Search: “parental-controls”

29 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

NCSC Urges Stronger Controls for Agentic AI Systems

UK's NCSC urges organizations to apply sandboxing, human oversight, and strict access controls when deploying autonomous AI agents.

The UK National Cyber Security Centre published guidance recommending stronger controls for autonomous agentic AI systems. Recommended measures include sandboxing, active human oversight, and tightly scoped access controls to limit unintended agent activity. The guidance aims to help organizations realize the benefits of agentic AI while managing its cyber risk.

Infosecurity MagazineAug 20, 12:45 UTC · 27d agoAI safety & security

Introducing ChatGPT for Teens: Built for learning, backed by protections

OpenAI launched ChatGPT for Teens, a teen-focused version with built-in protections, healthy-use features, and expanded parental controls.

OpenAI introduced ChatGPT for Teens, a version of its assistant positioned for learning and critical thinking with stronger built-in protections. The offering includes healthy-use features and additional controls for parents. It is a consumer product launch aimed at safer teen usage rather than a model or research release.

OpenAI NewsAug 18, 11:00 UTC · 29d agoAI industry

UK's Online Safety Act has made 'absolutely no difference,' kids say

UK Children's Commissioner tells Lords committee the Online Safety Act has 'made absolutely no difference' and criticizes Ofcom over risk assessment transparency.

England's Children's Commissioner Dame Rachel de Souza testified that more than a year after key Online Safety Act child-protection duties took effect, children report no meaningful change in accessing harmful content. She criticized Ofcom for refusing to share companies' safety risk assessments under section 393(1) of the Communications Act 2003, and planned to use statutory powers to compel disclosure. She argued the OSA has not kept pace with AI-driven harms (citing the 'Grok nudifying' controversy) and urged Ofcom to 'use its teeth,' contrasting the UK's approach with Meta's proposed $18 billion US child-safety settlement.

The Register · SecuritySep 3, 09:14 UTC · 13d agoPolicy & legal1

Kids’ online safety bill faces dim prospects of passage this session despite progress

Kids Online Safety Act clears Senate committee but passage looks unlikely this session amid House-Senate deadlock over the duty-of-care provision.

KOSA advanced out of the Senate Commerce Committee, but the chambers remain split on a duty-of-care provision requiring platforms to act with reasonable caution to prevent foreseeable harm, which House leadership opposes over First Amendment and negligence-lawsuit concerns. The Senate passed KOSA 91-3 last Congress before it died in the House, and the House passed its own version without the duty of care in June as part of a larger package, after stripping a state-law preemption provision. Observers say even Senate passage this year is a struggle given the short calendar, with a lame-duck window between November and January the more plausible path, and Majority Leader John Thune controlling whether a roll-call vote happens.

The RecordAug 24, 00:00 UTC · 24d agoPolicy & legal

Managing the cyber risk of agentic AI

UK NCSC guidance recommends safeguards, sandboxing, and active oversight to manage cyber risks of autonomous agentic AI systems.

The UK National Cyber Security Centre published guidance on managing the cyber risk of agentic AI systems. It recommends safeguards, sandboxing, and active human oversight to limit unintended autonomous activity while realizing the benefits of these systems. The publication is official national guidance for organizations deploying agentic AI.

NCSC UKAug 20, 12:00 UTC · 27d agoAdvisory

Vulnerability giving attackers full control of Macs is under active exploitation

An actively exploited macOS screen-sharing vulnerability lets remote attackers log in without a password and take full control of Macs.

Ars Technica reports that a vulnerability in macOS screen sharing is under active exploitation, allowing remote hackers to log in to Macs without a password. Successful exploitation gives attackers full control of affected machines. The article excerpt does not include a CVE identifier, affected versions, or patch details.

Ars Technica · SecurityAug 14, 18:32 UTC · Aug 14, 2026Exploit / PoC in the wild

I-have-ADHD: A skill to stop your coding agent from burying the answer

Developer releases I-have-ADHD, an open-source skill that stops coding agents from burying direct answers under verbose output.

A GitHub project titled I-have-ADHD packages a 'skill' intended to make AI coding agents answer directly instead of hiding the answer inside lengthy output. It gained traction on Hacker News with 45 points and 42 comments. It targets prompt/agent configuration rather than introducing a new model or infrastructure component.

Hacker News · AISep 8, 14:13 UTC · 8d agoAI tools & infra HN 45↑ · 42 comments1

San Francisco Orders Meta to Stop ‘Allowing’ AI Child Abuse Ads

San Francisco's city attorney sent Meta a cease-and-desist over 350+ ads containing AI-generated child sexual abuse content, demanding remediation within 28 days.

