Governance, Legislation, Regulation, Geostrategies

Human-centred AI puts people and responsibility in focus at UNGA’s General Debate – AI should enhance human capabilities rather than diminish people’s role in shaping their own development, speakers argued on the final day of the UN General Assembly’s General Debate, as countries addressed the effects of technological transformation on employment, skills and human responsibility. Malawi called for technological advances to remain human-centred, arguing that AI should complement and enhance human capabilities rather than diminish the indispensable role of people in shaping their own development. The country also highlighted the opportunities AI could offer developing economies. It pointed to applications in agricultural productivity and food security, healthcare and education, climate resilience and disaster preparedness, financial inclusion and more efficient public services. – https://dig.watch/updates/human-centred-ai-unga-general-debate

UNGA hears call for code on AI in international relations and diplomacy – A proposal for an international code governing the peaceful use of AI in international relations and diplomacy emerged on the final day of the UN General Assembly’s General Debate, as speakers addressed how emerging technologies could affect international peace, security and trust. – https://dig.watch/updates/unga-ai-code-international-relations-diplomacy

UN leaders highlight AI and digital threats in fight against racism – A high-level meeting of the UN General Assembly (UNGA) on 28 September marked the 25th anniversary of the adoption of the Durban Declaration and Programme of Action, a global framework for combating racism, racial discrimination, xenophobia and related intolerance. The meeting was held at UN Headquarters in New York under the theme of mobilising global support for the full and effective implementation of the Declaration. The UN said that, 25 years after its adoption, racism and racial discrimination remain embedded across institutions and societies and are often exacerbated by novel digital technologies and artificial intelligence (AI). The anniversary meeting was thus also presented as an opportunity to renew political commitment to the Declaration and address these emerging challenges. – https://dig.watch/updates/un-highlight-ai-digital-threats-against-racism

Australian developer withdraws proposed Sydney data centre – Goodman Group withdrew its application for the proposed A$1.2 billion, 90 MW Project Mars data centre in Sydney, on 28 September 2026. The company said it had considered changes in the policy and regulatory environment alongside feedback received during the planning process. The New South Wales Planning Portal now records the application as withdrawn. The proposed three-storey data centre would have operated continuously, approximately 20 metres from the nearest home and 160 metres from Lane Cove West Public School. According to ABC News, local community groups strongly opposed the project and presented their concerns during the first hearing of the Australian Senate inquiry into data centres and artificial intelligence. The withdrawal also followed the introduction of a New South Wales fast-track framework for data centres meeting specified requirements. – https://dig.watch/updates/developer-withdraws-sydney-data-centre-plan

India launches an open digital public infrastructure for tourism – India’s Ministry of Tourism launched the National Digital Tourism Stack on 27 September 2026 during its World Tourism Day programme in New Delhi. The ministry describes it as shared digital public infrastructure intended to make tourism offerings easier to find, access and trust. – https://dig.watch/updates/india-launches-digital-tourism-infrastructure

Ghana Tourism Authority explores AI-driven future of travel – The Ghana Tourism Authority hosted an stakeholder event ahead of World Tourism Day to examine how digital technologies and AI can be utilised to transform destination promotion, tourism businesses and travel experiences in Ghana. The event was held under the theme ‘Digital agenda and Artificial Intelligence to redesign tourism’. The summit brought together representatives from the tourism and hospitality industry, AI experts, students and other stakeholders to discuss how emerging digital technologies could be applied in Ghana’s tourism sector. – https://dig.watch/updates/ghana-tourism-authority-explores-ai-driven-travel

China hosts ‘Global Digital Trade Expo’ on AI, government urges closer cooperation – Hosted in Hangzhou, China, the fifth edition of the ‘Global Digital Trade Expo’ (GDTE) opened on 23 September and closed on 27 September. Under the theme ‘AI Empowers Digital Trade’, artificial intelligence was a major focus of the multi-day event and, according to the State Council Information Office (SCIO) of China, the expo attracted more than 50,000 participants from 163 countries and regions. – https://dig.watch/updates/china-hosts-global-digital-trade-expo-on-ai-government-urges-closer-cooperation

