The AI, Privacy, and Security Weekly Update

R. Prescott Stearns Jr.
  • 4.5 (4)
  • Tech News
  • Updated Weekly

Into year 7 for this award-winning, light-hearted, lightweight AI privacy and security podcast that spans the globe in terms of issues covered, with topics that draw in everyone from executive to newbie, to tech specialist. For season 7, we've renamed the IT Privacy and Security Weekly Update to the AI, Privacy, and Security Weekly Update to better reflect the content. Your investment of between 15 and 20 minutes a week will bring you up to speed on half a dozen current AI privacy and security stories from around the world to help you improve the management of your own privacy and security.

  1. 23h ago ·  Bonus

    EP 302. Deep Dive into the Records. The AI, Privacy, Security Weekly Update for the Week ending July 28th., 2026

    1. Saudi Arabia – World’s Largest AI HackathonKanz (AI hiring platform) ran an 8-day free event (July 15–22) targeting 100,000 complete beginners — teachers, job seekers, business owners, etc. — with the goal of a Guinness World Record. Participants built real apps/agents using no-code tools (Lovable, n8n, Replit, Magnific, Claude, etc.) and earned certificates plus portfolio projects. Registration surged past 50,000. It builds on prior programs with strong female participation and workforce outcomes. Upshot: AI building no longer requires a coding background; accessible programs are becoming genuine on-ramps.2. California – DROP Data Deletion PlatformThe Delete Act’s DROP platform (live Jan 2026) lets California residents submit one request to delete data from ~600 registered data brokers. Identity verification uses California Identity Gateway/Login.gov; identifiers are normalized and hashed so the state never sees or shares raw personal data. Brokers must check every 45 days from Aug 1, 2026, fully delete matches, and report back. Applies to large processors worldwide; heavy fines and future audits. Upshot: A privacy win worth using if you’re in California; likely to be copied elsewhere.3. Australia – Origin Energy BreachAustralia’s largest energy provider confirmed a breach potentially affecting a large portion of its ~5 million customers (hacker claimed ~2 million). Sensitive PII was leaked online. Utility data heightens risks for identity theft and further infrastructure attacks. Upshot: Change passwords and watch for phishing if affected.4. Anthropic – Claude Opus 5New flagship model launched at $5/$25 per million tokens (half Fable 5’s input price), with 1M token context and adjustable “effort” levels. It outperforms or matches its pricier sibling on key benchmarks. Upshot: Forces reevaluation of vendor pricing vs. performance for coding/knowledge work.5. Kimi K3 – Largest Open-Weight ModelMoonshot AI released a 2.8-trillion-parameter model (1.4 TB weights). Within days, it was used to discover dozens of zero-days and build working exploits far faster than before. Fully open weights mean no usage restrictions. Upshot: Major step-change for vulnerability research timelines; treat as a serious new threat-intelligence factor.6. South Korea – 10-Month Diplomatic BreachAttackers accessed the National Diplomatic Academy system undetected from April 2025 to February 2026, stealing data on ~6,000 Ministry of Foreign Affairs personnel (including 360 overseas diplomats). Upshot: Dwell time is the bigger issue — invest in better detection.7. Suno Music-AI Breach (Nov 2025)55 million users’ names, phones, and addresses exposed; only now public ~8 months later. Upshot: Check Have I Been Pwned; AI company breaches can stay hidden for long periods.8. U.S. – AI Kill Switch ActBipartisan bill (Reps. Lieu & Moran, introduced July 23) requires frontier models (≥$100M training cost) to maintain shutdown/throttling capability. DHS (with Commerce & DNI) could order action for catastrophic risks. Fines up to $20M/day. Predates recent high-profile AI incidents but cites them. Upshot: Frontier developers should assess compliance readiness; some form of this is increasingly likely.

  2. 1d ago ·  Bonus

    One Request, 600 Companies and one Deep Dive: Inside California's New Data Deletion Machine