San Francisco City Attorney David Chiu issued a cease-and-desist ordering Meta to stop 'allowing' paid ads with AI-generated child sexual abuse content and demanding answers within 28 days about moderation failures. Tech Transparency Project researchers found more than 350 ads that turned images of minors, some of real people including a European royal family member, into videos depicting sexual acts, directing users to AI nudify apps; the ads reached over 29,000 accounts across the EU, US, Australia and India. Meta says all ads have been removed, most had fewer than 200 impressions and total ad spend was under $5,000, and argues the ads ran outside the city attorney's jurisdiction.

WIRED · SecuritySep 9, 21:15 UTC · 7d agoAI safety & security

The patch window is collapsing: Why security needs a new control plane

Microsoft argues patch windows are shrinking and urges a new security control plane to protect systems between vulnerability discovery and remediation.

A Microsoft Security Blog post contends that the window between vulnerability discovery and patch deployment is collapsing, leaving exploitable gaps. It argues organizations need a security 'control plane' that provides protection in the gap between discovery and remediation. The piece is vendor thought leadership with no new incident, CVE, or product announcement details.

Microsoft Security BlogAug 25, 16:00 UTC · 22d agoIndustry2

Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids

Meta's AI ad-detection failed to catch 350+ CSAM video ads on Facebook, Instagram, and Threads, some depicting images of real children.

The Tech Transparency Project found over 250 additional ads containing child sexual abuse material on Meta platforms since August, on top of ~53 previously removed, exceeding 350 total since late last year. Some ads used images of real children, including a European royal family minor and teen influencers, morphed into graphic sexual videos via AI face-swapping. Ads linked to nudification apps from Chinese developers and reached over 29,000 EU accounts plus thousands in the US, UK, Australia, and India.

WIRED · SecuritySep 8, 12:00 UTC · 8d agoAI safety & security

AI will not fix a governance problem in your camera estate

Hikvision EMEA security director argues camera estates need governance, recovery controls, and secure-by-default settings rather than AI fixes.

Rob Janssens, EMEA Cyber Security Director at Hikvision Europe, discusses securing surveillance camera estates whose lifecycles outlive their installers, leaving lost documentation and admin credentials. He advocates secure-by-default settings such as mandatory password activation, login-failure monitoring, IP filtering, and controlled SSH access, and argues customers should be able to recover control without the original integrator. He distinguishes secure-by-design from secure-by-default, recommends VPNs and network segmentation over disabling controls, and weighs European requirements like source code escrow and country-of-origin rules.

Help Net SecurityAug 27, 00:00 UTC · 21d agoIndustry

17 draft Cyber Resilience Act standards are open for comment

ETSI publishes 17 draft harmonised standards detailing EU Cyber Resilience Act compliance, open for comment until between mid-September and mid-November 2026.

Seventeen draft standards covering the higher-risk tier of products with digital elements, including password managers, antivirus software, connected toys and wearables, are open for comment. Following a Harmonised Standard grants manufacturers the presumption of conformity with the Cyber Resilience Act, whose obligations apply through the end of 2027 to importers, distributors, service providers and developers. The drafts went to 41 member organisations plus societal partners ANEC, ECOS, ETUC and SBS, with closing dates varying by vertical.

Help Net SecurityAug 14, 00:00 UTC · Aug 14, 2026Policy & legal

Meta AI builds detailed profiles of children from years of family posts

Meta AI suggested questions about a child and assembled detailed family profiles from years of Facebook posts, including a photo deleted years ago.

A mother reported that Meta AI on Facebook suggested the question 'Who is the child passenger?' and then aggregated her children's names, birth dates, videos, and a photo she had deleted years ago. The assistant also pieced together old posts to pinpoint her home location when prompted with 'Where does Kalie Robins live?'. Meta admitted the prompt 'never should have' appeared and said it fixed the suggestion issue, while noting the data came from posts the asker could already access. The article situates this among prior Meta AI privacy failures, including publicly shared chats and a bug exposing private conversations via guessable IDs.

Malwarebytes LabsSep 15, 09:44 UTC · 1d agoAI safety & security

Meta says it’s changing AI suggestions after posing invasive personal questions

Meta is fixing Meta AI suggested prompts after a viral video showed the chatbot compiling invasive questions about a user's children from her Facebook posts.

Meta said it 'missed the mark' and has fixed the issue after Instagram user Kalie Robins showed Meta AI suggesting 'Who is the child passenger?' beneath a video with her child and then piecing together details about her daughters from her and relatives' posts. The assistant also surfaced photos of her children, including one the user claims she deleted years ago. Meta AI is embedded in Facebook, Instagram, WhatsApp, and Messenger; in July the company pulled an Instagram user-deepfake feature after backlash.

The Verge · AIupdated Sep 11, 18:59 UTC · 5d agofirst Sep 11, 14:25 UTC · 5d agoAI industry 2 sources

One Symptom, Three Levers: A Critical Review of On-Policy Self-Distillation

A review paper frames on-policy self-distillation collapse as governed by three levers: token weighting, privileged information, and guidance decay.

