AI security
Attacks on and with AI
New VOLTA infostealer uses commercial AI models to profile and rank stolen victim data
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests credentials, cookies, session data and cryptocurrency information. It then uses large language models, reported to include Claude, Gemini and Kimi, to enrich identities and rank victims by monetisation value.
India proposes DEPA framework to train AI models on local data without moving it
India's Ministry of Electronics and Information Technology has outlined the DEPA for AI Training framework, in which Training Data Providers such as hospitals and banks share anonymised, encrypted data with Data Exchange Platforms. Training Data Consumers then train models inside hardware-based secure data environments, with differential privacy and immutable audit logging. The framework is a proposal and its implementation timeline is unclear.
Amazon memo on AI use in engineering draws scepticism over mixed messages and token-usage metrics
An Amazon memo by a Distinguished Engineer says engineers who find AI does not help their work should document it as a finding, not a failing. The columnist argues the memo contradicts itself on input metrics and warns that token-usage targets, like Amazon's shut-down KiroRank leaderboard, can be gamed, while AWS earns revenue from token billing.
EFF Warns Narrowing Fair Use for Generative AI Training Would Harm the Public
The EFF has filed an amicus brief in In re OpenAI, arguing that narrowing the fair use doctrine would affect far more than generative AI developers. It warns that requiring lawful acquisition of training data or mandatory licensing would entrench large tech firms, impede research and journalism, and cast doubt on routine copying in everyday internet use.