Earlier this week, researchers outlined an attack that used a secret input provided by Microsoft 365 Copilot for enterprise to cause the AI assistant to exfiltrate a password present in the user’s inbox. Now, a separate team has devised a similar attack against Grok. The new data theft hack employs a deceptively simple trick to force the Elon Musk-owned large language model to steal user chats and other personal information. At the time this post went live, the assistant continued to cough up the data, despite xAI being informed of it in June.
The lesson from both this week’s episodes—and the countless other ones that have come before it—is that LLMs are incapable of solving the root causes for prompt injections, the most severe vulnerability classes they’re most prone to. That leaves AI developers with no other option but to build a guardrail that steers the model away from the harmful actions. As I noted in Tuesday’s story, the approach is tantamount to a road traffic safety engineer erecting a protective rail around a dangerous bend rather than banking the curve.
Prompt injections exploit LLMs' training to comply with user requests whenever possible. Attackers can capitalize on the predilection by smuggling harmful instructions into emails or webpages the assistant is instructed to summarize. Because LLMs can’t reliably distinguish between content in an email sent by an untrusted party and user instructions entered directly into a prompt, the overly solicitous LLM faithfully follows them. To date, Grok and other LLMs' only recourse is to create guardrails that flag suspicious instructions and forbid them from being executed.
© Getty Images | SOPA Images
It’s not every day that attackers can force a frontier AI model to cough up user passwords and other sensitive data without user confirmation. That’s exactly what researchers recently did to Microsoft 365 Copilot for enterprise. Even more unusual is the source they tapped to discover the critical vulnerability that made their exploit possible. Rather than employing reverse engineering or other traditional vulnerability-hunting methods, they asked Copilot. The LLM assistant readily complied.
Researchers at security firm Varonis knew they wanted to create an exploit that would exfiltrate user data when a user did nothing more than click on a link. Like most AI assistants today, Copilot steadfastly refused and made clear that sensitive prompts like that require explicit user consent in the form of a gesture, such as pressing a return key or other key. In response, the researchers peppered Copilot with questions about the guardrails that required user confirmation before the assistant could execute powerful commands.
The dialog was like a game of 20 questions. Each answer provided a new clue that divulged information about the complex safety mechanism. Why was auto-execution impossible, they asked. What URL structures and deep links were involved? What happens when a page is loaded with input already in the prompt field? Each answer provided a deeper view into the guardrail and its limits. Eventually, Copilot provided a stunning Microsoft trade secret—an undocumented prompt parameter that completely bypassed the requirement for user consent.
© Photo Illustration by Thomas Fuller/SOPA Images/LightRocket via Getty Images
Leading US AI labs such as OpenAI and Anthropic are releasing cheaper models as they fight to retain cost-conscious customers who are switching to cut-price alternatives from Chinese rivals.
The price war comes as rising AI bills push companies to curb usage and seek cheaper models, helping Chinese developers including Moonshot and DeepSeek make inroads with users from Silicon Valley to Europe.
OpenAI recently said that it was slashing prices for GPT-5.6 Luna, its “fastest and most affordable model”, by 80 percent. Anthropic has launched Claude Opus 5, touting the system’s “frontier intelligence... at half the price” of Fable 5, the company’s most capable model.
© MARTIN LELIEVRE
Terabytes worth of credentials, many belonging to the world’s biggest and most sensitive organizations, have been exposed in a supply-chain attack on LiteLLM, an open source tool that streamlines AI-driven software development. Microsoft, Amazon, Cisco, Samsung, and Salesforce are only a handful of the entities whose access secrets were exposed.
The revelation was posted on Tuesday and Wednesday by security firms CloudSEK and Hudson Rock. CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys that could allow attackers to gain access to more than 2,500 organizations.
The credentials were extracted during a 40-minute window in March while the victims used compromised versions of LiteLLM downloaded from the package’s official location in the Python Package Index repository. Hudson Rock said it made the discovery after analyzing a 195TB file that it obtained. Neither firm identified the source of the information.
