Technology News Articles on Fox News

AI builds virtual homes where robots learn from their mistakes

Thu, 23 Jul 2026 09:02:10 -0400

Ask a robot to put a coffee mug in the cabinet, and you quickly see how complicated an ordinary chore can become. You know where the mug belongs. You can step around a chair, avoid the clutter on the counter and open the right cabinet without giving it much thought. A robot has to work through every part of that process.

That helps explain why today's robots can look impressive during a demonstration but still struggle with basic jobs around a home or factory. They need experience in many different rooms and situations before they can work reliably. Teaching them everything in the physical world takes time and plenty of hands-on supervision.

Researchers at MIT's Computer Science and Artificial Intelligence Laboratory and Toyota Research Institute believe virtual training could help. Their system, called SceneSmith, uses AI agents to create detailed 3D indoor environments from simple text prompts. Robots can then practice tasks and expose weak action plans inside those AI-generated spaces before they enter a real home or workplace.

Sign up for my FREE CyberGuy Report

WOULD YOU TRUST A TINY DENTAL ROBOT?

Robots learn through experience. However, engineers cannot easily stage every room layout or object arrangement a machine may encounter. Physical testing also requires someone to reset the scene after each attempt. A tipped chair or misplaced bottle can change the next test. Meanwhile, a failed movement may damage the robot or something nearby.

Simulation offers a safer alternative. A robot can repeat a task without breaking a dish or tying up a real workspace. Still, many earlier simulation systems created rooms that felt sparse. They often lacked the clutter, movable furniture and physical details found in everyday spaces. SceneSmith makes those training environments feel much closer to the real world.

Other developers are also using AI video technology to speed up humanoid robot training, turning small amounts of real footage into synthetic training environments.

SceneSmith starts with a simple written request. A researcher could ask for a garage with a car and workbench, then add tires in the corner and a ladder against the wall. From there, three AI agents powered by GPT-5.2 work together to build the space. A designer starts creating the room. A critic checks whether everything looks realistic. An orchestrator manages the back-and-forth and decides when the design is ready.

SceneSmith builds each environment one layer at a time. It starts with the floor plan and furniture, then adds objects to the walls and ceiling. Smaller items that a robot can pick up or move come last. The critic also catches choices that feel out of place. For example, it might suggest removing a bathtub from the living room. The orchestrator can even send the project back a few steps when part of the design needs more work.

Once the agents agree, SceneSmith adds the physics that control how objects move and react. The result gives researchers a working virtual room where a robot can open cabinets and handle objects instead of a 3D scene that only looks realistic.

A robot needs more than realistic scenery. It needs objects that respond when touched. SceneSmith can place cabinets with working doors. It can also create movable objects and estimate physical properties such as mass or friction. Those details affect how an item reacts when a robot grabs, pushes or drops it.

For standard objects, the system can use a text-to-image-to-3D process. It retrieves articulated items with moving parts from a curated library. This approach keeps cabinet doors and drawers functional inside the simulator. The system also checks for overlapping objects and lets gravity settle them into stable positions.

Researchers reported that 96% of objects remained stable during simulation. Fewer than 2% of object pairs collided with one another. That work matters because a robot cannot learn much from a virtual kitchen where cups float or furniture sinks into the floor.

Better virtual practice could also support advances like this new AI brain that helps robots move more like humans, especially when a task requires precise hand movements.

HUMANOID ROBOT CLEANS FIRST US APARTMENT

The researchers used SceneSmith to generate more than 1,300 scenes. The collection included familiar spaces such as bedrooms and hotels. It also produced unusual settings, including a pottery store and a Minecraft-themed gaming room. Some scenes contained up to six times more items than those from earlier methods. As a result, robots can encounter the type of clutter that makes real-world tasks difficult.

A robot might need to move a soda can from a shelf to a table. Another task could involve placing a cup in the sink. Each scene changes the surroundings, so the robot cannot depend on one carefully staged layout. That variety gives engineers a better way to see whether a robot's plan works beyond a single demonstration.

In robotics, a policy tells a machine how to act based on what it observes. SceneSmith gives researchers a way to test those policies across many environments. The team generated 100 evaluation scenes covering four manipulation tasks. A robot policy attempted each chore in simulation. Then, an AI evaluator checked the result using simulator data and visual observations.

The evaluator reached 99.7% agreement with human labels. That result suggests researchers could use the system to screen robot attempts at scale without manually judging every run. The headline's phrase "learn from their mistakes" needs one important distinction. SceneSmith reveals where a policy fails. Engineers can use those failures to revise later versions of the robot's behavior. In this study, the system focused on scene generation and automatic evaluation rather than continuous self-retraining after every mistake.

A virtual room can look realistic to a person and still behave poorly during robot training. Therefore, the team tested SceneSmith through physical interaction inside the simulator. Researchers placed an independently trained robot policy into generated scenes. The policy predated SceneSmith and had never trained on its environments or assets.

In one demonstration, the robot moved an apple from a bowl to a cutting board after receiving a language instruction. The team also teleoperated a robot through the virtual spaces. Researchers guided it as it opened cabinets and put away bottles. These tests showed that the environments could support more than visual inspection. Together, the demonstrations provide early evidence that SceneSmith's rooms can support useful robotics experiments.

People preferred SceneSmith's virtual rooms

The researchers asked 205 people to compare SceneSmith with earlier scene-generation methods. SceneSmith recorded an average 92% win rate for realism. It also earned a 91% average win rate for following the original prompt.

In practical terms, participants usually thought its rooms looked more believable and matched the request more closely. Those results support the visual side of the system. However, robot performance remains the more important test. SceneSmith's ability to combine realistic design with usable physics gives the project its strongest advantage.

ROBOT SOCCER PLAYER DENTS WALL WITH TERRIFYING KICKS

Detailed virtual rooms take time to build. MIT says SceneSmith may need several hours to produce one scene because the AI agents create and inspect many objects. More computing power could speed up that process. Even so, generating a large training library would require substantial resources.

The current system also has limited support for deformable objects such as sponges. These materials change shape when touched, which makes them harder to reproduce in simulation. The researchers hope larger 3D libraries will help them expand that capability.

Real-world testing will still play a vital role. Homes contain unpredictable people and objects that wear down or break. Simulation can reduce risky trial and error, but engineers must still prove that robots behave safely outside a digital room.

