Modern laptops might've tried to kill off the built-in optical drive, but physical media is far from dead. Case in point: the Dell DW316 Slim external USB DVD-RW drive for $39 at Amazon.

Physical media is making a serious comeback (my hardware editor, with his massive library of films, games, and books, argues that it never went away). In fact, this Dell USB writer proved essential when I wanted to watch my wedding video from 20 years ago, which was locked on DVD.

If you need to rip CDs and DVDs, access archived files, or just kick back and watch a movie, the USB-powered Dell DW316 is an easy recommendation from me.

• Dell DW316 is also available for $40 (was $50) at Best Buy.

Why we recommend it

I put the Dell DW316 to good use myself this year when my wife and I celebrated our 20th wedding anniversary. As I mentioned, our wedding video is still on DVD and this gave us an easy way to watch it again.

Beyond digital nostalgia, it's a really practical upgrade to access older software, music, movies and other physical media that would otherwise be left gathering dust.

And unlike files stored on a computer, in the cloud or on a storage device, data burned to a write-once disc can't be accidentally deleted, overwritten or changed, giving you a permanent physical copy. Write-once media can create a physical copy of important documents, photos or other files that can be kept offline and separate from your computer.

The drive is just 14mm thick and weighs 200g. Power comes directly from your laptop's USB port, eliminating the need for a separate power adapter. It can also create discs using CyberLink Media Suite 12 which comes supplied free.

Price context & historical value

This drive has never been priced above $52 (at least, not since 2015), while its lowest price was $16 back in 2020. General trends show it more or less holds its price at around the $35 to $40 mark. For comparison, Dell's external disc drive is also available at the same price, $40 (was $50) at Best Buy.

Should you buy it?

✅ Buy the Dell DW316 if...

You occasionally need to access old CDs, DVDs or disc-based software, or want an inexpensive way to create physical copies of important files. The drive's small size means you can keep it tucked away until you actually need it.

❌ Skip the Dell DW316 if...

You need Blu-ray support or regularly work with large amounts of data. DVDs have limited capacity compared with modern storage devices, and this drive can't read or write Blu-rays.

The Catch: What to know before you buy

The DW316 connects over USB and is an older optical-drive design, so don't expect the transfer speeds you'd get from an external SSD or flash drive. Its purpose is accessing and creating optical media rather than moving large files quickly.

You'll also need compatible blank writable discs if you intend to use it for backups or archiving, adding a small additional cost on top of the $35 price.

• Shop all CD/DVD drives at Amazon

• 3 points

Data centers across the United States have been criticized for harming local environments sourcing power - sometimes illegally - from gas burning turbines that can release harmful pollutants into the air surrounding local communities.

But dozens of data centers have been accused of releasing harmful chemicals, heavy metals, and rare bacteria with the wastewater they release into nearby treatment facilities and waterways.

Violations have been logged for data centers in Wyoming, Virginia, New York, and Georgia, but the problem likely extends far across the rest of the US. Information on water usage and discharge for many data centers is hard to come by - or is being actively blocked.

Pollutants released into water across the US

In Wyoming, Meta was recently forced to halt water discharges from the construction site of its enormous 960-acre Cheyenne campus after a resistant bacterium - Cupriavidus gilardii - was found within a local water treatment facility.

The bacterium was identified after regulators tested a sample of the 801,000 gallons Meta had discharged into Cheyenne’s sewers. Following concerns that local residents could inhale droplets of the contaminated water if it was used for irrigation, local officials decided to stop accepting wastewater from the construction site.

Two water treatment facilities were forced offline as part of a multi-month decontamination and cleanup operation. Meta’s contractor responsible for the site, Goat Systems, is appealing the decision of officials to stop accepting wastewater from the site.

Multiple data centers across Virginia are facing enforcement actions from local authorities for violating wastewater and wetland regulations. In one such case, a data center under construction in West Virginia has funneled stormwater runoff into a local residential area, causing flooding on two occasions.

A data center near Lake Seneca, New York, is facing criticism from the Seneca Lake Guardian organization. The site was previously a cryptocurrency mining data center, but has been transitioning towards handling AI workloads instead. Seneca Lake Guardian has said that wastewater from the site flows directly into Lake Seneca at temperatures of up to 108F (42C), which can harm fish living in the lake and cause blooms of toxic algae.

