EPIC FAILS in Application Development Security practice processes, training, implementation, and incident response
YellowKey Attack: Zero-day exploit completely defeats default Windows 11 BitLocker protections
The steps for carrying out the bypass are simple:
1.        Copy the custom FsTx folder from the Nightmare-Eclipse exploit page to an NTFS- or FAT-formatted USB drive
2.        Connect the USB drive to the BitLocker-protected device
3.        Boot up the device and immediately press and hold down the [Ctrl] key
4.        Enter Windows recovery
This bypass works only in the Windows 11 default mode of BitLocker, which stores decryption keys in the TPM. This TPM-only configuration has long been considered insufficient by many security professionals, who instead advise that a PIN should be required before the key can be retrieved from the TPM.
People should enable a BIOS password lock to prevent YellowKey attacks. While using BIOS password locks is a good practice, it’s unclear how they provide any protection against this particular exploit.

Mystery Microsoft bug leaker keeps the zero-days coming
The anonymous security researcher who has already maliciously exposed three Windows zero-days this year has revealed two more, dropping them just after Microsoft's monthly Patch Tuesday update.
Nightmare-Eclipse, or Chaotic Eclipse, depending on which of their aliases you prefer, released details about YellowKey and GreenPlasma - respectively a BitLocker bypass and a privilege escalation flaw, handing SYSTEM access to attackers.

Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.
Shiny Hunters first demonstrated they’d breached Instructure on May 1, prompting Instructure’s Chief Information Security Officer Steve Proud to declare the following day that the incident had been contained. A May 6 update stated that Canvas was fully operational, and that Instructure was not seeing any ongoing unauthorized activity on their platform. “At this stage, we believe the incident has been contained.” However, on May 7, students and faculty at dozens of schools and universities were flooding social media sites with comments saying that a ransom demand from ShinyHunters had replaced the usual Canvas login page. Instructure responded by pulling Canvas offline and replacing the portal with the message, “Canvas is currently undergoing scheduled maintenance. Check back soon.”
The cybercrime group ShinyHunters claimed responsibility and said they would leak data on tens of millions of students and faculty unless paid a ransom. The stated deadline for payment was initially set at May 6, but it was later pushed back to May 12.

Congress investigates Canvas breach as company pays ransom
The company paid the undisclosed extortion demand prior to the Tuesday deadline. The US Congress has summoned education tech firm Instructure's CEO Steve Daly to the Hill to explain how digital thieves breached its Canvas online platform twice within two weeks.
The ShinyHunters abused XSS vulnerabilities in Canvas' Free-for-Teacher learning software, and the bugs allowed the data thieves to obtain administrative access. During the first intrusion, which Instructure detected on April 29, the extortionists claimed to have stolen about 3.6 TB of uncompressed data, including usernames, email addresses, course names, enrollment information, and messages.
On May 7, the crooks broke back into Canvas’ systems via the same vulnerability and injected JavaScript containing ransom demands directly into hundreds of Canvas school login portals, causing the ed-tech firm to take the platform offline for a day - during final exams and Advanced Placement testing for many.

Researcher Finds Microsoft Edge Stored Passwords Load in Plaintext
Microsoft's Edge is facing controversy after a security researcher discovered the internet browser will load stored passwords in plaintext in a computer’s RAM, paving the way for malware to fetch the login credentials.
“When you save passwords in Edge, the browser decrypts every credential at startup and keeps them resident in process memory. This happens even if you never visit a site that uses those credentials. Edge is the only Chromium‑based browser I’ve tested that behaves this way.” "In contrast, Chrome will only decrypt the credential you need for autofill, when you need it, and it will be removed after."
Microsoft is pushing back on the report, saying the threat only arises if a hacker has control over the user’s PC, which could occur through a malware infection.

A Security Researcher Decompiled The White House App, & What They Found Is Pretty Alarming
To start, the app has a full GPS tracking pipeline compiled in. Essentially, it’s set to poll your location every 4.5 minutes in the foreground, and 9.5 minutes in the background. It’s syncing latitude, longitude, accuracy, and timestamp data to OneSignal’s servers. These location permissions aren’t declared in the AndroidManifest, but they are hardcoded as runtime requests in the OneSignal SDK. Some have noted that the tracking only kicks in if the developer enables it server-side and the user grants permission, but it is there, ready to go.
The app is loading JavaScript from a random person’s GitHub site for YouTube embeds. Yes, you read that right, it’s just loading JavaScript from a random GitHub site. So if that account ever gets compromised, arbitrary code could run inside the app’s WebView.
The app also injects JavaScript and CSS into every page you visit in the in-app browser. This strips away cookie consent dialogs, GDPR banners, login walls, and paywalls. There’s also leftover dev artifacts in the production build, including a localhost URL to the Metro bundler.
[rG Illustration: Just because an App is in a curated App Store doesn’t mean that the security and privacy statements are accurate, nor that it is security hardened from becoming a potential attack vector to your systems and data.]