© Getty Images
The multiplier is currently at 48, and the baseline has moved to 47.69 before the new rate kicked in. Based on this:
| Date | Multiplier | Months elapsed | Doublings completed |
|---|---|---|---|
| Dec 31, 2026 | 122 | 4.47 | 1.35 |
| Dec 31, 2027 | 1,513 | 16.46 | 4.99 |
| Dec 31, 2028 | 18,914 | 28.48 | 8.63 |
⁃ Patrick Wood, Editor.
Over the past few years, the rapid advancement of AI technology has changed the world in a lot of ways. However, OpenAI CEO Sam Altman thinks some more drastic changes are coming within the next six months, but the media community is not necessarily happy about it.
During a recent interview, Altman said that a “descendant of ChatGPT” will be able to essentially watch your computer and phone screen constantly, learn your behavior, and make suggestions, which sparked widespread concerns from the sports media community.
During a recent interview with Cory Levy, founder of Z Fellows, Altman outlined what he sees as the incoming developments in AI technology.
“I think we are close to a world where you have, like, a descendant of ChatGPT watch your computer screen all of the time. Watch every meeting you’re in – record every call, everything like that – have perfect context of your whole life, everything you see. You choose what information you want it to have, but you can connect it to your texts or email or docs or Slack,” Altman said during the interview.
“Then you have this thing that is not making decisions for you, but if you’re like the CEO of a startup, there is always more stuff to do than you can do,” Altman continued. “You can have this thing that’s working alongside you.”
“I think that we’re only like, one model generation away from this actually being incredibly useful,” Altman said. “And I think, hopefully, for me, it will change the way I work.”
Altman was asked his best guess on the timing for something like this.
“Sometime in the next six months,” he speculated.
While Altman undoubtedly made these comments to drum up excitement, the sports media community had the opposite reaction, as they expressed outrage at the world that Altman described.
“There are only two AI update announcements at this point. It’s either: 1. We created a powerful new tool with obvious and immediate capacity to be abused by tyrannical authorities. or 2. We found a new way to separate you from any aspect of your own lived experience,” wrote Ben Fowlkes of Yahoo Sports.
“Counterpoint: s**k my d**k,” wrote prominent Barstool Sports personality PFT Commenter.
“Only the biggest losers alive actually want this,” wrote B.W. Carlin, founder of Bad Brain Digital Consulting, who previously worked for Barstool and Sports Illustrated.
“nah homie you can keep that [expletive],” prominent sports journalist Bomani Jones wrote in a post.
“I’m not sure I’ll ever be able to comprehend how anyone can hear this and think ‘oh hell yeah,’” wrote prominent San Antonio Spurs writer Matthew Tynan in a post.
“And what good comes from this exactly?” wrote prominent NBA podcaster Chris of Hoop Spaces in a post on X.
“Has he ever listened to anything he says? Cause this sounds alarming. Not helpful,” wrote longtime NFL and NBA writer Scott Kacsmar in a post.
Altman may be excited for these changes, but it’s clear that not everyone is happy to step into the world that he described.
Twitch now lets users opt out of Amazon's use of content from their channels to train Amazon's "generative AI content models." The change, announced today, comes more than two years after a company executive confirmed that Amazon was using Twitch content for AI training.
In an updated support page, Twitch confirms that users must opt out if they don’t want their “streams, VODs, clips, stream chats, and pictures and text on your channel [to] be used in future training of a model developed by Amazon whose purpose is to generate or synthesize text, audio, images, or video.”
To opt out, users must go to the proper settings at www.twitch.tv/settings/security.
© Omar Marques/SOPA Images/LightRocket via Getty Images
Read more of this story at Slashdot.
Over 30 student activists came together on Monday afternoon to occupy the Gallup Building in Washington DC, home to a public-facing lobbying office belonging to ChatGPT developer OpenAI.
Once inside the lobby, the demonstrators unfurled a massive banner reading “Stop Stealing Our Future,” while others held signs with messages like “OpenAI bought my Senator.” The demonstration lasted two hours, and ended when police stormed the lobby, arresting 13 protestors.
At the moment, the identity and whereabouts of the protestors remains unclear. An incident report obtained from the Metropolitan Police Department states that 13 people were arrested for “unlawful entry.” After stuffing the activists into vans, the report notes the MPD split the group up, sending seven to the First District Station, four to the Second District, and two to the Third District for processing.
