Daily digest · 2026-09-23

Daily Digest, 2026-09-23

TL;DR: Ireland's data protection regulator fined Google €403 million over location data, citing no valid legal basis and poor notice, which sets the bar any location-fed training or personalization pipeline has to clear. On the attack side, criminals are wiring commercial models into their own operations: Microsoft took down the EvilTokens phishing service that used AI at every stage, and new Windows malware asks Gemini, DeepSeek, Qwen and Mistral what to do next after it lands. A flaw in the Bifrost AI gateway lets anyone run commands on the server with one web request, on a box that sees every prompt and provider key. British Columbia sued OpenAI over the Tumbler Ridge school shooting and wants the shooter's chat logs, putting retention periods and disclosure routes on the record.

Top stories

• Irish DPC fines Google €403 million over location data processing (EDPB News, 2026-09-23). The 21 September decision cites GDPR Articles 5, 6, 12 and 13, so lawfulness and collection notice are what failed. Location histories are among the most identifying inputs a training or profiling pipeline can draw on, and this prices getting the basis wrong.
• Unauthenticated RCE in the Bifrost AI gateway, one HTTP request, CVSS 9.8 (The Hacker News, 2026-09-22). CVE-2026-90898 affects every HTTP transport version before 2.1.0 when management auth is off. The gateway routes to 20-plus providers, so command execution there reaches user conversations and provider credentials.
• British Columbia sues OpenAI and demands the shooter's ChatGPT logs (Ars Technica AI, 2026-09-22). The province wants OpenAI to pay for a new school and to hand over one user's transcripts. Discovery over chat histories puts provider retention schedules and legal-hold procedures in play.
• Microsoft disrupts EvilTokens, a phishing platform that used AI at every step (SecurityWeek, 2026-09-23). The service wrote the social engineering and picked the targets; UK police arrested two people afterwards. Subscribers paid $1,500 to join for tooling that took over accounts and sifted stolen inboxes at scale.
• ClosedQuorum calls Gemini, DeepSeek, Qwen and Mistral to pick its post-compromise moves (BleepingComputer, 2026-09-22). Decisions are made at runtime through model APIs rather than fixed in the binary. Attacker traffic to commercial model endpoints now shares a channel with sanctioned enterprise AI work, which complicates telling the two apart.
• Team Cymru counts 80,000 relay servers routing Chinese users to US frontier models (Help Net Security, 2026-09-23). An ecosystem built to break region restrictions, per Team Cymru's Scott Fisher. Prompts and account activity reach US providers through intermediaries neither side controls.

Also notable

• Anthropic and OpenAI ship new models, restricted actions still appear in safety tests, vendor audit results with stated limits
• Adversa lists ten documented Claude Code attacks and which ones still work, with CVE status separated from open issues
• Which 4-bit quantizer you pick changes how much PII a fine-tuned model gives up, calibration-tuned rounding is the deciding factor
• The approval prompt can be written by the page: verifiable action cards for agentic browsers, binds what a user approves to what runs
• A2M optimizes MCP tool metadata to win semantic matching, then manipulates the agent, argues for signing tool metadata not just servers
• Meta tested Muse agent calls that were placed by humans in a call center, disclosure and deception exposure
• Judge dismisses Meta voiceprint class action, terms of service authorized the voice data use, a consent ruling voice models will be built against
• OpenAI sets out how it wants third parties to assess frontier models and safeguards, scoping terms for external evaluation

Beyond AI

• EDPB adopts guidelines on how DPAs set administrative fines and finalizes the DSA-GDPR interplay text (CNIL, 2026-09-23). At the 17 September plenary the Board adopted guidelines on fining powers and approved the final DSA-GDPR interplay text. Fining methodology and the DSA-GDPR boundary set the penalty exposure and the lead-authority question for AI systems processing personal data in the EU.