News linked to both this project and an event.
: On Monday, the São Paulo Consumer Protection Office filed a lawsuit against Tools for Humanity, the company behind World, and its hosting service provider Amazon AWS, accusing them of abusive practices in the collection of consumer biometric data in São Paulo. The lawsuit estimates that over 400,000 people participated in World's promotions in São Paulo. It demands the preservation of all data and metadata related to the data collection and the suspension of any payments or benefits associated with biometric data collection before the assessment is completed. The lawsuit seeks a ruling that the related activities constitute abuse and demands payment of 240 million Brazilian reais, approximately $47 million, to compensate for individual consumer losses. The prosecution alleges that World continued to issue crypto rewards through in-app transactions after the National Data Protection Authority ordered it to stop in February 2025. A report from the Iris Parliamentary Committee of Inquiry stated that World concentrated its promotions in peripheral and high-traffic areas to attract people facing socioeconomic issues to submit biometric data in exchange for crypto rewards. The prosecution also claims that consumers were not informed about the economic purpose of the project or the risks associated with processing and storing data on AWS servers.
the U.S. government's export controls and access restrictions on Anthropic's models, Fable 5 / Mythos 5, were partly driven by Amazon's cybersecurity research and AWS CEO Andy Jassy's communications with the White House.It is understood that research submitted by Amazon indicated that through a series of prompt tests, researchers could induce Fable 5 to output sensitive information potentially usable for cyberattacks, raising security concerns. Subsequently, Andy Jassy reported these findings to the U.S. government level, prompting the White House to implement further restrictions, including banning foreign users from accessing the model.Meanwhile, former U.S. Commerce Department official Kate Koren revealed that the White House's existing policy stance towards Anthropic may have also influenced this decision. This is because Anthropic has disagreements with the White House over the boundaries of AI safety, including refusing to use its models for mass surveillance or lethal autonomous weapons systems. Although the two sides had eased tensions and expanded cooperation earlier this year, this incident could reignite strained relations between them. (The Wall Street Journal)
According to on-chain analyst PeckShield (@PeckShieldAlert), SlowMist’s threat intelligence system MistEye has detected a cross-registry supply chain attack targeting developers. Malicious packages have spread across three major registries—npm, PyPI, and Crates.io—comprising over 34 malicious packages and more than 384 related versions. The attack targets developer communities in cryptocurrency, DeFi, Solana, Sui/Move, and AI. It may lead to the theft of cryptocurrency wallets, SSH keys, cloud credentials, GitHub/AWS tokens, browser data, and other sensitive developer information. Some malicious payloads also attempt persistence via mechanisms including `.cursorrules`, `CLAUDE.md`, Git hooks, cron, systemd, and SSH. SlowMist recommends immediately removing affected packages, isolating compromised systems, rotating exposed credentials, rebuilding CI environments and developer machines from clean images, and conducting comprehensive reviews of GitHub, cloud, SSH, and wallet-related activities.
Wasabi Protocol released a security incident update, stating that the attacker exploited a Spring Boot Actuator configuration vulnerability in its AWS infrastructure to steal private keys controlling EVM smart contracts, and subsequently drained approximately $4.8 million in user funds and $900,000 from the protocol’s treasury—totaling roughly $5.7 million in losses. The attack chain originated from a public-facing analysis server whose Actuator heap dump was not properly password-protected, enabling the attacker to obtain credentials for another server and ultimately gain control of the smart contract private keys. This incident affected only EVM deployments—including certain treasuries on Ethereum, Base, Blast, and Berachain—while Solana deployments and the Prop AMM remained unaffected. No final user compensation plan has been announced yet; however, “ensuring all affected users are compensated” remains the team’s top priority. Updates on the investigation will be shared with the community via Discord.
PrimePiper has launched an enterprise-grade prime broker platform for AI agents, designed to address challenges including fragmented account management, inadequate risk control, inability to reconcile across venues, and insufficient compliance auditing in AI-driven automated trading. According to the company, its infrastructure supports unified connectivity to multiple trading venues—including Hyperliquid, OKX, Tiger Brokers, and Interactive Brokers (IBKR). For risk control, PrimePiper offers enterprise-grade API key management, spending limits, and circuit-breaker mechanisms to constrain AI agent trading behavior. At the execution layer, it enables automated strategy execution via SDK or the Model Context Protocol (MCP). For compliance and auditing, it provides audit-grade reporting capabilities tailored for funds and traders. PrimePiper has been selected for the latest cohort of Founders Inc’s accelerator program; its product is currently in the Alpha stage. Team members hail from Galois Capital, Kraken, DRW, and AWS.
Vercel CEO Guillermo Rauch (@rauchg) announced that Vercel is conducting an in-depth investigation into the April 2026 security incident. The investigation revealed that the attackers initially breached Vercel’s systems via Context.ai’s account—a startup—but their activities extended far beyond this initial intrusion. Threat intelligence indicates that the attackers distributed malware to steal Vercel account credentials and API keys from other service providers, then used those keys to rapidly and extensively enumerate non-sensitive environment variables. To trace the root cause, Vercel has processed nearly 1 petabyte of network and API logs. Vercel is collaborating with industry partners—including Microsoft, AWS, and Wiz—to respond jointly and has proactively notified other potentially affected parties, urging them to rotate credentials and adopt security best practices.