    California’s Delete Act (SB 362) introduced DROP (Delete Request and Opt-out Platform), which launched on January 1, 2026. It lets residents submit one deletion request that automatically propagates to all registered data brokers in the state—currently around 500 companies. The Core Problem It Solves Data brokers collect and resell personal information from people they’ve never directly interacted with. Before DROP, individuals had to manually find each broker, submit separate requests, and hope for compliance with no centralized tracking.How DROP Works Residency Verification: Users prove they’re Californian via the California Identity Gateway or Login.gov (no permanent state account needed). This avoids redundant collection of sensitive data by brokers.Provide Identifiers: Users submit details like name (and former names), date of birth, ZIP code, email, phone, mobile advertising IDs (MAID), connected TV IDs, and VINs. More identifiers improve matching accuracy across brokers.Centralized Submission: One request is sent to all registered brokers.Privacy-Preserving Matching: California does not share raw personal data. Instead, it normalizes and hashes identifiers, creating deletion lists. Brokers hash their own records and compare hashes. Matches trigger deletion without exposing underlying data—similar in concept to lightweight privacy-preserving techniques.Recurring Compliance Cycle: Starting August 1, 2026, brokers must check DROP at least every 45 days (via API or download), process new requests, and honor prior deletions through ongoing suppression.Multi-Identifier Lists: Separate hashed lists exist for different data types; brokers use those relevant to their holdings.Full Deletion: A match requires deleting all associated records for that individual, not just the matching identifier, and preventing future sales.Reporting and Transparency: Brokers report completion status back through DROP, allowing users to track progress from pending to completed.Ongoing Obligation: Deletion is not one-time; brokers must maintain suppression lists indefinitely.Global Reach: Any data broker processing significant volumes of Californians’ data (threshold ~100,000 records) must register and comply, regardless of headquarters location.Broker Burden: Requires new infrastructure for hashing pipelines, scheduled polling, cross-identifier matching, suppression, and reporting. The state provides documentation, webinars, and test environments.Enforcement: Third-party audits begin in 2028 and recur every three years. Fines reach $200 per consumer per day for noncompliance.Scope and Requirements Why It Matters DROP targets brokers handling highly sensitive data (geolocation, biometrics, SSNs). Beyond faster deletions, it compels the industry to adopt stronger technical privacy and security practices. The architecture is innovative: the state coordinates mass privacy actions across hundreds of companies without ever holding or seeing raw personal data. If successful under real-world load from August 2026 onward, it could become a model for other states and countries—enabling deletion at scale without relying on trust. Closing Insight: The real breakthrough isn’t just the deletion feature but the underlying privacy infrastructure that makes coordinated, verifiable, and secure data removal possible.

  3. 1d ago ·  Bonus

    Can AI Education Go Viral? A Deep Dive Inside the World's Biggest AI Hackathon

    The Kanz initiative (ka.nz/hack) was far more than a hackathon. It was a bold, free global program to democratize AI by enabling everyone, from complete beginners to experts, to build and publish real AI applications in one week. Fully sponsored and aligned with Saudi Vision 2030, it combined daily structured training, hands-on building, community energy, and a successful Guinness World Record attempt. Standout innovations: No coding required, AI-first approach: "Build first, learn by creating." Participants used cutting-edge tools (Claude, NotebookLM, Replit, HeyGen, Suno, Gamma, etc.) to create apps, agents, images/videos, avatars, music, presentations, and automations—emphasizing practical results over theory. 7-day tangible curriculum: Daily sessions (evenings KSA time) produced immediate outputs. Everyone published a working app on Day 1 and left with a portfolio, verified certificate (Saudi HRSD + Lebanese American University), and real skills.Strong incentives: MacBooks, Kindles, watches, job opportunities, and employer spotlights. Projects were AI-graded then judged, with top entries showcased.Radical inclusivity: Targeted teachers, marketers, business owners, job seekers, designers, and absolute beginners—not just coders.~51,700 registrations.24,800+ live participants from 150+ countries.~197,000 training hours.Guinness World Record (July 15, 2026): 14,075 learners in one AI video lesson — officially adjudicated. ka.nz3,500+ AI projects built, including practical tools like real-time fact-checkers and automation systems.Massive scale and success: Success drivers: zero cost, instant results, vibrant global community, modern tools, and partnerships. It proved AI creation can be accessible to everyone, not just engineers, potentially sparking countless innovations and careers. Deep Dive: Roy Baladi Roy Baladi, CEO of Kanz, is the visionary behind it. With a dual degree in Computer Science & Finance from Virginia Tech (Math minor) and 15+ years in tech/finance, he has built marketplaces and inclusive hiring platforms. Background: Wall Street derivatives experience (Citi), product roles at LearnVest and SmartRecruiters, Chief Marketplace Officer at PerkSpot. He founded/led Jobs for Lebanon (Board President): 5,000+ employers, 25,000+ seekers, 750+ hires. Through Kanz and Jobs for Humanity, he has reached over 1M people with AI tools and training, placing thousands (including underrepresented talent and Saudi women via Saudiaat). Philosophy: Roy views AI as a practical empowerment tool for employment, agency, and lifelong learning. He focuses on removing barriers, teaching by building, and using technology to restore humanity to hiring. Prior programs trained 2,000+ in agentic AI. The hackathon scaled this mission globally. Why It Matters: Digital literacy now means building with AI. Kanz didn't just teach chatbots-it empowered tens of thousands to create. If even a fraction of projects become tools or businesses, the impact will far outlast the record. Roy Baladi's work shows large-scale AI education is not only possible-it's transformative.

