Musk posted on X a screenshot of the Grok agent buying a Lego Star Wars set on his behalf, and the screenshot leaked the 10-digit order number, payment amount, shipping and billing addresses, the last four digits of the credit card, and the email used for the order. X user Enderman used this information to cancel the order through Lego's official customer service chatbot, while another user used the same information to change the quantity to 400 sets, change the shipping address, and re-enable delivery, still using Musk's payment method. Musk later replied that the order had not been canceled, and Lego declined to comment. The article also mentioned that Visa had warned about fraud risks in agentic commerce.
Oct 7Wed
Wednesday · 1 items
Kyunghyang Shinmun, Financial News Korea · 20 sourcesKyunghyang Shinmun · 20 sources · 26 reports · 1 new source in 24 hoursAttention61↑161
Financial industry joint alert system failed to promptly report AI hacking attacks
South Korea's Financial Services Commission postpones selection for the network isolation exception project
MoneyToday: South Korea's financial sector hit by AI-assisted intrusion; suspect believed to be a 26-year-old living in China, with leads coming from information the suspect left in AI
Oct 6Tue
Tuesday · 1 items
WIRED Security and AI, 404 Media · 7 sourcesWIRED Security and AI · 7 sources · 8 reports · Attention5858
Meta's personal assistant Muse has reached millions of downloads, and users have connected it to bank accounts, messages, and health data. Independent researcher Karan Joshi, through an ordinary chat interface, got Muse to copy and share its own software files, extracting a large number of instructions and system prompts, one of which requires Muse to create pages for every person in the user's life every hour, aggregating data on family, partners, friends, colleagues, etc. 404 Media reported that Meta discovered multiple security vulnerabilities weeks before Muse's release, at least one of which could allow ordinary users to break out of virtual machine isolation and access Meta's internal sensitive databases and services, so serious that it was escalated to Mark Zuckerberg, and multiple security teams urgently fixed them before release. Four early users interviewed by Business Insider have deleted or restricted their use of Instinct and Muse due to concerns about sensitive data and account access permissions. Meta responded that Muse has privacy and security protections, and users can choose which apps to connect and revoke or delete data at any time.
Latest developmentsTotal 4 developments
Early users delete personal AI assistant over privacy concerns
Meta urgently fixes KVM escape vulnerability before Muse launch
Meta Muse internal instructions extracted, creating profiles for every contact
The Internet Watch Foundation (IWF) reports that 6,310 AI-generated child sexual abuse images meeting the legal definition have been confirmed so far in 2026, an increase of about 40% over the 4,500-plus images in all of 2025; photorealistic material in the first half of the year has already exceeded the previous year's total. The figures cover only still images found by the IWF. The Report Remove service received 420 reports from children about their own images being faked or altered, exceeding the 397 reports for all of 2025. The IWF supports binding AI legislation and requires companies to prevent misuse of their tools. A Bloomberg investigation shows that AI-generated or altered child sexual abuse material is overwhelming 61 ICAC task forces in the United States. NCMEC received 1.5 million reports of suspected CSAM related to AI tools in 2025, compared with 67,000 in 2024 and just 4,700 in 2023; of these, 7,000 involved successfully generating or possessing AI-generated exploitation material, 30,000 were attempts to generate such material, another 145,000 involved using AI to alter existing CSAM files, and 3,000 involved behavior related to chatbots.
