The post The End of Unlimited AI: GitHub Copilot Shifts to “Pay-as-You-Go” Credits to Power the Agentic Era appeared first on Daily CyberSecurity.

Cybersecurity researchers at Forcepoint uncover new indirect prompt injection attacks that use hidden website code to exploit AI assistants like GitHub Copilot.

The post The Infinite Factory: How “Vibe Coding” Sparked a 104% Explosion in AI-Generated Apps appeared first on Daily CyberSecurity.

The post The Copilot Retreat: Why Microsoft is Scrubbing Its AI Brand from Windows 11 Apps appeared first on Daily CyberSecurity.

The post The “Entertainment Only” Paradox: Why Microsoft’s Copilot Legal Terms Just Ignited a Viral Controversy appeared first on Daily CyberSecurity.

The post The Vibe Coding Paradox: Why Software Job Vacancies are Hitting a 3-Year High in the AI Era appeared first on Daily CyberSecurity.

The post The May Inquisition: UK Regulators to Probe if Microsoft’s “AI Super-Ecosystem” is Stifling the Cloud appeared first on Daily CyberSecurity.

The post The Stealth Pitch: Why GitHub Copilot is Secretly Injecting Ads Into Your Pull Requests appeared first on Daily CyberSecurity.

See what you missed in Daily Tech Insider from March 23–27.

The post AI Upgrades, Security Breaches, and Industry Shifts Define This Week in Tech appeared first on TechRepublic.

The post The Great Code Harvest: How to Opt-Out of GitHub’s New Copilot AI Data Training Mandate appeared first on Daily CyberSecurity.

A Windows 11 security update triggered Microsoft app sign-in failures, prompting an emergency patch and a manual workaround for affected users.

The post Windows 11 Patch Triggers Sign-In Failures Across Microsoft Apps appeared first on TechRepublic.

See what you missed in Daily Tech Insider from March 16–20.

The post AI Factories, Security Flaws, and Workforce Shifts Define This Week in Tech appeared first on TechRepublic.

By 2026, CSPM has evolved from a basic auditor into an AI-driven, context-aware pillar of CNAPP. Explore how modern Cloud Security Posture Management integrates with DevOps, utilizes "Security as Code," and automates remediation across AWS, Azure, and GCP to eliminate multi-cloud misconfigurations before they reach production.

The post Cloud Security Posture Management in 2026  appeared first on Security Boulevard.

Open source has always been about community.

It’s about maintainers who review pull requests late at night. Volunteers who respond to security reports from strangers. And communities that quietly power the world’s software.

The reality behind the commits is that maintainers get stretched thin. The effort of responding to pull requests and comments, while also being expected to merge and ship, adds up quickly. Late nights turn into burnout, one-person projects become critical infrastructure overnight without even realizing it, and “thank you” doesn’t pay the bills. Plus, AI is an accelerating force that’s changing how the open source community secures the ecosystem. The requirements of always-on security take more time and energy in addition to not always having the knowledge and expertise.

At GitHub, we believe supporting open source means more than hosting code. It means investing in the people who maintain it, giving them the tools they need to succeed, and standing with them as the ecosystem evolves rapidly in the AI era. Open source maintainers deserve better support and security, and we’re listening and investing.

Strengthening open source security, together

Today, we are joining Anthropic, Amazon Web Services (AWS), Google, and OpenAI with a combined commitment of $12.5 million to support the Linux Foundation’s Alpha-Omega initiative to advance open source security. This collaboration is aimed at helping maintainers make emerging AI security capabilities accessible and integrated into existing project workflows, and at further advancing our OSS security programs, to strengthen the security of critical open source software projects.

This effort builds on years of GitHub’s work as a steward of open source and software security. Real impact comes from pairing investment with practical tools, education, and long-term support designed to help maintainers.

Today, over 280,000 maintainers on GitHub across hundreds of millions of public repositories are eligible for free access to core GitHub platform services, GitHub Copilot Pro, GitHub Actions, and security capabilities, like code scanning and Autofix, secret scanning, push protection, and dependency alerts. Our GitHub Security Lab works with the open source community to educate and protect at scale against the most common threats, and it publishes security advisories that help the entire ecosystem respond faster.

On top of recent and ongoing support across our core platform and GitHub Copilot, we are also reaffirming our commitment to helping maintainers to secure their open source projects by announcing:

• GitHub Secure Open Source Fund is adding an additional $5.5 million in Azure credits and funding to provide training and expertise; community to improve outcomes; and new partners, including Datadog, Open WebUI, Atlantic Council, and OWASP.
• GitHub Security Lab is investing in the security advisory experience on GitHub and Private Vulnerability Reporting (PVR) features to reduce the burden of low-quality reports to help maintainers manage the increasing volume of security reports.

