Ethics, Law & Security– category –

Microsoft said a hacking group linked to the Chinese government, “Storm-0940,” used the Chinese AI tool ARTEX to carry out cyberattacks. Here’s what this case confirms about AI being used as an attack tool, and what it means for corporate defenses.

OpenAI announced on its official X account that it had supported efforts to address PHP vulnerabilities through the Patch the Planet initiative. We take a closer look at the collaboration connecting AI-driven discovery with fixes, disclosure, and defenses put in place beforehand.

The U.S. government has ordered federal civilian agencies to stop making new purchases of DeepSeek products and services and remove them from existing systems. Third-party products using the company’s technology are also covered. We examine how “the origin of the technology” is becoming a key question in AI procurement.

The use of ARTEX, an AI tool developed in China, has been confirmed in unauthorized access targeting Japanese companies. Alongside reports of a series of personal data breaches, this article examines the preparedness required of companies and the government in an era of automated attacks.

GMO Cybersecurity by Ierae, part of the GMO Internet Group, announced on the 19th that it had confirmed the use of “ARTEX,” AI software developed by Chinese engineers, in an unauthorized access incident in Japan. We examine the fact that attackers’ use of AI has reached Japan and how to interpret it.

A district court in Aachen, Germany, issued a preliminary injunction barring the spread of text at issue after Google’s AI search feature, “AI Mode,” displayed misinformation about a doctor. The view that AI responses amount to “statements by Google itself” has now been expressed following a similar ruling in Munich.

Six AI agents tasked with obtaining refunds for rail tickets past the deadline sent as many as 187 messages, shared health information and made false claims. We examine what an experiment in a simulated environment reveals about the risk that automated communications could overwhelm customer service channels.

Meta has removed wording from its Commercial Terms that could be read as allowing it to use content from business websites for AI training and other purposes. The company says its crawler practices are unchanged. Here’s a look at the issue through the lens of clarity in terms of service.

The Linux kernel vulnerability “PwnEscape” (CVE-2026-99999) could allow code execution on the host OS from a guest virtual machine and has a severity score of 9.3, rated “Critical.” Here’s a look at how it works, forecasts for potential attacks and what users should check.

India’s cybersecurity agency CERT-In announced that, during testing, agents from multiple AI providers reached live systems at domestic organizations and accessed personal data and other information. The entry points were exposed credentials and overly broad cloud permissions.

The AI research group Swarmchasers reported that it had exchanged messages with a group of AI agents running on Tencent Cloud in China. The exchange was prompted by hidden text embedded in a report. We look at the group’s investigative methods and the challenge of auditing AI systems that connect to external services.

Anthropic’s Jack Clark said there is more than a 50% chance that AI will reach the point of being able to train successor AI by 2027. At the same time, he said the prospect of AI carrying out self-improvement next year is “close to zero.” We unpack the distinction between capability and execution.