Loading story…
The European Commission opened specification proceedings to define how Google must meet Digital Markets Act (DMA) interoperability requirements for Android and data-access requirements for Google Search. The Android proceeding concerns whether third-party AI-service providers must receive access to the same hardware and software features used by Google's own services, including Gemini, under Article 6(7). A separate Article 6(11) proceeding examines fair, reasonable, and non-discriminatory access to anonymised Search ranking, query, click, and view data for rival search engines, including whether AI chatbot providers qualify. The Commission said the proceedings themselves did not establish non-compliance but could inform later enforcement, including fines or periodic penalty payments.
Google said the Commission's final Android AI interoperability measures would require deeper access for user-downloaded AI agents to sensitive capabilities such as ambient microphones, cameras, on-screen content, and screen automation. The company warned that fraud, social engineering, polymorphic malware, and indirect prompt injection could abuse such access to compromise user data, accounts, and devices. Google also opposed a Trusted Certification Authorities model that could allow third parties to certify restricted-feature access without Google or device manufacturers retaining final approval, suspension, and revocation authority, and called for cybersecurity-expert consultation and strong platform enforcement controls during implementation.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
The European Telecommunications Standards Institute released its Securing Artificial Intelligence baseline cybersecurity requirements for AI models and systems.
Google was required to fully comply with applicable DMA obligations for its designated core platform services.
The European Commission designated multiple Google services as core platform services under the Digital Markets Act, including Google Search, Android, Chrome, Play, Maps, YouTube, Shopping, and online advertising services.
The European Commission issued final DMA interoperability measures requiring Android to provide user-downloaded AI agents with deeper access to device capabilities, including provisions for qualification of some high-risk features and a Trusted Certification Authorities program.
The Commission opened two DMA specification proceedings to clarify Google's compliance obligations for Android interoperability under Article 6(7) and Google Search data access under Article 6(11). The proceedings do not themselves determine that Google is non-compliant.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has warned that proposed European Commission remedies under the Digital Markets Act for **Google Search** and **Android** could introduce new cybersecurity and privacy risks by forcing broader interoperability and data sharing with rivals. According to Google security executive Heather Adkins, requirements that would give alternative AI assistants system-level access similar to **Gemini** on Android could make fraud easier and expose sensitive user data, while mandated access to Google Search data could weaken existing protections built around tightly controlled internal handling. Google also argued that sharing so-called anonymized search information—including query content, rankings, and click-rate data—at the level sought by regulators could enable user de-anonymization and create attractive new targets for attackers among smaller third-party recipients. The dispute comes as the European Commission prepares final decisions in two DMA cases covering Search and Android, with Google contending that competition measures can be implemented only if they do not materially erode security and privacy safeguards for European users.
Jul 12, 2026
The European Commission issued two binding decisions under the Digital Markets Act requiring Google to expand interoperability on Android and provide certain Google Search data to qualifying rivals. Under the Android ruling, third-party AI assistants must be allowed access to capabilities that Google Gemini already uses, including microphone, camera, screen interaction, ambient sensor data, hotword activation, background execution, and app-driving automation, with most changes tied to **Android 18** and a broader compliance deadline of **1 August 2027**. For a smaller set of more sensitive functions, Google may require certification through a **Qualified AI Assistant Programme**, but the Commission limited Google’s discretion and required equal treatment with Gemini. A second ruling compels Google to share anonymized search query, click, and ranking data with eligible rival search engines and AI chatbots that perform search, with rollout beginning in **2027** under contractual, audit, and independent review safeguards. Google said the measures could weaken privacy and security protections, expose sensitive search histories and trade secrets, and create broader national security risks, while the Commission said the final terms include tighter safeguards than earlier drafts. Google is expected to appeal the decisions.
Jul 18, 2026
Microsoft CEO Satya Nadella warned that enterprises are exposing proprietary knowledge when they use third-party AI systems, arguing that prompts, tool interactions, and corrective feedback can transfer valuable internal expertise to model providers. He described the dynamic as a "reverse information paradox," saying customers may pay twice for AI services—once in fees and again in knowledge that improves a vendor’s models—while urging organizations to set clear trust boundaries, keep control of evaluations and feedback, and avoid dependence on a single provider. The concern intensified as Google updated Search privacy settings so media from search interactions—including images, files, audio, and video—can be used to develop and improve its AI models unless users opt out. Separate reporting said enterprises are increasingly weighing private or open models against closed AI services because of fears that sensitive business data could be retained, learned from, or used to strengthen vendors that may later compete with them, even as major providers maintain that some API traffic is excluded from training or covered by zero-retention options.
Jul 14, 2026