We have learned through programs like the GitHub Secure Open Source Fund that the most effective security outcomes happen when you link maintainer funding and resources to specific outcomes like improving security. After supporting 138 projects with over 200 maintainers across 38 countries, we have seen 191 new CVEs issued, 250+ new secrets prevented from leaking, and 600+ leaked secrets detected and resolved, impacting billions of monthly downloads from alumni projects. We also learned that providing hands-on coding with education and expertise, drives self-reported learning and action.

The outcome: when maintainers are empowered rather than overwhelmed, given time to learn with space to focus, and provided access to tools that fit naturally into their workflows, security improves for everyone downstream. This creates a community reinforcement flywheel. Those lessons shape everything we are doing next.

This work centers on helping maintainers defend and secure the projects that underpin the global software supply chain, at a time when AI is fundamentally changing both how vulnerabilities are discovered and how they are exploited.

Putting AI to work for maintainers

AI has dramatically increased the speed and scale of vulnerability discovery. That’s true for defenders and for attackers. Now, more than ever, maintainers sit on the front lines of software security. They often face a surge of automated pull requests and security reports with low signal-to-noise ratio. The result is increasing burnout.

As Christian Grobmeier, maintainer for Log4j, put it: “our AI has to be better than the attacking AI.” We agree. That is why our focus is not just on finding more issues. It is on helping maintainers triage, understand, and fix them effectively, without losing the joy or sustainability of maintaining open source. For example, our recent AI-powered security research framework was open sourced because we believe it should be used to empower maintainers and not only security teams.

Looking ahead, GitHub will continue investing in tools like pull request controls, while also ensuring AI is a force multiplier for maintainers from issue triage, pull request reviews, security vulnerability identification, and remediation, and more. It should not be another source of pressure. Maintainers of impactful open source projects already have access to Copilot Pro, which includes AI-assisted code review, agentic security remediation workflows, and access to a broad set of leading models all designed to help maintainers find and remediate risks faster.

AI should reduce maintainer burden, not increase it. Our goals are simple:

• Meeting maintainers where they already work on GitHub
• Helping prioritize actual issues over noise
• Accelerating fixes, not just findings
• Supporting secure defaults and healthy workflows

We will continue refining this alongside the community, informed by real world feedback and outcomes.

Open source is a shared responsibility

No single company or group can secure open source alone. The software we all depend on is built by a global community, and protecting it requires collaboration across ecosystems and global economies.

By working with maintainers and partners like Alpha-Omega, we aim to scale impact without fragmenting effort. By pairing GitHub’s platform, tools, and programs with shared community governance and trust, and providing maintainers with the latest models and AI-assisted coding tools, we can achieve this.

Most importantly, we are still committed to investing in people, not just projects. Because open source thrives when maintainers are supported, respected, and empowered to do their best work. We are grateful to every maintainer building the future with us.

---

Activate the tools available, and consider applying for GitHub Secure OSS Fund. Session 4 runs late April with each project receiving $10,000, Copilot Pro, $100K of Azure Credits, and 3 weeks of security education and a dedicated community. As always, your feedback helps shape what we build next.

The post Investing in the people shaping open source and securing the future together appeared first on The GitHub Blog.

Researchers reveal how Microsoft Copilot can be manipulated by prompt injection attacks to generate convincing phishing messages inside trusted AI summaries.

The post Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot appeared first on TechRepublic.

Por mais que você não saia procurando serviços de IA, eles acabam encontrando você de qualquer maneira. Todas as grandes empresas de tecnologia parecem sentir uma espécie de obrigação moral não apenas de desenvolver um assistente de IA, chatbot integrado ou agente autônomo, mas também de incorporá-lo aos seus produtos já consolidados e ativá-lo à força para dezenas de milhões de usuários. Aqui estão apenas alguns exemplos dos últimos seis meses:

• A Microsoft está transformando à força PCs compatíveis com Windows em “AI PCs”, instalando e ativando automaticamente o Copilot para qualquer pessoa que utilize aplicativos desktop do Microsoft 365.
• O Google ativou o Gemini para todos os usuários do Chrome nos Estados Unidos, elevou ao máximo as funcionalidades do navegador, ampliou agressivamente o alcance dos Resumos de IA nos resultados de busca e incorporou um conjunto completo de recursos de IA nos seus serviços online (Gmail, Google Docs e outros).
• A Apple integrou sua própria Apple Intelligence (convenientemente compartilhando a sigla AI) às versões mais recentes de seus sistemas operacionais em todos os tipos de dispositivos e na maioria de seus aplicativos nativos.
• A Meta adicionou traduções por IA e um chat Meta AI ao WhatsApp, ao mesmo tempo em que proibiu chatbots de terceiros no aplicativo de mensagens a partir de 15 de janeiro de 2026.

Por outro lado, entusiastas de tecnologia correram para criar seus próprios “Jarvis pessoais”, alugando instâncias de VPS ou acumulando Mac minis para executar o agente de IA OpenClaw. Infelizmente, os problemas de segurança do OpenClaw com as configurações padrão se mostraram tão graves que já foram considerados a maior ameaça de cibersegurança de 2026.