A future household robot could practice inside hundreds or even thousands of virtual rooms before it ever rolls into your kitchen. That gives developers more chances to catch a bad move or weak action plan while the robot remains inside a simulator. SceneSmith can also expose a robot to rooms filled with different furniture, objects and layouts. That matters because your kitchen will look nothing like the carefully arranged space where a robot first learned a task.

That kind of preparation could eventually help machines like this home robot designed to cook, clean and handle the clutter and surprises found in everyday homes.

The technology remains in the research stage, and robots will still need plenty of testing in the physical world. Still, SceneSmith tackles a problem robot makers need to solve: How do you prepare a machine for homes where chairs move, counters get cluttered and almost nothing stays in the same place?

SceneSmith gives robots a safe place to get things wrong. Engineers can spot a bad move inside a crowded virtual home before the machine risks damaging something or moving too close to a person. What makes this system interesting is that the rooms actually work like physical spaces. Cabinets open, objects move and robots can interact with what is around them. The biggest drawback is speed. Building one detailed scene can take hours. Still, these AI-generated environments could help developers catch more problems before a robot ever enters your home.

Would you trust a household robot more if it had already made thousands of mistakes inside AI-generated homes? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Trump launches Gold Eagle to hunt cyber flaws with AI

Thu, 23 Jul 2026 08:08:07 -0400

Most of us tap Update Now and move on. However, a lot happens before that security patch reaches your phone or computer. Researchers must find the flaw. Someone needs to confirm it. Then the developer has to create a fix that will not cause a new problem.

Now, artificial intelligence can uncover software weaknesses much faster. That sounds promising, but it can also create a flood of vulnerability reports. Worse, attackers can use similar AI tools to hunt for the same openings.

The Trump administration wants to help defenders move first. The White House just announced the Gold Eagle AI cybersecurity clearinghouse. Officials say the program has already started receiving and prioritizing vulnerability reports.

Gold Eagle will connect federal agencies with private companies, critical infrastructure operators and open-source software teams. Its goal is to uncover serious flaws faster and coordinate the work needed to patch them.

AI CHATBOTS TAKE HEAT OVER LEFT-WING BIAS: ‘NO LONGER BE CONSIDERED NEUTRAL’

Sign up for my FREE CyberGuy Report

Gold Eagle is a federal coordination center for software vulnerabilities. The Treasury Department leads the effort with support from CISA and other federal partners. President Trump ordered the creation of the clearinghouse through Executive Order 14409 on June 2, 2026. The order directed Treasury to work with the National Cyber Director and other agencies.

Gold Eagle must coordinate vulnerability scanning and reduce duplicated work. It will also help validate findings before teams spend time fixing them. Finally, the program will support the distribution of patches once they are ready. The White House calls Gold Eagle a "force multiplier." In other words, the government wants each participating security team to accomplish more by sharing reliable information.

Gold Eagle does not replace the developers who maintain the affected software. Instead, it creates a central place where government and industry can coordinate their response. That distinction is important. Finding a bug does not automatically fix it. Developers still need to understand the weakness and build a safe update.

AI models can review large amounts of computer code quickly. They can also examine how software reacts when someone sends it unusual commands or unexpected data. That speed may help researchers uncover weaknesses that survived years of conventional testing.

A senior White House official said closed-source AI models will participate in Gold Eagle's vulnerability work. That includes Anthropic's Claude Mythos, which the company designed for advanced cybersecurity research. Anthropic says Mythos-class models can find software vulnerabilities and develop ways to exploit them. The company also warns that those abilities could make attacks easier if the models fall into the wrong hands.

That creates an uncomfortable reality. The same AI that can help protect a system may also help someone break into it. Therefore, Gold Eagle's success will depend on more than the model's ability to find bugs. The program must control who receives the details and how quickly developers get a warning.

Imagine several repair crews checking the same water pipe while another leak goes unnoticed. Cybersecurity teams can face a similar problem. Several organizations may scan the same popular software without knowing that another team already found the flaw. Meanwhile, less visible software may receive little attention.

Gold Eagle aims to coordinate those searches. It can help participating teams avoid repeating work and direct their attention toward software that still needs review. The clearinghouse will also try to cut through low-quality reports. AI models can generate convincing findings that turn out to be harmless or inaccurate.

As a result, human validation remains essential. Security engineers need to reproduce the reported flaw and confirm that it creates a real risk. After that, developers must test the repair. They also need to release the update without breaking the product for existing users.

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

Gold Eagle will use technology developed with Carnegie Mellon University's Software Engineering Institute. The system is called the Vulnerability Information and Coordination Environment, or VINCE. Carnegie Mellon's CERT Coordination Center already uses VINCE to accept vulnerability reports and communicate with affected software vendors.

Gold Eagle can use that platform as an intake point for AI-discovered vulnerabilities. Reports can then move through validation and coordination before details become public. This controlled process matters because revealing a serious vulnerability too early can give attackers a head start. Ideally, the software company receives enough time to prepare a patch before technical details spread.

However, several operational questions remain unanswered. The administration has not publicly identified every company participating in Gold Eagle. It has also released few details about daily oversight or the way sensitive reports will move between participants. The government has not said how many findings have resulted in completed patches either.

Open-source code sits inside a huge range of commercial products. It can power parts of a browser or business platform without the average user ever knowing its name. However, many open-source projects operate with limited resources. Some rely heavily on maintainers who contribute their time alongside other jobs.

AI could help those teams find dangerous flaws. At the same time, it could overwhelm them with reports that require careful review. Gold Eagle may offer a useful filter. The clearinghouse could validate a report before sending it to a project that lacks a large security department.

It could also connect maintainers with government or industry engineers who can help assess the problem. Anthropic has already worked with open-source groups through Project Glasswing. The company says its partners used Mythos Preview to find more than 10,000 high or critical-severity vulnerabilities. Those figures come from Anthropic and do not represent Gold Eagle's results. Still, those findings show why the government expects AI-generated vulnerability reports to arrive at a much greater scale.

The government's recent handling of Claude Mythos 5 shows how sensitive these capabilities have become. On June 12, 2026, the U.S. government applied export controls to Mythos 5 and Claude Fable 5. Anthropic suspended access because it could not immediately verify the nationality of every user.

The government lifted those restrictions on June 30. Anthropic restored Mythos 5 access on July 1 to a selected group of approved U.S. organizations. Anthropic currently limits Mythos 5 to vetted partners because the model could support defensive research or harmful activity.

CyberGuy previously took a closer look at how Anthropic's Mythos AI changed cybersecurity and why its ability to uncover thousands of hidden software flaws is raising concern.