F5 NGINX Rift Exploit (CVE-2026-42945): The AI Vulnerability Supply Shock Breaking Infrastructure Security
CVE-2026-42945 (CVSS 8.1)—is a heap-based buffer overflow in NGINX’s URL-redirection rewrite module. An unauthenticated attacker can exploit this to crash worker processes or remotely execute code.
The root cause is an 18-year-old engineering oversight. NGINX’s script engine relies on a two-pass process: it first computes the necessary output buffer size, then copies data. When a rewrite directive uses unnamed capture variables (like $1) alongside a replacement string containing a question mark, the passes disagree on whether URI escaping expands bytes. The length pass assumes zero expansion; the copy pass executes full URI encoding. The result is an undersized heap allocation flooded by attacker-controlled URI data. Spraying the heap across multiple requests allows an attacker to corrupt an adjacent memory structure, hijacking execution. A working proof-of-concept is already public.

Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged
The crew behind the early supply chain attack affecting Checkmarx in April, TeamPCP, defaced the company’s GitHub and published six packages, each with a description alluding to the Shai-Hulud wormable malware.
These packages no longer appear on Checkmarx’s GitHub, but TeamPCP made multiple changes to the AST plugins page, renaming it to “Checkmarx-Fully-Hacked-by-TeamPCP-and-Their-Customers-Should-Cancel-Now,” and altering the description to claim CheckMarx failed to rotate its secrets.
The latest infiltration of Checkmarx’s internals marks the third time TeamPCP has compromised the company’s packages in as many months.
What makes this particularly dangerous for Jenkins users is the trust model at play. The Checkmarx Jenkins plugin is a tool people install specifically to improve the security of their pipelines. A backdoored version doesn’t just compromise one project; it rides trusted infrastructure into every build pipeline it touches, with access to source code, environment variables, tokens, and whatever secrets the runner can see.

Bug hunter tracks down three massive MCP flaws and one vendor won't fix theirs
While security issues are never a good thing - and they are especially concerning when they exist in a server sitting between an AI agent and a production database, these in particular point to a larger problem in the way MCPs are developed.
Security vulnerabilities in MCP servers for three popular database projects could let attackers execute unintended SQL statements on Apache Doris, exfiltrate sensitive metadata from Alibaba RDS, and potentially take over Apache Pinot instances exposed to the internet. Alibaba, meanwhile, declined to patch its flaw.

AWS to Quick admins: The access control didn't work, but you weren't using it anyway, so what's the problem?
Amazon Quick is described on its own product page as an AI assistant that "connects Slack, Microsoft Teams and Outlook, CRMs, databases, and documents in one place" and "grounds every answer in your real business data." The default chat agent, which is automatically and annoyingly provisioned the instant Quick is enabled whether the customer wants those AI features or not, is the front end for that data.
IAM policies don't govern Quick's AI Chat Agent, SCPs don't apply, and RCPs don't apply. Custom permissions are the only knob the service provides. If those don't enforce, nothing else does.
Fog Security disclosed an authorization bypass in Amazon Quick on May 12 (that's the BI service formerly known as QuickSight, briefly known as Quick Suite, and now apparently just Quick, but check back next week) and AWS responded with a statement claiming "no customer data was at risk."
When an Amazon Quick administrator uses "custom permissions" to explicitly deny access to AI Chat Agents, the UI correctly hides the feature. The API, however, was perfectly willing to keep answering chat requests for any user in the account who knew how to send them.
Where this gets uncomfortable is the response. AWS classified the severity as "none." It issued no customer notification. It published no advisory.

Anthropic blames dystopian sci-fi for training AI models to act “evil”
Opus 4 model resorted to blackmail to stay online in a theoretical testing scenario last year. Now, Anthropic says it thinks this “misalignment” was primarily the result of training on “internet text that portrays AI as evil and interested in self-preservation.” the model maker says the best remedy for overriding those “evil AI” stories might be additional training with synthetic stories showing an AI acting ethically.

