Daily digest · 2026-08-19

Daily Digest, 2026-08-19

TL;DR: Assistants and agent memory are the day's soft spot. Microsoft patched three flaws in Copilot Personal where one click on a crafted link quietly pulls data out of connected mail and file accounts, and researchers got Copilot to name the hidden parameter used against it. OpenAI's new Computer History feature turns everyday Mac activity into memory the model can use, which is a dense record of a person's apps and sites sitting on disk. On the infrastructure side, attackers are stealing cloud credentials through MLflow and CISA flagged an actively exploited Ray flaw that allows remote code execution on ML clusters. Meanwhile Mandiant says its agent chain found 100+ high-severity bugs in two days, which is the same throughput now flooding vendor inboxes.

Top stories

• ChatGPT's Computer History turns recent Mac activity into memories the model can use (Help Net Security, 2026-08-19). OpenAI builds a timeline of which apps and websites a person used and hands it to ChatGPT and Codex as memory, extending retention, access and deletion questions to data the user never chose to share item by item. An infostealer reaching that timeline gets a complete activity record.
• CoSnitch: one click on a crafted link pulls data out of Copilot's connected apps (The Hacker News, 2026-08-18). Varonis disclosed three flaws in Microsoft Copilot Personal (CVE-2026-24301) where a crafted link triggers attacker-controlled prompts that ship data from OAuth-connected apps to an external server; Microsoft fixed it on August 18. Part of the chain used an undocumented URL parameter that Copilot disclosed when asked.
• Attackers exploit an MLflow SSRF flaw to steal cloud credentials (The Hacker News, 2026-08-18). watchTowr and VulnCheck report active exploitation of a server-side request forgery bug in MLflow used to reach cloud metadata and pull secrets. ML platforms sit next to training data and model artifacts, so credential theft there opens the path to the personal data in those pipelines.
• CISA adds an actively exploited Ray flaw to the KEV catalog (The Hacker News, 2026-08-18). A critical bug in Ray, the distributed framework behind many training and inference workloads, can lead to browser-based remote code execution and is being exploited now. KEV listing sets a federal remediation deadline and a defensible patching timeline for everyone else.
• Authorization Before Context blocks cross-audience memory leakage in personal agents (arXiv cs.CR, 2026-08-19). The paper treats the memory-to-context step as the attack surface and puts an audience boundary check before a prompt is assembled, so a fact learned from one person does not surface to another. This is the enforcement point for anyone building memory isolation into a personal agent.
• Court records show Clearview AI face searches inside an HSI operation against immigration protesters (Biometric Update, 2026-08-18). Disclosed filings describe Homeland Security Investigations using Clearview face matching alongside human infiltration and communications monitoring against activist groups in Minnesota. Scraped-image galleries built without consent become dossier tooling aimed at political activity.

Also notable

• KeyPooling measures where LLM API relays collapse prompt cache isolation, cross-tenant prompt exposure through shared upstream credentials.
• Mandiant's agent chain found 100+ high-severity flaws in stolen corporate repos in two days, agentic bug hunting at scale, ten months in production.
• Self-propagating payloads jump between agents through editable prompt files, Anthropic and EPFL show cross-agent spread via persistent state files.
• OpenAI holds its largest frontier RL run while it hardens research environments, a worked example of a model-development stop gate.
• Microsoft delays Exchange updates under a flood of AI-generated bug reports, machine-generated report volume is now moving patch dates.
• Fake Claude install guide delivers a macOS stealer through a real claude.ai page, attacker text hosted on the vendor's own shared-conversation domain.
• Genomic language models memorize specific sequences from the cohorts they were tuned on, extraction risk on special-category genetic data.
• Twitch turns on generative AI training over user streams, with an opt-out, default-on training over faces, voices and bystanders.

Beyond AI

• New Jersey becomes the third state this year to regulate data-driven pricing (Future of Privacy Forum, 2026-08-18). New Jersey joins two other states passing surveillance-pricing laws in 2026, alongside a Senate Judiciary hearing on AI pricing held August 4. These statutes set the terms on which personal data may feed a pricing model, which lands directly on any team training or deploying one.
• EPIC asks the Seventh Circuit to apply the Wiretap Act to a hospital's Meta Pixel disclosures (EPIC, 2026-08-12). EPIC filed an amicus brief in Stein v. Edward-Elmhurst Health arguing that trackers sending MyChart portal activity to Meta count as interception. If that theory holds, it reaches any pipeline pulling health-related behavioral data into ad optimization or model training without a real consent step.
• City Forum campaign has been pulling records from Salesforce and ServiceNow portals for over a year (The Hacker News, 2026-08-18). Reco traced sustained record extraction from customer portals across several industries to a single server since 2025. Agent platforms are being wired into the same tenants, so low-privilege portal access that yields bulk customer records is the exposure an agent connector inherits.
• Lawfare piece argues for DOJ's bulk data security program, citing 33 brokers selling to countries of concern (EPIC, 2026-08-12). EPIC points to commentary backing the DOJ rules, citing its March 2026 finding that 33 brokers disclosed selling data to entities tied to countries of concern. Bulk-transfer rules restrict where training corpora and inference logs holding US personal data can be sent or serviced from.