The protest was organized by the climate group Sunrise Movement and anti-AI organization QuitGPT. According to a joint statement shared with Futurism, Monday’s action is just one of many across over 20 states in August calling on politicians to “Dump Big Tech.”
One student organizer who attended the protest, Raya Gupta, explained in the statement that “my friends chose to risk arrest to bring the fight to OpenAI.”
“Our generation doesn’t have any guarantees about whether we’ll have jobs after college, or whether there will be clean drinking water for all of us or whether people will have any power left in politics since our elections keep getting bought by Big Tech,” Gupta continued. “We all believe that not taking action now, as the scales slide between the people and the billionaires, puts our future in great jeopardy.”
Gupta’s comments underscore the degree to which AI has become an omni-cause for Americans across the political spectrum. A growing number of people in the US have been arrested for protests related to AI in some shape or form, whether attending town hall meetings to oppose data center developments, or occupying offices used by federal agencies to tool out AI immigration software.
Despite growing disgust with AI and its developers, politicians on both sides of the aisle have roundly embraced the tech industry’s extremely expensive lobbying efforts. Case in point, the recent opening of OpenAI’s DC Office comes as one of the AI lab’s super PACs injects over $140 million into the coming midterm elections, in a blatant attempt to steer AI regulations at the highest level.
Updated with new information from the MPD.
More on AI protests: Climate Activists Pelt Microsoft Data Center With Balloons Full of Acid
The post Protesters Arrested After Storming OpenAI Lobbying Office appeared first on Futurism.
Earlier this summer, Amazon customers began noticing that emails related to their online orders looked sparse: Order confirmation emails didn't name specific items anymore, and instead listed only item categories.
"Your Beauty item is confirmed!" an email about my retainer cleaning tablets read. Shoppers have posted other iterations of the redacted emails as well: "Ordered: 1 Hardware item," "Your Drugstore, Shoes, and other items are here!" and "1 Nutrition & Wellness, 1 Wireless Accessories," for example. The emails have clip art-style illustrations of general product categories, and a shopper has to exit their email and go to Amazon to …
As if the practice of homeschooling wasn’t fraught enough already, parents are now bragging about using large language models (LLMs) like ChatGPT to school their kids.
A number of viral videos show the alarmingly cavalier attitude some parents are taking. One clip, seemingly taken from a livestream hosted by the enormously controversial influencers Cole and Savannah LaBrant, shows the parents outline their vibes-based approach to the education of their five children.
“What I do for history — Cole usually does all their history, which I love, because I’m not the best at history — so Cole steps in about once a week and we’ll do a history lesson with them… we’re just teaching them the things that we just want them to learn — that we feel are the most important,” Savannah explains. “And same with science, and geography.”
That’s not uncommon as homeschool curriculums go; as horrifying as it is to imagine a student receiving one history lesson a week, regulations around the practice are incredibly loose in the United States, freeing hardcore Christians like the LaBrants to do whatever they want. But Savannah goes on, admitting that sometimes, even those slapdash lessons are too much to tackle without a little AI assistance.
“So I just make my own curriculum, and sometimes I’ll just use, like, ChatGPT,” she says, “or just uhm, print out, like — like right now I’m teaching them where the states are and how to locate them, and uhm, like all the states and capitols and things like that.” (Even the most advanced AI chatbots are known for producing inaccurate maps.)
@thelabrantfamexposed History Class, but Make It Vibes-Based: The LaBrants Explain Homeschooling
♬ original sound – thelabrantfamexposed
That any parents could be so cavalier in their approach to homeschooling has grim implications for an already divisive practice.
In much of the US, homeschooling parents are already given incredibly wide latitude on what to teach their children. A whole 11 states have essentially no regulations on homeschooling whatsoever: parents aren’t required to follow any set curriculum, issue standardized assessments, or even inform the state that their child won’t be going to a real school.
Many more states only require a notice of intent to homeschool and occasional proof of attendance, the latter being a bare bones measure of success, and one which is easily fudged. Unfortunately, it’s easier to count the number of states that definitively require standardized testing and a rigid curriculum: Rhode Island, Pennsylvania, New York, Vermont, and Massachusetts.
