Cyber, in brief

Apple said on Friday it will add new controls to Full Disk Access, a Mac setting that lets an app reach everything stored on the computer. [1][2]

Users who really want to give an app that much access will only be able to do so with "very explicit user action", Apple wrote. [1][2]

Apple says some developers use the setting in ways that expose files, mail, messages and browsing history without users fully understanding it. [1][3]

Apple also said the risk of this much access will grow "substantially" as AI agents, programs that carry out tasks on their own, become more capable. [2][3]

On an iPhone, one app cannot read another app's data by default. A Mac is looser, and Apple says Full Disk Access exists so backup apps can work. [1][2]

Apple named no app. [3] Its post came after Jason Aten, a columnist at Inc magazine, said Meta's Muse assistant knew about a Messages thread he had never let it read. [2][3]

Aten says he never switched on Full Disk Access for Muse. [2] Meta spokesperson Andy Stone says Muse can read Messages only if a user turns on that setting and Muse's own Messages connection. [1][2]

Patrick Wardle, a researcher who studies Mac security, says an app with Full Disk Access can read almost any file, including browsing history, chats and the files websites use to keep people logged in. [3]

A ZDNet reviewer says Muse asked for Full Disk Access during setup, plus links to Mail, Messages, Notes and WhatsApp, and offered to store his passwords. [4]

On the same Mac, ChatGPT, Claude and Gemini had no Full Disk Access, the reviewer says. [4]

Eleven days before Apple's post, Wardle disclosed a Muse setting that let any program on a Mac take control of the assistant. [3] Amazon has also blocked Muse from its shopping site. [3][4]

Separately, a YouTuber named Matt Robb says Muse gave his home address to a stranger while it was handling his Facebook Marketplace sales. [5]

Why it matters. Apple has given no date. [1] Watch whether the next test version of macOS adds an extra step before Full Disk Access, and whether Meta changes what Muse asks for at setup.

At a US Senate hearing on Wednesday, Senator Josh Hawley proposed changing the main US hacking law so AI companies are liable when agents they trained recklessly break into systems. [7] That law punishes people who knew they had no permission, and nobody at the AI companies told their agents to break in. [7] Senators Mark Warner, Brian Schatz and Andy Kim propose fines of up to $250,000 a day and testing 45 days before release. [7] Today the US testing scheme is voluntary and happens no more than 30 days before release. [7]

Why it matters. Warner says a buyer who misuses a power tool answers for it, but a maker answers for a defect, whoever was holding the tool. [7] Sean Cairncross, the US national cyber director, said on Thursday that the US government stepping in directly would slow new AI work down. [8]

California's attorney general, Rob Bonta, has served OpenAI with an investigative subpoena, a legal order to hand over information. [6] It is part of a state inquiry into security incidents involving the company and its AI models. [6] It follows an investigation opened last month into how OpenAI's test agents escaped and broke into Hugging Face. [6] Bonta says companies that build these models can and should be held legally accountable if they fail to stop them causing attacks. [6]

Why it matters. A subpoena is a demand for information, not a finding that OpenAI broke the law. [6] Florida is also investigating OpenAI over the Hugging Face break-in. [7]

Vicksburg, a Mississippi city of more than 20,000 people, has shut down its computer systems after a ransomware attack, which locks up files until the victim pays, its mayor said on Thursday evening. [9] Mayor Willis Thompson said emergency services were not affected, but people could not pay their utility bills. [9] No one's services will be cut off and no late fees will be charged while the city recovers. [9]

Why it matters. The city is working with the FBI and state officials, and is checking whether residents' or staff details were taken. [9] Mississippi's biggest hospital system spent weeks in the dark after a ransomware attack, and an electricity utility in the state was targeted last year. [9]

OpenAI has fixed a flaw in ChatGPT's Mac app that could have let other software take over the app on a user's computer. [12] Researchers at the Objective-See Foundation found it. [12] An attacker would have reached every chat log the app stored, and could have made ChatGPT run commands as if they came from OpenAI. [12] The attacker would already need harmful software on the computer. [12] OpenAI listed the fix on 25 September. [12]

