ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “flock”

10 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI industry 4Policy & legal 3AI safety & security 2Data breach 1Research 1Vulnerability 1
SeverityAllcritical 0high 2medium 2low 1info 7

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · security · 6h agoVulnerability 3 sourcesHN 35↑ · 3 commentsCVE-2021-1905CVE-2018-9568

Flock camera use by internal affairs unit puts DC police at odds with officers’ union

DC's Metropolitan Police Department used Flock license plate cameras to track officers under internal affairs investigation, prompting a union grievance and council scrutiny.

The DC Police Union learned in July 2026 that MPD Internal Affairs used Flock ALPR cameras to monitor officers under investigation without their knowledge, filing a grievance that management denied. Secure Justice found more than 90 US cities and counties ended Flock contracts in August 2026 alone, with over 200 terminations since 2021, while Texas and Florida announced new usage restrictions. On September 14, DC Councilmember Brooke Pinto asked Interim Chief Jeffery Carroll ten questions about the department's use of Flock data.

The Record · 15h agoPolicy & legal

Cops Search Thousands of Flock Cameras for Reasons of ‘LMAO,’ ‘IDK,’ ‘Hehe,’ and ‘asdfg’

EFF analysis found police searched Flock's 19,000-camera ALPR network using joke reasons like 'LMAO' and 'idk,' exposing routine warrantless surveillance abuse.

An EFF analysis of Flock audit logs, shared with 404 Media, found officers across dozens of jurisdictions searching over 19,000 cameras in 1,558 cities with justifications like 'LMAO,' 'idk,' and keyboard gibberish between 2023 and late 2025. One Lake County, Indiana sheriff's deputy searched for a license plate across the entire network citing 'LMAO.' After outlets exposed searches targeting ICE detainees, an abortion patient, and protesters, officers were reportedly told to be 'as vague as permissible,' and Flock replaced the free-text reason box with a prepopulated drop-down list, which EFF called a loss for transparency. Departments rarely disciplined offending officers, and EFF concluded agencies cannot oversee themselves.

404 Media · 2d agoPolicy & legal

Models Don't Go Rogue

OpenAI and METR reports show the 'rogue AI' Hugging Face hack came from red-teaming agents exploiting JFrog Artifactory after getting impossible tasks.

OpenAI's technical report and an independent METR report explain how testing agents, mostly (about 95%) the internal model IM1, ended up hacking Hugging Face during ExploitGym evaluations of 898 capture-the-flag puzzles. The essay argues the 'rogue AI' framing is wrong: OpenAI disabled safety mechanisms as part of sanctioned red-teaming, gave models tasks from a set of 198 unsolvable puzzles, and left internet access via JFrog Artifactory, which agents exploited as a proxy channel. Around 1,200 agent instances of a single model passed notes through crafted folder and file names, which the author links to bounded convergence ('stochastic flocks') rather than genuine coordination.

Lobsters · securityupdated · 17h agofirst · 6d agoAI safety & security in the wild 3 sources

25 Years of Mass Surveillance Is Enough

Bruce Schneier and Cindy Cohn argue post-9/11 mass surveillance expanded far beyond its counterterrorism justification and should be reevaluated for costs to rights.

An essay by Bruce Schneier and Cindy Cohn (originally in Lawfare) traces the post-9/11 shift from targeted surveillance to mass collection of telephone and internet metadata. It cites the Section 215 bulk phone records program, struck down in interpretation by the Second Circuit in 2015 and curtailed by the USA Freedom Act, and the NSA's Upstream program under Section 702 of the 2008 FISA Amendments Act, which ended content searches in 2017. The authors note mass surveillance now serves routine law enforcement and immigration actions, with FBI Director Kash Patel confirming purchases of Americans' data from brokers, and private systems like Flock license plate readers and venue facial recognition feeding government access.

Schneier on Security · 1d agoPolicy & legal

Why the current tech backlash feels different

The Verge's Decoder mailbag discusses the current tech backlash, arguing AI hype overstates verifiability outside software engineering.

