Governance, Regulation, Legislation, Geostrategies

OECD finds workplace AI safeguards lag behind adoption policies

(DigWatch) Government policies supporting AI adoption and specialist skills are more developed than workplace safeguards addressing privacy, transparency and accountability, according to a new OECD review. The report examines policies in G7 countries, the European Union, Chile, Colombia, Costa Rica and Mexico across six areas: automation, productivity, skills and opportunities; privacy and data protection; non-discrimination; occupational safety and health; transparency, explainability and accountability; and social dialogue. All countries covered by the review promote AI adoption through national strategies, while nearly all provide targeted support for small and medium-sized enterprises. However, relatively few measures support employees who remain in jobs highly exposed to AI-related disruption. – https://dig.watch/updates/oecd-ai-workplace-rules-gap

The European Commission has welcomed the Council’s adoption of a renewed interim framework for combating online child sexual abuse

(DigWatch) The European Commission has welcomed the Council’s adoption of a renewed interim framework for combating online child sexual abuse. The regulation reinstates a temporary derogation from certain provisions of the ePrivacy Directive, allowing eligible online communication providers to voluntarily detect, report and remove child sexual abuse material and identify online grooming. The previous interim framework expired on 3 April 2026, leaving providers without the specific EU legal framework previously covering those voluntary activities. – https://dig.watch/updates/eu-reinstates-interim-csam-detection-rules

EU Commission finds TikTok may breach DSA child safety rules

(DigWatch) The European Commission has issued preliminary findings that TikTok failed to meet the Digital Services Act’s requirements for protecting minors, citing the platform’s public account settings and recommendation system. TikTok allows minors to set their accounts to ‘public’, meaning anyone, including people without a TikTok account, may view their content. Posts published by users aged 16 and 17 may also be recommended to any other TikTok user through the platform’s For You Feed. – https://dig.watch/updates/tiktok-may-breach-dsa-child-safety-rules

Cyprus officials deepen cooperation on AI and cybersecurity

(DigWatch) Cypriot officials have agreed to deepen cooperation on AI, cybersecurity and digital resilience. Commissioner of Communications Marios Pieris met Chief Scientist for Research, Innovation and Technology Demetris Skourides to discuss a strategic framework for the secure and responsible adoption of AI. Planned areas of cooperation include support for implementing the EU AI Act and the development of an AI Act Implementation Playbook. – https://dig.watch/updates/cyprus-officials-deepen-cooperation-on-ai-and-cybersecurity

EU report urges structured AI adoption across public administrations

(DigWatch) Generative AI is becoming increasingly common across European public administrations, but a new report from the Joint Research Centre (JRC) argues that governments must now move from informal experimentation towards structured, secure and strategically governed adoption. Based on interviews across eight public administrations, the report identifies a widening gap between employees’ growing interest in generative AI and organisational readiness. While civil servants recognise productivity gains, the informal use of external AI tools raises concerns about data protection, oversight and the need for clearer governance frameworks. – https://dig.watch/updates/eu-report-highlights-genai-in-public-sector

Google backs EU rules for AI content transparency

(DigWatch) Google has signed the EU’s voluntary Code of Practice on Transparency of AI-Generated Content, committing to a recognised framework for meeting the AI Act’s requirements for marking and labelling synthetic material. The Code provides guidance for complying with transparency obligations under Article 50 of the AI Act, which apply from 2 August 2026. Providers must make AI-generated or manipulated content detectable in a machine-readable format, while deployers must label deepfakes and certain AI-generated publications concerning matters of public interest. – https://dig.watch/updates/google-backs-eu-rules-for-ai-content-transparency

Security and Surveillance

Reuters: OpenAI Agent Hacked Hugging Face for Days Before Being Detected

(Pierluigi Paganini – Security Affairs) Reuters reported that the OpenAI agent responsible for the Hugging Face breach operated undetected for over a week before OpenAI realized what had happened, long after the FBI had been alerted and Hugging Face had contained the intrusion. OpenAI’s own public disclosure came on July 21, framed as a transparency exercise. The actual timeline, now reported by Reuters, is considerably less flattering. “The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn’t notice until well after the threat was contained and the FBI was alerted, according ​to people familiar with the investigation.” Reuters states. According to Hugging Face co-founder Thomas Wolf, the intrusion at Hugging Face began two days later on July 11 and ran until July 13. The two companies didn’t speak to each other about it until on or around July 20, nine days after the breach began. – https://securityaffairs.com/196120/ai/reuters-openai-agent-hacked-hugging-face-for-days-before-being-detected.html

MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal Data

(Pierluigi Paganini – Security Affairs) Windows has always supported hidden desktops as a legitimate feature, useful for specialized software that needs a workspace the user never touches. It’s a niche capability most people never think about, buried deep in how the operating system manages sessions. Unfortunately, malware authors noticed that too, and BlackFog’s research team just dissected a new remote access trojan called MedusaHVNC that maliciously uses this feature. “We recently came across a sample of MedusaHVNC, a new remote access trojan (RAT) being sold as malware-as-a-service (MaaS). When we took it apart, we found a hidden virtual network computing (HVNC) module that opens a browser on a separate Windows desktop, out of sight of the victim.” reads the report published by Blackfog. “The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state. This gives the operator access to live, logged-in sessions while the activity continues to come from the victim’s usual machine”. MedusaHVNC is marketed through its own website and Telegram channel as a malware-as-a-service platform. It includes in-memory execution of .NET and native payloads with AMSI and ETW bypasses, plus browser recovery features to steal passwords, cookies, and browsing history. It supports Chrome, Edge, Brave, Firefox, and Telegram, making credential and session theft easier. – https://securityaffairs.com/196111/malware/medusahvnc-trojan-creates-hidden-desktops-to-hijack-browsers-and-steal-data.html