Gold Eagle is betting that controlled access can give defenders an advantage. However, other advanced models will continue improving. That means Gold Eagle will need to move quickly. A flaw loses much of its defensive value once an attacker independently discovers it.

The idea behind Gold Eagle makes sense. Security teams should share validated findings and avoid wasting time on duplicate scans. However, coordination can become slow when too many organizations must approve each decision.

Gold Eagle will need clear rules for who validates a vulnerability. It also needs a reliable way to decide which reports deserve immediate attention. Transparency will matter too. The government should eventually publish useful performance information without revealing dangerous technical details.

For example, it could report how many findings were validated and how quickly affected developers received them. It could also show how many vulnerabilities led to released patches. The program faces a legal deadline as well. Its information-sharing process relies on protections in the Cybersecurity Information Sharing Act of 2015.

Congress temporarily extended that law through September 30, 2026. The administration says a lapse could undermine the cooperation Gold Eagle needs from private companies. Companies may hesitate to share sensitive information when they feel uncertain about legal protections. That could weaken the clearinghouse before it has time to prove itself.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

Gold Eagle works mostly behind the scenes. However, the patch still has to reach your device. You also need to install it. Here are several ways to reduce your exposure while companies work to close newly discovered flaws.

Enable automatic updates for your phone and computer. You should also update your browser and regularly used apps. Many software updates close security holes. Automatic installation reduces the time that a known flaw remains open on your device. However, review major operating system upgrades before installing them on a device you rely on for critical work. A short delay may make sense when an update has widely reported compatibility problems. For step-by-step help, see CyberGuy's guide on how to update all of your devices and keep them safe at cyberguy.com

Your router may not display update reminders as visibly as your phone. The same problem can affect security cameras and other connected devices. Open the manufacturer's app or support page and check for firmware updates. Some newer routers let you enable automatic updates. Also, change any default administrator password that came with the device. For additional router checks, see how Russian hackers hijacked old Wi-Fi routers and the steps you can take to protect yours.

A device can continue working after its manufacturer stops supporting it. However, newly discovered vulnerabilities may remain unpatched. Check the manufacturer's support policy when you own an older router or connected product. Consider replacing the device when it reaches the end of its security-update period. CISA warns that unsupported network equipment can increase an organization's attack surface.

A real vulnerability can inspire fake update messages. Criminals may send an email that claims you must download an urgent security patch. Do not install software from an unexpected email or text message. Instead, open your device settings or the manufacturer's official app. You can also visit its verified support page directly. CISA recommends downloading patches from validated sources.

Strong antivirus software can help detect malicious files that try to exploit a weakness on your computer. Keep the protection active and allow it to update automatically. New detection information helps the software recognize recently identified threats. Still, antivirus software cannot make an unsupported device safe. It works best as one layer alongside regular updates. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

A current backup can help you recover if malware damages your files or ransomware locks them. Use a trusted cloud backup service or an external drive. When using an external drive, disconnect it after the backup finishes so malware cannot easily reach it. Finally, confirm that your backup is working. A backup you have never checked may fail when you need it most. For help choosing a method, check out our article on how to back up your devices the right way.

What stands out to me is how quickly AI is changing the cyber fight. It can help researchers uncover serious software flaws faster, but finding the problem is only half the battle. Someone still has to confirm it, build the fix and get that update onto your device before criminals take advantage. Gold Eagle could make that process less scattered by giving government agencies, private companies and open-source developers one place to coordinate. That could save valuable time when a major vulnerability appears. The real test will be what happens next. We need to see whether Gold Eagle can protect sensitive findings and help turn them into patches people actually receive. There is also a legal deadline coming in September that could affect how freely companies share threat information. For now, do not wait for a federal program to protect every device you own. Keep your software updated and take a closer look at older routers or smart devices that may no longer receive security fixes.

Would you feel safer knowing AI is hunting for software flaws, or more concerned knowing attackers can use the same technology? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Fake password-manager alerts could put your vault at risk

Wed, 22 Jul 2026 09:07:59 -0400

You open your inbox and see a message about updated security policies. Nothing about it screams scam. The email looks polished, the wording sounds official and the button promises a quick way to review the changes. That is exactly what makes it dangerous.

LastPass is warning users about a newly identified phishing campaign that uses lookalike domains and a fake DocuSign page to lure people into downloading suspicious software.

The good news is that LastPass says its systems were not affected. The bad news is that scammers are counting on you to trust the logo, overlook the web address and click before taking a closer look. Here is what to watch for before one routine-looking email puts your entire password vault at risk.

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us TODAY, Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

FBI HELPS TAKE DOWN AI PHISHING RING

LastPass phishing scam starts with a routine policy email

The phishing email comes from hello@lastpassnewsletter.com. Its known subject line reads, "Action Required: Review Updated LastPass Security Policies." Inside, the message claims LastPass has made service policy changes. It mentions enhanced SaaS monitoring. It also claims administrators can reset master passwords and that the admin console has improved.

Those details make the email sound like a real company notice. However, the sending domain belongs to the attackers. LastPass says lastpassnewsletter[.]com has no affiliation with the company. The email includes a Review & Access Terms button. That button creates the next layer of the trap.

Clicking the button sends you to lastpasscompliance[.]com. The landing page copies the look of DocuSign and claims a document is ready for review. That choice makes sense from a scammer's perspective. Many people receive electronic signature requests at work or while handling personal paperwork. A familiar layout can lower your guard before you inspect the web address.

We have seen the same trust trick in other fake DocuSign email scams. The brand name gives the request a sense of legitimacy, even when the sender and domain do not match. LastPass says Microsoft Defender for Office 365 and Cloudflare classified the phishing site as malicious. The page also prompted visitors to download software that claimed to work on Windows and macOS.

LastPass was still investigating the download when it published its warning. Therefore, you should treat the file as dangerous and avoid opening it. The site also displayed a live support chat box, although it was unclear whether the chat worked. The malicious page had gone offline by the time the campaign was reported. However, attackers can quickly replace blocked domains with new ones.

LastPass users are not the only targets. Bitwarden customers have received similar messages from hello@bitwardennewsletter.com. Those emails directed recipients to bitwardencompliance[.]com. The matching format suggests attackers may be reusing the same campaign structure across password manager brands.

That matters because password manager customers present an attractive target. One stolen master password could put many saved accounts at risk. Multi-factor authentication may still block access, depending on your security settings.