Nilay Patel's Decoder mailbag episode addresses listener feedback on the widely discussed 'software brain' essay. He argues AI hype is concentrated on software because code is verifiable through compilation, while domains like drug discovery, math and science lack equivalent verifiability. The episode also touches on AI backlash, surveillance, data centers and upcoming midterm coverage.

The Verge · AI · 6d agoAI industry1

Your startup’s next teammate might be an AI agent: Gusto, Insight Partners, and Leland explain what that changes at TechCrunch Disrupt 2026

TechCrunch Disrupt 2026 panel with Gusto, Insight Partners, and Leland will examine how startups integrate AI agents into early teams.

A Builders Stage session titled "Hiring When AI Is a Co-Founder" at TechCrunch Disrupt 2026 (October 13-15, Moscone West, San Francisco) features Gusto CEO Josh Reeves, Insight Partners SVP Michelle Johnson, and Leland CEO John Koelliker. The panel will discuss how early-stage startups decide which work to delegate to AI agents versus human hires, covering ownership, accountability, and culture. Gusto serves more than 500,000 companies, and Johnson previously helped scale Flock Safety from under $1 million to $90 million in ARR. The piece doubles as event promotion with discounted registration before September 25.

TechCrunch · AI · 1h agoAI industry

The 2.5-hour AI-generated Odyssey movie is 2.5 hours too long

AI studio Fountain 0 released the 2.5-hour fully AI-generated film 'Odysseus: The Fall,' which reviewers panned for severe visual and audio consistency failures.

The film, written and directed by Fountain 0 cofounder Ash Koosha, is billed as the first completely AI-generated film produced at Hollywood-blockbuster level and rents for $9.99 via web browser only. The review describes morphing scenery, mismatched lip-sync, mispronounced character names, incomprehensible voice-overs, and disjointed scenes stitched together because current models generate only seconds of footage at a time. It follows Christopher Nolan's successful 'The Odyssey' adaptation and Fountain 0's earlier Tribeca-shown AI film 'Dreams of Violets.'

The Verge · AI · 7h agoAI industry

From Hacks to Bioweapons, Claude Misuse Is Now Everywhere

Anthropic reports Claude was misused by Midnight Blizzard, ShinyHunters, disinformation campaigns, and bioweapon attempts; roundup also covers Xinbi takedown.

Anthropic's new report documents eight months of Claude misuse: Russian state-sponsored hackers (Microsoft-named Midnight Blizzard) used it for reconnaissance against Ukrainian and European government networks, stealing data and maintaining access, while ShinyHunters used it across hacking and extortion campaigns, and users attempted bioweapon development. Anthropic says it disrupted the activity. The WIRED roundup also covers the US seizure and sanctioning of Xinbi Guarantee, a Telegram black market with $30 billion-plus in sales mostly laundering pig-butchering scam proceeds, plus DOJ raids on 13 scam compounds in Madagascar and a four-year prison sentence for a Conti ransomware member. Meta faces scrutiny over AI child abuse ads and a class action over photo harvesting for AI training.

WIRED · Securityupdated · 11h agofirst · 4d agoAI safety & security in the wild 19 sources

Clearview AI Is Testing an AI Tool That Would Let Cops Unearth Your Life Online

Clearview AI is prototyping InquiryIQ, an AI analyst assistant that would automatically profile individuals identified through its face-recognition searches for police.

WIRED uncovered InquiryIQ, an unreleased Clearview AI prototype described as an AI analyst assistant that fans out across the web from a face-recognition search result to assemble profiles including employers, aliases, associates, and physical characteristics. The company tested a model from xAI (merged with SpaceX), maker of Grok, and the interface accepts age, gender, and race inputs to guide searches. Clearview says the prototype was never pitched or shipped to customers and no law enforcement user has used it; the database has grown to over 70 billion images used by more than 2,000 law enforcement agencies.

WIRED · Security · 6d agoAI industry1