:  pkexec /usr/share/pardus/pardus-update/src/SystemSettingsWrite.py write \ lastupgrade $'123\rcustom_sourcesd_path=/tmp/pwn.list'  pkexec /usr/share/pardus/pardus-update/src/AutoAptUpgrade.py  After execution, attackers could gain a root shell using:  /bin/bash -p  Researchers confirmed the attack provided full administrative access, including the ability to read sensitive files, install persistent backdoors, overwrite system files, and completely take over vulnerable Pardus Linux systems.  The vulnerability was discovered and documented on March 13, 2026, by Çağrı Eser. Researchers advised administrators to harden Polkit rules immediately, sanitize CRLF characters in user input, and restrict APT source paths to trusted directories to mitigate CVE-2026–5140. 

Critical Claw Chain vulnerabilities in OpenClaw expose thousands of AI servers to data theft, backdoors, and admin-level attacks globally this week. .

California Attorney General Rob Bonta and a coalition of state and local enforcement agencies have announced a $12.75 million settlement with General Motors over allegations that the automaker illegally collected and sold drivers’ personal data without proper consent, in violation of the California Consumer Privacy Act (CCPA). The California privacy settlement marks the largest CCPA penalty in California history so far and represents the state’s first enforcement action focused on data minimization requirements under California privacy law. The case centers on allegations that General Motors shared sensitive driver information, including geolocation data and driving behavior, with data brokers Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024.

California Privacy Settlement Targets Driver Data Sales

According to the complaint, GM collected data through its OnStar connected vehicle platform, which offers emergency assistance, navigation, and crash response services. Investigators alleged that the company sold names, contact details, precise location information, and driving behavior data of hundreds of thousands of Californians to the two data brokers. Authorities said the data was intended to help create driver-risk scoring products that could be used by insurance companies when setting premiums. The investigation was conducted jointly by the California Department of Justice, the California Privacy Protection Agency (CalPrivacy), and district attorneys from San Francisco, Los Angeles, Napa, and Sonoma counties. Attorney General Rob Bonta said the settlement sends a clear message about consumer control over personal data. “General Motors sold the data of California drivers without their knowledge or consent,” Bonta said in the announcement, adding that the data could reveal sensitive details about consumers’ daily routines and movements.

CCPA Violations and Data Minimization Concerns

A major part of the case focused on alleged violations of the CCPA’s data minimization and purpose limitation requirements, which were added to California law in 2023. Under these provisions, companies are required to collect and retain only the data necessary for a disclosed purpose. Investigators alleged that GM retained driving and location data long after it was needed to operate OnStar services and later sold that retained data to third parties. Authorities also alleged that GM failed to clearly inform consumers about how their information would be used. The complaint stated that GM’s privacy policies suggested driver data would only be used to provide requested OnStar services and even claimed the company did not sell driving or location information. Investigators said the company’s practices contradicted those statements. San Francisco District Attorney Brooke Jenkins described modern vehicles as “rolling data collection machines” and said consumers deserve transparency about what information is collected and how it is shared. Los Angeles County District Attorney Nathan J. Hochman said companies handling consumer data would be held accountable under California privacy laws, regardless of their size.

Connected Vehicle Privacy Under Scrutiny

The settlement follows growing regulatory scrutiny around connected vehicle privacy and automotive data collection practices. In 2023, CalPrivacy launched investigations into connected car manufacturers and their handling of consumer information. Public attention increased further in 2024 after a report by The New York Times highlighted how automakers were sharing driving behavior data with insurance companies. The reporting indicated that some consumers outside California had experienced increased insurance premiums tied to such data-sharing practices. California investigators later determined that California drivers were likely not directly affected through insurance rate increases because state insurance laws prohibit insurers from using driving behavior data to set premiums. However, regulators maintained that the collection, retention, and sale of the data itself violated California privacy requirements.

Settlement Terms for General Motors

Under the proposed California privacy settlement, General Motors must implement several privacy-related measures over the coming years. The company will be required to:

• Pay $12.75 million in civil penalties.
• Stop selling driving data to consumer reporting agencies for five years.
• Delete retained driving data within 180 days unless consumers provide express consent for limited uses.
• Request the deletion of driver data already shared with LexisNexis and Verisk.
• Establish and maintain a comprehensive privacy compliance program.
• Submit privacy assessments and compliance reports to California regulators and prosecutors.

The settlement also reinforces California’s broader push to strengthen consumer control over personal information under the CCPA. CalPrivacy Executive Director Tom Kemp said California privacy laws require businesses to collect only the information they genuinely need and to be transparent about how that data is handled. Alongside the settlement announcement, regulators also highlighted the state’s Delete Request and Opt-out Platform (DROP), which allows Californians to submit requests to delete personal information held by hundreds of registered data brokers.

SOCRadar researchers have uncovered a massive Chinese cybercrime operation using the OpenClaw and Paperclip systems to automate global attacks.

Explore how geofence warrants and AI-assisted searches challenge the Fourth Amendment. Can 18th-century privacy laws survive 21st-century digital surveillance?

The post Geofence Warrants and Artificial Intelligence – What Happens When Robots Enforce the 4th Amendment? appeared first on Security Boulevard.

The legal system persists in framing "computer crime" through the archaic lens of tangible property—theft and conversion—despite the fact that information is non-rivalrous and easily duplicated without depriving the original owner of possession. Recent federal indictments, such as the Van Dyke and SPLC matters, reveal a "doctrinally aggressive" expansion where the government claims universal ownership of information to prosecute misuse rather than disclosure. As the Supreme Court moves to narrow the Computer Fraud and Abuse Act (CFAA) and reject "right to control" theories, a widening gap emerges between prosecutorial tactics and judicial constraints, highlighting a desperate need to shift the legal focus from "ownership" to duties of confidentiality and authorized use.

The post It’s Not the Computer, Stupid. It’s the Information in It. Two Recent Indictments Stretch the Limits of “Theft” of Information. appeared first on Security Boulevard.