Amazon’s new Echo Dot includes a built-in Eero Wi-Fi extender, along with other smart home features.
Source: ZDNet Security · 2026-10-28
Day: October 28, 2026
-
Objection, your honor
You’ve probably heard, at this point, about the big changes coming to Meta’s AI scraping terms for business accounts. Nieman Lab had that scoop, and since then, small businesses, journalists, and artists using Meta products like Instagram have been raising the alarm. But if you’re in the EU or UK, you might be in luck and can object to that use of your data, as some users have pointed out.
Images via Unsplash / collage via 404 Media If You’re In the UK or EU, Here’s How to Object to Meta’s AI Training
Earlier this month, Meta updated its commercial terms of use for business accounts to allow it to “use any content from such domains, web pages, or URLs to provide, develop, improve, research, train, and maintain the integrity of” Meta’s products.
Many artists and small business owners that rely on Instagram and Facebook are livid at Meta granting itself permission to use their content, including from websites simply connected to their Meta accounts, to train AI. But for users in the United Kingdom and European Union, for now, there’s a way to object.
Meta buried this change in its Commercial Terms, and Nieman Lab first reported on the change. The update was originally set to go into effect on October 30, but following backlash, Meta changed the effective date to November 20. Adding to the confusion, Meta then removed the word “train” from a list of allowed use cases, Nieman Lab reported, and limited those uses to “advertising and business products,” where previously it said that data would be used for all Meta products. Those terms still allow Meta plenty of leeway for scraping users’ data to develop its products, however.
Several users based in the UK and EU have explained how to object on Instagram. On mobile: by clicking the three lines on their account, going to the privacy center, and clicking “object,” which goes to a form that asks users to write why they are objecting to their data being used. They received an email from Meta saying their objections were approved.
MORE FROM 404
On the podcast this week, we talk Flock CEO’s leaked police conference audio and Sam’s piece about Marissa Mayer’s latest meltdown. Subscribe wherever you get your pods.
FROM AROUND THE WEB
The New York Times has an antisocial aversion to linking: Another day, another the-New-York-Times-isn’t-linking controversy. The specifics here almost don’t matter because this happens seemingly every day, but basically the New York Times investigation about chemical plant polluters under the Trump administration was covered in much the same way by Hunterbrook, a news outlet fused with a hedge fund. The Times article—which led the Sunday print edition—uses similar photos, some of the same sources, and covers similar ground to Hunterbrook’s earlier investigation from February, with no acknowledgment or link whatsoever. After the cofounder of Hunterbrook rightfully ranted about this on X, the Times added an acknowledgment (but no link!!!) toward the bottom of the story. Puck’s Dylan Byers has a good rundown about what happened, which includes parts of a three-paragraph Times’ spokesperson statement explaining at length why they don’t think they have to link. This is extremely antisocial, deranged behavior and it’s ridiculous that the Times is still getting away with this. Bottom line: I’m sure the Times was already working on this story, what with their massive newsroom. Even so, they got beat, and they should link. Journalism awards need to stop looking the other way when big outlets do this. This has happened to us many times and it actually does matter for smaller outlets and links are free. Let’s try them!
Artificial reef: TIL that a gigantic military ship, the SS United, is going to be purposefully sunk to be turned into an “artificial reef.” Scuba divers seem quite excited. I didn’t really know that this was a thing that was done, but maybe I’m a rube.
Ransomware scam mitigation scammer: A company that promised to help victims of ransomware (for a fee) was indicted by the feds, according to ProPublica and a Department of Justice affidavit. The original investigation that led to this was published by ProPublica back in 2019 but is still worth a read; there are so many of these companies that prey on victims of cyberattacks, sextortion campaigns, etc.
Today in c’mon, man: CIA whistleblower John Kirakou is doing sponcon for Kalshi, writing “I spent 15 years at the CIA trying to figure out what was going to happen next in the world. Now Kalshi is finding new ways to put a price on those predictions. This partnership between Kalshi and S&P Dow Jones Indices is fascinating.” C’mon, man.
