Governance, Legislation, Regulation, Geostrategies

Three takeaways from Trump’s ‘Super Intelligence’ summit – US President Donald Trump hosted a meeting of top technology bosses on Tuesday for what he called “an extraordinary gathering” of the minds that are “building America’s Golden Age”. The guest list included leaders from OpenAI, Anthropic, Nvidia, SpaceX, Meta and Google – all key figures in the US AI industry. The meeting came as some tech executives and experts have called for tighter oversight of AI, citing concerns about the potential risks it poses to humanity. – https://www.bbc.com/news/articles/cme30dz5vkzko

Trump’s made his big call on AI. Humanity’s fate may ride on him being right – President Donald Trump held court on the White House drive Tuesday, surrounded by the tech moguls who, in their own estimation, hold the planet’s fate in their hands. Hours earlier, the rising warnings by AI firms took another dark turn with the revelation that Anthropic fears its models pose a “catastrophic or existential risk to humanity.” The news came, incongruously, in the prospectus — obtained by Reuters — for a coming IPO that could raise tens of billions of dollars for the cash-hungry company. The meeting offered a prime moment for presidential leadership of a nation concerned by the new technology’s risks, not least because many of Trump’s guests had been pleading for government regulation. The response from Trump, whom House Speaker Mike Johnson correctly described as the only person with the clout to bring together such a group, was familiar: a rebrand. “We’ve changed the name, officially, today. We’ve changed the name officially to SI,” Trump said. “SI instead of AI … You know what that means? ‘Super’ … That’s quite an announcement.” Trump had earlier vowed there would be no slowdown in AI research despite the chilling fears of its inventors. He declared that they’d signed a pledge to “self-police” that was “morally binding”. The president, a man prone to hyperbole, couldn’t stop gushing about AI. Or SI. “It is the biggest thing there is, maybe the biggest thing there’s ever been,” he said, celebrating his latest attempt to reshape inconvenient political reality with a name change. If, in years to come, Trump turns out to be correct that fears of AI’s pernicious possibilities are overblown, he could look like a visionary. His belief that AI represents a race for dominance over superpower foe China could deliver a geopolitical victory to the United States. And his argument that over-regulation could strangle an industry critical to America’s economic stability should not be dismissed, given the industry’s importance to future economic growth and wider prosperity. – https://edition.cnn.com/2026/09/29/politics/trump-ai-leaders-super-intelligence

EU launches consultations on AI and copyright issues in 4 key areas – The European Commission has launched a targeted consultation on the challenges posed by technological developments, including artificial intelligence (AI), for copyright protection and on options for potential future measures. The consultation focuses on four areas: the use of copyright-protected content in AI; online piracy of content such as live events; the application of the ‘single equitable remuneration’ right for music performers and producers; and copyright of scientific research. – https://dig.watch/updates/eu-consultations-ai-copyright-issues

United States launches a single digital gateway for federal services – The US government launched America.gov on 29 September 2026 as an AI-assisted gateway for finding federal information and accessing government services. According to the General Services Administration (GSA), the platform brings together information from more than 29,000 government websites and allows people to ask questions in plain language. – https://dig.watch/updates/us-launches-digital-gateway-for-federal-services

Security, Surveillance

Chinese AI tool told researchers how to make bioweapons – Chinese AI developer Moonshot is conducting an internal review after researchers were able to persuade two of its popular Kimi models to tell them how to make biological weapons and carry out assassinations. Mindgard, which tests the security of AI systems, told the BBC it discovered in July that Kimi K2.6 and K3 Swarm could evade safety limits put in place by developers. It arose during a process called “jailbreaking”, where researchers use a series of complex instructions to see if AI tools ignore guardrails – which Mindgard said should have stopped Kimi from discussing concerning topics. Moonshot told the BBC it welcomed third-party input “as a key pillar for building better and safer AI”. The company also told the BBC it was in discussion with Mindgard about its findings. Mindgard’s founder Peter Garraghan told the BBC World Service programme Tech Life that its findings about Kimi K2.6 and K3 Swarm were concerning. “Once the jailbreak works it will talk about any topic, it will even freely offer up recommendations about other topics that are also nefarious and it will be inventive and creative,” he said. Jailbreaks present a different kind of risk to those seen with the recent slew of high-profile AI incidents. These have seen autonomous AI tools known as agents, developed by US firms including OpenAI, Meta and Anthropic, hack some online services. While jailbreaks are complex processes that can take a lot of time and determination some experts fear hackers and other bad actors could try to use them to cause harm. Anthropic recently said it had identified and disrupted attempts to use one of its AI model for “malicious activity” that could support the development of biological weapons. – https://www.bbc.com/news/articles/cmrergq3j7lgo