Your doctor’s AI notetaker may be making things up, Ontario audit finds
In a recent report on Use of Artificial Intelligence in the Ontario Government, the auditor general reviewed transcription tests of two simulated patient-doctor conversations performed across 20 AI scribe vendors that were approved and pre-qualified by the provincial government for purchase by healthcare providers.
9 hallucinated patient information,
12 recorded information incorrectly
17 missed key details about discussed mental health issues.
The average tested AI scribe scored only a 12 out of 20 on the “accuracy of medical notes generated”. But that “accuracy” metric was only responsible for 4% of a vendor’s overall score, making it easy to meet the minimum threshold for approval even if an AI scribe scored a “zero” on the accuracy metric (a separate metric measuring “domestic presence in Ontario” was worth 30% of the overall scoring).

What’s Weak This Week:

HACKING
Cookie thieves caught stealing dev secrets via fake Claude Code installers
The attack runs across three domains, all registered within six days of each other in April, and all fronted through Cloudflare. It relies on developers searching for “install claude code,” and selecting a sponsored result that leads to a lookalike Claude Code installation page.
The page downloads and executes Anthropic’s authentic installer - but as Ontinue’s team found, the malicious instruction isn’t stored in the file itself, but instead rendered into the HTML of the landing page. Automated scanners, URL reputation services, and any skeptical reviewer who simply curls the URL therefore observe clean PowerShell delivered from a Cloudflare-fronted domain bearing a valid Let’s Encrypt certificate. Victims, meanwhile, are presented with an entirely different command.

When prompts become shells: RCE vulnerabilities in AI agent frameworks
We discovered a vulnerable path in Microsoft Semantic Kernel that could turn prompt injection into host-level remote code execution (RCE).
A single prompt was enough to launch calc.exe on the device running our AI agent, with no browser exploit, malicious attachment, or memory corruption bug needed. The agent simply did what it was designed to do: interpret natural language, choose a tool, and pass parameters into code.
Vulnerabilities in the AI layer are no longer just a content issue and are an execution risk. If an attacker can control the parameters passed into these plugins via prompt injection, the agent may be driven to perform actions beyond its intended use.
The AI model itself isn’t the issue as it’s behaving exactly as designed by parsing language into tool schemas. The vulnerability lies in how the framework and tools trust the parsed data.
Defending AI agents requires acknowledging that AI models aren’t security boundaries. Security teams must correlate signals across two layers: the AI model level (intent detection through meta prompts and content safety filters) and the host level (execution detection). If an attacker bypasses the AI model guardrails, traditional endpoint defense must be in place to detect anomalous behavior, such as an AI agent process suddenly spawning command lines or dropping scripts into Startup folders.

When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps
AI and agentic applications are being rolled out at scale, moving rapidly from experimentation to broadly deployed systems. These applications are no longer isolated components; rather, they sit at the center of workflows, automation, and decision-making across organizations.
15% of remote MCP servers are severely insecure and allow unauthenticated access to sensitive internal data and operational capabilities.
Mage AI is an open-source platform for building, running, and orchestrating data and AI pipelines.
kagent is an open-source framework under CNCF’s CNAI landscape that’s designed to run AI agents on Kubernete.
Microsoft AutoGen Studio is a low‑code agentic framework for building multi‑agent workflows.
Also Agentgateway, MLRun, Numaflow, OpenLIT, Microsoft Agent Framework Dev UI, Nvidia Nemo Agent Toolkit, Marimo, Comfy UI, Ray Dashboard, MCP Hub Dashboard.

[rG SSDLC:  Highly important is production continuous monitoring. Initial design/deployment QA is insufficient.]

NIST achieves 120 km stable quantum encryption in real-world test
NIST maintained sub-femtosecond phase stability for quantum signals over 120 km of aerial fiber, matching metropolitan network conditions.
Why it matters: The test overcomes key barriers to unhackable communication, potentially securing data between major government, financial, and data center hubs.

Robot Dogs Are A Security Nightmare YouTube Video
[rG: Thx David]

APPSEC, DEVSECOPS, DEV
NIST Revises SP 800-70 | National Checklist Program for IT Products: Guidelines for Checklist Users and Developers
The National Checklist Program (NCP), defined by the NIST SP 800-70, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.
 