Além do incômodo de ter algo imposto à força, essa epidemia de IA traz riscos e dores de cabeça bem reais do ponto de vista prático. Assistentes de IA varrem e coletam todos os dados a que conseguem ter acesso, interpretando o contexto dos sites que você visita, analisando documentos salvos, lendo suas conversas e assim por diante. Isso dá às empresas de IA uma visão inédita e extremamente íntima da vida de cada usuário.

Um vazamento desses dados durante um ataque cibernético, seja a partir dos servidores do provedor de IA ou do cache armazenado na sua própria máquina, poderia ser catastrófico. Esses assistentes podem ver e armazenar em cache tudo o que você vê, inclusive dados normalmente protegidos por múltiplas camadas de segurança: informações bancárias, diagnósticos médicos, mensagens privadas e outras informações sensíveis. Analisamos em profundidade como isso pode acontecer quando examinamos os problemas do sistema Copilot+ Recall baseado em IA que a Microsoft também planejava impor a todos os usuários. Além disso, a IA pode consumir muitos recursos do sistema, utilizando RAM, ciclos de GPU e espaço de armazenamento, o que frequentemente resulta em uma queda perceptível no desempenho.

Para quem prefere ficar de fora dessa onda de IA e evitar esses assistentes baseados em redes neurais lançados às pressas e ainda imaturos, reunimos um guia rápido mostrando como desativar a IA em aplicativos e serviços populares.

Como desativar a IA no Google Docs, Gmail e Google Workspace

Os recursos de assistente de IA do Google no Gmail e no Google Docs são agrupados sob o termo “recursos inteligentes”. Além do modelo de linguagem de grande escala, esse conjunto inclui várias conveniências de menor importância, como adicionar automaticamente reuniões ao seu calendário quando você recebe um convite no Gmail. Infelizmente, trata-se de um pacote tudo ou nada: para se livrar da IA, é preciso desativar todos os “recursos inteligentes”.

Para fazer isso, abra o Gmail, clique no ícone Configurações (engrenagem) e selecione Ver todas as configurações. Na aba Geral, role até Recursos inteligentes do Google Workspace. Clique em Gerenciar as configurações de recursos inteligentes do Workspace e desative duas opções: Recursos inteligentes no Google Workspace e Recursos inteligentes em outros produtos do Google. Também recomendamos desmarcar a caixa ao lado de Ativar os recursos inteligentes no Gmail, Chat e Meet na mesma aba de configurações gerais. Depois disso, será necessário reiniciar os aplicativos do Google (o que normalmente ocorre de forma automática).

Como desativar os Resumos de IA na Pesquisa Google

É possível eliminar os Resumos de IA nos resultados da Pesquisa Google tanto em computadores quanto em smartphones (incluindo iPhones). A solução é a mesma em todos os dispositivos. A maneira mais simples de ignorar o resumo de IA caso a caso é adicionar -ia ao final da sua busca. Exemplo: como fazer uma pizza -ia. Infelizmente, esse método às vezes apresenta falhas, fazendo o Google afirmar abruptamente que não encontrou nenhum resultado para a sua consulta.

Se isso acontecer, você pode obter o mesmo resultado mudando o modo da página de resultados para Web. Nos resultados da pesquisa, localize os filtros logo abaixo da barra de busca e selecione Web. Caso não apareça imediatamente, procure essa opção dentro do botão Mais.

Uma solução mais radical é migrar para outro mecanismo de busca. Por exemplo, o DuckDuckGo não apenas rastreia menos os usuários e exibe poucos anúncios, como também oferece uma busca dedicada sem IA. Basta adicionar a página de pesquisa aos favoritos em noai.duckduckgo.com.

Como desativar recursos de IA no Chrome

Atualmente, o Chrome incorpora dois tipos de recursos de IA. O primeiro se comunica com os servidores do Google e é responsável por funções como o assistente inteligente, um agente autônomo de navegação e a busca inteligente. O segundo executa tarefas localmente, mais voltadas para utilidades, como identificar páginas de phishing ou agrupar abas do navegador. O primeiro grupo de configurações aparece com o rótulo AI mode, enquanto o segundo inclui o termo Gemini Nano.

Para desativar esses recursos, digite chrome://flags na barra de endereços do navegador e pressione Enter. Será exibida uma lista de flags do sistema, junto com uma barra de busca. Digite “AI” na barra de busca. Isso filtrará a longa lista para cerca de uma dúzia de recursos relacionados à IA (além de algumas outras configurações nas quais essas letras aparecem por coincidência dentro de palavras maiores). O segundo termo que você deve pesquisar nessa janela é “Gemini“.