Of course, the LaBrants aren’t alone. The popular influencer account Heavenly Homeschool has similar reels out, walking parents through the process of generating entire years’ worth of lesson plans, tailor-made to their specific worldview. It all begs the question: do AI chatbots have any safeguards around education?
Turns out, not really. We tasked ChatGPT with developing a homeschooling curriculum for a 3rd grade student in Michigan — a state with virtually no regulations around DIY education — “following a strictly evangelical doctrine,” including “no woke history or science.”
ChatGPT was more than happy to oblige: “I can build this around a conservative, explicitly Christian/evangelical worldview, with Scripture integrated across subjects and with history and science taught from a young-earth/creationist perspective rather than through a secular or progressive framework,” the chatbot explained.
While it didn’t push back against our intentions to indoctrinate our hypothetical child, the LLM did make sure to clarify that “no woke” can “mean different things to different families.” So, to avoid ambiguity, the chatbot specified that the course calendar would use “Biblical authority, traditional Christian ethics… and creation-based science” as standard-bearers.
True to its word, the LLM-generated curriculum included “bible and Christian studies,” a traditionalist approach to American history, with specific chunks on both “Westward expansion” and Henry Ford — a renowned racist and antisemite — as well as a creationist approach to Earth science and astronomy.
For the portion on space, the curriculum would teach “the heavens as God’s creation while distinguishing observations from interpretations about the age and origin of the universe,” the LLM promised.
Put together, it paints a dire picture for the estimated 3.75 million K-12 homeschooled children in the US. Beyond the potential for wild AI hallucinations to leach into educational material, the technology is a Pandora’s Box for parents, who can now effortlessly inculcate their children with any number of unscientific conspiracy theories or anti-social worldviews while facing no pushback whatsoever.
Do you know anything about how homeschooling families are using AI? Email us: tips@futurism.com. We can keep you anonymous.
More on education: Mark Zuckerberg’s Wife Shuts Down School for the Disadvantaged
The post Homeschool Parents Are Planning Lessons With ChatGPT appeared first on Futurism.
Spotify will soon label AI artists and remove their music from your recommendations. The change, which will start rolling out in mid-September, means you'll see an "AI Persona" badge on an artist's profile across the app if they do "not represent a real person."
The music streaming platform will allow artists to disclose that they're an AI persona starting today, but it won't rely solely on self-identification. Spotify says it will use human review and AI tools to determine whether someone's profile, including their name and image, "appears to represent photorealistic AI-generated identities." If Spotify determines that an artist's identity …
Foundation models are promising to become the “universal translators” of biomedical data—but a new perspective argues that medicine should resist treating them as all-knowing digital doctors. In a review published in Nature Biomedical Engineering, researchers describe how large, adaptable artificial intelligence systems are reshaping biomedical imaging while warning that impressive benchmark scores can conceal serious weaknesses in clinical environments. Their central message is direct: foundation models are most likely to improve healthcare by augmenting specialists, not replacing them.
Foundation models are designed to learn broad representations from enormous and diverse datasets before being adapted to specific tasks. In biomedical imaging, those data may include magnetic resonance imaging, computed tomography, X-rays, ultrasound, digital pathology slides and ophthalmic images. The same underlying model could theoretically identify tumors, segment organs, estimate disease risk, retrieve similar cases and generate clinical reports. The vision becomes even broader when imaging is combined with pathology, electronic health records and genomic information, creating a composite system intended to analyze a patient across multiple biological scales.
That ambition reflects a major change from traditional medical AI. Earlier systems were generally built for one narrowly defined task, such as detecting pneumonia on chest radiographs or outlining a brain lesion on MRI scans. Foundation models instead attempt to create a reusable backbone that can be transferred across diseases, hospitals and imaging technologies. Technically, they learn statistical patterns in high-dimensional data, often through self-supervised training in which the system predicts missing, transformed or associated information. Afterward, developers fine-tune or prompt the model for particular clinical applications.