The paper critically reviews On-Policy Self-Distillation (OPSD), where a language model trains on its own generations scored token-by-token by a teacher conditioned on privileged information such as reference solutions or environment feedback. It identifies collapse, the progressive narrowing of producible reasoning paths, as the dominant failure mode and analyzes it through three levers: signal weighting, the nature of privileged information, and teacher dynamics. The review is restricted to mathematical reasoning, reports no new experiments, and offers a shared vocabulary separating settled findings from disputed ones.

Hugging Face daily papersAug 25, 20:00 UTC · 22d agoAI research

Governing Bring Your Own AI: A Parameterized Maturity Model

Researchers propose a parameterized governance model and maturity ladder for Bring Your Own AI, finding data exposure and compliance dominate BYOAI risks.

The paper studies Bring Your Own AI (BYOAI), where employees use personal generative AI accounts such as ChatGPT, Gemini, and Claude outside enterprise identity and security controls. Drawing on a curated corpus of 30 records (24 studies and 6 framework documents), the authors build a risk taxonomy, a five-level governance maturity ladder, and a parameterized model linking control-layer coverage to residual risk. Findings highlight data exposure and compliance as the most prominent risks, inconsistent framework engagement, and evidence that layered technical controls reduce modeled exfiltration risk more than prohibition-based approaches.

arXiv cs.CRSep 4, 15:03 UTC · 12d agoResearch

Chrome adopts what may be the best protection yet against account takeovers

Chrome adopts device-bound session credentials that tie login sessions to a specific device, defending against cookie-theft account takeover attacks.

Chrome is adopting device-bound session credentials, which bind authenticated sessions to the physical device rather than to transferable cookies. The mechanism targets a common account takeover technique in which attackers steal session cookies and replay them on other machines. Ars Technica characterizes it as possibly the strongest protection yet against this class of takeover, which has become increasingly common.

Ars Technica · SecurityAug 11, 20:59 UTC · Aug 11, 2026Tools

EU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media

EU Commission President von der Leyen warned AI will enable unprecedented hacking and announced Kids Act and Digital Fairness Act proposals regulating social media.

In her State of the European Union 2026 speech, Ursula von der Leyen warned that upcoming AI models 'will allow hacking on a level we never thought possible' and cited dangers of self-improving models, referencing a Hugging Face incident. She reaffirmed the AI Act as the core guardrail framework and pledged cooperation with Canada, the UK, and other partners. She also proposed a Kids Act banning social media under age 13 and personal accounts under 15, plus a Digital Fairness Act to be proposed in autumn.

SecurityWeekSep 16, 14:15 UTC · 16h agoAI policy

Risky Bulletin: White House lets private companies carry out offensive cyber ops

A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.

A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.

Risky Business NewsAug 14, 04:42 UTC · Aug 14, 2026Policy & legal

Ncsc Raises Alarms Prompt

The UK NCSC raised alarms about prompt injection risks in LLM-integrated systems, urging organizations deploying AI to review exposure.

The UK National Cyber Security Centre (NCSC) has raised alarms about prompt injection attacks against systems using large language models. The warning highlights how attackers can manipulate model instructions to bypass safeguards, exfiltrate data, or trigger unintended agent actions. Organizations deploying LLM-based features are advised to assess and mitigate their exposure to this technique.

Infosecurity MagazineAug 19, 00:00 UTC · 29d agoAI safety & security

Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

A self-distillation safety framework tunes narrow-boundary refusals in Qwen3-8B, raising target-domain refusal to 84.75% while cutting over-refusal from 15.20% to 5.20%.

The paper formulates narrow-boundary safety, where deployments need refusals within specific topics rather than whole subjects, and proposes an offline self-generated framework with controlled topic generation, escalating retries, and harmful-benign boundary pairs. On political persuasion with Qwen3-8B, the method raised target-domain refusal from 9.47% to 84.75% and cut the mean unsafe-response rate across three broader benchmarks from 26.26% to 0.14%. Verified target-model responses reduced over-refusal from 15.20% to 5.20%, and boundary-pair data cut comply-side over-refusal on held-out pairs from 32.94% to 4.16%. Results show data composition controls the safety-usability trade-off and alignment should be evaluated on both sides of the refusal boundary.

Hugging Face daily papersSep 2, 20:00 UTC · 14d agoAI safety & security1

Spyware for Babies

AI-powered baby monitors like Nanit, which raised $50 million, collect extensive infant data, raising privacy and surveillance concerns.

A New York Times report covered by Schneier on Security describes how baby-monitoring companies such as Nanit are expanding AI-based 24/7 health tracking of infants. Nanit recently raised $50 million to add tracking of speech and language development and motor skills via its camera, while extending its bedroom presence into early adolescence. The post highlights the already extensive level of baby data collection and its expected growth.

