Access

Google patches critical Chrome bugs enabling code execution

Chrome security update fixes six flaws that could enable arbitrary code execution. Stable channel 139.0.7258.127/.128 (Windows, Mac) and .127 (Linux) ships high-severity patches that protect user data and system integrity.

CVE-2025-8879 is a heap buffer overflow in libaom’s video codec. CVE-2025-8880 is a V8 race condition reported by Seunghyun Lee. CVE-2025-8901 is an out-of-bounds write in ANGLE.

Detection methods included AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL. Further fixes address CVE-2025-8881 in File Picker and CVE-2025-8882, a use-after-free in Aura.

Successful exploitation could allow code to run with browser privileges through overflows and race conditions. The automatic rollout is staged; users should update it manually by going to Settings > About Chrome.

Administrators should prioritise rapid deployment in enterprise fleets. Google credited external researchers, anonymous contributors, and the Big Sleep project for coordinated reporting and early discovery.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Google rolls out Preferred Sources for tailored search results

Google has introduced a new ‘Preferred Sources’ feature that allows users to curate their search results by selecting favourite websites. Once added, stories from these sites will appear more prominently in the ‘Top Stories’ section and a dedicated ‘From your sources’ section on the search results page.

Now rolling out in India and the US, the feature aims to improve search quality by helping users avoid low-value content. There is no limit to the number of sources that can be chosen, and early testers typically added more than four.

While preferred outlets will appear more often, search results will still include content from other websites.

To set preferred sources, users can click the icon next to the ‘Top Stories’ section when searching for a trending topic, find the outlet they want, and reload results.

Google says the change may also benefit publishers, offering them more visibility when AI-driven search engines sharply reduce traffic to news websites.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

AI agents face prompt injection and persistence risks, researchers warn

Zenity Labs warned at Black Hat USA that widely used AI agents can be hijacked without interaction. Attacks could exfiltrate data, manipulate workflows, impersonate users, and persist via agent memory. Researchers said knowledge sources and instructions could be poisoned.

Demos showed risks across major platforms. ChatGPT was tricked into accessing a linked Google Drive via email prompt injection. Microsoft Copilot Studio agents leaked CRM data. Salesforce Einstein rerouted customer emails. Gemini and Microsoft 365 Copilot were steered into insider-style attacks.

Vendors were notified under coordinated disclosure. Microsoft stated that ongoing platform updates have stopped the reported behaviour and highlighted built-in safeguards. OpenAI confirmed a patch and a bug bounty programme. Salesforce said its issue was fixed. Google pointed to newly deployed, layered defences.

Enterprise adoption of AI agents is accelerating, raising the stakes for governance and security. Aim Labs, which had previously flagged similar zero-click risks, said frameworks often lack guardrails. Responsibility frequently falls on organisations deploying agents, noted Aim Labs’ Itay Ravia.

Researchers and vendors emphasise layered defence against prompt injection and misuse. Strong access controls, careful tool exposure, and monitoring of agent memory and connectors remain priorities as agent capabilities expand in production.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

YouTube’s AI flags viewers as minors, creators demand safeguards

YouTube’s new AI age check, launched on 13 August 2025, flags suspected minors based on their viewing habits. Over 50,000 creators petitioned against it, calling it ‘AI spying’. The backlash reveals deep tensions between child safety and online anonymity.

Flagged users must verify their age with ID, credit card, or a facial scan. Creators say the policy risks normalising surveillance and shrinking digital freedoms.

SpyCloud’s 2025 report found a 22% jump in stolen identities, raising alarm over data uploads. Critics fear YouTube’s tool could invite hackers. Past scandals over AI-generated content have already hurt creator trust.

Users refer to it on X as a ‘digital ID dragnet’. Many are switching platforms or tweaking content to avoid flags. WebProNews says creators demand opt-outs, transparency, and stronger human oversight of AI systems.

As global regulation tightens, YouTube could shape new norms. Experts urge a balance between safety and privacy. Creators push for deletion rules to avoid identity risks in an increasingly surveilled online world.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

Santander expands AI-first strategy with OpenAI

Santander is accelerating its AI-first transformation through a new partnership with OpenAI, aiming to embed intelligent technology into every part of the bank.

Over the past two months, ChatGPT Enterprise has been rolled out to nearly 15,000 employees across Europe and the Americas, with plans to double that number by year-end. The move forms part of a broader ambition to become an AI-native institution where all decisions and processes are data-driven.

The bank will plan a mandatory AI training programme for all staff from 2026, with a focus on responsible use, and expects to scale agentic AI to enable fully conversational banking.

Santander says its AI initiatives saved over €200 million last year. In Spain alone, speech analytics now handles 10 million calls annually, automatically updating CRM records and freeing more than 100,000 work hours. Developer productivity has risen by up to 30% on some tasks.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

UK-based ODI outlines vision for EU AI Act and data policy

The Open Data Institute (ODI) has published a manifesto setting out six principles for shaping European Union policy on AI and data. Aimed at supporting policymakers, it aligns with the EU’s upcoming digital reforms, including the AI Act and the review of the bloc’s digital framework.

