This is a permanent edition. It carries the briefing exactly as published on this date and does not change.
Anthropic's Claude Desktop App Accused of Invasive Browser Data Collection
Reports have emerged detailing concerning behavior by Anthropic's Claude Desktop application, specifically its alleged scanning of local machine browsers and modification of application access settings even for browsers not yet installed. This suggests proactive and potentially unauthorized data collection practices or broad permission requests that raise significant privacy concerns. Users are alarmed by the application's deep system interaction without explicit consent or clear justification for such extensive access. This incident highlights ongoing challenges in managing software permissions and data handling, especially within the rapidly evolving AI application landscape.
Following Schrems II, controllers using SCCs must additionally:
Obtain approval from the CJEU before each transfer, following the established cross-border transfer framework, with particular attention to documentation requirements
Only transfer pseudonymised data, under the international data flow requirements, with particular attention to documentation requirements, with corresponding accountability measures
Take no additional steps beyond signing the SCCs, following the established cross-border transfer framework, including appropriate organizational measures
Conduct a transfer impact assessment (TIA) to evaluate whether the legal framework of the recipient country provides essentially equivalent protection and implement supplementary measures if needed
The Next.js developer Vercel has confirmed a security incident involving a customer credential compromise. While initial reports cited a breach at Context AI, Vercel's confirmation indicates broader implications for its own customer base, leading to concerns about the security of developers using their platform. This highlights the interconnectedness of supply chain security and the significant risks associated with third party vendor breaches.
Vibe coding upstart Lovable is denying claims of a data leak, attributing the issue to 'intentional behavior' and shifting blame towards HackerOne. This situation highlights the complex nature of breach investigations, particularly when internal and external security assessments offer conflicting narratives. The dispute underscores the intricate challenges in digital forensics and accountability following reported security incidents, complicating transparency for affected users.
A Scottish individual has pleaded guilty in the US, becoming the second person linked to the Scattered Spider group to admit guilt for cryptocurrency theft. This development underscores the ongoing international efforts to combat cybercrime and hold perpetrators accountable, highlighting successful cross border legal cooperation. The case serves as a reminder of the global reach of cyber security laws and enforcement actions targeting sophisticated hacking collectives.
Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.