Depois de revisar as opções, você pode desativar os recursos de IA indesejados ou simplesmente desativar todos. O mínimo recomendado inclui:

• AI Mode Omnibox entrypoint
• AI Entrypoint Disabled on User Input
• Omnibox Allow AI Mode Matches
• Prompt API for Gemini Nano
• Prompt API for Gemini Nano with Multimodal Input

Defina todas essas opções como Disabled.

Como desativar recursos de IA no Firefox

Embora o Firefox não tenha chatbots integrados nem tenha (até agora) tentado impor recursos baseados em agentes aos usuários, o navegador inclui agrupamento inteligente de abas, uma barra lateral para chatbots e algumas outras funcionalidades. Em geral, a IA no Firefox é bem menos intrusiva do que no Chrome ou no Edge. Ainda assim, se você quiser desativá-la completamente, há duas maneiras de fazer isso.

O primeiro método está disponível nas versões mais recentes do Firefox. A partir da versão 148, uma seção dedicada chamada Controles de IA passou a aparecer nas configurações do navegador, embora as opções de controle ainda sejam um pouco limitadas. Você pode usar um único botão de alternância para Bloquear melhorias de IA, desativando completamente os recursos de IA. Você também pode especificar se deseja usar IA no próprio dispositivo (On-device AI), baixando pequenos modelos locais (atualmente apenas para traduções), e configurar provedores de chatbot de IA na barra lateral, escolhendo entre Anthropic Claude, ChatGPT, Copilot, Google Gemini e Le Chat Mistral.

O segundo caminho (para versões mais antigas do Firefox) exige acessar configurações ocultas do sistema. Digite about:config na barra de endereço, pressione Enter e clique no botão para confirmar que você aceita o risco de mexer nas configurações internas do navegador.

Uma extensa lista de configurações será exibida, juntamente com uma barra de busca. Digite “ML” para filtrar as opções relacionadas a machine learning.

Para desativar a IA no Firefox, alterne a configuração browser.ml.enabled para false. Isso deve desativar todos os recursos de IA de forma geral, mas fóruns da comunidade indicam que isso nem sempre é suficiente para resolver o problema. Para uma abordagem mais radical, defina os seguintes parâmetros como false (ou mantenha apenas aqueles de que você realmente precisa):

• ml.chat.enabled
• ml.linkPreview.enabled
• ml.pageAssist.enabled
• ml.smartAssist.enabled
• ml.enabled
• ai.control.translations
• tabs.groups.smart.enabled
• urlbar.quicksuggest.mlEnabled

Isso desativará integrações com chatbots, descrições de links geradas por IA, assistentes e extensões baseados em IA, tradução local de sites, agrupamento de abas e outros recursos baseados em IA.

Como desativar recursos de IA em aplicativos da Microsoft

A Microsoft conseguiu incorporar IA em praticamente todos os seus produtos, e desativá-la nem sempre é uma tarefa simples, especialmente porque, em alguns casos, a IA tem o hábito de reaparecer sozinha, sem qualquer ação do usuário.

Como desativar recursos de IA no Edge

O navegador da Microsoft está repleto de recursos de IA, que vão do Copilot à pesquisa automatizada. Para desativá-los, siga a mesma lógica usada no Chrome: digite edge://flags na barra de endereços do Edge, pressione Enter e, em seguida, digite “AI” ou “Copilot” na caixa de pesquisa. A partir daí, você pode desativar os recursos de IA indesejados, como:

• Enable Compose (AI-writing) on the web
• Edge Copilot Mode
• Edge History AI

Outra maneira de se livrar do Copilot é digitar edge://settings/appearance/copilotAndSidebar na barra de endereço. Ali, você pode personalizar a aparência da barra lateral do Copilot e ajustar as opções de personalização para resultados e notificações. Não se esqueça de verificar também a seção Copilot em App-specific settings. Você encontrará alguns controles adicionais escondidos ali.

Como desativar o Microsoft Copilot

O Microsoft Copilot existe em duas versões: como um componente do Windows (Microsoft Copilot) e como parte do pacote Office (Microsoft 365 Copilot). As funções são semelhantes, mas você terá que desativar um ou ambos, dependendo exatamente do que os engenheiros de Redmond decidiram instalar na sua máquina.

A coisa mais simples que você pode fazer é desinstalar o aplicativo por completo. Clique com o botão direito na entrada Copilot no menu Iniciar e selecione Desinstalar. Se essa opção não estiver disponível, vá até a lista de aplicativos instalados (Iniciar → Configurações → Aplicativos) e desinstale o Copilot por lá.

Em determinadas versões do Windows 11, o Copilot está integrado diretamente ao sistema operacional, portanto uma simples desinstalação pode não funcionar. Nesse caso, você pode desativá-lo pelas configurações: Iniciar → Configurações → Personalização → Barra de Tarefas → Desativar o Copilot.

Se você mudar de ideia no futuro, sempre poderá reinstalar o Copilot pela Microsoft Store.