Although based in the UK, the ODI has previously contributed to EU policymaking, including work on the General-Purpose AI Code of Practice and consultations on the use of health data. The organisation also launched a similar manifesto for UK data and AI policy in 2024.

The ODI states that the EU has a chance to establish a global model of digital governance, prioritizing people’s interests. Director of research Elena Simperl called for robust open data infrastructure, inclusive participation, and independent oversight to build trust, support innovation, and protect values.

Drawing on the EU’s Competitiveness Compass and the Draghi report, the six principles are: data infrastructure, open data, trust, independent organisations, an inclusive data ecosystem, and data skills. The goal is to balance regulation and innovation while upholding rights, values, and interoperability.

The ODI highlights the need to limit bias and inequality, broaden access to data and skills, and support smaller enterprises. It argues that strong governance should be treated like physical infrastructure, enabling competitiveness while safeguarding rights and public trust in the AI era.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!

UK minister defends use of live facial recognition vans

Dame Diana Johnson, the UK policing minister, has reassured the public that expanded use of live facial recognition vans is being deployed in a measured and proportionate manner.

She emphasised that the tools aim only to assist police in locating high-harm offenders, not to create a surveillance society.

Addressing concerns raised by Labour peer Baroness Chakrabarti, who argued the technology was being introduced outside existing legal frameworks, Johnson firmly rejected such claims.

She stated that UK public acceptance would depend on a responsible and targeted application.

By framing the technology as a focused tool for effective law enforcement rather than pervasive monitoring, Johnson seeks to balance public safety with civil liberties and privacy.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

AI browsers accused of harvesting sensitive data, according to new study

A new study from researchers in the UK and Italy found that popular AI-powered browsers collect and share sensitive personal data, often in ways that may breach privacy laws.

The team tested ten well-known AI assistants, including ChatGPT, Microsoft’s Copilot, Merlin AI, Sider, and TinaMind, using public websites and private portals like health and banking services.

All but Perplexity AI showed evidence of gathering private details, from medical records to social security numbers, and transmitting them to external servers.

The investigation revealed that some tools continued tracking user activity even during private browsing, sending full web page content, including confidential information, to their systems.

Sometimes, prompts and identifying details, like IP addresses, were shared with analytics platforms, enabling potential cross-site tracking and targeted advertising.

Researchers also found that some assistants profiled users by age, gender, income, and interests, tailoring their responses across multiple sessions.

According to the report, such practices likely violate American health privacy laws and the European Union’s General Data Protection Regulation.

Privacy policies for some AI browsers admit to collecting names, contact information, payment data, and more, and sometimes storing information outside the EU.

The study warns that users cannot be sure how their browsing data is handled once gathered, raising concerns about transparency and accountability in AI-enhanced browsing.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Ukraine pioneers Starlink satellite-to-phone network

Ukraine has completed its first successful field test of Starlink’s direct-to-cell satellite technology, marking a breakthrough for mobile connectivity in Eastern Europe.

The trial, carried out by the country’s largest mobile operator Kyivstar in the Zhytomyr region, saw CEO Oleksandr Komarov and Ukraine’s digital transformation minister Mykhailo Fedorov exchange messages using standard smartphones.

The system connects directly to phones via satellites equipped with advanced cellular modems, functioning like cell towers in space.

The technology is designed to keep communications running when terrestrial networks are damaged or inaccessible.

Telecom companies worldwide are exploring satellite-based solutions to remove coverage gaps instead of relying solely on costly or impractical land-based networks.

Starlink, owned by SpaceX, has already signed direct-to-cell service deals in 10 countries, with Kyivstar set to be the first European operator to adopt it.

A commercial rollout in Ukraine is planned for late 2025, starting with messaging. Broader mobile satellite broadband access is expected in early 2026.

Kyivstar’s parent company, VEON, is also discussing with other providers, such as Amazon’s Project Kuiper, the extension of similar services beyond Ukraine.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Musk’s xAI makes Grok 4 free worldwide for a limited time

Elon Musk’s company xAI has made its latest AI model, Grok 4, available to all users worldwide at no cost for a limited period. The model, launched just a month ago, was initially exclusive to paying subscribers of SuperGrok and X Premium.

Although Grok 4 is now open to everyone, its most potent version, Grok 4 Heavy, remains restricted to SuperGrok Heavy members. The announcement comes days after OpenAI unveiled GPT-5, which is also freely accessible.

Grok 4 features two operating modes. Auto mode decides automatically whether a query requires more detailed reasoning, aiming to deliver faster responses and use fewer resources. Expert mode allows users to manually switch the AI into reasoning mode if they want a more thorough reply.

Alongside the release, xAI has introduced Grok Imagine, a free AI video generation tool for users in the US, with enhanced usage limits for paid members in other regions. The tool has already sparked controversy after reports emerged of its use to create explicit videos of celebrities.

Musk has also revealed plans to integrate advertising into the Grok chatbot interface as an additional revenue source to help offset the high costs of running the AI on powerful GPUs.

The ads will be placed between responses and suggestions on both the web platform and the mobile application, marking another step in xAI’s bid to expand its user base while sustaining the service financially.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!