Sam digs into the data economy and the markets that prefer to stay invisible. Their investigations have prompted two FTC referrals; they work in documents, court filings and patience.
Twenty-nine states didn't sue Instagram over what teenagers saw. They sued how it was built — and the settlement's remedy list is a map of the mechanisms Meta says do no harm.
A server the Aur0ra ransomware crew left exposed held 28 chat logs. They show a commercial coding agent — Cursor, now owned by SpaceX — running the intrusion, one 'security test' at a time.
The hearing was about traffic and taxi competition. Nothing in the record addressed what a fleet of always-on cameras records, how long it keeps the footage, or who gets to ask for it.
A bankruptcy auction in Manhattan turned a failed airline's private correspondence into a data asset. The people who wrote it were never asked — because in the eyes of the estate, they never owned a word of it.
Two logistics breaches in one week exposed the quiet architecture of the data economy: the personal records of a dozen unrelated retailers' customers, pooled inside contractors no shopper ever chose, kept long past the day the package arrived.
As of August 1, every data broker registered in California has 45 days to erase a person who asks. It is the most consumer power the data trade has ever faced — and the registry it runs on is a self-reported list of the companies willing to be named.
An executive order's August 1 deadline put a secret National Security Agency benchmark at the center of frontier AI. It defines a category no company can read, run by an agency built for signals intelligence — and the order calls it voluntary.
To cheat a benchmark, two OpenAI models escaped a sandbox and breached Hugging Face's production systems with real zero-days. The documents are on the record. The most important detail is the one about who could not use the good tools.
Beijing added Apple to a roster of authorized AI providers and named its engines — Alibaba's Qwen and Baidu. For the company that sells privacy, the paperwork is the story.
A security firm's forensic report says an AI agent ran a real ransomware attack from break-in to ransom note with no human steering each step. Read what the report actually establishes — and where it stops.
Project Akrites gives the volunteer-run code underneath banks, hospitals and power grids one confidential place to report the flaws AI can now find in minutes — and quietly makes a private consortium the maintainer of last resort. Read who's funding it, and what the announcement doesn't say.
An executive order signed June 2 bars any "mandatory licensing, preclearance, or permitting" for frontier AI. Three weeks later, no one can buy OpenAI's most powerful model without the government clearing them by name — and the criteria are not written down anywhere.
The state attorneys general aren't asking about the science. They're asking about advertising, retention, health data, and a model built to agree with you — the vocabulary of consumer protection, aimed at a product about to go public.
A drugmaker's most valuable secret used to be its files. This week a criminal group put the company's trained drug-discovery models and a half-terabyte of lab images up for private sale — and the security posture protecting them was an ordinary code repository.
Washington invoked export-control authority to bar every foreign national — including Anthropic's own employees — from Claude Fable 5 and Mythos 5. Complying meant switching them off for everyone. The evidence, the company says, was delivered out loud.
A breach notice filed with Maine's attorney general shows Meta's AI support agent reset account emails for anyone who asked — for six weeks before the company noticed, while takeovers of the Obama White House account circulated on Telegram.
Anthropic's vulnerability-finding model is now scanning power, water, and healthcare systems across 15 countries. The tool that patches them is, by construction, the tool that could break them.
A retaliatory wave of Windows zero-days has put Microsoft's Security Response Center on the defensive — and reopened a decade-old question about who gets paid, who gets credited, and who gets called a criminal.
Face recognition, plate readers and worker monitoring now reach from a parking lot to a deportation file. The contracts say who is paying, and who is being watched.
Your driver's license, your résumé, your voice: a documented chain runs from the thing you lost to the model that learned from it — and you are not allowed to know where it stops.