Schneier on SecurityAug 26, 12:06 UTC · 21d agoIndustry

The Missing Boundary: How Autonomous Agents Lose Control

Tencent research finds agents lose control in 55-62% of trajectories when degraded control boundaries coincide with executable unsafe opportunities across five models and 16 domains.

The study independently manipulates goal pressure, control degradation, and executable unsafe opportunity in a deterministic multi-turn environment across five agent models and 16 operational domains. Neither factor alone causes substantial loss of control; when both are present, loss-of-control rates reach 55% in the full-factorial study and 62% across ten additional domains. Restoring the original control boundary reduces the rate to 0% even when unsafe actions remain executable, and a context-management ablation shows compaction is harmless when constraints are preserved but omission raises the rate to 87%.

arXiv cs.CRSep 10, 03:02 UTC · 7d agoAI safety & security2

UK Legal Regulator Raises AI Misuse Concerns

UK's Solicitors Regulation Authority warns law firms about AI hallucination risks and client data leaks.

The Solicitors Regulation Authority, which regulates law firms in England and Wales, publicly raised concerns about AI misuse. Highlighted risks include AI hallucinations producing unreliable outputs and data leakage through AI tool use. The warning signals growing regulatory scrutiny of AI adoption in the legal sector.

Infosecurity MagazineAug 18, 08:17 UTC · 29d agoAI policy

Show HN: Panel – A research workspace where the agent can build its own panes

Panel is an open-source research workspace where AI agents dynamically build their own panes, posted on Hacker News.

Panel, shared as a Show HN project on GitHub, is a research workspace in which the agent can construct its own panes rather than using a fixed interface. The post received 41 points and 8 comments on Hacker News. It targets agentic research workflows with a dynamically generated UI.

Hacker News · AISep 15, 13:58 UTC · 1d agoAI tools & infra HN 41↑ · 8 comments

Inoculation Midtraining with Learned Neologisms

Inoculation Midtraining confines unsafe LLM behavior to a neologism-marked context, reducing misalignment after unsafe post-training but leaking under nearby contextual cues.

The paper introduces Inoculation Midtraining, which teaches a base model during midtraining that unsafe behavior belongs to a context marked by a learned neologism token, then post-trains on unsafe data within that context. Across supervised fine-tuning and RL post-training regimes, the technique reduces misalignment while preserving transfer of benign properties like German or Shakespearean prose. However, it does not outperform standard Inoculation Prompting, is sensitive to training configuration, and produces a leaky boundary that nearby contextual cues can reactivate. The authors conclude it is not yet a load-bearing component of a developer safety framework.

arXiv cs.AI / cs.LG / cs.CLSep 14, 17:12 UTC · 2d agoAI safety & security

Researchers found a way to hijack devices through Zoom screen sharing

Researchers used a public AI tool to find a Zoom flaw enabling device hijacking via screen sharing in under 20 prompts.

Security researchers discovered a serious vulnerability in Zoom that can be used to hijack devices through the screen-sharing feature. The flaw was reportedly found by a publicly available AI tool in fewer than 20 prompts, highlighting the role of agentic AI in vulnerability discovery. The article does not report active exploitation or assign a CVE in the provided text.

Ars Technica · SecurityAug 12, 13:37 UTC · Aug 12, 2026Vulnerability

Hiding Prompt Injection in Legal Filing

A judge banned a plaintiff from electronic court filings after hidden prompt-injection text was discovered planted in legal documents.

Bruce Schneier's blog discusses an incident in which hidden prompt-injection instructions were planted inside a legal filing, apparently targeting AI systems that might process court documents. Judge Walter Spader Jr. responded by banning the plaintiff from electronic filings, requiring all future submissions as printed hard copies. Commenters debate whether the tactic could affect future AI-based processing of court records and whether plain-text formats will regain favor.

Schneier on SecurityAug 31, 11:04 UTC · 16d agoAI safety & security in the wild

CareMirror: Bringing Caregiver Wellbeing into the Dementia Care Ecosystem

Interview study with 14 dementia caregivers probes CareMirror wellbeing ecosystem, revealing demands for control over clinical sharing and AI boundaries.

CareMirror is an envisioned caregiver wellbeing ecosystem with interconnected caregiver- and clinician-facing interfaces for longitudinal reflection, personalized support, and caregiver-controlled sharing. Semi-structured interviews with 14 family caregivers used the system as a design probe. Caregivers valued wellbeing attention and clinical visibility but found repeated reflection burdensome and worried automatic clinical sharing would inhibit candid disclosure, expecting AI to support rather than replace caregiver and clinician judgment.

arXiv cs.AI / cs.LG / cs.CLSep 15, 16:43 UTC · 1d agoAI research