The company behind the data center, Vulcan Infrastructure and Power, says it complies with all relevant environmental laws.

Multiple new data centers in Georgia have been approved to draw water from the Chattahoochee river, but local environmental guardians, such as water policy director at Chattahoochee Riverkeeper, Chris Manganiello, are being blindsided by a complete lack of information on how much water will be taken from the river, and what will be put back in.

“We need to know what is in this wastewater but there is a void of information,” Mangeniello told The Guardian. “I would like there to not be more Pfas [forever chemicals] going into the river but there is this level of anxiety because we don’t know what’s there.”

Don’t throw the Pfas out with the cooling water

Data centers pump water through miles of pipes crisscrossing their hardware in order to draw away excess heat. While there have been moves towards “closed-loop” cooling technology - where the water used is recycled within the system - there are still valid environmental concerns associated with these systems.

Before using a closed-loop system, the pipes need to be flushed through with water to wash away any debris or contaminants that were deposited within the pipes during assembly. This water is then released back into sewers to be cleaned by local treatment plants.

But many water treatment plants simply aren’t built to handle filtering water that contains industrial contaminants. These contaminants can include heavy metals or Pfas that can cause health problems in humans and animals.

Data centers are also being built in drought-hit regions, largely because the land is cheap, placing additional strain on already struggling water tables. Data centers can use hundreds of thousands of gallons of water per day to stay operational, and while closed-loop systems ensure this water is only taken out of the cycle once, it is still a significant sum of water to remove from regions experiencing droughts.

• Microsoft has fixed no fewer than 974 vulnerabilities in its latest Patch Tuesday release
• Two were already being exploited in the wild, 114 categorized as 'Critical'
• AI is to blame for boosting CVE discovery and also intensifying attacks

Microsoft's September 2026 Patch Tuesday has become its biggest security release on record, with the company issuing fixes for a staggering 974 vulnerabilities across the entire stack.

According to the company's release notes, an overwhelming majority (723) of the vulnerabilities addressed related to Windows, with Office coming in at second place with 111 of its own vulnerabilities being addressed.

While it's clear that the number of vulnerabilities is going up year-over-year, it's likely that the company was also simply able to find more of them that would otherwise have slipped through the net thanks to AI-assisted discovery tools.

This is Microsoft's biggest Patch Tuesday ever

Speaking about the September 2026 Patch Tuesday in a blog post, Dustin Childs explains that this could be the start of the "new normal." Childs goes on to reveal that Microsoft has patched 2,760 CVEs this year to date – more than double any other year that precedes it.

Childs' figures show that the company patched 1,139 CVEs in the whole of 2025, and a much lower 492 a decade ago in 2016. According to the post, 114 of the vulnerabilities patched in this latest update were 'Critical' – more than one in 10.

In its own notes, Microsoft described CVE-2026-85880 and CVE-2026-81963 as especially notable because they're both being actively exploited, hence the push to get them fixed and for customers to install the update.

Elsewhere in the industry, Microsoft isn't the only company addressing a higher volume of bugs. Childs also highlighted high activity from Adobe, while a number of browser developers including Google, Mozilla, Brave and Microsoft itself have doubled the release cycle to two weeks in order to get fixes into customer hands more quickly.

Besides fixing exploitable bugs, Microsoft also used the opportunity to issue fixes to known issues – including fixing Teams and Outlook crashes on Arm64 PCs – as well as to upgrade Copilot+ AI components.

• CISA, NSA, FBI warn Chinese AI firms of industrial‑scale knowledge distillation
• Companies like DeepSeek, Moonshot, Alibaba allegedly extracted billions of tokens from US frontier models
• Advisory urges detection of malicious prompts, deceptive responses to distillation, and cross‑provider intelligence sharing

Chinese AI companies’ core development strategy is to steal proprietary functionalities and capabilities from their US counterparts, law enforcement agencies have warned.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published a new security advisory, drafted jointly with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), warning American AI companies about an ongoing “aggressive, malicious, and targeted distillation activities at an industrial scale,” and sharing recommended mitigation steps.

Knowledge distillation

IBM defines knowledge distillation as a “machine learning technique that aims to transfer the learnings of a large pre-trained model, the ‘teacher model,’ to a smaller ‘student model’.” It is used in deep learning as a form of model compression and knowledge transfer, it added, particularly for massive deep neural networks.