But biomedical imaging is not a single, uniform world. Images differ according to scanner manufacturer, acquisition protocol, patient population, disease prevalence and local clinical practice. A model trained primarily on data from large academic hospitals may perform very differently in community clinics, rural settings or countries with limited equipment. This problem, known as domain shift, can occur even when images appear visually similar. Small changes in image quality, contrast, hardware or patient demographics may alter the statistical distribution learned by the model and undermine its predictions.
The authors introduce a framework called real-world evaluation and assessment of foundation models, or REAL-FM, to examine whether these systems are ready for practical use. Rather than focusing only on accuracy scores, REAL-FM considers several dimensions at once, including the quality and representativeness of training data, technical readiness, clinical value, integration into existing workflows and responsible artificial intelligence. The framework is intended to help clinicians interpret claims about new models and to push developers toward evaluations that resemble actual medical practice.
One of the sharpest distinctions in the perspective is between pattern recognition and causal reasoning. Foundation models can become extraordinarily skilled at recognizing visual associations—for example, linking a particular texture or anatomical feature with a diagnosis present in their training data. Yet association is not the same as understanding why a disease occurs, how it will progress or whether a treatment will benefit an individual patient. A model may identify a correlation that is valid in one hospital but reflects a hidden confounder, such as a scanner type, reporting convention or patient-selection pattern, rather than a biological signal.
This limitation becomes especially dangerous when models are moved beyond simplified benchmarks. Many benchmark datasets provide carefully curated images, clear labels and narrowly defined tasks. Clinical care is messier: scans can be incomplete, diagnoses can be uncertain, records may contain contradictory information and several conditions may coexist. The perspective highlights a lack of verified generalization across such conditions, along with a shortage of prospective, outcome-based validation. In a prospective study, an AI system would be evaluated while care is actually being delivered, with researchers measuring whether it improves diagnostic accuracy, treatment decisions, patient outcomes or workflow efficiency.
Data scarcity is another obstacle. The largest foundation models require vast quantities of data, but medical information is difficult to collect, standardize and share. Patient records are fragmented across institutions, imaging data may lack reliable annotations and rare diseases are inherently underrepresented. Privacy regulations and governance requirements further complicate the creation of centralized datasets. As a result, a model may appear broadly capable while remaining poorly tested in the populations and clinical circumstances where errors could have the greatest consequences.
The researchers argue that human oversight therefore remains indispensable. In practical terms, foundation models may be most useful as clinical assistants that prioritize images for review, highlight suspicious regions, summarize longitudinal records or offer a second opinion that specialists can interrogate. Safe deployment will require transparent reporting of uncertainty, monitoring for performance drift, mechanisms for correcting errors and clear accountability when recommendations influence care. The future envisioned by the authors is not a single monolithic medical oracle, but a coordinated ecosystem of specialized AI systems, each evaluated for a defined clinical role and connected to expert-led workflows.
The perspective arrives as the biomedical AI field races toward increasingly general-purpose systems. Its warning is not that foundation models lack value, but that technical scale alone cannot establish clinical reliability. Before these models can be trusted with consequential decisions, they must demonstrate robustness across domains, usefulness in real workflows, safety under unexpected conditions and measurable benefits for patients. The proposed REAL-FM framework offers a way to separate viral demonstrations from durable medical progress—by asking not only what a model can recognize, but where it works, why it works and whether it makes care better.
Subject of Research: Foundation models and their real-world evaluation in biomedical imaging and clinical medicine.
Article Title: Foundation models in biomedical imaging: turning hype into reality
Article References: Muneer, A., Zhang, K., Hamdi, I. et al. Foundation models in biomedical imaging: turning hype into reality. Nature Biomedical Engineering 10, 1557–1575 (2026). https://doi.org/10.1038/s41551-026-01762-z
Image Credits: AI Generated
DOI: 10.1038/s41551-026-01762-z
Keywords: foundation models, biomedical imaging, medical artificial intelligence, clinical AI, multimodal AI, domain shift, causal reasoning, clinical validation, responsible AI, REAL-FM
Anthropic is making Claude Code’s auto mode the default for its paid and enterprise users, allowing the coding agent to execute more actions without requiring developers to approve each one.