A password manager remains valuable protection. In fact, autofill can help expose a fake website because the manager should recognize the legitimate domain. You can compare current options in our guide to the best password managers for 2026 at cyberguy.com

This campaign follows other LastPass-themed phishing attempts from earlier this year. In January, fake messages warned that users had only 24 hours to back up their vaults before maintenance. Then, a March campaign used fabricated email threads about unauthorized account access.

Both approaches relied on urgency to push people into acting before they verified the message. The new compliance notice uses a calmer approach. It looks like paperwork rather than a crisis. That may make it especially effective because policy updates feel normal and boring.

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

A few careful steps can keep one convincing email from turning into a much larger problem.

Delete the message or report it as phishing. Do not reply. Avoid opening its links or downloading the file it offers.

Use the official LastPass app or type lastpass.com into your browser. Check for account notices after you sign in through the trusted route.

Lookalike domains often add a trusted brand name to words such as "newsletter" or "compliance." Check the website address before the first slash. A legitimate LastPass address should end in lastpass.com, such as support.lastpass.com, rather than merely containing the word "LastPass."

A password manager may refuse to fill your credentials on a fake domain. Treat that as a warning. Do not copy and paste the password to get around it. Instead, close the page and access your account through the official app or website.

Use a trusted device and go directly to LastPass. Change the master password immediately. Then review your vault for unexpected activity, as LastPass recommends. Next, change passwords for sensitive accounts stored in the vault if you see signs of access. Start with email, financial accounts, cloud storage and social media. Use a different password for every account.

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

Do not open software offered by a security notice you reached through email. If you already opened the file, disconnect the affected device from the internet. Then use strong antivirus software to inspect it. Our current best antivirus protection guide at cyberguy.com can help you compare tools that block malicious websites and dangerous downloads. It also covers protection against malware. You can also follow these steps after you clicked a suspicious email and entered information.

Enable multi-factor authentication for your password manager and other important accounts. An authenticator app or security key can add a barrier if someone steals your password. However, never approve a login request you did not initiate. A second security step only helps when you treat unexpected prompts as a warning.

Scammers often use information from data broker sites to make phishing emails feel more personal. That could include your phone number, home address, relatives or past employers. A data removal service can help find and remove some of that information from people-search websites. It will not secure a compromised password manager, but it may give scammers fewer details to use in future attacks. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Forward questionable LastPass-branded emails to abuse@lastpass.com. LastPass says no one from the company will ever ask for your master password.

What makes this scam dangerous is how normal the email looks. Most people expect password manager alerts to sound urgent. This one arrives dressed up as a boring policy update, which may make you less likely to question it. The biggest red flag is the web address. A company name inside a domain does not mean the company owns it. Before entering a master password or downloading anything, close the email and open the password manager directly. Your master password protects everything stored in your vault. Treat any request for it like someone asking for the keys to your house.

Have you ever received a security email that looked so real you almost clicked? What made you stop and take a closer look? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Robot bird swims underwater then flies away

Wed, 22 Jul 2026 07:55:33 -0400

Watching a diving bird vanish beneath the water can feel almost unreal. One moment it cruises through the sky. Seconds later, it swims after prey before returning to the air. Around 100 bird species can move between those two environments. Engineers have found that natural ability incredibly difficult to recreate at a small scale.

Now, researchers at MIT and the Swiss Federal Institute of Technology Lausanne, known as EPFL, have built a robotic bird that can complete the entire journey. The 8.8-ounce robot flies, plunges into water and swims below the surface. Then it launches back into the air using the same set of flapping wings.

NEW YORK SCHOOL DISTRICT TO DEPLOY HUMANOID ROBOT IN CLASSROOMS THIS FALL

According to the research team, it marks the first bird-scale robot to complete that full cycle through flapping motion alone. The research appeared in the journal Science.

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us TODAY, Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

Most amphibious robots use separate systems for air and water. This mechanical bird takes a simpler approach. The robot relies on flapping wings instead of propellers. It also completes its water launch without legs or a complicated wing-folding mechanism.

That design presents a major engineering problem. Water is about 800 times denser than air, so wings face far greater resistance once they enter the water. To handle that dramatic change, the robot adjusts its flapping speed. Its flexible wings also change shape as the surrounding pressure increases.

In the air, the robot can flap its wings up to 11 times per second. Underwater, its flapping rate ranges from 0.1 to 6 times per second. Meanwhile, water pressure can bend the wings by as much as 90%. That flexibility shortens the effective sweep of each stroke and reduces the load on the motor.

The same wings become more effective for flight once the robot reaches the air. Researchers also made the machine neutrally buoyant. As a result, it neither rises nor sinks on its own while underwater. That balance helps conserve battery power because the robot spends less energy fighting buoyancy.

The hardest part begins when the robot tries to leave the water. It completes the transition in under one second using about eight to 10 wingbeats. However, the maneuver requires a careful combination of wing flexibility, tail placement and launch angle.

Researchers found that moderately flexible wings worked best. A rigid wing struggles to adapt underwater, while excessive flexibility reduces the force needed for takeoff. The tail also needs to remain short and close to the body. Otherwise, it can drag through the water and pull the robot back down. An exit angle near 70 degrees produced the strongest results. A flatter approach creates too much tail drag. A nearly vertical launch can make the robot tip backward into the water.

ZELENSKYY ANNOUNCES 'THE FUTURE IS HERE' AFTER WAR'S FIRST ALL-ROBOT CAPTURE

The machine also gives scientists a new way to study real diving birds. Tracking the movement of a live bird beneath the surface can be difficult. With a robot, researchers can adjust one feature and measure how that change affects performance.

For example, many diving birds reduce their wingspan while swimming. Researchers have often connected that behavior with lower energy use. The robot's results suggest that shorter underwater strokes may instead help birds increase speed.

The team also compared the machine's propulsion efficiency with that of real birds. Both fell within a Strouhal number range of 0.2 to 0.4, which researchers associate with efficient movement. However, body size can change the launch strategy. Heavier diving birds may use their legs to help push away from the water, while this lightweight robot relies entirely on its wings.

The robot's most efficient travel mode depends on the distance ahead. According to the team's data, flying uses less energy once a journey extends beyond roughly 51 feet. For shorter trips, staying underwater may make more sense.

Water creates heavy resistance, so swimming becomes increasingly costly over longer distances. A future robot could use that difference to plan its route. It might swim toward a nearby target, surface and then fly to a more distant location.

The prototype costs around $300 in materials and uses parts that researchers can source commercially. The team also released open CAD files for the project. That could allow universities and other builders with access to a 3D printer to reproduce the design.