So, knowledge distillation is not illegal or malicious, per se. Its goal is to train a more compact model to mimic a larger, more complex one. In the security advisory, the agencies stress it is “recognized as a legitimate and useful technique in AI research,” but add that China-based AI companies are using it in ill will.

In other words, the agencies claim that instead of spending months and millions developing new capabilities for their models, the Chinese are simply sending huge numbers of carefully designed questions to US models and extracting the answers.

Which companies are engaged in knowledge distillation?

Apparently, all companies worth anything. DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI all allegedly “extracted billions of tokens across millions of exchanges/requests from US frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.” CISA also stressed that this was likely done with the awareness of the Chinese government. It hasn’t outright said, “with its blessing”, although it could be read between the lines.

The advisory shares a thorough list of all the models that were being trained, as well as all the models being taken advantage of.

On the Chinese side, they include DeepSeek R1 and V3 models, Moonshot’s Kimi-K2 and Kimi-K3 models, and MiniMax’s M2 model. On the US side, they start with earlier models such as GPT-4, Claude 3.7, and Gemini 2.5 Flash Preview, all the way to Claude Fable 5, GPT-5, and similar.

When done in good faith, knowledge distillation is not illegal. However, the report says the companies routed the requests through multiple accounts, different API access points, multiple cloud providers, third-party AI aggregators, proxy services and “transfer stations”, as well as premium subscriptions shared between developers, all in an attempt to work around defenders trying to disrupt the process.

“This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership. Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations,” the agencies concluded.

What US companies should be doing

To defend their intellectual property (and thus remain ahead of Chinese competing models) US AI companies should implement comprehensive detection and mitigation, the agencies said. That means hunting for anomalous and malicious prompts, accounts, networks, and behaviors. Furthermore, they should monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.

The second step is to “deploy targeted response changes”: “Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.” In other words, AI companies should make sure their products lie when they spot they were being distilled for knowledge.

Finally, US AI firms should set up cross-organization intelligence sharing, correlating activity across model providers, cloud platforms, and API aggregators.

The bottleneck on sophisticated cyber operations that target nation states is breaking. Conducting a large-scale cyber attack used to mean scaling expert talent.

When the cost of adding a capable attacker approaches the cost of compute, the economics of offense fundamentally change.

This is already operational: Dream's threat research recovered an autonomous multi-agent framework that ran intrusion campaigns against government entities in Asia, executing twelve attack waves in four days with eight parallel agents, compromising 85 government accounts, and using a closed learning loop to adapt after failure.

The advantage is shifting from the number of experts to how effectively their expertise can be scaled.

AI benefits both attackers and defenders, but defenders start with a unique advantage: they already own the map attackers must discover.

Defenders that understand their environment can use AI to turn that knowledge into operational scale.

The Autonomous AI Government Hacker

In July, our threat research team recovered the operational workspace of an autonomous multi-agent framework that had been conducting intrusion campaigns against government entities in Asia.

Over roughly four days, the framework executed twelve attack waves and ran up to eight AI agents in parallel. Built on the publicly available Hermes and OpenClaw frameworks, it compromised 85 government employee accounts and used 84 of them to pivot through a government single sign-on environment.

What’s really intriguing is its autonomous operational decision making.

Assigning confidence scores

Every discovery was assigned a Bayesian confidence score to assess different paths and then chose how to proceed, just like an actual team.

Similarly, when an attack path failed, the framework automatically entered what it called a Learning Cycle, searched vulnerability databases and security research techniques relevant to that government's technology stack, and tried again. The framework audited itself – it created a closed learning loop: investigate, validate, act, observe the result, update its operational knowledge, and try again.

This was not a self-improving model. It was a self-adapting cyber attacker – there is a real expert behind it, embedded as AI system. The fundamentals of this attack weren’t even particularly impressive or novel. It is the scale – and the prospect for nearly infinite scale – that is daunting.

Until recently, one of the limiting factors in scaling sophisticated offensive operations was the expert reasoning required to decide what to investigate, validate findings, connect them into viable attack paths, and adapt when those paths failed. It was expensive, both in dollars and in expertise. That scarcity placed a natural constraint on offensive scale - scaling a sophisticated operation meant scaling skilled people, time and coordination.

