Signal
External signal.
Curated external reporting on AI privacy, sovereignty, security, and the regulatory shift that makes local-first architecture load-bearing.
Signal
What is happening outside — and why it matters here
Curated reporting on AI data leaks, regulatory shifts, and sovereignty pressure. Each item links to its primary source.
- 01
EU AI Act full enforcement arrives August 2, 2026 — fines up to €35M or 7% of global turnover
High-risk AI obligations under Articles 9–49 become fully enforceable. Penalty ceiling exceeds GDPR. Combined with collapsed EU-US data transfer pathways, cloud-by-default AI architectures sit in an increasingly narrow legal corridor for European operators.
Read our take → - 02
OpenAI Codex command-injection flaw exposed GitHub access tokens
Codex agent mishandled GitHub branch names, enabling injection of commands that could steal tokens and grant read/write to private repos. Patched. Reinforces the pattern: the more autonomy an external AI agent holds over your systems, the wider the blast radius when it fails.
Read our take → - 03
European Parliament bans AI tools over security concerns after Microsoft Copilot breach
Institutional AI tools restricted inside the European Parliament following a reported Microsoft Copilot data-exposure incident. Direct signal that hosted AI is increasingly treated as an operational liability in sensitive environments — not a productivity upgrade.
Read our take → - 04
ChatGPT data-exfiltration flaw patched — hidden DNS channel leaked full conversations
A single malicious prompt could silently forward ChatGPT chat content, uploaded files, and AI-generated summaries out through a covert DNS channel. Disclosed and patched February 2026. The incident is the argument for local-first: your data never leaves the boundary if there is no outbound channel to abuse.
Read our take → - 05
AI chat app leak exposes 300 million messages tied to 25 million users
A wrapper app plugging into ChatGPT, Claude, and Gemini left 25M users' conversations — 300M messages in total — publicly exposed. The failure mode is structural: sending private work to third-party wrappers concentrates risk in operators you never audited.
Read our take → - 06
34+ countries now enforce data-localization rules that cloud AI defaults may violate
Data-residency regimes have expanded to the point where the standard cloud AI architecture — send data to a centralized API, receive results — is legally questionable across dozens of jurisdictions. Local execution moves from preference to compliance requirement.
Read our take →
Continue