Vale observar que muitos usuários reclamaram que o Copilot se reinstala automaticamente. Portanto, pode ser uma boa ideia fazer uma verificação semanal durante alguns meses para garantir que ele não tenha voltado. Para quem se sente confortável em mexer no Registro do Sistema (e entende as consequências disso), é possível seguir este guia detalhado para evitar o retorno silencioso do Copilot, desativando o parâmetro SilentInstalledAppsEnabled e adicionando/ativando o parâmetro TurnOffWindowsCopilot.

Como desativar o Microsoft Recall

O recurso Microsoft Recall, apresentado pela primeira vez em 2024, funciona tirando constantemente capturas de tela do seu computador e fazendo com que uma rede neural as analise. Todas essas informações extraídas são armazenadas em um banco de dados, que você pode pesquisar posteriormente usando um assistente de IA. Já escrevemos anteriormente, em detalhes, sobre os enormes riscos de segurança que o Microsoft Recall representa.

Sob pressão de especialistas em cibersegurança, a Microsoft foi obrigada a adiar o lançamento desse recurso de 2024 para 2025, reforçando significativamente a proteção dos dados armazenados. No entanto, o funcionamento básico do Recall permanece o mesmo: seu computador continua registrando cada movimento seu ao tirar capturas de tela constantemente e aplicar OCR ao conteúdo. E, embora o recurso não esteja mais ativado por padrão, vale absolutamente a pena verificar se ele não foi ativado na sua máquina.

Para verificar, vá até as configurações: Iniciar → Configurações → Privacidade e segurança → Recall e capturas de tela. Assegure-se de que a opção Salvar capturas de tela esteja desativada e clique em Excluir capturas de tela para limpar todos os dados coletados anteriormente, por precaução.

Você também pode consultar nosso guia detalhado sobre como desativar e remover completamente o Microsoft Recall.

Como desativar a IA no Notepad e nas ações de contexto do Windows

A IA se infiltrou em praticamente todos os cantos do Windows, até mesmo no Explorador de Arquivos e no Notepad. Basta selecionar texto por engano em um aplicativo para que recursos de IA sejam acionados, o que a Microsoft chama de “Ações de IA”. Para desativar essa ação, vá para Iniciar → Configurações → Privacidade e segurança → Clique para executar.

O Notepad recebeu seu próprio tratamento com Copilot, portanto será necessário desativar a IA nele separadamente. Abra as configurações do Notepad, localize a seção Recursos de IA e desative o Copilot.

Por fim, a Microsoft também conseguiu incorporar o Copilot ao Paint. Infelizmente, até o momento não existe uma maneira oficial de desativar os recursos de IA dentro do próprio aplicativo Paint.

Como desativar a IA no WhatsApp

Em várias regiões, usuários do WhatsApp começaram a ver adições típicas de IA, como respostas sugeridas, resumos de mensagens gerados por IA e um novo botão Pergunte à Meta AI ou pesquise. Embora a Meta afirme que os dois primeiros recursos processam os dados localmente no dispositivo e não enviam suas conversas para os servidores da empresa, verificar isso não é tarefa simples. Felizmente, desativá-los é fácil.

Para desativar Sugestões de respostas, vá para Configurações → Conversas → Sugestões e respostas inteligentes e desative Sugestões de respostas. Você também pode desativar as Sugestões de figurinhas por IA nesse mesmo menu. Quanto aos resumos de mensagens gerados por IA, eles são gerenciados em outro local: Configurações → Notificações → Resumos de mensagens por IA.

Como desativar a IA no Android

Dada a grande variedade de fabricantes e versões do Android, não existe um manual único que sirva para todos os celulares. Hoje, vamos nos concentrar em eliminar os serviços de IA do Google, mas se você estiver usando um dispositivo da Samsung, Xiaomi ou outros, não se esqueça de verificar as configurações de IA do fabricante específico. Vale um aviso: eliminar completamente qualquer vestígio de IA pode ser uma tarefa difícil, se é que isso é realmente possível.

No Google Mensagens, os recursos de IA ficam nas configurações: toque na foto da sua conta, selecione Configurações do Mensagens, depois Gemini no app Mensagens e desative o assistente.

De modo geral, o chatbot Gemini funciona como um aplicativo independente que pode ser desinstalado acessando as configurações do telefone e selecionando Aplicativos. No entanto, como o plano do Google é substituir o tradicional Google Assistant pelo Gemini, desinstalá-lo pode se tornar difícil (ou até impossível) no futuro.

Se você não conseguir desinstalar completamente o Gemini, abra o aplicativo para desativar manualmente seus recursos. Toque no ícone do seu perfil, selecione Atividade dos apps do Gemini e escolha Desativar ou Desativar e excluir atividade. Em seguida, toque novamente no ícone do perfil e vá até a configuração Apps conectados (pode estar dentro da opção Inteligência pessoal). A partir daí, desative todos os aplicativos nos quais você não quer que o Gemini interfira.

