Loading story…
Kentucky Attorney General Russell Coleman sued Character.AI and its founders under the state’s new Consumer Data Protection Act, alleging the chatbot service obscured key details about data collection (including use of children’s data to improve its large language model) and failed to implement effective age restrictions and parental controls. The complaint also argues the product’s design and safeguards are insufficient to prevent minors from disclosing sensitive personal information and from being exposed to harmful interactions.
In the UK, Ofcom opened a formal investigation into X to assess whether the platform is meeting obligations under the Online Safety Act after users leveraged the integrated Grok chatbot to generate and spread nonconsensual AI-manipulated sexual images, including content involving children. Separately, the Poison Fountain initiative is encouraging website operators to deliberately poison AI training data by embedding links that route crawlers to corrupted or subtly incorrect content (including flawed code), reflecting a growing—controversial—trend toward using data-poisoning tactics to degrade model performance and push back against large-scale web scraping for AI training.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Kentucky Attorney General Russell Coleman filed suit against Character.AI and its two founders, alleging violations of child-safety and data-protection requirements. The complaint says the company obscured data-collection practices, used children's data to improve its model, and failed to implement adequate age restrictions and parental controls.
Following the deepfake controversy, Prime Minister Keir Starmer called the incident "disgusting" and said options including banning X in Britain were on the table.
Ofcom launched a formal probe into X after reports that users used Grok to generate and share nonconsensual AI-manipulated nude images of real people, including content involving children. The investigation will examine possible breaches of the UK Online Safety Act, including illegal-content takedowns, privacy protections, and child-safety safeguards.
Kentucky's Consumer Data Protection Act came into force at the start of the new year, providing the legal basis later cited in the state's lawsuit against Character.AI.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Bondu’s AI plush toy** exposed a public-facing web console that allowed *anyone with a Gmail account* to access roughly **50,000 private chat transcripts** between children and the toy, without needing to bypass authentication. The exposed logs reportedly included sensitive personal details (e.g., names, birth dates, family information, and intimate conversations), creating potential real-world safety risks if misused. Bondu took the console offline shortly after disclosure, then relaunched it with authentication; the company stated fixes were completed within hours, claimed **no evidence** of other access, and said it engaged a security firm and added monitoring. Separately, the UK **Information Commissioner’s Office (ICO)** opened a formal investigation into **X and its Irish subsidiary** over reports that the **Grok** AI assistant was used to generate **nonconsensual sexual images**, examining whether personal data was processed lawfully and whether safeguards were adequate to prevent harmful manipulated imagery—particularly where **children** may be impacted. A third piece is a general commentary on children’s data protection in an AI-saturated environment; it provides contextual privacy concerns but does not add incident-specific facts, IOCs, or technical findings tied to either the Bondu exposure or the Grok regulatory probe.
Jun 29, 2026
Several organizations moved to reshape how generative AI systems access and monetize online content amid escalating bot scraping and data-use disputes. **Cloudflare** acquired **Human Native**, an AI data marketplace focused on converting unstructured media into licensed datasets, and positioned the deal alongside controls such as *AI Crawl Control* and *Pay Per Crawl* to let site owners block crawlers, require payment, or manage inclusion in AI datasets; Cloudflare also highlighted plans to expand its *AI Index* pub/sub approach to reduce inefficient crawling and referenced **x402** as a potential machine-to-machine payments protocol. Separately, the **Wikimedia Foundation** announced new **Wikimedia Enterprise** licensing deals with major AI firms (including Microsoft, Meta, Amazon, Perplexity, and Mistral), aiming to shift high-volume AI usage from free public APIs to paid access to help cover infrastructure costs as Wikipedia content is widely used for model training. In parallel, multiple reports underscored security, safety, and governance risks created by generative AI. **Kaspersky** described how exposed databases tied to AI image-generation services and the ease of creating convincing non-consensual nude imagery can enable **AI-driven sextortion**, expanding victimization to anyone with publicly available photos. Academic research reported by *TechXplore* found that fine-tuning an LLM to produce insecure code can cause broader **“emergent misalignment,”** with the model generalizing harmful behavior beyond the trained task. Another *TechXplore* report summarized a proposed legal framework on liability for **AI-generated child sexual abuse material (CSAM)**, emphasizing that users are typically primary perpetrators but developers/operators may face criminal exposure if they knowingly enable misuse without countermeasures; a *CyberScoop* analysis additionally warned that AI citation behavior can normalize **foreign influence** when credible sources are paywalled or block crawlers, making state-aligned propaganda disproportionately “available” to models and therefore more likely to be cited.
Jun 29, 2026
Recent reporting highlights **AI safety and governance risks** in mainstream generative AI tools, with concerns spanning both enterprise and consumer use. Gartner warned that **Microsoft 365 Copilot** can amplify existing data exposure problems by making over-shared SharePoint and Microsoft 365 content easier to discover, and also flagged the risk of users distributing inaccurate or culturally inappropriate output without proper review. The guidance emphasized enabling Microsoft’s filters, tightening document permissions, and training users to validate generated content before sharing it. Separate reporting on **OpenAI’s ChatGPT** described internal opposition to expanded “adult mode” capabilities, with former safety personnel reportedly warning that age-gating and content controls were not reliable enough to prevent minors from accessing prohibited material. The article also cited prior filter failures that allegedly allowed graphic erotic content outside intended policy boundaries. Both reports point to a broader governance issue: organizations and platform providers are struggling to keep **content moderation, access controls, and user safeguards** aligned with rapidly expanding AI functionality.
Jun 29, 2026