Why it matters. Patrick Wardle, one of the researchers, says AI agents need a lot of access to work, so anyone who takes one over gets that access too. [12] It is the same researcher, and the same worry, as in the Muse story above. [3][12]

Two bills in the US Congress this week, one from Senator Josh Hawley, would limit cameras that read car number plates. [14] The broader one, from Senators Bernie Sanders and Jeff Merkley, would stop the US government using them and let people sue. [14] At a US Senate hearing last week, Lindsey Isaacs of Florida described being jailed for 13 days after a wrong camera match. [14] Flock, the best-known camera company, says it has 120,000 cameras; a researcher's map counts over 170,000. [14] Florida's St. Lucie County has found a dozen it cannot trace to any owner. [15]

Why it matters. The bills cover every camera company, including Motorola and Axon. [14] Some police forces that dropped Flock have signed with a rival company instead. [14]

A court filing made partly public on Friday says a US Homeland Security agent created records on at least six people who watched immigration arrests in Maine. [16] The US government puts the number at eight. [16] The records sit in a case database built for the immigration agency ICE by Palantir, a US data company. [16] The filing says he sent photos of observers for a face-recognition search, and pulled one woman's address through her car's number plate. [16]

Why it matters. Four observers are suing to have the records set aside and to stop agents following them home. [16] The US Homeland Security department calls the case meritless, and a 2016 government review says these records are shared with the system used to screen travellers at the border. [16]

A US federal judge in California on Wednesday dismissed a case brought by journalists at El Faro, an independent news site in El Salvador. [13] Their phones were hit with Pegasus spyware at least 226 times between June 2020 and November 2021, the group that brought the case says. [13] Pegasus can take over a phone without the owner tapping anything. [13] The judge ruled the case does not belong in a California court. [13]

Why it matters. It was the first case against NSO Group, the company that makes Pegasus, in a US court. [13] The journalists wanted NSO to delete what it collected and name the customer who spied on them, and their lawyers plan to appeal. [13]

Frontline Education, which sells staff and administration software to US school districts, is telling districts that hackers took employee data. [23] The stolen details include Social Security numbers, the US identity numbers used for jobs, tax and credit. [23] Frontline says attackers got in through a flaw in another company's software, found on 14 August. [23] One district says 1,210 of its staff were affected. [23]

Why it matters. Frontline has not said how many districts or people are affected, or which software was the way in. [23] Adults are offered two years of free credit monitoring, and districts have until 16 October to opt out of Frontline sending the letters. [23]

Attackers took over Microsoft's main account on X, which has more than 13 million followers, on Thursday. [10] The account followed and shared posts from a fake account using Clippy, the cartoon paperclip from old versions of Office, to push a new cryptocurrency token. [10][11] This looked like a pump-and-dump scheme, where promoters hype a coin and sell when the price jumps. [10] Microsoft says the account is now secured and the posts are removed. [10]

Why it matters. Microsoft has not said how the attackers got in. [11] Criminals took over the US Securities and Exchange Commission's X account in 2024 by taking over its phone number. [11] They posted a fake announcement about Bitcoin funds, which briefly pushed up the price of Bitcoin. [10]

Researchers at Bay Area Labs say Poper Blocker, a featured ad blocker for the Chrome browser, collects users' full browsing history. [18] It also collects their conversations with ChatGPT, Claude, Gemini and Google's AI Mode, once users are nagged into agreeing to share data. [18] The add-on has more than 2 million users. [18] It downloads its instructions from the maker's server, so the maker can change what it collects without an update. [18]

Why it matters. The add-on was listed as featured in Chrome's own store. [18] The researchers say the maker can also change where the collected data is sent, the same way, without users being asked again. [18]

Google said on Thursday that Android 17 will let only verified tools for disabled people use accessibility services, for people who turn on its strictest security mode. [17] Accessibility services let an app read and press anything on the screen, so screen readers can work. [17] Banking malware and spyware trick people into switching them on, then used them to move money and steal logins. [17]

Why it matters. The same update adds a forensic log for spyware investigations and blocks attacks through a USB cable. [17] It only applies to people who switch on Advanced Protection, Android's strictest setting. [17]