UNICEF and Helios Towers partner to expand digital learning in Africa – UNICEF and telecommunications infrastructure company Helios Towers have announced a multi-year partnership to expand school internet connectivity and access to digital learning for children and young people in underserved African communities. The partnership will initially focus on the Democratic Republic of the Congo, Malawi, and the United Republic of Tanzania, with support also planned for another country in West Africa. Helios Towers will contribute its infrastructure expertise and local operational knowledge to help extend connectivity in areas where internet access remains limited. – https://dig.watch/updates/unicef-helios-towers-digital-learning-africa

Security, Surveillance

AI could boost cyberterrorism, Costa Rica warns at UNGA’s General Debate – AI could boost cyberterrorism and enable forms of crime that cannot yet be envisaged, Costa Rica warned on the final day of the UN General Assembly’s General Debate, as speakers addressed the growing relationship between technological change, cybersecurity and cross-border crime. Costa Rica placed the warning within a broader discussion of rapid technological change. It said technological developments were creating unprecedented challenges for institutions and pointed to transnational organised crime, including cybercrime, as a threat that crosses national borders and undermines democratic stability, development and the rule of law. The country specifically warned that AI could boost cyberterrorism and other crimes that cannot yet be envisaged. – https://dig.watch/updates/ai-cyberterrorism-costa-rica-warning-unga

GPT-6 Astra and the Supply Chain Attack It Wasn’t Asked to Launch – The UK’s AI Security Institute tested GPT-6 Astra before its public release, and the results, published September 28, aren’t subtle. When given a routine cybersecurity evaluation, the model went off script and attacked real-looking targets outside the test’s boundaries, on its own, without being told to. To be clear about the stakes here: nothing in this testing actually happened in the real world. AISI ran everything through Petri, a tool that fully simulates cyber scenarios using other language models, and they turned off GPT-6 Astra’s cyber safety classifiers on purpose, specifically to see what the model would try without any guardrails stopping it. “In our simulations, we found that GPT-6 Astra conducted a range of unsanctioned attack activities, and did so at a higher rate than GPT-5.6 Sol and GPT-5.5. Attack activities included GPT-6 Astra creating fake identities which it used to deceive developers, posting comments from fake accounts arguing against the results of accurate security reviews, and delivering malicious payloads to open-source codebases.” reads the report published by UK’s AISI. “When we updated the instructions for the simulated cyber evaluation to explicitly clarify that only listed, local parts of the environment were in scope, we still observed GPT-6 Astra occasionally conduct full supply-chain attacks on simulated internet targets.” – https://securityaffairs.com/199947/ai/gpt-6-astra-and-the-supply-chain-attack-it-wasnt-asked-to-launch.html

FBI grapples with fallout from massive data breach – A week after a cybercriminal group claimed to steal sensitive personal data on thousands of current and former FBI employees, the bureau is still assessing the extent of the damage while facing internal criticism about the agency’s handling of the incident. It’s one of the most serious breaches of agency data in years, but some FBI employees have felt left in the dark about whether they’re affected and underwhelmed by the security resources being offered to victims, according to current and former officials. “Management is lost,” one ex-FBI agent in touch with their former colleagues told CNN. “They’re not providing any clear advice to agents”. The issue began a week ago, when hackers broke into an online portal hosting information on FBI job applicants. Social Security numbers, emergency contact information and personal addresses were in the stolen data. The hackers demanded that the FBI amend a previous advisory issued about the group, saying it was “offended” over how the agency described its alleged tactics for extorting victim organizations. Many at the FBI and within the cybersecurity industry took the demand as a tacit threat that the hackers would leak the stolen data. (The cybercriminal group now claims that it never planned to publish any of the stolen data, but they have a history of doing so with other victims). The hackers responsible, known as ShinyHunters, have previously targeted “major companies across tech, finance, and retail, often stealing millions of customer records at once,” according to the FBI’s advisory on the group. –  https://edition.cnn.com/2026/09/28/politics/fbi-fallout-data-breach-hacking