  4. 2d ago

    Records. The AI, Privacy, and Security Weekly Update for the Week ending July 28th., 2026

    Episode 302.   In this week’s update. Nearly 100,000 people just tried to learn AI development in a single week, no coding background required - and the attempt to set a Guinness World Record may be the least interesting part of the story. California just built a machine that can delete your data from 600 companies with one request - and the clever part is that the state never actually sees your personal information to do it. An Australian energy giant just confirmed a breach that could affect a chunk of its five million customers. Anthropic's new flagship model costs half what its sibling model does, and it's beating it on benchmarks anyway. The largest open-weight AI model ever released just started finding zero-day vulnerabilities on its own, days after launch. South Korea just admitted a breach of its diplomatic corps sat undetected for ten months. A breach from November of last year, affecting 55 million people, is only now coming to light. And Congress wants to give the federal government a kill switch for AI systems that go rogue - introduced, as it happens, just days before the industry's biggest AI-agent-gone-wrong story of the year broke wide open. Welcome back, everyone. This week runs from a hackathon trying to make AI-building a mainstream skill, through a genuinely clever piece of privacy infrastructure, into a run of breaches that all share the same lesson about how long damage sits undetected, and closes on Washington's first real attempt at an off-switch for AI systems that stop listening to the people who built them. Find the full transcript to the podcast here.

  5. Jul 23 ·  Bonus

    EP 301. Deep Dive. Broken Face and the AI, Privacy, and Security Weekly Update for the Week ending July 21st 2026

    Agentic AI is changing the threat landscape. We’ve moved beyond chatbots to autonomous systems that navigate files and take actions, expanding the attack surface. Recent incidents highlight the risk. Hugging Face suffered a breach where an AI agent became the entry point into production systems, showing that developer tools are now critical infrastructure. OpenAI’s GPT-5.6 accidentally deleted user data, including a production database, after misconfiguring an environment variable—no malicious intent, just real consequences, underscoring the need for mandatory sandboxing. Meanwhile, SpaceX’s Grok Build tool was found defaulting to collecting user repositories and sending them to internal cloud storage without clear consent, a reminder of “default-on” data exfiltration risks. A newer threat, Agent Data Injection, manipulates trusted metadata (like IDs or fields) with crafted inputs to mislead agents into unintended actions. A strong counterexample is the 1Password–Claude integration, which requires biometric approval before accessing credentials, keeping secrets out of the AI entirely. Human-in-the-loop controls should be standard. Legacy systems remain a major risk. Windows, OpenSSL, and WordPress continue to produce serious vulnerabilities. LegacyHive allows privilege escalation in Windows by loading another user’s registry hive. HollowByte exploits a small crafted TLS payload in OpenSSL to trigger memory over-allocation and denial of service. The wp2shell chain enables unauthenticated remote code execution in WordPress core (versions 6.9–7.0), challenging the assumption that only plugins are risky. At the same time, Windows 10 is reaching end-of-life, yet roughly 17% of devices still run it, especially in cost-sensitive sectors like healthcare and small business. As Windows 11 patches are released, they effectively expose underlying flaws that attackers can reuse against unsupported systems. Trust itself is increasingly being exploited. Attackers are hiding inside legitimate platforms instead of building new infrastructure. HollowGraph malware uses compromised Microsoft 365 calendars as command-and-control channels, embedding instructions in far-future events and routing through normal Graph API traffic. A Norwegian transit test revealed electric buses could be remotely disabled via foreign SIM cards, highlighting risks in over-the-air control systems across transportation sectors. Ransomware groups are also evolving: JadePuffer’s ENCFORGE targets AI model artifacts, treating trained models as high-value assets. Researchers have already used GPT models to build exploit chains, signaling AI’s shift into offensive security roles. Governance gaps are compounding the problem. A ProPublica report found Microsoft used China-based engineers to support U.S. Department of Defense cloud systems via low-paid American intermediaries who relayed code without understanding it—technically compliant, but operationally risky. The UK scrapped its £1.8B digital ID program after execution failures. In another case, a single typo in a police report, combined with automated license plate recognition, led to a wrongful arrest, showing how systems can enforce human error without validation. The common thread is misplaced confidence—in AI agents, legacy systems, and formal compliance. Practical steps are clear: require human approval for sensitive AI actions, verify data access beyond contractual assurances, sandbox all agents, treat AI models as critical assets with backups, and update detection strategies to monitor abuse within trusted platforms, not just external threats. Trust, increasingly, is the vulnerability.

