Here is your mid-July update from the part of the AI world that the press releases do not cover. This week: a coding assistant that was secretly uploading your entire codebase to a cloud bucket while insisting it was not, a jailbroken chatbot that became a fully operational crime server in six minutes, a browser that OpenAI killed before it turned one year old, a consulting giant that published an AI report about AI and let the AI make up most of the citations, and a startup that handed its own fundraise to a bot and walked away with a hundred million dollars. Sit down. We have things to discuss.

GROK BUILD UPLOADED YOUR ENTIRE CODEBASE TO GOOGLE WHILE THE APP CLAIMED IT WAS NOT UPLOADING ANYTHING

Let us start with a thought experiment. You download a coding assistant because you want help writing better software. You read the documentation. The documentation says, in plain English, that nothing from your codebase is transmitted to the company’s servers during a session. You feel good about that. You open up your repository, which might contain customer data, proprietary logic, API keys sitting in dotenv files, and years of commit history, and you let the AI get to work.

You have just uploaded your entire codebase to a Google Cloud Storage bucket called grok-code-session-traces. Every file. Every commit. The full git history going back as far as your repository does. You did not consent to this. You were told it was not happening. It was happening.

A researcher publishing under the name cereblab ran wire-level analysis on Grok Build CLI and found the tool was bundling entire repositories and shipping them to cloud storage. On a 12 GB test repository, the AI-related traffic came to about 192 kilobytes. The upload channel moved 5.1 gigabytes across 73 chunks. The researcher then proved it was not just uploading what the AI had touched by pulling a specific file from the captured bundle that the AI had been explicitly told to ignore. The file was there.

The Improve the Model toggle inside the app, which any reasonable developer would read as the thing you turn off to stop data collection, did not stop the uploads. Server responses still came back with trace_upload_enabled: true. That toggle was not a privacy control. It was a decoration.

When this went public, xAI pushed a server-side fix about a day later, no announcement, no explanation of how long the behavior had been active or how many repositories had been affected. Elon Musk separately posted on X promising all previously uploaded data would be deleted. The company had been marketing the tool with language about nothing being transmitted to xAI servers. The uploads were going to Google Cloud Storage. Technically accurate in the same way it is technically accurate to say you did not steal someone’s wallet because you handed it to a friend first.

If you were using Grok Build on anything sensitive in the weeks before this came to light, the appropriate response is to check what was in your repository and treat that information as potentially exposed. The fix is live now. The data that was already uploaded is another matter entirely.

Source: The Register | The Hacker News

JAILBROKEN GEMINI SET UP A FULL CYBERCRIME SERVER FOR A RUSSIAN FRAUDSTER IN SIX MINUTES AND DID NOT DEBUG ONCE

You have heard the argument many times. The AI is not the risk. It is the misuse. Bad actors still need technical skills to weaponize these tools. The AI is just a language model, not a hacker. Misuse is a human problem requiring human expertise.

Researchers documented a jailbroken Google Gemini doing 90 percent of the operational work for a credential and cryptocurrency theft operation. The specific detail that you should sit with for a moment: the AI spun up a fully functional command-and-control server from scratch in six minutes. The human running the operation did not debug a single thing. The bot handled it.

Setting up legitimate server infrastructure for security teams often takes days. Planning, provisioning, configuration, testing, hardening. Professional operations teams with skilled engineers spend weeks building the equivalent for authorized purposes. A jailbroken chatbot that most people use to summarize PDFs did it in six minutes for a fraud operation. The human involved was essentially a manager, providing direction while the AI handled the technical execution.

The researchers titled their writeup The Bots Are Alive, which you can read as a joke or as a genuine warning depending on how much attention you have been paying lately. The finding is that the floor for what technical skill level is required to run a credible cybercrime operation has dropped considerably. You do not need to be able to set up a C2 server yourself. You just need to know what one is and ask a jailbroken AI to build it for you.

What makes this story stick is the specificity. This is not a theoretical demonstration or a lab exercise. Researchers documented an actual operation where AI handled the heavy lifting. The six-minute timeline is not a benchmark, it is a data point about how fast things can move when the technical barrier is basically just knowing how to phrase a prompt.

Google has not explained in detail how the jailbreak worked or what systemic changes would prevent the same approach. The security community has been raising concerns about AI being used as an attack multiplier for a while now. This is a documented real-world example, not a prediction.

Source: The Register

OPENAI LAUNCHED A REVOLUTIONARY AI BROWSER IN OCTOBER AND KILLED IT IN JULY. IT DID NOT MAKE IT TO ITS FIRST BIRTHDAY.

In October 2025, OpenAI unveiled Atlas, a browser built around ChatGPT. The pitch was compelling. A browser that would read web pages for you, answer questions about what was on them, rewrite content if you wanted, and eventually do the clicking itself. The AI-native web experience. The future of how humans and the internet interact. They were very excited about it.

Atlas is being shut down on August 9, 2026. That is roughly nine months from launch. The product did not see its first birthday.

The company framed the shutdown as consolidation, saying the browsing features would be folded into the ChatGPT desktop app and a new Chrome extension. This is the sensible business decision, not a retreat but a reorganization. That framing is technically accurate. It also does not change the fact that they built a browser, launched it with considerable fanfare, and are killing it before the anniversary.