NIST Releases SP 800-172r3 and SP 800-172Ar3: Enhanced Security Requirements and Assessment Procedures for Protecting CUI
Efforts to strengthen protections for securing controlled unclassified information (CUI) in nonfederal systems.
Contractors Should Prepare as NIST Finalizes Enhanced Security Requirements for Protecting Controlled Unclassified Information
Provides a selection of recommended cybersecurity controls for protecting CUI resident on a nonfederal information system when associated with a “high value asset” or “critical program.” The revised publication highlights the importance of contractors being able to identify CUI and having plans to implement SP 800-172r3 controls even before the revisions are adopted into the Department of War (DOW) Cybersecurity Maturity Model Certification (CMMC) Program.
These publications do not immediately apply to contractors; however, agencies have required contractors to meet certain SP 800-172 requirements through terms of contracts, grants, or other agreements.

Linux Kernel Adds Documentation For What Qualifies As A Security Bug, Responsible AI Use
The majority of the bugs reported via the security team are just regular bugs that have been improperly qualified as security bugs due to a lack of awareness of the Linux kernel's threat model.
The security list exists for urgent bugs that grant an attacker a capability they are not supposed to have on a correctly configured production system, and can be easily exploited, representing an imminent threat to many users. Before reporting, consider whether the issue actually crosses a trust boundary on such a system.
If you resorted to AI assistance to identify a bug, you must treat it as public. While you may have valid reasons to believe it is not, the security team's experience shows that bugs discovered this way systematically surface simultaneously across multiple researchers, often on the same day.
Many AI tools are actually better at writing code than evaluating it. Please ask your tool to propose a fix and test it before reporting the problem. If the fix cannot be tested because it relies on rare hardware or almost extinct network protocols, the issue is likely not a security bug.

Google DORA: ROI of AI-assisted Software Development report and calculator
Measure the potential return on investment for adopting AI in your software development lifecycle using DORA's ROI of AI calculator.

Welcome to the vulnpocalypse, as vendors use AI to find bugs and patches multiply like rabbits
Palo Alto Networks usually finds five vulnerabilities a month, but on Wednesday said it scanned its entire codecase using the latest frontier models, including Anthropic’s Mythos, and found 75 security holes, covered in 26 CVEs.
This comes a day after Microsoft said it used its new agentic bug hunting system called MDASH to find 17 vulnerabilities across its products - on a record-setting Patch Tuesday that saw Redmond disclose a whopping 30 critical CVEs.
Plus, last week Mozilla said it fixed 423 Firefox bugs in April, which is more than five times higher than the 76 fixes issued in March and almost 20 times higher than its 21.5 monthly average last year. The browser maker previously said Mythos found 271 flaws in Firefox 150.
Microsoft’s multi-agent AI system tops Anthropic’s Mythos on cybersecurity benchmark
CyberGym benchmark scores over time, showing the rapid improvement in AI vulnerability discovery capabilities. Microsoft’s multi-model MDASH system (top right) tops the leaderboard at 88.4% - ahead of Claude Mythos and ChatGPT 5.5.
Anthropic's Bug-Hunting Mythos Was Greatest Marketing Stunt Ever, Says cURL Creator
“My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos.”
Mozilla says 271 vulnerabilities found by Mythos have “almost no false positives”
Of the 271 bugs found using Mythos, 180 were sec-high, Mozilla’s highest designation for internally reported vulnerabilities. These types of vulnerabilities can be exploited through normal user behavior, such as browsing to a web page. (The only higher rating, sec-critical, is reserved for zero-days.) Another 80 were sec-moderate, and 11 were sec-low.
The engineers said their earlier brushes with AI-assisted vulnerability detection were fraught with “unwanted slop.”  Mozilla’s work with Mythos was different. The biggest differentiating factor was the use of an agent harness, a piece of code that wraps around an LLM to guide it through a series of specific tasks. The additional verification comes in the form of a second LLM that grades the output from the first LLM.
[rG Take Aways: Any of the top LLMs can help developers identify bugs and vulnerabilities, but still require human evaluations. The quantity of findings depends upon a product’s historical attention to QA and security testing. If pre-production testing had been deprioritized in favor of release velocity, then an audit will always find more un-remediated bugs and vulnerabilities – whether AI tools are used or not. The needed cultural change isn’t so much about AI adoption, but commitment to application security and data privacy.]