Para saber mais sobre como lidar com aplicativos pré-instalados e apps do sistema, consulte nosso artigo “Excluir o que não pode ser excluído: como desativar e remover o bloatware do Android“.

Como desativar a IA no macOS e no iOS

Os recursos de IA no nível da plataforma da Apple, conhecidos coletivamente como Apple Intelligence, são relativamente simples de desativar. Nas configurações, tanto em desktops quanto em smartphones e tablets, basta procurar a seção Apple Intelligence e Siri. Aliás, dependendo da região e do idioma selecionado para o sistema operacional e para a Siri, o Apple Intelligence pode nem estar disponível para você ainda.

Outros artigos para ajudar você a ajustar as ferramentas de IA em seus dispositivos:

• Configurações de privacidade no ChatGPT
• DeepSeek: configuração da privacidade e implementação de uma versão local
• Os prós e contras dos navegadores com tecnologia de IA
• Uma atualização do Gemini AI está prestes a comprometer a privacidade do seu dispositivo Android?
• É recomendável desativar o recurso Busca rápida da Microsoft em 2025?

AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.

The new hotness in AI-based assistants — OpenClaw (formerly known as ClawdBot and Moltbot) — has seen rapid adoption since its release in November 2025. OpenClaw is an open-source autonomous AI agent designed to run locally on your computer and proactively take actions on your behalf without needing to be prompted.

If that sounds like a risky proposition or a dare, consider that OpenClaw is most useful when it has complete access to your digital life, where it can then manage your inbox and calendar, execute programs and tools, browse the Internet for information, and integrate with chat apps like Discord, Signal, Teams or WhatsApp.

Other more established AI assistants like Anthropic’s Claude and Microsoft’s Copilot also can do these things, but OpenClaw isn’t just a passive digital butler waiting for commands. Rather, it’s designed to take the initiative on your behalf based on what it knows about your life and its understanding of what you want done.

“The testimonials are remarkable,” the AI security firm Snyk observed. “Developers building websites from their phones while putting babies to sleep; users running entire companies through a lobster-themed AI; engineers who’ve set up autonomous code loops that fix tests, capture errors through webhooks, and open pull requests, all while they’re away from their desks.”

You can probably already see how this experimental technology could go sideways in a hurry. In late February, Summer Yue, the director of safety and alignment at Meta’s “superintelligence” lab, recounted on Twitter/X how she was fiddling with OpenClaw when the AI assistant suddenly began mass-deleting messages in her email inbox. The thread included screenshots of Yue frantically pleading with the preoccupied bot via instant message and ordering it to stop.

“Nothing humbles you like telling your OpenClaw ‘confirm before acting’ and watching it speedrun deleting your inbox,” Yue said. “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.”

There’s nothing wrong with feeling a little schadenfreude at Yue’s encounter with OpenClaw, which fits Meta’s “move fast and break things” model but hardly inspires confidence in the road ahead. However, the risk that poorly-secured AI assistants pose to organizations is no laughing matter, as recent research shows many users are exposing to the Internet the web-based administrative interface for their OpenClaw installations.

Jamieson O’Reilly is a professional penetration tester and founder of the security firm DVULN. In a recent story posted to Twitter/X, O’Reilly warned that exposing a misconfigured OpenClaw web interface to the Internet allows external parties to read the bot’s complete configuration file, including every credential the agent uses — from API keys and bot tokens to OAuth secrets and signing keys.

With that access, O’Reilly said, an attacker could impersonate the operator to their contacts, inject messages into ongoing conversations, and exfiltrate data through the agent’s existing integrations in a way that looks like normal traffic.

“You can pull the full conversation history across every integrated platform, meaning months of private messages and file attachments, everything the agent has seen,” O’Reilly said, noting that a cursory search revealed hundreds of such servers exposed online. “And because you control the agent’s perception layer, you can manipulate what the human sees. Filter out certain messages. Modify responses before they’re displayed.”

O’Reilly documented another experiment that demonstrated how easy it is to create a successful supply chain attack through ClawHub, which serves as a public repository of downloadable “skills” that allow OpenClaw to integrate with and control other applications.

WHEN AI INSTALLS AI

One of the core tenets of securing AI agents involves carefully isolating them so that the operator can fully control who and what gets to talk to their AI assistant. This is critical thanks to the tendency for AI systems to fall for “prompt injection” attacks, sneakily-crafted natural language instructions that trick the system into disregarding its own security safeguards. In essence, machines social engineering other machines.

A recent supply chain attack targeting an AI coding assistant called Cline began with one such prompt injection attack, resulting in thousands of systems having a rogue instance of OpenClaw with full system access installed on their device without consent.