AI is beginning to automate precisely that expensive layer of the operation: deciding what to investigate, validating hypotheses, learning from failure and choosing what to try next. Talent still determines the quality of those decisions. But the number of talented people no longer has to determine how many times those decisions can be made in parallel.

What happens when scaling an offensive operation no longer requires scaling the number of experts behind it at the same rate?

As someone who has spent 15 years in both offensive and defensive cyber roles, it’s becoming clearer every day that AI has changed that equation - the historical relationship between the amount of expert talent an organization has and the scale at which it can operate is beginning to break down.

AI does not eliminate talent - it changes what talent can scale.

An Attack Surface the Size of a Country

Government IT infrastructure is an interconnected ecosystem built over decades. It consists of ministries, municipalities, operational technology, legacy applications, cloud services, contractors, suppliers, and countless trust relationships connecting them together.

These connections typically exist for legitimate operational reasons (or at least historically legitimate reasons).

Of course, every connection is also a potential vulnerability.

This is how modern government attacks spread - not necessarily by exploiting one critical vulnerability, but by chaining together many ordinary ones.

Historically, this challenged both sides. No defensive team could continuously reason over every asset, identity, configuration, vulnerability and trust relationship across an entire country. But attackers faced a version of the same constraint. Their experts also had to decide where to spend their time to find a viable path from intrusion to crown jewel

Autonomous systems change that.

An autonomous attacker does not need to understand the entire government environment in advance. It can explore it continuously: discover a relationship, form a hypothesis, test it, learn from the result and move to the next one.

For the first time, governments may face adversaries capable of reasoning over national-scale attack surfaces faster than the institutions responsible for defending them.

The Race to Change the Outcome

The dramatic decline in the cost of offensive cyber expertise, via leveraging and weaponizing agents, is a tectonic shift. Until now, this was a skill limited to a select few and came with a high price tag.

Today, discovering, prioritizing and combining these techniques into viable attack paths is cheap, and one can repeat the process at machine speed.

With the pace of AI development, that statement becomes more true every day.

Offensive capability is becoming cheaper, faster and easier to reproduce.

But there is another side to this equation.

Defenders have always had structural advantages: more telemetry, deeper context, persistent access to their infrastructure, and knowledge of its configurations, identities and relationships, while also have a much better ability to act.

They too had the constraint of human capacity. No team could continuously reason over all that information, across every asset and relationship, all the time. The same AI that benefits attackers may operationalize defender’s historical edge at scale too.

This is where time plays a key role. Analyzing everything is not the same as defending everything. If AI detects a compromised identity in seconds but the credential remains active for six hours, the attacker still has six hours. If it identifies an exploitable path to a critical system but remediation takes three weeks, that path remains open for three weeks.

The opportunity, then, is not simply better analysis. It is reducing time-to-effective-action: the time between understanding a risk and changing the outcome.

And "effective" matters- disabling an identity, changing a firewall rule or patching a vulnerability is not enough. The system must verify that the attacker can no longer achieve its objective.

The defensive loop cannot end with intelligence - or even with action. It has to end with a verified security outcome.

The Gap That Matters

AI does not inevitably favor the attacker.

The framework we recovered had to steal its map of the environment, one probe at a time. Defenders already have that map. Every configuration, credential, telemetry stream and trust relationship could take an attacker – even an AI attacker – days to weeks to discover. What defenders could never do was reason over all the assets they had, continuously, due to the lack of talent capacity to do that.

AI begins to remove that human-attention constraint. It allows defenders to amplify expert talent across thousands of investigations in parallel, continuously identifying attack paths, prioritizing those that pose the greatest risk, and focusing action where it matters most.

Attackers get the same leverage. But they don't start from the same place. Defenders have a home-field advantage: they already know and control the environment the attacker must discover.

The gap that matters is no longer simply the number of experts on either side. It is how effectively each side can scale that expertise- and direct it toward the right risks first.

Ultimately, the race is not about who can know more.

It is about who can scale talent in the right way- and turn that scale into an outcome first.

We've ranked and reviewed the best antivirus software available.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Over the past few years, I've become absolutely fascinated and have fallen in love with BenQ monitors. I love how they have become more Apple-esque, yet they include some features that most people wish Apple would add to their monitors. While I would love to have a studio display someday, I think that the quality would be amazing.