Eventually, the robotic bird could help scientists monitor waterways and coastal environments. Researchers imagine launching it from shore or a boat. It could fly toward an area of interest, dive to collect a sample and then return with the data.

Potential missions could include taking measurements near an iceberg or observing marine wildlife from a safer distance. Flapping wings may also offer practical advantages in those environments. They avoid exposed high-speed propeller blades and could produce less noise around animals. Underwater, flexible wings may tolerate contact with debris better than rigid propellers.

INSIDE CHINA’S AI ‘WOLF PACK’ DRONES BUILT WITH TAIWAN CONFLICT IN MIND

The current prototype still relies on human control during key parts of its journey. Researchers manually launched the robot during several tests. Timers or basic triggers also activated parts of its diving and swimming behavior.

Autonomous navigation represents the next major step. The robot would need to recognize its surroundings and control each transition without human assistance. Salt water creates another hurdle. Testing has focused on fresh water, so future versions will need stronger protection against corrosion. Longer range and improved endurance would also make the robot more useful outside controlled experiments.

You probably will not see robotic birds patrolling your local beach anytime soon. Still, this project shows how future drones could reach places that traditional flying machines struggle to explore. A single robot could gather information above the water before taking measurements below the surface. That flexibility could reduce the need for separate aircraft and underwater vehicles.

The low material cost also matters. Smaller research teams could experiment with the design without investing in an expensive custom platform. As navigation and battery performance improve, machines like this could make environmental monitoring more accessible.

What stands out here is how much work the researchers get from one flexible set of wings. The robot changes its flapping speed, while the wings naturally bend to handle the resistance underwater. The launch back into the air makes this more than another bird-inspired drone. Pulling off that transition requires the right wing stiffness and a carefully controlled exit angle. The prototype still needs autonomous controls and better protection for saltwater. Even so, its $300 material cost and open design could give other researchers an affordable foundation to build on.

Would robotic birds collecting environmental data make you feel hopeful about conservation, or uneasy about machines blending into natural habitats? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report

CrashStealer Mac malware steals passwords and wallets

Tue, 21 Jul 2026 07:21:15 -0400

A polished installer can make risky software feel routine. You see a familiar Mac window, follow the directions and enter your password when asked. By then, the app may already be working against you.

Security researchers at Jamf Threat Labs have uncovered CrashStealer, a new Mac information stealer that impersonates Apple's crash-reporting software. Jamf first tracked the malware in May 2026 while it appeared to be under development. By early July, researchers detected it in active attacks.

Free live CyberGuy class: Sick of Spam? Join us on July 22.

Join us this Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

CrashStealer targets information many people rely on every day. It searches for browser credentials, password-manager data and cryptocurrency wallet information. The malware can copy the Mac login Keychain as well. The malware stands out because its developers wrote it in native C++. Many common Mac stealers rely on AppleScript or simpler software wrappers.

CrashStealer also encrypts the files it collects before sending them to an attacker-controlled server. Meanwhile, anti-debugging features make the malware harder for researchers to examine. However, the first app a victim sees isn’t called CrashStealer. The attack begins with a disk image branded as "Werkbit Setup."

The Werkbit Setup disk image contains a polished installer. Its directions tell the user to right-click the app and choose Open. That action often appears in instructions for software that needs to get around a Mac security warning. In this case, the installer already carried a valid Apple Developer ID and a notarization ticket. Therefore, it could clear Gatekeeper on its first launch. Jamf also found that the disk image itself had been signed, which researchers called unusual for malicious Mac delivery.

The website that distributed Werkbit Setup required a meeting PIN. That setup may have helped the attackers limit access to people who received the correct code. It also made the download feel more exclusive and potentially more believable.

Once opened, Werkbit Setup contacted GitHub for an initial command. It then downloaded a script from the attackers' infrastructure. Next, the script installed a second disk image named CrashReporter.dmg in a hidden temporary folder. The payload used the name CrashReporter and the bundle identifier com.apple.crashreporter. Those details were chosen to resemble an Apple system component. The malware then launched quietly in the background.

Apple uses Gatekeeper alongside Developer ID signing to reduce the risk from downloaded software. Its notarization process checks an app for known malicious content when developers submit it. Gatekeeper can also check whether Apple has revoked the signing certificate. Still, a notarized label should never replace your judgment about where an app came from.

A harmful app can slip through before researchers or Apple identify its behavior. Attackers can also use a trusted first-stage installer to retrieve a different payload after launch. Jamf reported the Developer Team ID connected to Werkbit Setup to Apple after confirming that it had distributed malicious software. The report did not say how many people had been infected.

After CrashStealer launches, it displays a password prompt designed to resemble a legitimate macOS authorization request. The malware checks the password locally with a built-in Mac directory service command.

If the password is wrong, the prompt returns. If it is correct, CrashStealer stores an obfuscated copy and uses the credential to unlock the login Keychain.

The malware can then copy the Keychain database into its collection folder. That makes the prompt one of the most important warning signs. A password request can look convincing, yet the timing may feel wrong. An online meeting installer should not need your Mac password to display a call or download ordinary content.

CrashStealer searches broadly across the Mac. Jamf found code and activity tied to Chromium-based browsers, Safari data and Firefox credential files. The malware also checked wallet extensions such as MetaMask and Phantom. In addition, it targeted password managers that included 1Password, Bitwarden, LastPass and Dashlane. Jamf observed roughly 80 cryptocurrency wallet extensions and 14 password managers in the target list.

A separate file-search tool scans locations such as Documents and Downloads. However, it skips many large installers, apps and media files. That filtering suggests the thieves want compact files that may contain credentials or financial records. Other personal documents may also appeal to the attackers.

CrashStealer stores stolen material inside hidden folders under the user's home directory. It encrypts each collected item with AES-256-GCM. Then it packages groups of encrypted files into hidden ZIP archives before uploading them. Encryption helps the attackers conceal the contents of the stolen files while they sit on the Mac. It also means a leftover archive can confirm that collection occurred even when an investigator cannot read the data inside it.

The malware then copies itself into the Mac's Library cache folder. It creates a LaunchAgent that starts the copied app when the user logs in. The LaunchAgent uses an Apple-like name, which can make the entry blend in during a quick inspection.

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

You may have encountered this campaign after downloading Werkbit Setup. The risk rises if the website requires a meeting PIN. An unexpected CrashReporter password prompt is another red flag. Be more suspicious when the prompt appears right after installing unrelated software or joining an online meeting.