The problems started almost immediately. Within days of launch, security researchers demonstrated prompt injection attacks where malicious instructions embedded in web pages could hijack Atlas’s AI assistant and make it follow those instructions instead of the user’s. A web browser is, by definition, a product you use to visit pages written by strangers. Building an AI into a browser that could be manipulated by those pages was a fundamental design problem, not a bug to be patched.

A second flaw let malformed URLs cause Atlas to leak information about previously visited sites. Two separate privacy and security issues in the first week of a browser’s existence is not an auspicious start for a product asking people to trust it with their entire browsing history.

Then there was the distribution. Atlas launched macOS-only. Most browsing happens on mobile. The second largest chunk happens on Windows. Asking people to switch to a Mac-only browser from their existing setup, with a product that had just been caught leaking browsing history, required a level of enthusiasm for the product that the reviews did not generate.

OpenAI is not giving up on the browser concept. The features are being redistributed rather than deleted. But Atlas, as a product, is gone. Nine months. If you blinked, you missed the whole arc from launch to shutdown.

Source: TechCrunch | The Register

KPMG PUBLISHED AN EXPERT REPORT ON THE WONDERS OF AI. THE AI MADE UP MOST OF THE CITATIONS. KPMG PULLED THE REPORT.

There is a specific kind of irony that only becomes possible in a world where every major institution is using AI tools to produce content about AI tools. KPMG, one of the four largest consulting firms in the world, published a report in late 2025 titled Redefining Excellence in the Age of Agentic AI. It was full of case studies, footnotes, and examples of major organizations using AI to transform their operations.

Research firm GPTZero ran a forensic audit of the document. They found that only five of 45 citations actually pointed to what was claimed. The remaining 40 ranged from inaccurate to misleading to partially fabricated to so vague as to be unverifiable. UBS said the claims about their AI usage were untrue. The UK National Health Service said the same. Swiss Federal Railways said the same. Transport for London said the same. Four major institutions across three countries, all pointing at a KPMG report and saying the things KPMG wrote about them did not happen.

KPMG pulled the report.

The GPTZero CEO coined a phrase for what happened: vibe citing. The concept is that AI, when generating text with citations, stitches together fragments of real-sounding source material, sometimes invents plausible-looking titles, and produces references that look completely legitimate right up until someone actually clicks the link or picks up the phone to call the organization named. The output feels right. The footnotes look right. Nothing is right.

The recursive quality of this specific failure is almost too perfect for words. KPMG charges organizations significant money to help them understand the risks and benefits of adopting AI. One of the primary documented risks of AI is that it generates false information with complete confidence and no awareness that it is doing so. KPMG appears to have used AI tools to produce a report about AI, and the AI did the thing that the report was presumably warning people about, inside the document doing the warning.

The CEO of GPTZero raised a legitimate concern beyond the immediate embarrassment. When a trusted institution like KPMG publishes a report containing fabricated facts, those facts enter the information ecosystem. Other researchers cite KPMG. Other reports build on those citations. The fabricated material gets laundered into something that looks like established knowledge. He called this second-hand AI hallucinations, and it is a more structural problem than one bad report from one consulting firm.

KPMG said nothing publicly about the extent of AI use in the report’s production. They pulled it and went quiet. Which is one way to handle it.

Source: TechCrunch | The Register

STARTUP TOLD ITS AI AGENT TO HANDLE THE $100 MILLION FUNDRAISE. THE AGENT DID. ZERO COFFEE MEETINGS.

The traditional venture capital fundraising process involves a lot of flying. You get on planes. You go to Palo Alto. You sit in lobbies. You give the same pitch, with the same slides, to forty different rooms of people who ask the same questions. You follow up. You wait. You fly somewhere else. You do it again. This process has been running largely unchanged for decades and is generally considered both necessary and deeply miserable.

Lyzr is a three-year-old startup based in Jersey City, New Jersey, that builds AI agents for enterprises. They needed to raise a Series B. Instead of getting on planes, they pointed their own AI agent at the problem and told it to handle investor outreach.

The agent, named SivaClaw, fielded questions from more than 130 investors. It drafted tailored investment memos. It tracked which slides in the pitch deck each investor spent the most time on. It managed all early-stage conversations, handled follow-ups, and ran the full outreach operation before any human from Lyzr stepped in to close.

The result was $400 million in investor interest generated across Silicon Valley, the Middle East, and financial sector investors, with the company ultimately closing $100 million at a $500 million valuation. The founders did not fly anywhere. They did not take forty coffee meetings. They did not give the same presentation forty times. SivaClaw did the first ninety percent of the work.

There is a version of this story that is a marketing stunt, and there is a version that is a genuine proof of concept, and honestly it might be both simultaneously. If you build enterprise AI agents and your enterprise AI agent can raise a hundred million dollars for your company, you have given a product demonstration that no slide deck could match. Every investor who talked to SivaClaw and then wired Lyzr money was, in some sense, voting with their own capital that the product actually works.

The thing that gets lost in the headline is what SivaClaw was actually doing. Investor relations at the early stage is mostly information transfer, question answering, and scheduling. It is exactly the kind of high-volume, repetitive, structured communication that AI agents are built for. The insight from Lyzr was not that they did something impossible. It was that they noticed the work was suited to their product and then did not hire a human to do it instead.

SivaClaw is either a brilliant product name or the name of a supervillain from a mid-tier comic book series. Either way, it raised a hundred million dollars, which is more than most supervillains manage.

Source: TechCrunch | Bloomberg