AI models are getting better at replacing cybersecurity pros on certain tasks
The UK AI Security Institute (AISI) has found that frontier models are quickly becoming more efficient when asked to do some cybersecurity work. AISI is not saying frontier models are becoming twice as capable by all measures. It's a narrow assessment based on the time it takes people to accomplish security tasks.
AISI measures this with its "time window benchmark for cybersecurity," which estimates how much work an AI can do compared to a human. Using the benchmark could lead to findings such as Claude Sonnet 4.5 can do what a human cybersecurity expert can do in 16 minutes about 80 percent of the time, given a budget of 2.5m tokens.
[rG: Claude Code is the tool, while Sonnet is the AI model. You use Claude Code (the terminal agent) to give your AI direct access to your local files, and it uses Sonnet (the model) to actually write and reason through the code.]
The latest Mythos Preview checkpoint solved a 32-step simulated corporate network attack called "The Last Ones" in six of 10 attempts and managed to complete a previously unsolved challenge, a seven-step industrial control system attack called "Cooling Tower," in three of 10 attempts.
As a point of comparison, when Opus 4.6 was evaluated in February 2026, it completed a maximum of 22 of 32 steps for The Last Ones. That model managed to reach milestone 6, which involves reverse-engineering a Windows service binary to access encrypted credentials, escalating privileges via token impersonation, and recovering a cryptographic key to access a command-and-control management service.

AI security benchmark 2026: What happens when you drop 15 AI coding agents into a real legacy codebase
The practical lesson from this benchmark is not “replace security engineers with agents.” It is almost the opposite. Repo-scale AI-assisted security review is becoming genuinely useful precisely because humans can now spend less time on repo traversal and more time on judgment. The workflow that increasingly makes sense looks something like this:
·       Cheaper models perform broad reconnaissance,
·       Multiple runs widen search coverage,
·       Stronger models adjudicate findings,
·       Humans evaluate consequence and remediation priority.
This benchmark also convinced me that future evaluations need to separate:
·       “found the chain”
·       “understood the consequence.”
Those are not the same capability. Most public AI security discourse still treats vulnerability detection as the headline milestone. The harder and more important capability is prioritization under uncertainty. The important shift is that repo-scale AI-assisted security review is already operationally useful with ordinary models and ordinary tooling.

9 Best AI Tools for Spec-Driven Development in 2026: Kiro, BMAD, GSD, and More Compare
Developers generate working code in minutes, only to discover days later that it doesn’t match what the system actually needed. Spec-driven development (SDD) addresses this directly — by treating a structured specification as the source of truth and code as its generated output, rather than the other way around.

Gainful employment: The top 10 AI skills with the highest job market demand
The findings show that LLM expertise ranks highest in demand, with average salaries approaching $200,000 per year, reflecting the rapid adoption of generative AI technologies across industries.
Closely following are deep learning and computer vision, both of which appear in tens of thousands of job postings, indicating sustained demand for advanced technical capabilities in AI development and deployment.
By contrast, skills such as no-code AI tools and prompt engineering show comparatively lower demand and more modest salary levels. However, these roles still offer compensation that exceeds typical entry-level salaries for recent graduates, making them accessible entry points into the AI workforce.

A Beginner’s Guide to Kubernetes

VENDORS & PLATFORMS
Vizio Helps Walmart Cut A Bigger Slice Of The CTV Ad Pie
“We are connecting retail intelligence with Vizio’s connected TV footprint [so] brands can activate and measure on real shopping behavior.”
New Vizio TVs require a Walmart account for activation, while existing Vizio users are prompted to add their Walmart account for an easier time purchasing items (from Walmart, duh) with their remotes. The same rules apply for Onn TVs, a Walmart-owned line of TVs that are now powered by Vizio’s SmartCast OS (and formerly used Roku’s OS).
By centralizing streaming data within Vizio’s OS, Walmart hopes for a leg up in its battle against Roku, Amazon, Samsung and other streaming distributors that are competing for growth within the overall CTV ad ecosystem.
[rG Reminder: Many modern smart TVs and remotes include built-in microphones for voice commands; which can also be a source of data collection. So each TV (in addition to mobile phones, home hubs/appliances, tablets, cars, etc.) becomes an access point to collect personal information to be used for product promotion, online and in-store retail purchasing.]