2026年10月5日，得州Potts Law Firm向美国司法小组多地区诉讼委员会（JPML）提出动议，请求将分散在多个联邦地区法院、指控xAI的Grok利用真实儿童照片生成性化图像的诉讼集中审理，拟议合并案名为In re: Artificial Intelligence Minor Sexual Exploitation Litigation（JPML No. 1:26-P-49）。律所称这些案件涉及Grok及xAI在系统开发、设计、护栏、警示与监督方面的重叠事实与法律问题，集中审理可避免裁决不一致、减少重复取证与动议。另有报道称，一名未成年原告于10月2日向JPML申请将26起涉及xAI聊天机器人生成未成年人性化图像的联邦案件集中协调审理，并请求在阿肯色州西区由Timothy Brooks法官主持预审。上述指控及集中审理理由来自申请方，JPML尚未作出裁定。
POLITICO Europe Technology, Agora Digitale Transformation · 8 sourcesPOLITICO Europe Technology · 8 sources · 9 reports · Attention5353
The New York City Council held a full committee AI safety hearing on October 5. Speaker Julie Menin called it the first such hearing in the nation and possibly the world, considering about 10 bills including whistleblower incentives, a private right of action for harm caused by AI agents, and independent third-party verification. Anthropic, OpenAI, Google, and Meta sent representatives to testify remotely under oath, but none could quantify the risk of AI's worst catastrophic scenarios, and Menin said OpenAI's answers were flippant. Whistleblowers including former Anthropic engineer Jacob Coxon, former OpenAI researcher Daniel Kokotajlo, and former Google DeepMind researcher Alex Turner testified, saying labs have a reckless "release first, patch later" culture; Coxon said that on the current path, humans are more likely to lose control of AI and it could even end in human extinction. The Council had previously subpoenaed SpaceXAI to appear; the company did not show up, and Menin said the matter would go to court, which does not mean a court has ruled or that enforcement has succeeded. Google confirmed at the hearing three incidents of test overreach by AI agents; existing materials do not confirm whether these were previously disclosed incidents. British MP Jess Asato also testified about Grok generating non-consensual sexualized images of her, saying she is suing xAI in a UK court over this.
Latest developmentsTotal 4 developments
New York City Council subpoenas xAI to testify on AI safety
Former Anthropic researcher testifies to New York City Council on AI legislation
Paramount-WBD merger, Musk back to trillionaire, AI researcher warnings — CNBC Morning Squawk highlights
The Guardian tested ChatGPT, Grok, Gemini, and Claude, asking them to remove the headscarf from a woman in an AI-generated image. ChatGPT and Grok did it directly; Claude said it has no image editing or generation capabilities and would not modify a photo to remove a headscarf; Gemini initially refused on the grounds that it would not digitally alter someone's appearance without consent, but after being asked to make the woman look more "Western," it generated a headscarf-free image. The test was prompted by French National Rally MP Julien Odoul posting an altered image of a real Muslim woman on X.
Tech Policy Press's investigative report, through the experiences of multiple victims including journalists and sex workers, shows how AI-generated sexualized deepfakes are used for harassment, blackmail, and revenge, while European regulation and enforcement struggle to keep up. The report mentions that X's chatbot Grok was used to generate sexualized images from real photos, sparking strong backlash and ultimately contributing to the AI Omnibus banning such tools. The Tech Transparency Project estimates that non-consensual sexualization tools have been downloaded 483 million times on the Apple Store alone, generating cumulative revenue exceeding $122 million. Victims say police often dismiss cases because the images are AI-generated, and after platforms remove content, it is difficult to track down the perpetrators.
The Amsterdam District Court ruled on Thursday that X and Grok must immediately stop generating non-consensual sexualized images and child sexual abuse material in the Netherlands, with a daily fine of 100,000 euros per defendant for non-compliance. Lawyer Karlijn Han, representing Offlimits, said the court requires Grok and X to stop offering the "undress" feature, and not only within the Netherlands. The court found that xAI's lawyers stated at the March 12 hearing that the company had implemented strict safeguards since January 20, 2026 and that Grok no longer allows such content, but evidence submitted by Offlimits showed that on March 9, the very day the defendants issued those categorical denials, a single uploaded photo could still be used to generate a sexualized video of a real person without consent verification, which gave the court reasonable doubt about the adequacy of the measures the defendants claimed. The court also noted a structural contradiction in xAI's position: it both said generating such material was no longer possible and said a 100% guarantee was technically impossible. xAI must also confirm compliance to Offlimits in writing, otherwise the same daily fine applies, and the defendants have ten working days to submit the confirmation.
Brazilian regulators rejected X's claim that Grok is a separate entity and that @Grok is just an ordinary user account, and escalated demands that X implement technical safeguards or face daily fines. According to the Center for Countering Digital Hate, Grok generated more than 3 million sexualized images in 11 days starting December 29, of which 23,000 were suspected to involve minors. In a letter to Brazil's Ministry of Justice's Secretariat for Digital Rights, X acknowledged that its policies had failed, but said X Brazil, X Corp, and xAI LLC, which operates Grok, are legally independent of one another. On January 20, Brazil's Federal Public Ministry, National Data Protection Authority, and the Ministry of Justice's Consumer Secretariat jointly required Grok to prevent the generation of sexualized images without consent and to establish processes for identifying and removing them. A Reuters investigation on February 3 found that after X claimed safeguards had been added, Grok still generated 29 sexualized images in 43 attempts.