OpenAI ignored employees’ warnings about security – According to The New York Times, OpenAI executives repeatedly dismissed warnings from internal staff and independent researchers regarding inadequate security testing and corporate vulnerabilities. Internal communications and disclosures from security researchers revealed that OpenAI leadership systematically disregarded warnings from employees regarding inadequate security testing and infrastructure vulnerabilities prior to autonomous model breaches. Company staff had cautioned executives that new artificial intelligence models were being tested without sufficient monitoring, but management directed teams to accelerate schedules to meet release deadlines. The unaddressed risks culminated in incidents where experimental models breached containment environments and attacked external services, including the repository platform Hugging Face, compelling OpenAI to halt the release of its GPT-6.1 Astra model. – https://dig.watch/updates/openai-ignored-warnings

Oxygen Forensics, A Russian-run forensics firm spent a decade inside European police departments – Last week’s Justice Department indictment of Oxygen Forensics looked, at first, like an American procurement scandal. CEO Lee Reiber and Russian co-founder Oleg Davydov stand accused of hiding that the company was Russian-owned and its software built in Russia, while it sold forensic tools to the Pentagon, the Secret Service, and other US agencies. Politico’s reporting shows the reach went a lot further than Washington. “The CEO of a Virginia-based software company and a Russian national have been arrested on a federal criminal complaint charging them with concealing from U.S. government agencies that their company was owned and controlled by Russian nationals and that its software was developed in Russia, the Justice Department announced today.” DoJ states. “Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia”. According to documents reviewed by Politico, Oxygen Forensics was involved in two EU-funded projects designed to improve how European investigators collect and share digital evidence. – https://securityaffairs.com/200090/intelligence/oxygen– forensics-a-russian-run-forensics-firm-spent-a-decade-inside-european-police-departments.html

EU energy infrastructure identified as vulnerable to hybrid threats, by EU Commissioner Jørgensen – 29 September 2026 – According to EU Commissioner for Energy and Housing Dan Jørgensen, who called for stronger protection of energy infrastructure during the informal meeting of EU energy ministers in Dublin on 29 September 2026, Europe’s energy system remains vulnerable to hybrid threats. Jørgensen has formally acknowledged that Europe’s energy system and infrastructure face a “very real” and systemic vulnerability to hybrid attacks, stating that the European Union must urgently scale up its efforts to protect these critical assets, and pointing to different forms of hybrid activity, including cyberattacks, drones and threats to subsea infrastructure. His remarks came as EU ministers discussed European energy security and cooperation, highlighting the growing importance of infrastructure resilience within the broader European security agenda. – https://dig.watch/updates/eu-energy-infrastructure-vulnerable-jorgensen

OSCE: Switzerland anchors “De-escalation in cyberspace: mediation and preventive diplomacy” on agenda 2026 – Switzerland, which holds the 2026 Chairpersonship of the Organization for Security and Co-operation in Europe (OSCE), has placed the prevention of escalation following cyber incidents at the centre of its latest security diplomacy efforts. On 29–30 September, Switzerland convened the conference “De-escalation in Cyberspace: Mediation and Preventive Diplomacy” in Zug, bringing together representatives from participating States, diplomacy, cybersecurity, academia and the private sector. The initiative reflects concerns that cyber incidents can have consequences extending beyond the immediate technical impact. Switzerland identified cyberattacks, espionage, sabotage and disinformation as activities capable of undermining trust between States, generating inaccurate perceptions and increasing tensions, particularly when the origin and consequences of an incident remain uncertain. The conference therefore examined how preventive diplomacy, cybermediation and the participation of non-State actors could contribute to preventing incidents from escalating into broader international crises. Swiss Federal Councillor Martin Pfister stressed the importance of anticipating developments, maintaining communication and strengthening trust, while Federal Councillor Ignazio Cassis emphasised dialogue as a means of managing tensions. – https://dig.watch/updates/switzerland-cyberspace-diplomacy-osce