Also, watch for an unfamiliar app asking for Full Disk Access or permission to reach Documents and Downloads. CrashStealer's configuration included permission messages designed to make broad file access sound necessary for "system administration." Security teams can also look for the hidden CrashReporter locations and LaunchAgent described in Jamf's technical report. However, most home users should avoid digging through system folders unless they know exactly what they are changing.

A few careful habits can help you spot a suspicious Mac installer before it gets access to your passwords and personal files.

Use the Mac App Store when possible. Otherwise, type the developer's official website address yourself. Avoid downloading software from a meeting link, private message or unexpected pop-up unless you can independently confirm the source.

Be wary when an installer tells you to right-click and choose Open or use the Open Anyway button. Apple recommends overriding a security warning only when you trust the app's source. You should also confirm that nobody altered the download.

Look at which app triggered the prompt and why it needs authorization. Cancel the request when the reason does not match what you are doing. Then close the app and verify the download with the company through a separate channel.

Open the Apple menu > System Settings > Privacy & Security. Review Full Disk Access, Files & Folders and Accessibility for apps you do not recognize. Turn off access for anything suspicious.

Next, open System Settings > General > Login Items & Extensions. Review the apps listed under Open at Login and Allow in the Background. Remove or disable unfamiliar entries.

You can also check System Settings > General > Device Management for profiles you do not recognize. This option may appear only when a profile is installed. Do not remove a work or school profile without contacting the administrator first.

Open the Apple menu > System Settings > General > Software Update . Install available updates promptly because they include current security protections.

A trusted antivirus program can help detect known malicious files, suspicious persistence and harmful network behavior. Keep real-time protection enabled and allow the software to update automatically. Jamf says threat-prevention tools can help block and report similar Mac threats. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

Disconnect the Mac from the internet. Do not enter another password on that computer. Run a full scan with trusted security software. You should also contact Apple Support or your workplace IT team.

Next, use a clean device to change the password for your Apple Account, primary email account and password manager. Change passwords for banking, shopping and other sensitive accounts that were saved on the affected Mac. Enable two-factor authentication (2FA) where available and sign out of devices or active sessions you do not recognize.

After the Mac has been cleaned, change its login password because CrashStealer may have captured and validated that credential.

If you use cryptocurrency wallets on the affected Mac, treat their private keys and recovery phrases as exposed. Move remaining funds to newly created wallets from a clean device. Never reuse the old recovery phrase.

If security software cannot confirm that CrashStealer has been fully removed, contact Apple Support or a qualified technician about erasing the Mac and reinstalling macOS. Restore personal files carefully from a backup created before the infection, when possible.

FBI HELPS TAKE DOWN AI PHISHING RING

CrashStealer shows how attackers can wrap harmful software in a convincing Mac experience. The signed Werkbit installer gave the campaign a layer of credibility. Then the fake crash reporter used a familiar password prompt to reach valuable data on the computer. Your best defense begins before the password prompt appears. Verify the source of every installer and stop when the instructions ask you to bypass a warning. Strong antivirus protection and current macOS updates add another barrier.

Would Apple notarization earn your trust, or would you still question a polished Mac installer? Let us know by writing to us at Cyberguy.com

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.

For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com - trusted by millions who watch CyberGuy on TV daily.

Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.

Could a paint-on electronic tattoo spot heart attacks?

Tue, 21 Jul 2026 07:14:08 -0400

A colorful shark painted on your hand might look like a temporary tattoo. However, the design could also monitor the electrical activity of your heart. Penn State engineers have developed a paint-on electronic tattoo made from conductive ink. Researchers apply the ink directly to the skin, where it dries into a working electrode.

The team can add food dye to create almost any color or design. Therefore, a medical sensor could look more like face paint than a clinical patch. Penn State has filed a provisional patent for the technology. The researchers published their findings earlier this month, in the Proceedings of the National Academy of Sciences.

WOULD YOU TRUST A TINY DENTAL ROBOT?

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us this Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

Researchers created the ink by mixing several polymers and acidic additives into a water-based solution. The wet material has a glue-like consistency. Once painted onto the body, it dries in less than 10 minutes. A hair dryer can shorten the drying time.

After it dries, the ink becomes an electrode that collects electrical signals from the body. Because researchers paint it directly onto the skin, the ink follows tiny ridges and uneven areas. That close contact can produce more reliable measurements.

Many traditional electrodes use rigid metal-based materials. Those materials provide stability, but they can pull away from the body during exercise or everyday movement. Some experimental sensors use hydrogel instead. The soft material absorbs water and stretches with the skin. However, hydrogel can dry out over time and lose its grip.

Prefabricated electrodes can also leave a small air gap after someone applies them. Hair or sweat may make that gap worse. As a result, the sensor may struggle to capture a clear signal. Painting the electrode in place helps it settle into the skin's natural texture before it hardens.

The dried ink handles the skin contact. Meanwhile, a piece of porous silver textile connects the electrode to the rest of the system. Researchers paint part of the wet ink over the silver fabric. The liquid flows into the textile and hardens, forming a secure connection.

A clip then connects the fabric to a larger electronic module. The wearer keeps that module taped beneath their clothing. Finally, the module sends the collected signals to a computer through Bluetooth.

The porous textile allowed the electrode to stretch beyond 150% of its original size without breaking. Its open structure also gives hair and moisture space to pass through the material.

HUMANOID ROBOTS PERFORM LIVE SURGERY IN WORLD FIRST

In one experiment, a co-author wore the painted electrodes during normal daily activities for 12 hours. The system successfully tracked the person's ECG readings throughout the test. An ECG records the electrical activity of the heart. Doctors can use that information to examine heart rhythm and identify signs that may need further attention.

A separate co-author wore the electrodes during exercise. The material remained attached and continued recording accurate signals during physical activity. The researchers also painted an electrode onto a co-author's forearm. It captured EMG signals produced by muscle contractions.

The team sent those signals to a robotic prosthetic. As a result, the person could control the robotic hand without touching it. The research paper also describes EEG detection through hair. EEG readings reflect electrical activity in the brain. In addition, the researchers reported no image artifact during MRI testing, which suggests the design may work alongside medical imaging.

Penn State says the technology could eventually help spot heart attacks early. The electrodes can record detailed ECG data, which may reveal changes in the heart's electrical activity. Still, the researchers have not shown that the tattoo can diagnose a heart attack.