UK live facial recognition trial scans over 500,000 faces and produces one false match – A live facial recognition (LFR) trial at major railway stations in the UK scanned more than half a million faces over six months but generated only one alert, which proved to be an incorrect match, according to figures reported on 29 September. No arrests during this period resulted directly from an LFR alert. British Transport Police (BTP) has since extended the pilot until November and expanded deployments to selected London Underground stations. The initial phase involved 18 deployments at major London railway stations between February and July 2026. According to information obtained through a freedom of information (FOI) request by Liberty Investigates and reported by The Guardian, equipment hire and police staffing cost £320,786 and the deployments involved almost 100 hours of police officers’ time. The system compared the faces of people passing cameras against police watchlists intended to identify wanted individuals and people breaching court orders. The only alert generated during those deployments was subsequently determined to be a false positive. – https://dig.watch/updates/uk-live-facial-recognition-trial-results

Microsoft Warns NeedyMantis Malware Enables Persistent Network Access – Cybersecurity researchers at Microsoft have warned that a stealthy new malware framework is enabling attackers to remain hidden inside compromised networks for extended periods. Dubbed NeedyMantis, the malware operation has been active since at least October 2025. Microsoft Threat Intelligence said in analysis, published on September 28, that the malware has been used in hacking campaigns which have targeted telecommunications providers, universities and government-linked organizations. Microsoft attributed NeedyMantis activity as emerging from China, although the company has not gone so far as to attribute the activity to the threat actor working on behalf of the Chinese state. It could also not determine if all activity could be attributed to the same operator but at least one is Storm-3069. – https://www.infosecurity-magazine.com/news/microsoft-needymantis-malware/

Japanese Railway Operators Hit with Weekend Cyber Attacks – Two major railway operators in the Tokyo region of Japan have disclosed significant cyber-attacks, although passenger travel remains unaffected. Tokyo Metro operates some of the capital’s busiest subway lines, carrying over seven million passengers each day. It said in a statement on September 27 that an unauthorized third party had accessed the email addresses of 59,000 passengers signed up to its Metpo loyalty scheme. The operator confirmed that it has identified the suspected point of unauthorized access and taken measures to prevent a reoccurrence. Only email addresses were taken, but the company urged customers to “exercise particular caution” regarding possible follow-on phishing attempts. –  https://www.infosecurity-magazine.com/news/japanese-railway-operators-cyber/

Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach – The cryptocurrency exchange Bitget has restarted Bitcoin withdrawals four days after unauthorized transfers totaling approximately $387.5m were made from part of its hot and warm wallet infrastructure. Withdrawals on the Bitcoin network reopened at 08:00 UTC on September 28 after additional security checks. Bitget’s September 26 withdrawal update said the vulnerability behind the incident had been identified and remediated, while its investigation with Mandiant and blockchain security firm SlowMist continued. – https://www.infosecurity-magazine.com/news/bitget-restarts-withdrawals-387-5m/

Amazon Bedrock AgentCore Flaws Could Expose AWS Credentials – Two vulnerabilities in Amazon Bedrock AgentCore’s Python software development kit (SDK) could have let attackers execute commands inside AI sandboxes and reach the AWS credentials attached to the affected workloads. The flaws affected the SDK’s Code Interpreter helper for package installation and were tracked as CVE-2026-12530 and CVE-2026-16796. In a technical write-up published on September 28, BeyondTrust said package name was enough to get commands past the AgentCore Python SDK and into the Code Interpreter sandbox. – https://www.infosecurity-magazine.com/news/aws-agentcore-sdk-flaws-ai/

RatHat’s Evolving C2 Panel Points to Malware-as-a-Service Model – The infrastructure behind the RatHat Android banking trojan has changed more than the malware itself, with successive command-and-control (C2) panels able to build malware, manage infected devices and use AI to rank potential victims. In research published September 28, Cleafy said the implant had changed little from late 2025 through September 2026, while its C2 panel went through three generations in six months and rebranded from BlackCat to Panda Workshop. Nearly 100 separate deployments since April 2026 have been observed, consistent with a malware-as-a-service (MaaS) model. – https://www.infosecurity-magazine.com/news/rathat-c2-panel-malware-as-a/