Who gets to use your data, and who gets access?

This week's stories boil down to the same thing: who gets to use data, and who gets access to what. Sometimes the answer is unclear, and sometimes it's fraud.

Data used for more than agreed

The most intrusive example comes from the Muse headband. According to a study in the journal Science, the manufacturer used customers' brain data to train an AI model, without the privacy policy saying so. The company has since changed the policy.

At OpenAI, it's an upcoming change. Starting November 29, the company will use data from Daybreak Blue sessions to train its models. Researchers fear that OpenAI will thereby learn from their security work. After criticism, a separate opt-out has been promised. That has not happened yet, so for now the opt-out is only a promise.

The same question looms online. Meta has postponed new commercial terms indefinitely after publishers feared the terms give Meta the right to pull content from their sites. This is called scraping: automated collection of content from websites. Legal experts say the revised wording is still broad.

Fake copies and locked doors

A malicious version of the Claude Code extension sat on Cursor's marketplace for about 11 hours and may have given attackers access to as many as 5,000 developers' computers. Cursor is a program that developers use to write code with AI assistance. Anthropic says the company's own systems were not compromised, while ThreatDefence calls it unresolved whether Anthropic's official channels were unaffected.

Another example is the Yoba campaign, which Check Point Research has described. Here, fake AI programs contained genuine, signed installer files from OpenAI and Anthropic. Behind them sat a cryptominer that exploits the user's computer.

On the defense side, the news points in two different directions. Google DeepMind says AI agents working under human supervision have found two weaknesses in older RSA encryption with 1024-bit keys. The results do not apply to keys of 2048 bits or more. Meanwhile, OpenAI has launched GPT-6 Cyber to find and test vulnerabilities in software, but only approved security teams can get access. Here, access is deliberately restricted.

Regulators are watching

According to Spotlight Delaware, the Delaware Department of Justice has sent a subpoena to OpenAI about safety and governance. California has already sent a similar one as part of an investigation into cybersecurity incidents, including the Hugging Face incident.

What can you do?

Read along when a service changes its terms, and look for opt-out options. Only download programs and extensions from official sources, and check the publisher, even when the name looks familiar. Keep an eye on November 29 at OpenAI, and on whether Meta comes back with new terms.