Loading story…
LinkedIn has announced that it will share user data with Microsoft and its affiliates to train generative AI models, including those developed by OpenAI. Users are automatically opted in to this data sharing, and must manually opt out if they do not wish their information to be used for AI training. The data involved includes profile details, job-related information, posted content, and user feedback. Privacy advocates have raised concerns about the default opt-in approach and the breadth of data being shared. LinkedIn provides users with settings and formal objection processes to limit future data use, but data already processed cannot be retracted.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
LinkedIn introduced a policy to use members' data to train its AI systems unless users actively opt out. The change was reported in late September 2025, with guidance focused on how users could disable the setting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft CEO Satya Nadella warned that enterprises are exposing proprietary knowledge when they use third-party AI systems, arguing that prompts, tool interactions, and corrective feedback can transfer valuable internal expertise to model providers. He described the dynamic as a "reverse information paradox," saying customers may pay twice for AI services—once in fees and again in knowledge that improves a vendor’s models—while urging organizations to set clear trust boundaries, keep control of evaluations and feedback, and avoid dependence on a single provider. The concern intensified as Google updated Search privacy settings so media from search interactions—including images, files, audio, and video—can be used to develop and improve its AI models unless users opt out. Separate reporting said enterprises are increasingly weighing private or open models against closed AI services because of fears that sensitive business data could be retained, learned from, or used to strengthen vendors that may later compete with them, even as major providers maintain that some API traffic is excluded from training or covered by zero-retention options.
Jul 14, 2026
LinkedIn introduced identity-authentication and account-management tools aimed at limiting AI-enabled impersonation, fabricated employment histories, online manipulation, and scams. Members will be able to confirm that verified connections were colleagues or classmates during a stated period, creating peer-based confirmation of employment or education rather than a skills endorsement. A verifier must have a verified profile, have been connected to the member for at least one year, and use two-factor authentication. The platform is also giving organizations controls to remove profiles that falsely claim employment from their company pages and related search results, while piloting mandatory workplace verification for future company-page associations. LinkedIn is expanding identity-verification partnerships so users can display their LinkedIn-verified identity on third-party services, including Truecaller and PeerSpot.
Sep 28, 2026
HackerOne publicly addressed security researcher concerns that bug bounty submissions might be used to train its AI capabilities following the launch of its **Agentic PTaaS** offering. CEO Kara Sprague stated the company does **not** train generative AI models on researcher submissions or confidential customer data (internally or via third parties), describing its AI system (*Hai*) as intended to speed up outcomes like report validation and rewards rather than replace researchers; other bug bounty platforms (including **Intigriti** and **Bugcrowd**) similarly reiterated policies against using researcher data for AI model training. Separately, a consumer Android app, **“Video AI Art Generator & Maker,”** exposed user content after researchers found an unsecured Google Cloud storage bucket containing **8.27 million** media files, including roughly **2 million private user photos and videos**, along with AI-generated media; the developer (Codeway) reportedly secured the bucket after disclosure, and another Codeway app had previously been linked to a large-scale exposure due to backend misconfiguration. In parallel, reporting on academic research and litigation highlighted that LLMs can be induced to reproduce **near-verbatim copyrighted text** from training data, with courts scrutinizing both the legality of training on copyrighted works and the separate issue of storing pirated datasets; AI vendors argued that extraction techniques are impractical for typical users and that models learn patterns rather than retain exact copies, while researchers and legal experts warned that verbatim reproduction can constitute copyright infringement and raises broader governance and data-handling risk for AI deployments.
Jul 12, 2026