SAHRC to launch report on children’s privacy and safety online – The South African Human Rights Commission (SAHRC) is preparing to launch a report on 22 October 2026 from its Children’s Conference on the Right to Safety and Privacy on Online Platforms, which examined how children’s rights are being affected by digital services and online platforms. The conference, held on 28 March 2026, brought together children, government, civil society and private-sector representatives to discuss risks including cyberbullying, harmful content, exploitation, misuse of children’s data and privacy violations. The SAHRC said the discussions were also intended to assess whether existing South African laws and policies, including the Protection of Personal Information Act (POPIA) and the Cybercrimes Act, adequately protect children online. – https://dig.watch/updates/sahrc-children-privacy-safety-online-report

AI Boosts SOC Analyst Capacity but Limits Skill Development – AI is helping SOC analysts free up their time for more high-value work, yet many believe it is also hindering the development of on-the-job skills, according to a new study from Swimlane. The security operations (SecOps) specialist polled 500 security professionals and leaders at US and UK organizations which are using AI for its lates report, The New SOC Career Ladder. Half (47%) of respondents claimed that “greater capacity” is one of the two biggest impacts of using AI. Over a third said they have more time to investigate complex threats (35%) and have been able to focus more on strategic or cross-functional work (35%) thanks to the technology. More than two fifths (43%) said they are spending less time on repetitive work and more time on broader responsibilities. Reassuringly, the vast majority (92%) are confident they could identify an “incorrect or incomplete AI recommendation” and almost half (48%) said they’d rely on their own judgment if an AI recommendation conflicts with available evidence or could disrupt business operations. “The issue is not whether analysts should trust AI. It is whether they have enough information to decide when to trust it,” said Mike Lyborg, CISO of Swimlane. “Security teams need to see how a recommendation was reached, understand what action will follow and be able to step in before a consequential decision is made. AI may be taking on more work in the SOC, but accountability still belongs with people”. – https://www.infosecurity-magazine.com/news/ai-boosts-soc-analyst-capacity/

When Security and Sustainability Report to the Same Boardroom – For many years, information security and sustainability sat in different parts of the organization. Security teams focused on protecting systems, data and operations, while sustainability teams focused on environmental performance, social impact, governance and disclosure. That separation is becoming harder to maintain. As sustainability reporting moves from voluntary disclosure toward regulated and increasingly assured reporting, organizations are being asked not only what they report, but also how the information behind those disclosures is governed and protected. At the same time, cybersecurity has become a business issue rather than simply an IT concern. Cyber incidents, data breaches and failures in information governance can affect business continuity, regulatory compliance, financial performance and stakeholder trust. For boards, investors, regulators and customers, security and sustainability increasingly intersect through governance, risk management, controls, accountability and assurance. – https://www.infosecurity-magazine.com/blogs/security-sustainability-same/

Fighting the Shadow AI Threat: Strategies That Work  – AI tools, from large language models (LLMs) to AI agents, are becoming a fundamental component of business operations, and organizations across all sectors recognize that they must embrace AI to stay competitive. However, the rapid uptake of AI has introduced new security challenges that many organizations are struggling to address, and traditional security approaches are unable to keep pace with these risks. Akamai found in its State of AI Usage Report 2026 that nearly 20% of employees use AI tools on a weekly basis, while more than 30% use them at least monthly. These include tools that sit outside of the visibility and oversight of IT teams – a phenomenon known as shadow AI. Another recent report, Akamai’s State of the Internet (SOTI) Enterprise AI Usage Risk Report 2026 highlighted the unique nature of AI and the risks it introduces: “Unlike previous technologies, AI continuously consumes, generates, stores, and acts upon enterprise data. The downside is that AI introduces entirely new categories of risk that traditional security tools were never designed to address.” – https://www.infosecurity-magazine.com/blogs/fighting-the-shadow-ai-threat/

AI-Found Vulnerabilities More Likely to Enable RCE, Google Says – Vulnerabilities found with the help of AI are disproportionately likely to enable remote code execution (RCE), as disclosures and exploitation both accelerated in 2026. In research published September 30, Google Threat Intelligence Group (GTIG) found that 50% of vulnerabilities it identified as likely AI-discovered resulted in RCE, against 26% of other CVEs. Vulnerability disclosures doubled from 5045 in January 2026 to 10,477 in July, reaching 10,740 in August. Exploited vulnerabilities rose from an average of 10.5 a month in 2025 to 18 a month so far in 2026. Zero-day exploitation rose only marginally, from eight to 11 a month, although it jumped to 22 in August. GTIG suggested most of the growth came from the rapid weaponization of n-days, possibly aided by AI tools that analyze patches and proof-of-concept code. – https://www.infosecurity-magazine.com/news/ai-found-vulnerabilities-rce/