I am absolutely loving my MA series monitors across several of my workstations. I'm still loving my MA320U on my main desk in my home office studio, but the MA270S has made its home as the vertical monitor in my setup, where I currently have my RD monitor as well.

This panel is unbelievably crisp, integrates with everything in my DisplayPilot 2 app, and offers extra ports. It's got a halfway decent speaker for virtual meetings, though I wouldn't listen to music through it beyond background lo-fi. All around, this monitor has been an absolute treat for a ton of reasons.

BenQ MA270S: Price and availability

The BenQ MA270S retails for just under $1,000 on BenQ's website. It's also widely available from online retailers, including Amazon.

If that price doesn't scare you and you're looking for a 32-inch variant, they do have an MA320UG panel that is the same type of panel, just 32 inches. Make sure you check that one out if you're interested.

BenQ MA270S: Unboxing and First Impressions

The unboxing experience for this monitor is much like that of every other BenQ monitor I've tested. It comes in a simple brown box that's somehow still very well packed and secure. In the box is the monitor or panel, the stand, documentation, and every cable you could possibly need.

That is one thing I will always appreciate about BenQ: they include every single cable, regardless of how you use this monitor. If there's an HDMI option, they include an HDMI. If there's USB-C, they include USB-C, so you can get up and running right away.

The first time I laid eyes on the monitor, I immediately recognized how glossy the first panel was. Of course, that could be an issue if you're in a high-glare area, but I decided to put it to the test anyway. It took me exactly one second to know exactly what I wanted with this monitor.

I added it to my test setup that already has a BenQ R/D monitor. I knew this would be a perfect vertical monitor, even though there's a difference between the slightly matte display on the R/D monitor and the glossy display on this one.

Plus, to the left of my desk is a window. I have a semi-transparent shade on it, but still, there's a window. I did worry for a moment if there was going to be too much glare, but after setting everything up, I completely forgot that it was a concern. I was able to get to work immediately. Now, 100 days later, I am absolutely thrilled with this monitor.

BenQ MA270S: Design & Build Quality

As I briefly mentioned above, this monitor is incredibly clean. It comes with everything in the box, which is awesome. It has a fairly high-gloss finish. This is the kind of glossy finish that you would find on a studio display.

This is the kind of glossy finish that you would find on a MacBook or on a high-end creative laptop. It's beautiful. It's not just glossy for the sake of being glossy, but it's glossy to show just how sharp the image is, how beautiful the blacks are, and how vibrant the colors are.

That, plus the native integration with Apple's walled card, makes this monitor an absolute dream to use with a Mac. While I have used this desk setup with a PC, I prefer to use it with my MacBook Pro M4 Pro 14-inch. I can plug in a single cable through a docking station, technically, too, and run both these monitors without any problem.

When I need to just listen to a little bit of music or join a virtual meeting and I don't want to use my soundbar, I can run the audio through this monitor. While it's not great, it could get the job done before a virtual meeting if that's all you need it for, or maybe some lo-fi background music. If you're trying to actually listen to music or need to play audio for some other reason, I would suggest using headphones or an external speaker.

The bezels on this are sharp. The port access is phenomenal, and the ability to fit a clean Mac desk setup is truly uncanny. Sure, there's still a part of me that wishes I could have a studio display; however, with every upgrade to the BenQ Mac-specific line-up, that desire shrinks a little bit, by little bit, by little bit.

To bring me back to the ports for a moment, I genuinely appreciate that BenQ doesn't try to hide their ports under some sort of breakable plastic cover. Instead, they make the cables highly accessible, pointing directly over the monitor to avoid the cable dangling down underneath the bezel and being visible from the front.

The ports are firm yet not difficult to plug things into. They are well spaced, leaving room for even awkward cables, and they're in a good position. All around, a big win for me.

I've said it once, maybe even twice now, but I'll say it again: this is essentially BenQ's version of a 27-inch studio display. While the studio display has better speakers and a built-in camera and mic, this display wins out in pretty much every other category.

It's easy to set up and easy to use with both the Apple ecosystem and others, in case you need to plug in something else. It's got spectacular color accuracy, a beautiful panel, high resolution, a nice gloss, and it functions just as beautifully as it looks.

