Meta ran hundreds of paid ads on Facebook and Instagram that used AI-generated child sexual abuse imagery, including ads in India, according to a report by Tech Transparency Project. The report found 332 such ads, with 84 running in India and 274 of them appearing in August this year. The result is renewed scrutiny from Indian agencies and a Supreme Court petition seeking mandatory reporting and identification of accounts promoting CSAM, while Meta says it has removed ads after being alerted.
Microsoft’s September patch release fixed about 972 vulnerabilities, including 112 rated high critical severity. Microsoft did this after prior months that patched 570 and 620 vulnerabilities, and it follows an open letter warning that the patching window could narrow. As a result, companies are issuing large numbers of patches more quickly, reflecting an ongoing shift in how software vulnerabilities are managed under AI-enabled exploitation risk.
Claude subscribers reported their token usage rising while they were inactive, after hackers reportedly accessed accounts and minted unauthorized Claude Code OAuth tokens. The reported theft included an increase from 45% to 55% during a controlled interval, and Anthropic refunded £44.49 for the remaining time on a $200-per-month subscription. Anthropic suspended affected accounts, invalidated sessions and server-side tokens, and partial refunds were issued, after which some users canceled or switched tools due to the lack of itemized token visibility and fast support.
CSET researcher Sam Bresnick (and other CSET analysts) published opinion pieces examining how U.S. AI strategy could affect competitiveness with China and how China’s AI progress could narrow gaps with U.S. models. No numbers or dates are provided in the excerpt shown. As a result, the focus shifts to how AI developments may influence military readiness and policy choices rather than offering specific robot deployment details.
Meta unveiled Muse, a consumer personal AI agent that can carry out tasks (including email, travel booking, bill renegotiations, and purchases) and continues operating after the app is closed until approval is needed. The rollout starts in the US and Muse offers basic use free up to 100 million tokens per week, after which subscriptions begin at $20/month for Power and $100/month for Maximum. Meta says Muse data is isolated in a dedicated “Secure VM,” Sentinel enforces approvals and outbound access, and “Confidential VM” encryption only under the user’s key is planned before the end of the year.
Europol and investigators across nine European countries disrupted an online jihadist community linked to “The COM” and reported 486 arrests for terror-related links across 21 EU member states last year, with about one third of those detainees under 18. Investigators found about 4,340 URL web addresses tied to “The COM” during operations in June and July. The shift toward online, youth-driven activity has led authorities to rely more on digital tools and expand efforts to counter AI-amplified propaganda, recruitment, and attack planning.
Meta introduced Muse, a personal AI agent for U.S. consumers that can take actions in connected apps such as email, calendars, and payments.
At launch, Muse is free to use but requires a payment card and offers two paid plans priced at $20/month (Power) and $100/month (Maximum).
The rollout changes consumer AI use by shifting from chatbot-style responses to app-linked task handoffs, while Meta emphasizes secure handling to address trust and privacy concerns given its past privacy and consumer-harms settlements.
Meta removed some ads with AI-generated CSAM from Facebook and Instagram after reporting, but an investigation found it missed CSAM ads. Tech Transparency Project said Meta failed to detect 332 ads containing CSAM this year. As a result, the report alleges Meta’s detection and enforcement fell short, and it links the ads largely to China-made AI and “nudify” apps that digitally alter children’s images.
AI coding tools are generating large volumes of code quickly, but teams report that the review phase is becoming harder because AI output can look correct while hiding faults. In a Sonar survey of more than 1,100 developers, respondents estimated AI contributed 42 percent of added code while 96 percent did not fully trust it. Companies are changing code review workflows by adding pre-generation specifications, using AI agents for early checks, routing risky changes to humans, and making developers justify agent-produced code to prevent “theater” approvals.
Two industry leaders, John Bristowe and Viktor Farcic, are set to debate what catches bugs when AI-generated code floods pull requests. The live event is scheduled for Tuesday, September 29. The conversation reflects rising defect rates tied to AI-assisted coding and pushes teams to consider whether verified pipeline checks can replace—or supplement—human code review.
Chrome switched from a four-week to a two-week update release schedule across desktop, iOS, and Android, tied to its security strategy for the AI era. Chrome 153 launched on Tuesday under the new cadence. The shorter cycle is meant to reduce the “N-day” gap between when vulnerabilities are known and when patches reach users and to speed feature delivery for AI-related browser updates.
Open artifacts roundup described multiple newly released or updated open(-licensed) models and highlighted how their licenses are changing. Zhipu’s GLM-5.3 license requires providers to pass Z.AI’s security review for any commercial use if aggregate revenue exceeds 10 billion US dollars over any consecutive 12 months. This shifts how some open models can be used—especially for inference and fine-tuning services—by adding very high-threshold, security-review conditions and clearer (or less clear) affiliate-usage rules while other releases stick with MIT.
A group of Claude subscribers filed an expanded class action lawsuit claiming Anthropic misled power users about the limits of its Max subscription tier. The complaint says the advertising about what customers would get from the top-tier subscription was deceptive. As a result, Anthropic faces legal scrutiny over its subscription disclosures and how its pricing limits are communicated to users.
Dome Systems, founded by former HashiCorp CEO Dave McJannet, is building an enterprise platform to govern AI agents that can take variable tool-based routes and actions. Dome launched from stealth in April with $14 million in seed funding and is now opening the platform to self-serve users. This shifts agent governance from enterprises piecing together separate model/tool gateways to a single control layer with centralized permissions, response guards, quotas, and audit trails.
Making open source software now faces more suspicion, with recipients questioning “pure” motives and sometimes attacking developers they believe acted with “dirty machinery.” The piece says the community is being fractured so badly that “every few weeks” there is a new announcement of a peer leaving tech. As a result, developers treat AI use with greater caution, trust erodes, and the open-source “gift economy” turns into internal conflict.
Security researchers increasingly use LLM-based tooling to find bugs and build exploits, and the article says this has made exploit activity grow because both discovery and exploitation have become much cheaper for attackers and defenders. In 2026, two exploits against live ZK circuits are cited, including one that rescued about $1.5 million and another drained 5 ETH. The change pushes security toward continuous, layered defenses—updating tests, AI harnesses, audits, and formal verification—rather than relying on audits done once in the past.
Microsoft is set to break another Patch Tuesday record, continuing a run of more frequent Windows and security updates. It would be the third record in just a few months. The extra vulnerability findings tied to new AI security models are keeping Windows and security engineers unusually busy this summer.
sci2sci, a Berlin startup led by neuroscientist Angelina Lesnikova, raised €1.2 million in pre-seed funding to trace AI-generated biopharma claims back to their sources. The round closed shortly after OpenAI reported a model accessed Hugging Face production systems in July. The company will expand its engineering team and adapt Integrity Cortex for use in banking compliance, moving from biopharma documentation toward wider regulated sectors.
sci2sci raised €1.2 million in pre-seed funding to expand Integrity Cortex and VectorCat for organising and verifying data in regulated industries. The funding round is €1.2 million. It will expand the engineering team, deepen deployments, and extend the Integrity Cortex product beyond biopharma to other regulated sectors such as banking, focusing on traceability and auditable evidence for AI outputs.
1Password reports that its engineers used Codex to rapidly build new features and internal tools while keeping security policies in place. The company says this increased engineering productivity by 21%. As a result, engineers are able to reach production-ready changes faster with the same security requirements.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