Today in printers: I am absolutely mesmerized by this microphotography of an inkjet printing, which won the 2026 Nikon Small World photomicography competition. Ole Bielfeldt’s work is on his Instagram, which is absolutely worth checking out. Wow, wow wow.
Today in yikes: A Roblox scraper has been grabbing more than a hundred gigabytes of data from a 3D modeling community, including more than 60 GB of adult content from a section of the site called “SmutBase.” “We don’t think Roblox set out to collect adult content, and we have no evidence that any of it reached a model or a product. The scrapes were likely automated. But that is exactly the problem: as far as our logs show, nobody checked. A crawler working for a company whose platform tens of millions of children use was pointed at an adult site, and it took explicit models without telling them apart from anything else,” Open3DLabs wrote in a blog post about the scraping. “For a company being sued by several US states over child safety, ‘our AI team bulk-downloaded an adult site without looking’ is not a good position to be in.”
Source: 404 Media · 2026-10-28
-
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
Source: Dark Reading · 2026-10-28
-
Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk
Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware. Following recent findings from the Citizen Lab, members of the European Parliament signed a letter urging the E.U. to investigate the potential exposure of its institutions to zero-click spyware through online targeted advertising. In the U.S., Democratic Sens. Booker and Wyden say that the findings underscore the need for better security practices in the industry.
Source: Citizen Lab · 2026-10-28
-
If You’re In the UK or EU, Here’s How to Object to Meta’s AI Training
Earlier this month, Meta updated its commercial terms of use for business accounts to allow it to “use any content from such domains, web pages, or URLs to provide, develop, improve, research, train, and maintain the integrity of” Meta’s products.
Many artists and small business owners that rely on Instagram and Facebook are livid at Meta granting itself permission to use their content, including from websites simply connected to their Meta accounts, to train AI. But for users in the United Kingdom and European Union, for now, there’s a way to object.
Meta buried this change in its Commercial Terms, and Nieman Lab first reported on the change. The update was originally set to go into effect on October 30, but following backlash, Meta changed the effective date to November 20. Adding to the confusion, Meta then removed the word “train” from a list of allowed use cases, Nieman Lab reported, and limited those uses to “advertising and business products,” where previously it said that data would be used for all Meta products. Those terms still allow Meta plenty of leeway for scraping users’ data to develop its products, however.
EU users’ personal data rights are governed by the General Data Protection Regulation and the AI Act. GDPR, which became enforceable in 2018, requires explicit consent to use personal data. This includes the right to object to one’s data being used. The AI Act, which went into effect in 2024, dictates how AI companies can use personal data, and how people can opt in or out, stating that they can withdraw consent at any time. The UK has its own version of the GDPR. The European Commission states: “The GDPR rules only apply to personal data about individuals; they do not govern data about companies or any other legal entities. However, information in relation to companies may constitute personal data where it allows the identification of a natural person.”
Several users based in the UK and EU have explained how to object on Instagram. Instagram user bookish.sil posted a walkthrough of how they did it on mobile: by clicking the three lines on their account, going to the privacy center, and clicking “object,” which goes to a form that asks users to write why they are objecting to their data being used. They received an email from Meta saying their objection was approved. Instagram user jenniqueart posted a similar walkthrough with the same results.
My Meta accounts are based in the US, but using a VPN to locate my IP address in London, I could see options in my Meta privacy settings that would let me object to the use of my information by Meta AI. To get there on desktop with a VPN on, I went to my account privacy center, clicked “Submit a privacy rights request” at the bottom, selected Instagram, clicked “How can I object to the processing of my information?” and got to a page where I could choose to object to the use of my information for Meta AI or third parties, which were two separate options.
When my location is based in the US, these options don’t appear.
When I clicked through the option to “object to the use of my information for Meta AI,” however, it returned an error page that said “This form is only available to people in certain regions.” GDPR is meant to apply to wherever someone is located at the time, but since this objection applies to the preferences of one account, it might be based on where the account was created. I tried again located in Belgium and got the same results. I’ve asked Meta to clarify.
