Instinct’s private-access AI personal assistant has drawn privacy and security criticism from testers after it was found to access user devices and email and operate under terms that broadly grant the company ongoing rights to user materials and device-captured inputs. The Terms of Service include a “perpetual and irrevocable” license covering user materials, including for training the AI models. The backlash is prompting users to question whether this level of autonomy is acceptable and to push for fixes like data-deletion controls and clearer consent for actions taken on their behalf.
Several AI agent platforms released similar “bot roster” interfaces but defined different security boundaries for what a misbehaving bot can access across agents. Grok Bot’s documentation and design describe sharing a persistent cloud workspace and user account sessions, with the interface updated to match within a week of Hermes Bot Mode in Hermes Agent v0.20.3 dated August 17. As a result, operators must follow each product’s security guidance and choose based on whether isolation is enforced at the account level, profile level, runtime sandbox, or per-agent containers—because the roster interface alone does not determine containment.
Flock Safety’s neighborhood camera network has faced mounting privacy and civil-liberties backlash, prompting cities to drop or renegotiate contracts over data-ownership and machine-learning training concerns. Flock operates in more than 5,000 communities across 49 states, and at least 36 states have documented camera vandalism. Flock says it is adding new guardrails including a recommended seven-day data-retention policy, but some agencies are rewriting terms to bar the company from using collected data and LAPD has begun renegotiation.
The UAE’s Cyber Security Council says it has detected and contained coordinated AI-assisted cyberattacks targeting aviation, energy, and education sectors since February. The council reported about 800,000 hacking attempts a day since February, four times the prewar level. The result is that the UAE is speeding up defense via its May 12 “Cyber Factory” effort to build AI security systems alongside human analysts, aiming to close the exploitation-time gap from days to hours.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