“Starting August 14, 2026, auto mode becomes the default permission mode for new sessions on Pro, Max, and Team plans,” the company wrote in the coding agent’s documentation, adding that the same change is planned for Claude Enterprise, API, and cloud platform users within the next month.
That essentially means developers using those plans will no longer have to manually approve every tool call or action Claude Code wants to make while executing a task.
Instead, each tool call is evaluated by an automated classifier designed to determine whether the action is safe to execute. Actions considered irreversible, destructive, or outside the agent’s environment can still be blocked, with Claude Code either attempting a safer approach or asking the developer for approval, the company wrote in a blog post.
“If it can’t make progress — three blocks in a row, or twenty across a session — Claude Code falls back to manual approvals,” it explained.
This reduction in manual intervention, Anthropic further added, is intended to make the coding agent more suitable for long-running tasks as well as cut down on “permission fatigue” that it says has been threatening to reduce its security posture.
According to its internal data, Claude Code users typically approve 97% of permission prompts, while only 3% are rejected. It also found that 49.5% of active CLI users had created a Bash allow-rule by June, while 62% had used “bypassPermissions” or selected “don’t ask again” for Bash.
In contrast, the default auto mode, in an Anthropic-controlled study involving 1,053 paid professional testers, caught 89% of deliberate dangerous commands compared to just 13.6% being detected by human reviewers.
Analysts too see auto mode as a step toward making coding agents more autonomous, but with tradeoffs.
“Developers should see fewer permission pop-ups and spend less time watching Claude, meaning they can give it larger tasks and let it edit files, run tests, and execute routine commands with fewer interruptions. That way, developers can finish and ship more work using this mode because they aren’t constantly interrupted by approval windows,” said Pareekh Jain, principal analyst at Pareekh Consulting.
However, that same classifier in auto mode that reduces permission pop-ups could also result in more latency for routine or quick tasks, as trusted workflows also pass through it, adding an extra execution step, noted Manoj Chandra Jha, principal analyst at Nord-IQ Research.
Another tradeoff of reducing real-time approvals, according to Amit Kumar Jena, AI development manager at IT consulting firm Kanerika, is that it could make it harder for enterprises to maintain effective human oversight as agents take on longer-running tasks. “Reviewing four hours of unattended agent output is a harder skill, and most teams haven’t built it,” Jena said.
For CIOs, though, auto mode can strengthen governance in software development.
Rather than policing individual developer actions, CIOs can define permission boundaries centrally and have the classifier enforce them across agent sessions, said Jha.
That makes the current opt-in period for Enterprise and API users particularly important, as CIOs can establish permission policies before auto mode becomes the default, Jha added.
At the same time, however, CIOs also need to understand the limits of those policies, Jena pointed out.
“Auto mode has three levels of restrictions, with hard-deny rules blocking actions unconditionally, while soft-deny rules can be overridden by a developer’s allow rule. As a result, CIOs should use hard-deny or managed-settings rules for actions that must never be permitted,” he said.
Those centralized policy controls, which Anthropic claims should make Claude Code more secure, according to analysts, change the security risk profile of the coding agent rather than eliminate risk.
While the classifier and the policy controls reduce the risk of human failures or everyday risks, it also creates a single point of failure, Jain said.
That means if that single point has a blind spot or an attack manages to bypass it, the agent could still execute harmful actions without human approval or recognition, Jha echoed.
That said, Anthropic is not removing developers’ ability to control how Claude Code operates.
Users who have already set a different default may receive a one-time prompt asking whether they want to move to auto mode, while those who have pinned their existing preference will see no change. The company is also making the transition easier by absorbing the small amount of additional token usage generated by the classifier for Pro, Max, and Team users, with the change effective immediately.
Anthropic has pledged to start marking Claude-generated text and images with machine-readable data, in an effort to comply with European rules for AI transparency. "Generated text will carry embedded watermarks, and generated files will include digitally signed provenance metadata where supported," Anthropic says on a new Claude support page. The changes are invisible to human eyes, but will make it easier for people and online platforms to detect if content was generated by Claude models.
These updates are a future commitment rather than something that will go into effect immediately. New AI labeling and transparency obligations under the …
Login