The latest roundup of security stories highlights how trusted software can quietly erode privacy. AI coding tools are a growing concern: Z.ai's ZCode assistant had a default setting that uploaded users' local code repositories to Alibaba Cloud servers in China without explicit consent. The company has since disabled the offending workflow and opened its codebase for review, but the incident follows a similar case where SpaceXAI's Grok Build was found uploading entire Git repos to a Google Cloud Storage bucket. For enterprises, the risk is clear: source code is highly sensitive, and AI tools may not treat it as such.
Separately, researchers detailed the surveillance capabilities of MAX, a Russian state-backed super-app developed by VK. They found five distinct abilities that let MAX act as a man-in-the-middle for all mini-app interactions: capturing screenshots without permissions, reading and writing mini-app local storage, injecting JavaScript at runtime, mediating network traffic (including routing through a GOST TLS proxy in the Russian build), and controlling authentication tokens so it can silently impersonate users. The report concludes that users' assumed security guarantees within mini-apps are effectively void.
Phishing remains a low-tech but effective vector. A fake Claude Max giveaway used a spoofed Google sign-in window in a browser-in-the-browser attack to steal credentials. There was no card form or download—just a prompt to log in. Together, these stories show that both advanced AI tooling and simple social engineering can compromise privacy, and that vigilance is needed when granting access to code, data, or login details.