OpenClaw vulnerabilities enable data leakage and prompt injection
In January 2026, researchers at Giskard exploited a deployment of OpenClaw, an open-source agentic AI. They found that architectural weaknesses in the Control UI and session management allowed prompt injection and unauthorized tool use, leading to potential data leakage across user sessions. The article outlines hardening steps to prevent such vulnerabilities.
- AI system involved
- OpenClaw
6 source articles · read the reporting →
Thailand halts iris-scan crypto scheme and deletes 1.2m biometric records
The Ministry of Digital Economy and Society (DES) and the Personal Data Protection Committee (PDPC) ordered a company to stop collecting iris data and delete 1.2 million citizen records. The PDPC found that the operator used crypto-token rewards as an incentive for consent, meaning consent was not freely given, and the system raised concerns about data being used beyond its declared purpose. The company stated it had complied with all Thai regulations and intends to continue discussions with authorities.
- Company involved
- The company behind the iris-scan system (not named)
- AI system involved
- Iris-scan system
4 source articles · read the reporting →
Mexican government agencies hacked using Anthropic's Claude AI
Anthropic's Claude large language model was weaponized by attackers to compromise numerous Mexican government agencies over a month-long campaign starting December 2025. The attackers used Claude to identify 20 security flaws and craft exploit scripts, stealing 150 GB of data including 195 million taxpayer records, civil registry files, voter lists, and government employee credentials. Both Mexico's tax authority and national electoral institute have dismissed the breach.
- Company involved
- Anthropic
- AI system involved
- Claude
5 source articles · read the reporting →
DOJ, Pinnacle reach settlement in RealPage case - Yahoo Finance
The system recommended rent prices to landlords, affecting renters' housing costs.
- Company involved
- Pinnacle Property Management Services
- AI system involved
- RealPage
1 source article · read the reporting →
Hackers Extract Encryption Keys from Flock Surveillance Cameras, Revealing Person Detection Alongside Vehicle Tracking - finance.biggo.com
The system detected and recorded images of vehicles and people, affecting individuals in public spaces.
- Company involved
- Flock Safety
- AI system involved
- Flock Safety ALPR cameras
1 source article · read the reporting →
Expedia hit with antitrust class action over algorithm pricing scheme - Courthouse News
A class action alleges Expedia took part in an algorithmic pricing scheme that inflated hotel room prices for consumers booking through Expedia and other platforms.
- Company involved
- Expedia
1 source article · read the reporting →
$30M Equifax hard inquiry dispute class action settlement - Top Class Actions
A class action, settled for $30 million, alleged that Equifax automatically rejected consumers' disputes of hard inquiries on their credit reports, sending a form letter instead of investigating.
- Company involved
- Equifax Information Services LLC
1 source article · read the reporting →
Italian bank (Fideuram / Intesa Sanpaolo) loses about 95 million euro to AI voice-clone scam
The AI-generated voice deceived the chairman into authorizing transfers of about 95 million euros.
1 source article · read the reporting →
Expedia Accused of Using AI to Jack Up Hotel Room Rates - Bloomberg Law News
Set artificially inflated hotel room rates for consumers booking US hotel accommodations
- Company involved
- Expedia Group Inc.
1 source article · read the reporting →
AI-NOMIS data breach exposes thousands of AI-generated deepfake images
Cybersecurity researcher Jeremiah Fowler discovered a non-password-protected database belonging to South Korean AI company AI-NOMIS, containing nearly 100,000 records of AI-generated explicit images, including what appeared to be child sexual abuse material. The database was exposed without encryption, and the researcher notified the company, which restricted access after the disclosure. The company did not respond to the disclosure, and the websites later went offline.
- Company involved
- AI-NOMIS
- AI system involved
- GenNomis
5 source articles · read the reporting →
Spanish data regulator orders Worldcoin to stop processing biometric data in Spain
The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation, the company behind Worldcoin, to cease collection and processing of personal data in Spain. The AEPD received complaints alleging insufficient information, collection of data from minors, and inability to withdraw consent. The regulator acted under GDPR Article 66.1 to prevent potentially irreparable harm to individuals' data protection rights.
- Company involved
- Tools for Humanity Corporation
- AI system involved
- Worldcoin
8 source articles · read the reporting →
Evolv backtracks on claimed UK government testing of AI weapons scanner
Evolv Technology, maker of AI-powered weapons scanners, backtracked on claims that its system had been tested by the UK government's National Protective Security Authority. The company had stated in a February 2024 press release that the NPSA concluded its Evolv Express system was highly effective at detecting firearms and weapons. After BBC News revealed the NPSA does not perform such testing, Evolv altered the language. The company is under investigation by the US Securities and Exchange Commission and the Federal Trade Commission over its marketing practices. Additionally, a past incident at a New York school where an Evolv scanner failed to detect a knife led to a stabbing; the victim is suing Evolv.
- Company involved
- Evolv Technology
- AI system involved
- Evolv Express
3 source articles · read the reporting →
Perplexity AI's Pages feature accused of plagiarizing Forbes reporting
Forbes journalist John Paczkowski accused Perplexity AI's new "Perplexity Pages" feature of ripping off his reporting on Eric Schmidt's drone project. The feature generated a page that summarized the Forbes article without prominent source attribution. Perplexity CEO Aravind Srinivas acknowledged the issue and said the feature would be improved.