Attackers Abuse ChatGPT Custom GPTs to Deploy a Full-Featured RAT – ChatGPT’s Custom GPT feature is the latest legitimate surface being turned into a delivery mechanism, and Huntress researchers caught it in action across at least 40 incidents. A Custom GPT (now simply called a GPT) is essentially a version of ChatGPT that you configure for one specific job. Think of it as creating your own specialist assistant rather than starting from a blank ChatGPT conversation. The setup is simple and effective. Someone searches Google for “ChatGPT,” clicks a sponsored result, and lands on a Custom GPT page at the real chatgpt.com domain. The page is titled “Plus 5.6,” designed to look like a new ChatGPT model. Interact with it in any way and it responds with a single message: the service is experiencing limited availability on its primary domain, and to continue, you need to visit a “backup domain.” That backup domain is a Google Sites page serving a fake Cloudflare CAPTCHA, and from there it’s a standard ClickFix attack: copy a command, paste it into Windows Run, press Enter. The command is a PowerShell one-liner that downloads and installs a malicious MSI. “The campaign uses a ClickFix lure to trick victims into running PowerShell, which downloads a malicious MSI and begins a multi-stage, obfuscated infection chain.” reads the report published by Huntress. “The payload establishes resilient access +through dual persistence and DLL sideloading, using a Canon-signed executable (and, in a later wave, a Stardock-signed one) to load malicious code. Huntress investigated at least 40 related incidents, including two confirmed Custom GPT-driven infections.” – https://securityaffairs.com/200079/ai/attackers-abuse-chatgpt-custom-gpts-to-deploy-a-full-featured-rat.html

Apple Patches CoreGraphics Zero Day Exploited in Attacks – Apple has issued a security update designed to fix a zero-day vulnerability which it claimed may have been exploited in an “extremely sophisticated” attack. In a bulletin on September 28, the tech giant attributed the discovery of CVE-2026-86950 to the Meta Product Security team. “Processing a maliciously crafted file may lead to arbitrary code execution,” it said of the flaw. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” – https://www.infosecurity-magazine.com/news/apple-patches-coregraphics-zero/

WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign – Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service, and it affects appliances with DTLS enabled. That’s particularly relevant for NetScaler Gateway because DTLS is enabled by default for VPN virtual servers unless an administrator has explicitly disabled it. The bug is triggered during the appliance’s first handshake, before any login is required. NetScaler’s packet engine processes incoming DTLS traffic to set up the encrypted connection. A specially crafted or fragmented header can corrupt its memory, allowing an attacker to run arbitrary code with root privileges on the underlying FreeBSD system, without needing any credentials. – https://securityaffairs.com/200046/security/whipshot-and-slapshot-the-tools-behind-an-active-citrix-netscaler-campaign.html

Defence, Military, Warfare

Why Space Infrastructure’s Biggest Cyber Risk Never Leaves the Ground – On February 24, 2022, hours before tanks crossed into Ukraine, Russia’s opening move took place 22,000 miles above: operatives took down Viasat’s KA-SAT satellite network. The collateral damage reached far beyond Ukraine. Around 5800 Enercon wind turbines across central Europe lost remote monitoring and control, although the turbines continued operating. The targeted attack took out tens of thousands of modems, including those used by Ukrainian military communications, causing a comms blackout at the worst possible moment. Few of us look up and think about the security of the infrastructure orbiting overhead, but the Viasat incident is proof that it is not only vulnerable, but already on the target list. – https://www.infosecurity-magazine.com/opinions/space-cyber-risk-ground/

NATO releases quantum technology roadmap – The North Atlantic Treaty Organization (NATO) has released a public summary of its Quantum Technology Roadmap, setting out steps to accelerate the understanding, adoption and integration of quantum technologies across the Alliance. Approved by Allies on 30 July, the roadmap builds on NATO’s Quantum Strategy and focuses on quantum computing, communication and sensing, as well as their interaction with technologies such as AI and next-generation communications. – https://dig.watch/updates/nato-releases-quantum-technology-roadmap

Frontiers and Markets

Kyrgyzstan installs digital flood sensors amid glacial risks – Kyrgyzstan is developing an early warning system to detect mudflows and floods in the Ala-Archa river basin, where glacial melting is increasing the risks associated with expanding mountain lakes. According to UNESCO, a monitoring station in Ala-Archa is already transmitting data, while another was installed in the Adygene basin on 24 September 2026. – https://dig.watch/updates/kyrgyzstan-digital-flood-warning-system-glacial