BenQ MA270S: In use

Looking back at my arrival date, I've had this monitor for exactly 166 days as of this review. In that time, it has lived almost every single one of those days on my desk in the photos as a vertical monitor paired alongside my BenQ RD series monitor.

It truly is a remarkably good 5K monitor, especially with the built-in features that let me adjust brightness and volume directly from my keyboard. I've used this monitor for accessing emails.

I always have my calendar, some messengers, and reminders up on this monitor, as I can have it scaled up to the smallest size Mac offers and still see every single line super crisp. Unlike the Studio Display, what I really appreciate about this monitor is that it doesn't just have USB-C. It has USB-A, USB-C, HDMI, and others to make these a lot easier.

BenQ MA270S: Final verdict

At the end of the day, most Mac users decide whether they care about the Studio Display. Since it was released, most people with an X-ray monitor have thought about switching to the Studio Display, but usually see the cost and change their minds.

That's where this monitor comes in strong, serving as a shield unless you are sitting on cash to burn or need the proprietary one for some other reason. This BenQ monitor feels like a true MVP.

I have absolutely loved using this monitor for work, and I look forward to continuing to use it as much as possible in the future. For me, this is one of the best photo editing monitors I've ever used.

For more top picks, we've tested the best monitors for Mac mini and the best monitors for MacBook.

• Check Point Research exposed coerced insider flaw in ChatGPT’s agent architecture
• Containers shared metadata via internal service, enabling cross‑account prompt injection and data theft
• OpenAI closed the path, but CPR warns similar risks may exist in other AI platforms

ChatGPT’s AI agents were allowed to pull sensitive data from one account shared with an entirely different account because, colloquially speaking, all agents used to walk down the same hallways, experts have warned.

A new report from security experts Check Point Research (CPR) dubbed the flaw “coerced insider”, since it revolves around persuading the agent instead of abusing a vulnerability.

Coerced insider

When an AI agent is given a task that needs code execution, it handles that task in an isolated container which also sometimes needs to install software. To enable that, without giving containers direct internet access (which would be too risky), OpenAI routes those packages through an internal JFrog Artifactory instance. As a separate security contingency, containers from different accounts cannot talk between themselves.

However - they can reach the same internal service (our proverbial hallways), which exposes an item management feature that lets the containers attach text or binary properties to a repository item. As a result, any container can read back the properties written by any other container.

“Check Point Research confirmed the isolation gap directly: a property written from one account’s container was fully readable from a different account’s container moments later, with data too large for one property simply split into chunks and reassembled on the other end,” the researchers explained.

“The package delivery metadata effectively became a shared clipboard between containers that were supposed to be walled off from one another.”

From there, the exploit turns into your usual, off-the-shelf prompt injection. The only difference is that the malicious prompt is not delivered directly to the victim, but rather left in the hallways, and the results are not shared with the attackers directly, but rather left in those same proverbial hallways, too.

The attacker then delivers a prompt or a shared conversation that instructs the agent to check the same storage during its next ordinary reply. The agent checks, sees the malicious instructions, executes them, all the while replying to the victim’s question in the usual manner. The victim is oblivious to the fact that data theft is taking place in the background.

What kind of information can be stolen?

But this is just half of the equation. How destructive this attack ends up being still depends on the amount of data being shared with the victim agent.

The bare minimum is the information shared while chatting to the agent. It then grows with every connected app: Gmail, Google Drive, Microsoft Teams, GitHub, and similar. “In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn,” CPR stressed.

The good news is that you’ll likely never be exposed this way, at least not via ChatGPT. CPR says it disclosed the findings to OpenAI, who then confirmed that the specific internal Artifactory instance identified in the research has been commissioned. In other words, the hallways attack path has been closed.

The bad news is that this doesn’t automatically mean everyone’s safe. This particular path might be closed, but the architectural pattern behind the flaw could be present in other platforms, CPR warns.

“Any AI assistant that operates inside an organization’s trust boundary, holding credentials, running code, and reaching connected services, can become what Check Point Research calls a coerced insider,” the report states. “The model itself does not need to be malicious. It only needs to be persuaded, through text it was never meant to trust, to use access that was granted for entirely legitimate reasons.”

Going forward, businesses are advised to learn which AI tools their employees are using, and what those tools are connected to. Then, they should govern what AI tools and agents are allowed to do, treating all of their actions (not just output) as something that needs to be monitored.