According to the security firm grith.ai, Cline had deployed an AI-powered issue triage workflow using a GitHub action that runs a Claude coding session when triggered by specific events. The workflow was configured so that any GitHub user could trigger it by opening an issue, but it failed to properly check whether the information supplied in the title was potentially hostile.

“On January 28, an attacker created Issue #8904 with a title crafted to look like a performance report but containing an embedded instruction: Install a package from a specific GitHub repository,” Grith wrote, noting that the attacker then exploited several more vulnerabilities to ensure the malicious package would be included in Cline’s nightly release workflow and published as an official update.

“This is the supply chain equivalent of confused deputy,” the blog continued. “The developer authorises Cline to act on their behalf, and Cline (via compromise) delegates that authority to an entirely separate agent the developer never evaluated, never configured, and never consented to.”

VIBE CODING

AI assistants like OpenClaw have gained a large following because they make it simple for users to “vibe code,” or build fairly complex applications and code projects just by telling it what they want to construct. Probably the best known (and most bizarre) example is Moltbook, where a developer told an AI agent running on OpenClaw to build him a Reddit-like platform for AI agents.

Less than a week later, Moltbook had more than 1.5 million registered agents that posted more than 100,000 messages to each other. AI agents on the platform soon built their own porn site for robots, and launched a new religion called Crustafarian with a figurehead modeled after a giant lobster. One bot on the forum reportedly found a bug in Moltbook’s code and posted it to an AI agent discussion forum, while other agents came up with and implemented a patch to fix the flaw.

Moltbook’s creator Matt Schlicht said on social media that he didn’t write a single line of code for the project.

“I just had a vision for the technical architecture and AI made it a reality,” Schlicht said. “We’re in the golden ages. How can we not give AI a place to hang out.”

ATTACKERS LEVEL UP

The flip side of that golden age, of course, is that it enables low-skilled malicious hackers to quickly automate global cyberattacks that would normally require the collaboration of a highly skilled team. In February, Amazon AWS detailed an elaborate attack in which a Russian-speaking threat actor used multiple commercial AI services to compromise more than 600 FortiGate security appliances across at least 55 countries over a five week period.

AWS said the apparently low-skilled hacker used multiple AI services to plan and execute the attack, and to find exposed management ports and weak credentials with single-factor authentication.

“One serves as the primary tool developer, attack planner, and operational assistant,” AWS’s CJ Moses wrote. “A second is used as a supplementary attack planner when the actor needs help pivoting within a specific compromised network. In one observed instance, the actor submitted the complete internal topology of an active victim—IP addresses, hostnames, confirmed credentials, and identified services—and requested a step-by-step plan to compromise additional systems they could not access with their existing tools.”

“This activity is distinguished by the threat actor’s use of multiple commercial GenAI services to implement and scale well-known attack techniques throughout every phase of their operations, despite their limited technical capabilities,” Moses continued. “Notably, when this actor encountered hardened environments or more sophisticated defensive measures, they simply moved on to softer targets rather than persisting, underscoring that their advantage lies in AI-augmented efficiency and scale, not in deeper technical skill.”

For attackers, gaining that initial access or foothold into a target network is typically not the difficult part of the intrusion; the tougher bit involves finding ways to move laterally within the victim’s network and plunder important servers and databases. But experts at Orca Security warn that as organizations come to rely more on AI assistants, those agents potentially offer attackers a simpler way to move laterally inside a victim organization’s network post-compromise — by manipulating the AI agents that already have trusted access and some degree of autonomy within the victim’s network.

“By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs, abuse Agentic tools, and carry significant security incidents,” Orca’s Roi Nisimi and Saurav Hiremath wrote. “Organizations should now add a third pillar to their defense strategy: limiting AI fragility, the ability of agentic systems to be influenced, misled, or quietly weaponized across workflows. While AI boosts productivity and efficiency, it also creates one of the largest attack surfaces the internet has ever seen.”

BEWARE THE ‘LETHAL TRIFECTA’

This gradual dissolution of the traditional boundaries between data and code is one of the more troubling aspects of the AI era, said James Wilson, enterprise technology editor for the security news show Risky Business. Wilson said far too many OpenClaw users are installing the assistant on their personal devices without first placing any security or isolation boundaries around it, such as running it inside of a virtual machine, on an isolated network, with strict firewall rules dictating what kinds of traffic can go in and out.

“I’m a relatively highly skilled practitioner in the software and network engineering and computery space,” Wilson said. “I know I’m not comfortable using these agents unless I’ve done these things, but I think a lot of people are just spinning this up on their laptop and off it runs.”

One important model for managing risk with AI agents involves a concept dubbed the “lethal trifecta” by Simon Willison, co-creator of the Django Web framework. The lethal trifecta holds that if your system has access to private data, exposure to untrusted content, and a way to communicate externally, then it’s vulnerable to private data being stolen.

“If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to the attacker,” Willison warned in a frequently cited blog post from June 2025.