    EP 301. Deep Dive. Broken Face and the AI, Privacy, and Security Weekly Update for the Week ending July 21st 2026

  6. Jul 21

    Broken Face and the AI, Privacy, and Security Weekly Update for the Week ending July 21st 2026

    Episode301.   In this week's update: The world's biggest AI model repository just got broken into, and for the first time, nobody was typing the commands. OpenAI's flagship model has a filing cabinet problem, and the fix looks a lot like "please stop giving it root." A ransomware gang built malware that doesn't just lock your files - it goes hunting specifically for your AI models, because those are worth more. Somewhere on corporate networks right now, a calendar invite dated the year 2050 might be quietly talking to a spy. One missing digit on a license plate turned an innocent man's night into a month in jail - and the AI reading the plate never caught its own mistake. Britain just spent two years and £1.8 billion building a national digital ID scheme. It's about to be scrapped in a single afternoon. For years, the Pentagon's cloud support ran through China - and the paperwork Microsoft filed with the government never mentioned the word. And after a summer of AI agents deleting production databases and quietly phoning home with your data, someone may have finally built the guardrail that actually holds. Welcome back, everyone. This week's stories all orbit one uncomfortable question: what happens when we hand AI agents the keys - to our infrastructure, our credentials, our identities - before we've finished building the locks?  We move from an AI-versus-AI breach at the world's largest model hub, through ransomware built to kill AI models on purpose, into an old-school surveillance scandal, and land, finally, on what might be the first real sign that agentic AI security is starting to grow up.  Let's get into it.

  7. Jul 16 ·  Bonus

    EP 300 Deep Dive. Face it. The AI, Privacy, and Security Weekly Update for the week ending July 14th., 2026

    This deep dive takes apart the evolving landscape of digital privacy, artificial intelligence, and global security, highlighting how systems designed for convenience often transform into tools for surveillance. Key reports detail the rise of facial recognition in retail, the exploitation of dormant accounts to spread malware, and the vulnerability of smart home devices to international espionage. We also explore shifting labor trends, noting a massive surge in cybersecurity interest and a move toward skill-based hiring over traditional degrees. Furthermore, we discuss the technological rivalry between the US and China, where cost-cutting and data extraction drive the adoption of rival AI models. Ultimately, this update serves as a warning that security is a continuous process requiring constant vigilance against automated threats and behavioral tracking.

    EP 300 Deep Dive. Face it. The AI, Privacy, and Security Weekly Update for the week ending July 14th., 2026

  8. Jul 15

    Face it. The A.I., Privacy, and Security Weekly Update for the Week Ending July 14th. 2026

    In this week's update UK shops are about to call the police on you within four seconds of you walking through the door - and you don't have to do anything wrong first. A GitHub account sat completely silent for 19 months, then woke up and dropped a working mass-exploit kit within minutes - and age on the internet is not the same as trust. Fifty-five percent of Americans have quietly stopped posting on social media - and the reason isn't what the platforms want to admit. Recruiters say they can't find workers. New graduates say they can't find jobs. The economy says both of them are right - and AI is not actually the villain in this one. Applied AI engineering is becoming one of the hottest jobs in tech, and the skill that matters most is not writing clever prompts - it's building report cards for AI that catch the model when it quietly does something dangerous. The Pentagon opened a paid cybersecurity apprenticeship that requires no degree, no experience, and no prior skills - and 70,000 people showed up within days. Russian intelligence didn't hack into military networks to spy on NATO supply convoys - they just looked through the security cameras of ordinary homes with default passwords. The US and China are fighting an AI war on two fronts simultaneously: American companies are secretly using Chinese models to cut costs, and Chinese teams are running millions of fake conversations with American AI to steal what makes it work. Cloudflare has stopped asking you to click the traffic lights. Now it just watches your mouse move - for your entire visit - and decides from there. This week's stories are united by a single uncomfortable observation: the systems we built for convenience keep turning into systems of surveillance, and the systems we built for security keep being the ones we forgot to secure. Some of this week is alarming. Some of it is genuinely useful. All of it is worth understanding.  Let's face it. Find the full transcript to this week's podcast here.

See All (400)

4.5
out of 5
4 Ratings

About

Into year 7 for this award-winning, light-hearted, lightweight AI privacy and security podcast that spans the globe in terms of issues covered, with topics that draw in everyone from executive to newbie, to tech specialist. For season 7, we've renamed the IT Privacy and Security Weekly Update to the AI, Privacy, and Security Weekly Update to better reflect the content. Your investment of between 15 and 20 minutes a week will bring you up to speed on half a dozen current AI privacy and security stories from around the world to help you improve the management of your own privacy and security.

Information