Amazon employees are “tokenmaxxing” due to pressure to use AI tools
Departments pushing to increase adoption of generative AI tools, as companies seek to demonstrate returns on vast spending commitments to AI infrastructure and embed the technology more deeply into day-to-day work.
Amazon employees are using an internal AI tool to automate non-essential tasks in a bid to show managers they are using the technology more frequently.
Amazon has told employees that the AI token statistics would not be used in performance evaluations. But several staff members said they believed managers were monitoring the data.
Multiple Amazon employees said they were concerned about the security risks of an AI tool that was granted permission to act on a user’s behalf. This risks situations where the agent may make errors or undertake unintended actions.
[rG: This is what happens when activity is used as a proxy for productivity. Tasks that can be automated using traditional scripts will get replaced by agentic tasks that will increase IT costs, be not as reliable as deterministic algorithms, and can potentially result in disruptive unintentional consequences. The more important question is be, ‘should this task be eliminate’ vs refactored for AI. The real test will be how many executives are willing to switch 100% from Personal Assistants to their own created and managed virtual agents.]

Google Meet Adds Real-Time Transcription From Voice Tech Startup Otter.ai
Speech Recognition
Digital development since 1952.
[rG: Most people think recent GenAI brought online meeting transcription, but I remember real-time Internet webinar transcription around 2000 to compensate for audio and video broadcast bandwidth limitations.]

Gartner: AI Code Assistants (Transitioning to Enterprise AI Coding Agents) Reviews and Ratings

The newest AI boom pitch: Host a mini data center at your home
The “distributed data center solution” announced by the San Francisco startup SPAN would deploy thousands of XFRA nodes that contain liquid-cooled Nvidia RTX Pro 6000 Blackwell Server Edition GPUs operating with minimal noise, according to a press release. By harnessing excess power capacity among US households, SPAN aims to quickly expand the available compute for AI workloads without the costs and delays associated with trying to build warehouse-size data centers.
SPAN also claimed it could install 8,000 XFRA units at a cost five times lower than building a typical 100-megawatt data center with the same compute capacity. SPAN would take on responsibility for paying the electricity and Internet bills for each household while offering residents either a flat utility fee—the company floated the example of a $150 fee—or possibly no fee at all.
[rG: With all the excess commercial real estate office space still available post-COVID, this seems like it would popular with businesses as on-prem AI data centers that could generate revenue for excess capacity.]

Energy supplier abandons Lake Tahoe residents to serve data centers
Lake Tahoe’s local electricity provider, California-based Liberty Utilities, has been obtaining 75 percent of its power from the Nevada-based company NV Energy. But the latter has said it will stop providing power to the Lake Tahoe region’s 49,000 residents by May 2027.
After NV Energy initially sold its California assets to Liberty in 2009, it struck a series of temporary agreements to keep providing power to Lake Tahoe until Liberty could secure another energy supplier.
Now NV Energy has decided it cannot keep extending such agreements. That leaves Liberty scrambling to find a new energy supplier as it plans to offer a replacement contract for any bidders capable of meeting California’s renewable energy requirements.

The new Wild West of AI kids’ toys
Age-inappropriate content is just the tip of the iceberg when it comes to AI toys. We’re starting to see real research into the potential social impacts on children.
Experts are also concerned about how established play habits and business models could dictate future features, whether that’s engagement farming, selling data, or pushing paid add-ons. 

LEGAL & REGULATORY
“Will I be OK?” Teen died after ChatGPT pushed deadly mix of drugs, lawsuit says
OpenAI is facing down another wrongful-death lawsuit after ChatGPT told a 19-year-old, Sam Nelson, to take a lethal mix of Kratom and Xanax.
The teen viewed ChatGPT so highly as an authoritative source of information that he once swore to his mom that ChatGPT had access to “everything on the Internet,” so it “had to be right.” But ChatGPT was designed to be sycophantic, not informative. So, it strove to please Nelson by recommending ways to “optimize your trip.”
OpenAI does not seem to accept that ChatGPT is responsible for Nelson’s death, emphasizing that the ChatGPT model implicated is “no longer available” and suggested that current models are safer.
“ChatGPT is not a substitute for medical or mental health care, and we have continued to strengthen how it responds in sensitive and acute situations with input from mental health experts. The safeguards in ChatGPT today are designed to identify distress, safely handle harmful requests, and guide users to real-world help. This work is ongoing, and we continue to improve it in close