The reported tests involved co-authors during daily activities and exercise. The team did not test the system on patients experiencing heart attacks. Therefore, the heart attack application remains a future possibility. The prototype cannot replace emergency care or medical testing.

Medical wearables can make some people feel self-conscious. A visible patch may also feel intimidating to a child who needs ongoing monitoring. The paint-on electronic tattoo gives the wearer more control over its appearance. Someone could choose a cartoon, a favorite color or a less noticeable design.

Researchers believe that personalization could encourage people to wear the sensors longer. The approach may be especially useful for children, teenagers and people who worry about the stigma of wearing a medical device. The electrodes can also wash away after use. A person could then paint on a fresh set while continuing to use the more expensive electronic module. According to the researchers, one bottle of ink could contain enough material for several applications over multiple days or a week.

COULD 'HUMANMAXXING' ACTUALLY HELP YOU LIVE LONGER? HERE'S WHAT EXPERTS SAY

The team plans to keep developing the electrodes. Future versions may be able to monitor biomarkers such as glucose or cortisol. Researchers are also considering how health care providers, including pediatricians, might use the system.

Another possible application involves plants. Painted electrodes could help scientists study chemical exposure and track how environmental conditions affect plant health.

However, Penn State has not announced a consumer version or release date. The technology will need more development and clinical validation before people can rely on it for medical decisions.

You will not find a bottle of electronic tattoo ink at your pharmacy anytime soon. Even so, the research offers a look at how wearable health technology may change. Future sensors could fit the skin more closely and remain comfortable during movement. Custom designs could also make long-term monitoring feel less clinical.

More dependable contact may help doctors collect useful data while patients go about their normal routines. That could reveal changes that a short appointment might miss. The research remains early, though. Comfort and colorful designs will matter only if larger studies confirm the technology is safe and medically reliable.

This is the kind of wearable tech that could make health monitoring feel a lot less clinical. The paint goes right on the skin, stays connected during movement and can be customized so it looks more like body art than medical gear. I am also intrigued by the prosthetic hand test because it shows this idea could eventually help people control devices through their own muscle signals. The heart attack angle is promising, but it is still early. The tattoo can record ECG data, though researchers have not shown that it can diagnose an active heart attack.

Would a colorful, washable design make you more willing to wear a medical sensor every day, or would you trust a traditional hospital-style patch more? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.

For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com - trusted by millions who watch CyberGuy on TV daily.

Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.

RedHook Android malware can quietly hijack your phone

Mon, 20 Jul 2026 11:05:24 -0400

Your phone rings, and the caller sounds official. They say your bank account or government service needs immediate verification. A link arrives moments later. The page looks like Google Play, and the caller tells you to install an app to fix the problem. Then the app asks you to turn on Accessibility access, a powerful Android permission that can let an app read the screen and control taps.

That approval can give the latest RedHook Android malware far more control than a regular app should have. Researchers at Group—IB, a global cybersecurity company that investigates online fraud and digital crime, analyzed the new threat. They say the upgraded remote access trojan, a type of malware that lets criminals control a device remotely, abuses Android's Wireless Debugging feature to gain shell-level privileges. That means it can run powerful system commands and change protected settings that ordinary apps cannot access, although it does not gain full root control.

RedHook can then watch the screen, record what you type, operate apps and steal login information. The new technique also helps it install or remove apps without showing the usual approval prompts. That makes one rushed permission decision especially costly.

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us Wednesday, July 22, at 1 p.m. ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

NEW BANK SCAM LAWS COULD STOP SUSPICIOUS PAYMENTS

The attack begins with social engineering. Criminals call or message victims while posing as bank employees, government representatives or support agents. They direct people to fake websites that resemble official services or the Google Play Store. However, the app comes from outside Google Play. The victim sideloads an APK, which means installing an Android app from another source. After installation, the app guides the victim through enabling Accessibility.

Android built Accessibility services to help people use their devices. However, those services can also let an approved app observe the screen and perform actions for the user. RedHook takes advantage of that control. It simulates taps, opens Settings and enables Developer Options. Next, it turns on Wireless Debugging and asks Android for a pairing code.

The malware reads the code and connects back to the phone through 127.0.0.1, a local address that points to the same device. In effect, RedHook tricks the phone into connecting to its own powerful debugging controls, giving the malware deeper access without a computer.

ADB stands for Android Debug Bridge. Developers use it to manage a phone from a command line, install test apps and troubleshoot software. Android introduced Wireless Debugging with Android 11, allowing ADB connections over Wi-Fi instead of a USB cable. Once RedHook pairs with the phone, it gains shell-level access. That gives the malware more authority than a normal Android app, allowing it to run powerful commands and change protected settings. However, it still does not gain full root control.

RedHook can then grant itself additional permissions, capture low-level touch activity and avoid some confirmation screens that would normally alert the user. The malware also borrows from Shizuku, a legitimate Android utility used by developers and power users. Shizuku allows approved apps to use elevated Android features without rooting a phone. RedHook repurposes parts of that framework to carry out malicious commands.

Group-IB counted 53 commands that attackers can send to the current RedHook version. Some commands appear unfinished, but the working features give criminals extensive access to an infected phone.

That access creates several opportunities for fraud. A criminal could watch you sign in to a banking app, capture a verification code or place a convincing overlay above a real login screen. RedHook may also remove security software or install another malicious app.

Gaining access helps the attacker only while the malware remains active. Therefore, RedHook includes several persistence methods designed to keep Android from shutting it down. It can play silent audio so the operating system treats its process as important. A WakeLock keeps the CPU awake. Meanwhile, two separate services monitor each other and restart their partner when one stops.

RedHook also sets a five-minute alarm that checks whether its services remain alive. After a reboot, a receiver can restart the malware and reconnect its privileged helper. It even adjusts its out-of-memory score to reduce the chance that Android will close it when memory runs low. These methods make removal harder. They also explain why simply swiping the app away may accomplish very little.

One warning sign may have an innocent explanation. Several appearing together should make you stop and investigate.

Do not let an urgent tone make the decision for you. Legitimate organizations can give you time to verify a request through an official phone number or website.

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

A few checks can stop this attack before it reaches the Wireless Debugging stage. Other steps can help limit the damage if you already installed a suspicious app.

Settings may vary depending on your Android phone’s manufacturer

Avoid APK files sent through texts, messaging apps or unexpected phone calls. Apps downloaded from unknown sources can put your device and personal information at risk. You should also review which apps can install software from outside Google Play. Open Settings and search for Install unknown apps . Turn off this permission for browsers, messaging apps and file managers unless you have a specific reason to use it.