As many have already pointed out in the comments on UK and EU users who’ve posted walkthroughs, these objection steps aren’t available to people outside of those countries, and as Meta continuously changes its platform, these steps might not work for everyone always. Unless something changes before November 20, the rest of us are screwed.
Source: 404 Media · 2026-10-28
-
AI Is Turning CISOs Into Business-Risk Translators, Says Nvidia’s Head of Cyber
Nvidia’s Mark Weatherford says CISOs must translate AI cybersecurity risks into business priorities, clarify risk ownership and balance innovation with security controls
Source: Infosecurity Magazine · 2026-10-28
-
Energy Giant Engie Notifies Customers of Supply Chain Breach
An undisclosed number of Engie customers have had their data compromised after a supply chain incident
Source: Infosecurity Magazine · 2026-10-28
-
Banks are blocking AI agents from customer accounts
This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bank’s rules.
Bianco Research president Jim Bianco raised the question during Unchained’s Bits + Bips livestream on October 26:
“Are you protecting me, or are you protecting your own profits?”
Bianco described traditional finance’s business model as “based on laziness.” Customers may leave idle cash in low- or no-interest bank accounts rather than move it into a money market fund. An AI agent could make that move for them. “Now that you’re able to do it, the banks are afraid they’re gonna lose that revenue stream,” he said.
The banks offer a different explanation. JPMorgan Chase CEO Jamie Dimon said the bank wouldn’t allow just any outside agent into its systems because doing so was “too risky for clients and for JPMorgan.”
Both explanations can be true: banks can want to retain deposits while also facing real security problems when software acts through customers’ accounts.
Handing over your banking login introduces another service into the security chain. A vulnerability in that service could expose your credentials or allow your account to be misused. And as Bank of America reportedly pointed out:
“If you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”
That’s the bank’s stated position, not a universal ruling on consumers’ legal rights. Still, it’s a warning worth taking seriously.
Pros and cons
An AI agent with permission to make purchases might find and buy an item at a lower price. But giving an agent access to your bank account also means sharing sensitive banking information with a third party. We’ve seen shared AI chats become searchable online too.
Axios reported that many banks allow, or are moving toward allowing, read-only access. This can let a tool analyze transactions without giving it permission to move money.
That’s an important boundary, but it doesn’t make the information harmless. An agent that can read bank statements may still disclose them if it’s compromised or manipulated. Preventing transactions and protecting confidentiality are separate security goals.
How to keep control of your money
For consumers, the practical question is not whether banks have perfectly selfless motives. It’s what access you’re giving away, and what could happen if the agent makes a mistake.
- Don’t paste banking passwords or security codes into a general-purpose AI assistant. Major banks have explicitly warned customers against sharing their credentials.
- Use your bank’s approved connection methods rather than giving an agent your login. Where supported, choose read-only access if all you need is analysis or budgeting help.
- Give agents access to as little sensitive information as possible. An assistant comparing publicly advertised savings rates doesn’t need your bank statements. OpenAI recommends limiting agents to the data and credentials they need for the task.
- Review consequential actions yourself. If an agent asks for confirmation, check exactly what it intends to do and what information it will share. Don’t treat a confirmation prompt as a formality.
AI can make it easier to compare financial products and spot opportunities you might otherwise miss. But an assistant that finds a better rate and an agent that can act inside your account are different propositions.
Let it help with the homework, but be cautious about handing it the keys.
Let’s face it, an incognito window can only do so much.
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.Source: Malwarebytes Labs · 2026-10-28
-
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical
Source: The Hacker News · 2026-10-28
-
KR: Bithumb discloses data leak after internal system breach; One of three financial firm breaches reported that day
CoinTelegraph reports: South Korea’s crypto exchange Bithumb is investigating the extent of a data leak caused by a hack of its internal mobile system earlier this week, Yonhap News Agency reported Wednesday. Bithumb discovered the breach of its in-house mobile system — the platform used by employees to communicate internally — on Tuesday and notified…
Source: DataBreaches.net · 2026-10-28