Every click is a risk, Digital Defenders.

If it connects, it’s a vector. From exposed chat histories to backdoored dev tools, today’s threats hit across AI, hardware, and human behavior. Trust nothing by default.

Here’s what you need to know:

Zero-Day Download

OpenAI Kills Searchable Chat Option After Privacy Blowback

OpenAI disabled a feature that let ChatGPT chats appear in search engines, after users exposed personal information despite warnings not to.

Source: Visual China Group via Getty Images

The opt-in feature, added earlier this year, included a “Make this chat discoverable” checkbox on shared chats. Some indexed chats revealed names, emails, and other sensitive data. OpenAI says it is now working with search engines to scrub cached results. However, the company still faces legal pressure to retain user data due to a New York Times lawsuit.

Never assume “optional sharing” tools are private. Always review what’s exposed before hitting send.

Nvidia Faces Scrutiny Over Alleged Chip Backdoors

China’s top internet regulator summoned Nvidia to explain security concerns about its H20 AI chip. Experts allege the chip could allow remote shutdowns or location tracking.

The H20 is not the company’s most powerful chip, but Chinese firms see it as key to closing the AI gap. Earlier this year, US lawmakers introduced a bill requiring chips to report their location to enforce export rules. The H20 is approved for sale in China after the Trump administration lifted an export ban.

Location control features could become a new standard. If you work with AI hardware, monitor how export controls and compliance tracking will affect your supply chain.

Social Engineering Named Top Cyber Threat of 2025

Palo Alto Networks’ Unit 42 found that social engineering caused 36% of all cyber incidents in the past year. Nearly 60% of these attacks led to data exposure. 

Help desks and identity recovery systems are frequent targets. Attackers now use AI-generated lures and real-time impersonation to bypass security controls. ClickFix campaigns use fake browser prompts and SEO poisoning to trick users into downloading infostealers. 

People are now the primary attack surface. Lock down identity resets and monitor user behavior.

Share this newsletter!

Pulse Check

Could your coworkers recognize a deepfake voice?

Yesterday's Pulse Check Results

What’s your biggest red flag in a phishing email?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Cursor AI Tool Hit by Critical Flaw Allowing Remote Code Execution

Security researchers found a flaw in the AI coding assistant Cursor that lets attackers run code on a user’s machine by injecting prompts through external tools like Slack. 

Source: Alina Vytiuk/Alamy

The attack starts when a user connects Cursor to a tool like Slack and opens a chat asking the AI to summarize messages. If a hacker has posted a malicious message in that Slack channel, Cursor reads it, writes hidden instructions to its settings file, and runs the code automatically before the user sees or approves anything.

Cursor has fixed the issue in its latest version, but experts warn that any AI tool connected to outside apps can still be at risk.

Before linking AI tools to chat or work apps, make sure they can't run code without asking you first.

North Korea Uses Popular Open Source Tools to Spy on Developers

xperts discovered that North Korea’s Lazarus Group uploaded fake versions of popular developer tools to open source hubs like npm and PyPI. The malware posed as common tools for debugging, APIs, and command-line tasks.

Once installed, it stole credentials, profiled developer machines, and opened hidden access points inside company systems. The attacks spread quietly through automated build pipelines and affected thousands of environments.

Researchers say open source software is now a key target for state-backed hacking. Don’t install open-source packages blindly. Check publishers and scan for hidden code.

Security Tip of the Day

Don’t Trust AI to Write Secure Code

AI coding tools can speed up development, but they often produce code riddled with security flaws.

Source: Shutterstock

A new study tested over 100 AI models and found that nearly half of their code samples failed basic security checks. Many introduced well-known risks like cross-site scripting or hardcoded credentials, especially in popular languages like JavaScript and Python.

Here’s how to keep AI-written code from becoming a liability:

Fast doesn’t mean safe. If you’re using AI to write code, you need a security review built into the workflow.

Meet Our Writer:

Greg Parker

Greg Parker is a cybersecurity and emerging tech writer who explores the intersection of digital risk, human behavior, and innovation across sensing and security technologies.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.