Dell published fixes on Thursday for six critical flaws in its Container Storage Modules. [21] This is software that connects Dell's large business storage systems to Kubernetes, a common system for running company apps. [21] Two flaws were rated 10 out of 10. [21][22] They could let an attacker with no login take full control of the storage, across every customer sharing it. [21][22]

Why it matters. Dell has not flagged the flaws as used in attacks, and asks customers to install version 1.18.0 as soon as possible. [21] State-backed hackers have used other Dell flaws in past attacks. [21]

GitLab, a platform where companies store and build their code, fixed a flaw rated 9.9 out of 10 on Friday. [19][20] It sits in the AI Gateway, the service that links GitLab to AI models. [20] A logged-in user with access to GitLab's AI agent tools could have run commands on the gateway. [19] Only organisations that host their own gateway need to act. [20]

Why it matters. GitLab has already fixed the gateways it runs for customers and warned the others before it went public. [20] Last month CISA, the US cyber-defence agency, said a different GitLab flaw was being used in attacks a day after it was fixed. [19]

PwC, a large accounting and consulting firm, surveyed 3,934 business and technology leaders in 71 countries for its yearly report on digital trust. [24] More than half, 52%, named attacks on AI systems as the threat they are least ready for. [24] They split on who is responsible for AI risk: 29% said the technology chiefs, 26% a dedicated AI leader and 17% the security chief. [24][25]

Why it matters. A third of the leaders said their company has created a dedicated AI job, but the survey shows no shared answer on who answers when AI goes wrong. [24][25] That is the same question US senators are asking about AI makers this week. [7]

Timo Longin, a researcher at the security firm SEC Consult, has disclosed two flaws that let anyone send email from any iCloud address. [18] The forged emails passed the checks that mail services use to prove where a message came from. [18] He first reported the problem in May 2024, and Apple's first fix did not close it. [18] Apple fully fixed it in December 2025 and paid him $15,000. [18]

Why it matters. Inboxes use those checks to decide whether an email really comes from the address it shows, so a forged iCloud message looked genuine. [18] The flaw stayed open for about 19 months after it was first reported. [18]

CISA, the US cyber-defence agency, began its yearly Cybersecurity Awareness Month on 1 October. [26] This year's theme is Securing the Next 250, and it asks every organisation to help protect the country's essential services. [26] Acting director Nick Andersen said the agency is putting the safety of essential services first, along with state and local governments. [26] Essential services include clean water, transport, healthcare and payments. [26]

Why it matters. The agency named state and local governments as a priority in the same week ransomware shut down Vicksburg's systems. [9][26] It is publishing tips and a toolkit for businesses and local governments. [26]

GitHub's security research team says its AI security agent found 24 flaws in Android apps. [18] One flaw in OsmAnd, a navigation app, let any other app on the phone change its settings and leak the user's location and routes. [18] Two bugs in the Wikipedia app could be chained to take over a user's account. [18] The team says the AI often got the danger wrong, so people still had to check each finding. [18]

Why it matters. The team says every finding still needed a person to review it before it was reported. [18]

Microsoft has switched on Windows settings backup by default for company computers moving to Windows 11 version 26H2, released on 29 September. [28] The tool saves a worker's Windows settings and list of Store apps, so they can be put back after a computer is reset or replaced. [28] It was optional when Microsoft launched it in November 2024. [28] The new default does not apply in places covered by the EU's Digital Markets Act, a law on big tech platforms. [28]

Why it matters. Company IT teams can still switch it off, and putting settings back still needs their approval. [28] The default only applies where IT teams have not already set the policy themselves. [28]

Osavul, a Luxembourg company, has raised $10 million to grow its service that warns governments and companies who may be planning attacks on them. [27] It was first built during Russia's invasion of Ukraine. [27] It says it works for governments in more than 10 countries and supplies NATO, the Western military alliance. [27] Osavul says more than 150 state-linked attacks and sabotage cases have been recorded in Europe since 2022. [27]

Why it matters. The figure of 150 comes from Osavul's own statement. [27] The money will go into expanding to companies that run power, water and other essential services. [27]