Privacy and Cybersecurity Roundup: AI Risks, Regulatory Guidance and Threat Warnings
Summary
A roundup of recent privacy and cybersecurity developments covers smart-glasses and shareholder-data concerns, shadow AI, third-party assessments, cyber readiness, risk-management guidance and alleged large-scale AI model distillation.
Key points
- Germany’s Hamburg data-protection authority says smart-glasses wearers may have GDPR responsibilities; it found the recording indicator may be inadequate and raised concerns about using bystander data to train AI.
- The UK NCSC warns that unapproved AI tools can expose organizational data, while AI agents may create security risks through their access to systems and data.
- Canadian privacy guidance recommends assessing third-party providers’ data practices, security controls, subcontractors, cross-border handling, breach response and deletion arrangements.
- A Canadian Cyber Centre advisory urges organizations to review readiness for disruptive attacks, including DDoS and defacement, and strengthen measures such as MFA, incident response and OT protection.
- New York DFS guidance emphasizes documented, repeatable cybersecurity risk assessments that cover assets, third parties, emerging threats and links between identified risks and controls.
- The U.S. NSA, CISA and FBI allege that Chinese AI companies used large-scale, evasive campaigns to extract capabilities from U.S. AI models; they recommend stronger monitoring and information sharing.
- Other developments include CISA’s updated insider-threat guide and a German court’s finding that a proposed video connection to the U.S. required a valid GDPR international-transfer mechanism.
Article Details
- Event Type
- Joint cybersecurity advisory alleging industrial-scale AI model distillation and circumvention of provider controls by China-based companies.
- Impact
- NSA, CISA and FBI said the companies collectively extracted billions of tokens through millions of requests from models operated by Anthropic, OpenAI, Google and xAI. The agencies said the activity was used to accelerate competing model development and could expose proprietary capabilities; the allegations are attributed to the advisory.
People
Vendors
Alibaba GroupAccording to the advisory, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have collectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAIAnthropicZ.AI have collectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAI since at least late 2024. The agencies state that the campaigns were likelyDeepSeekAccording to the advisory, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have collectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAIGoogleextracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAI since at least late 2024. The agencies state that the campaigns were likely conducted with theMeta🇩🇪 Hamburg DPA Examines Meta AI GlassesMiniMaxAccording to the advisory, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have collectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAIMoonshot AIAccording to the advisory, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have collectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAIOpenAIcollectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAI since at least late 2024. The agencies state that the campaigns were likely conductedStepFunAccording to the advisory, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have collectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAIxAIbillions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAI since at least late 2024. The agencies state that the campaigns were likely conducted with the ChineseZ.aiAccording to the advisory, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have collectively extracted billions of tokens through millions of requests involving models from Anthropic, OpenAI, Google and xAI
Products
DeepSeek R1Chinese government’s awareness and were used to accelerate development of competing models, including DeepSeek R1 and V3 and Alibaba’s Qwen family.DeepSeek V3Meta AI🇩🇪 Hamburg DPA Examines Meta AI GlassesQwenand were used to accelerate development of competing models, including DeepSeek R1 and V3 and Alibaba’s Qwen family.Ray-Ban Meta AI Glassesand Freedom of Information (HmbBfDI) published its final technical and legal review of the Ray-Ban Meta AI Glasses. The report examines the first-generation Ray-Ban Meta Wayfarer as a case study, focusingRay-Ban Meta Wayfarerand legal review of the Ray-Ban Meta AI Glasses. The report examines the first-generation Ray-Ban Meta Wayfarer as a case study, focusing particularly on the processing of third-party data by people wearing the
Countries
Chinaand Federal Bureau of Investigation (FBI) issued a joint cybersecurity advisory alleging that several China-based AI companies have conducted large-scale campaigns to extract proprietary capabilities from U.S.United States(Sächsisches Oberverwaltungsgericht) refused a request to allow an expert adviser located in the United States to participate remotely in proceedings concerning Leipzig/Halle Airport. The Court relied on
Industries
Artificial intelligenceThe Government of Canada has released its National Artificial Intelligence Strategy: AI for All, setting out a federal policy framework built around AI trust, adoption and technological sovereignty. The strategy isCritical infrastructureGoals provide a structure for that review. The framework contains 36 goals for Canadian critical infrastructure owners and operators and maps each goal to an intended outcome, recommended action, relevant