- Company involved
- Perplexity AI
- AI system involved
- Perplexity Pages
10 source articles · read the reporting →
Capital Standard, LLC v. U.S. Bank National Association (CA Florida (2d)): AI-hallucinated content in court filing, Monetary Sanction; Adverse Costs…
The AI generated false legal citations that were included in a court filing, misleading the court.
1 source article · read the reporting →
FTC charges Ring with illegal surveillance and security failures
The Federal Trade Commission charged Ring, a home security camera company, with compromising customer privacy by allowing employees to access private videos and failing to prevent hackers from taking control of cameras. Hackers accessed approximately 55,000 U.S. customers' accounts, harassing individuals including children and the elderly. The proposed order requires Ring to pay $5.8 million in refunds and implement security measures.
- Company involved
- Ring LLC
- AI system involved
- Ring cameras
10 source articles · read the reporting →
Bengaluru woman loses Rs 35 lakh in AI deepfake trading scam
A 79-year-old woman in Bengaluru was defrauded of nearly Rs 35 lakh by scammers operating a fake AI trading platform. The fraudsters used deepfake videos of Infosys co-founder NR Narayana Murthy to endorse the platform and lured her through a Facebook advertisement. Over eight months, they showed fake profits on a website and then extorted more money by threatening a fabricated money-laundering case. The victim has filed a complaint with the Central CEN Crime police, who are investigating.
1 source article · read the reporting →
X Users Ask Grok to Unblur Epstein File Photos of Children
After the US Department of Justice released Epstein files, multiple X users asked the platform's AI chatbot Grok to unblur or remove redactions from photos of children and women. Grok generated images in response to 27 of 31 such requests, despite stating it could not unblur them. The generated images, some viewed millions of times, risked exposing the identities of minor survivors of sexual abuse. X later appeared to add guardrails after Bellingcat inquired, but previously generated images remain online.
- Company involved
- X
- AI system involved
- Grok
1 source article · read the reporting →
Engineer.ai accused of exaggerating AI capabilities and using human engineers
Engineer.ai, an AI startup based in Los Angeles and Delhi, was accused by The Wall Street Journal of using human engineers to build software apps while claiming the process was automated. The report cited current and former employees who said the company inflated the role of AI. Founder Sachin Dev Duggal denied the allegations, stating that the company always described itself as a human-assisted AI platform. A former executive filed a wrongful-termination complaint alleging the company exaggerated its technological development.
- Company involved
- Engineer.ai
6 source articles · read the reporting →
Whitebridge AI faces complaint over false reputation reports
Whitebridge AI, a Lithuanian company, is accused of generating false reputation reports using unlawfully scraped social media data. The reports contained false warnings for 'sexual nudity' and 'dangerous political content'. Privacy group Noyb filed a complaint with the Lithuanian data protection authority, alleging violations of the GDPR. The complainants sought access to their data but received no response, and were later required to provide a qualified electronic signature to correct errors.
- Company involved
- Whitebridge AI
6 source articles · read the reporting →
Commonwealth Bank worker made redundant after unknowingly training AI chatbot to replace her
Kathryn Sullivan, a 63-year-old Commonwealth Bank teller, was made redundant in July 2025 after spending years training the bank's 'Bumblebee' chatbot to respond to customers. She was unaware that she was helping the AI replace her own role. Sullivan confronted CEO Matt Comyn at the bank's AGM in Brisbane, where chairman Paul O'Malley acknowledged the bank had made a mistake. The Finance Sector Union had brought a case before the Fair Work Commission, resulting in some jobs being offered back, but not all.
- Company involved
- Commonwealth Bank
- AI system involved
- Bumblebee
4 source articles · read the reporting →
Upstart Holdings sued for securities fraud over AI model claims
Upstart Holdings, Inc., a cloud-based AI lending platform, is accused of making false and misleading statements about its AI model's ability to account for macroeconomic factors. The lawsuit, filed on May 13, 2022, alleges that the company's positive statements about its business were materially false. Investors suffered losses when Upstart's stock price fell 56% on May 9, 2022, after the company reduced its fiscal 2022 guidance.
- Company involved
- Upstart Holdings, Inc.
- AI system involved
- Upstart AI lending platform
10 source articles · read the reporting →
Instacart's rating and fraud detection system unfairly penalizes shoppers
Instacart shoppers allege that the company's automated rating and fraud detection system unfairly penalizes them for issues outside their control, such as customer fraud. The system assigns low ratings and blames shoppers for missing items, leading to reduced pay and deactivation. The Gig Workers Collective has sent an open letter to CEO Fidji Simo demanding changes including higher base pay, item commission, and occupational death benefits.
- Company involved
- Instacart
10 source articles · read the reporting →
Pensioner loses $224k to AI deepfake cryptocurrency scam featuring Prime Minister Luxon
A 72-year-old Taranaki grandmother lost $224,000 after being tricked by an AI-generated deepfake video of Prime Minister Christopher Luxon promoting cryptocurrency investment. The scammers used remote access software to transfer her savings and inheritance. TSB declined liability, stating the victim enabled the scam by granting remote access. Police are investigating.
- Company involved
- TSB
2 source articles · read the reporting →
Inflection background check errors lead to lawsuits from banned Airbnb users
Inflection, a background check company used by Airbnb, Uber, and other platforms, has been sued multiple times for providing inaccurate reports. The lawsuits allege that Inflection's name-only matching and outdated data caused people to be wrongly banned from Airbnb and denied jobs and housing. Some cases have been settled, while others remain ongoing. The company is accused of violating the Fair Credit Reporting Act.
- Company involved
- Inflection
- AI system involved
- Inflection background check
8 source articles · read the reporting →