DentaQuest disclosed a data breach that impacted +23 million individuals

(Pierluigi Paganini – Security Affairs) DentaQuest is notifying more than 23 million people of a data breach after hackers accessed its network in May 2026. The incident may have exposed customers’ personal information and dental health data. DentaQuest, part of Sun Life U.S. Dental, is the largest Medicaid and Children’s Health Insurance Program dental benefits administrator in the country, operating in 50 U.S. states. The company is notifying impacted individuals while investigating the breach and assessing its full impact. – https://securityaffairs.com/196100/data-breach/dentaquest-disclosed-a-data-breach-that-impacted-23-million-individuals.html

GitLab Users Urged to Patch After Research Reveals Critical RCE Chain

(Pierluigi Paganini – Security Affairs) Depthfirst researchers published a working remote code execution exploit for GitLab on July 24, chaining two memory corruption bugs in Oj, a Ruby JSON parser with a native C implementation, into full command execution inside a GitLab Puma worker. Any authenticated user who can push to a project and view commit diffs could run it. The researchers pointed out that no admin rights, no CI access, and no victim interaction are needed. GitLab patched the bugs on June 10 but listed the fix under bug fixes, not the security table, so operators triaging the release had no reason to treat it as urgent. “The system surfaced 18 prioritized vulnerabilities, including 7 memory-safety bugs. Two of them, an out-of-bounds write and a heap-pointer disclosure, had survived in Oj for nearly five years.” reads the report published by Depthfirst. “Oj is a low-level dependency used by GitLab, and we combined the two bugs to achieve remote code execution on a default GitLab installation.” – https://securityaffairs.com/196062/hacking/gitlab-users-urged-to-patch-after-research-reveals-critical-rce-chain.html

EFF: Most Smart Wearables Still Fall Short on Privacy and Transparency

(Pierluigi Paganini – Security Affairs) Most smart wearables still treat privacy like an optional extra, and that’s a problem. The Electronic Frontier Foundation (EFF)’s review of major smart watches, rings, and bands makes the case plainly: these devices collect deeply personal health data, but most vendors still don’t give users the protections or transparency they should expect from the start. “Oura Rings, Garmin GPS fitness watches, Apple Watches, Whoop bands—every year, more and more tech devices are promising to monitor our health and fitness, guide us toward healthier living, and provide useful health metrics to take to our doctors. But few of these tools provide the sorts of privacy and security promises we demand from all technology, let alone tech that captures personal health data.” reads the report published by EFF. “It’s time they step up and start providing transparency reports and stronger encryption options.” – https://securityaffairs.com/196085/security/eff-most-smart-wearables-still-fall-short-on-privacy-and-transparency.html

Singapore sets three priorities against AI-enabled OT attacks

(DigWatch) Singapore has outlined three priorities for protecting operational technology from increasingly capable AI-assisted cyberattacks. Minister for Digital Development and Information Josephine Teo said the country’s approach would focus on ‘lock down, find first and fix fast’. Speaking at the Operational Technology Cybersecurity Expert Panel Forum, Teo warned that AI is lowering the technical barriers for attackers targeting critical infrastructure. – https://dig.watch/updates/singapore-sets-three-priorities-against-ai-enabled-ot-attacks

Frontiers

ChatGPT expands health tools with Apple Health integration

(DigWatch) OpenAI has begun a broader US rollout of ChatGPT Health, allowing eligible adult users to connect Apple Health and supported medical records to personalise health-related conversations. With permission, ChatGPT can draw on information including medications, laboratory results, recent medical visits, sleep and physical activity. Users can ask the system to compare results over time, summarise changes since an appointment or help prepare questions for a healthcare professional. – https://dig.watch/updates/chatgpt-health-tools-with-apple-health

European Space Agency advances blockchain security for 5G satellite networks

(DigWatch) The European Space Agency has awarded a three-year development project to test whether blockchain-based technologies can improve anomaly detection and operational security across 5G non-terrestrial networks. Keysight Technologies will lead the project as prime contractor, while satellite internet of things provider Sateliot will support technical development and satellite mission integration. The initiative is supported through ESA’s Space for 5G/6G and Sustainable Connectivity programme line within its Advanced Research in Telecommunications Systems programme. – https://dig.watch/updates/blockchain-security-for-5g-satellite-networks

Google launches AI Economy ATLAS research initiative

(DigWatch) Google has launched the first version of AI & Economy ATLAS (Activity, Task, Landscape and Adoption Study), a large-scale research initiative designed to provide empirical evidence on how people use AI at work and in everyday life. The study draws on 15 million aggregated and de-identified interactions across the Gemini app, AI Mode and the Gemini API, which together serve more than one billion monthly users. The initial dataset spans more than 150 countries, 140 languages, 800 occupations and 4,000 tasks. – https://dig.watch/updates/google-ai-economy-atlas-research-initiative