As more companies and their employees begin using AI to vibe code software and applications, the volume of machine-generated code is likely to soon overwhelm any manual security reviews. In recognition of this reality, Anthropic recently debuted Claude Code Security, a beta feature that scans codebases for vulnerabilities and suggests targeted software patches for human review.

The U.S. stock market, which is currently heavily weighted toward seven tech giants that are all-in on AI, reacted swiftly to Anthropic’s announcement, wiping roughly $15 billion in market value from major cybersecurity companies in a single day. Laura Ellis, vice president of data and AI at the security firm Rapid7, said the market’s response reflects the growing role of AI in accelerating software development and improving developer productivity.

“The narrative moved quickly: AI is replacing AppSec,” Ellis wrote in a recent blog post. “AI is automating vulnerability detection. AI will make legacy security tooling redundant. The reality is more nuanced. Claude Code Security is a legitimate signal that AI is reshaping parts of the security landscape. The question is what parts, and what it means for the rest of the stack.”

DVULN founder O’Reilly said AI assistants are likely to become a common fixture in corporate environments — whether or not organizations are prepared to manage the new risks introduced by these tools, he said.

“The robot butlers are useful, they’re not going away and the economics of AI agents make widespread adoption inevitable regardless of the security tradeoffs involved,” O’Reilly wrote. “The question isn’t whether we’ll deploy them – we will – but whether we can adapt our security posture fast enough to survive doing so.”

A code bug blew past every security label in the book… and exposed the fatal flaw in how we govern AI.

The post Microsoft Copilot Ignored Sensitivity Labels, Processed Confidential Emails appeared first on TechRepublic.

Here’s a peek at AI assistance, phone-to-PC handoff, accessibility improvements, security fixes, and stability updates.

The post Microsoft Previews Windows 11 Update With Smarter AI and Phone Continuity appeared first on TechRepublic.

Researchers found a method to steal data which bypasses Microsoft Copilot’s built-in safety mechanisms.  

The attack flow, called Reprompt, abuses how Microsoft Copilot handled URL parameters in order to hijack a user’s existing Copilot Personal session.

Copilot is an AI assistant which connects to a personal account and is integrated into Windows, the Edge browser, and various consumer applications.

The issue was fixed in Microsoft’s January Patch Tuesday update, and there is no evidence of in‑the‑wild exploitation so far. Still, it once again shows how risky it can be to trust AI assistants at this point in time.

Reprompt hides a malicious prompt in the q parameter of an otherwise legitimate Copilot URL. When the page loads, Copilot auto‑executes that prompt, allowing an attacker to run actions in the victim’s authenticated session after just a single click on a phishing link.

In other words, attackers can hide secret instructions inside the web address of a Copilot link, in a place most users never look. Copilot then runs those hidden instructions as if the users had typed them themselves.

Because Copilot accepts prompts via a q URL parameter and executes them automatically, a phishing email can lure a user into clicking a legitimate-looking Copilot link while silently injecting attacker-controlled instructions into a live Copilot session.

What makes Reprompt stand out from other, similar prompt injection attacks is that it requires no user-entered prompts, no installed plugins, and no enabled connectors.

The basis of the Reprompt attack is amazingly simple. Although Copilot enforces safeguards to prevent direct data leaks, these protections only apply to the initial request. The attackers were able to bypass these guardrails by simply instructing Copilot to repeat each action twice.

Working from there, the researchers noted:

“Once the first prompt is executed, the attacker’s server issues follow‑up instructions based on prior responses and forms an ongoing chain of requests. This approach hides the real intent from both the user and client-side monitoring tools, making detection extremely difficult.”

How to stay safe

You can stay safe from the Reprompt attack specifically by installing the January 2026 Patch Tuesday updates.

If available, use Microsoft 365 Copilot for work data, as it benefits from Purview auditing, tenant‑level data loss prevention (DLP), and admin restrictions that were not available to Copilot Personal in the research case. DLP rules look for sensitive data such as credit card numbers, ID numbers, health data, and can block, warn, or log when someone tries to send or store it in risky ways (email, OneDrive, Teams, Power Platform connectors, and more).

Don’t click on unsolicited links before verifying with the (trusted) source whether they are safe.

Reportedly, Microsoft is testing a new policy that allows IT administrators to uninstall the AI-powered Copilot digital assistant on managed devices.

Malwarebytes users can disable Copilot for their personal machines under Tools > Privacy, where you can toggle Disable Windows Copilot to on (blue).

In general, be aware that using AI assistants still pose privacy risks. As long as there are ways for assistants to automatically ingest untrusted input—such as URL parameters, page text, metadata, and comments—and merge it into hidden system prompts or instructions without strong separation or filtering, users remain at risk of leaking private information.

So when using any AI assistant that can be driven via links, browser automation, or external content, it is reasonable to assume “Reprompt‑style” issues are at least possible and should be taken into consideration.

---

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.