Hang up and call the organization using the number printed on your bank card or listed on its official website. Avoid phone numbers included in the message, pop-up or download page. Be especially cautious when someone contacts you unexpectedly and pressures you to change a phone setting or install an app. Google lists both behaviors as warning signs of a possible scam.

Open Settings and search for Accessibility . Then review Installed apps , Downloaded apps or Installed services , depending on your phone. Turn off access for anything you do not recognize. An ordinary banking, delivery or government app rarely needs permission to read your screen and control your taps. Pause whenever an app claims that Accessibility access is required to complete verification. As CyberGuy has previously reported, malware can abuse Accessibility permissions to take control of an Android phone.

Open the Google Play Store > tap your profile icon > Play Protect . Tap Scan to check the apps currently installed on your phone. Play Protect may warn you about harmful software, which you can disable or remove from the phone. Google Play Protect, which is built-in malware protection for Android devices, automatically removes known malware. However, Play Protect may not catch every malicious app, so strong antivirus software adds another layer of protection.

Strong antivirus software can help flag malicious links, suspicious downloads and harmful apps. Keep its protection active, especially if you sometimes receive APK files for work or testing. However, do not assume an antivirus scan has fully removed RedHook if the app keeps returning or your settings continue to change. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com

Open Settings > Software updates , then follow the prompts. You can also check your Android security update and Google Play system update under About phone > Android version . Paths can differ slightly by device.

Turn on Airplane mode and use another trusted device to contact your bank and change important passwords. Do not enter more information on the affected phone. Try to remove the suspicious app or contact your phone manufacturer, carrier or a trusted repair professional for help. A factory reset may be necessary if the app returns or the phone continues behaving strangely.

A data removal service can help reduce the personal details available about you on people-search sites. That may include your home address, phone number and information about relatives. However, a data removal service cannot clean malware from your phone, recover stolen login information or remove data that criminals already copied. You can also submit opt-out requests yourself for free, although the process can take time. Information may later reappear, so continued monitoring may be needed. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

RedHook depends on social engineering before it can take control. The attacker still needs you to install a malicious app and approve powerful Accessibility permissions. That gives you a chance to stop the attack early. Be suspicious of urgent calls, fake app pages and anyone who tells you to install an APK from a link. Google Play Protect and strong antivirus software can help, but your best defense is slowing down before you approve an unexpected request.

Should Android make Accessibility permissions harder to approve when an app comes from outside Google Play? Let us know by writing to us at Cyberguy.com.

Amazon Leo satellite internet takes on Starlink

Mon, 20 Jul 2026 09:20:18 -0400

Amazon Leo satellite internet is getting closer to turning on service for customers. Amazon launched 29 more satellites into low Earth orbit on July 2, bringing its deployed total to 396 satellites, according to Amazon's latest mission update. That launch gives Amazon enough satellites for an initial service rollout later this year. However, the newest satellites still need to move into their assigned operating positions before they can support customers.

That is a big step for Amazon. It also shows how far Amazon still has to go. Starlink has been building its network since 2019 and already has a much larger satellite fleet, wider coverage and more paying customers. So, should Starlink be nervous? Maybe. Should you expect Amazon Leo to replace your home internet right away? Probably not yet.

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

JETBLUE FLIGHT REPORTS DRONE STRIKE DURING APPROACH TO NEW YORK AIRPORT: FAA

Amazon Leo is the new name for Project Kuiper, Amazon's low-Earth-orbit satellite internet network. Amazon says the goal is to deliver fast internet to customers and communities that lack reliable broadband. The name "Leo" comes from low Earth orbit. These satellites fly much closer to Earth than older satellite internet systems. That shorter distance can help reduce lag during video calls, streaming or online work.

Amazon says the network will use satellites, ground stations, fiber and customer antennas to connect people from space. The company also plans to offer different antennas for homes, businesses and other customers. In other words, Amazon wants Leo to become a serious internet option for places where cable, fiber or 5G home internet fall short.

Amazon's July 2 mission was its 14th Leo launch. It was also the final launch in Amazon's Atlas V campaign with United Launch Alliance. Amazon says Atlas V launched 224 Leo satellites across eight missions with a 100% success rate. Now Amazon plans to move future ULA launches to the heavier Vulcan rocket, which can carry larger Leo payloads.

That change could help Amazon increase its deployment pace. Melissa Wuerl, Amazon Leo's director of launch systems, said the company has hundreds of flight-ready satellites waiting at Cape Canaveral. That detail stood out to me. Amazon may be late to the space internet race, but it clearly has hardware ready and a launch pipeline in motion.

Starlink still has the obvious lead. SpaceX started earlier, launched faster and already sells satellite internet in more than 150 countries, territories and markets, according to Starlink's availability map. Amazon Leo is at a very different stage. The company expects limited service later this year, with coverage and pricing still to come.

That means Starlink remains the more realistic choice if you need satellite internet today. Amazon Leo may become a stronger option later, especially if Amazon prices it aggressively or bundles it with business services. Still, I would not underestimate Amazon. The company has deep pockets, massive logistics experience and AWS, its cloud business, behind it. That combination could help Leo win customers in rural broadband, business connectivity, airlines and emergency backup systems.

You may notice Amazon Leo on a plane before you see it on your roof. Amazon has already signed airline deals, including JetBlue and Delta. JetBlue plans to use Amazon's satellite technology to improve its free Fly-Fi service starting in 2027. Delta says Amazon Leo will roll out across hundreds of aircraft beginning in 2028, with an initial installation on 500 planes.

Amazon also introduced a commercial aviation antenna that it says can deliver speeds up to 1 Gbps down and 400 Mbps up. A single antenna can connect a full aircraft for entertainment, work and crew operations. That could make airline Wi-Fi feel much less painful. If Amazon can deliver stable service at cruising altitude, travelers will notice fast.

DAGEN MCDOWELL BLASTS BIG TECH FOR DATA-DRIVEN EFFICIENCY, IGNORING HUMAN COST

Amazon also wants Leo to connect directly to phones and other cellular devices. That strategy became much bigger after Amazon announced plans to acquire Globalstar. Globalstar already supports satellite services used by Apple. Amazon says the deal will help Leo add direct-to-device services to future versions of its satellite network.

That could eventually help mobile carriers extend voice, text and data coverage beyond normal cell towers. Amazon also says its next-generation direct-to-device system will begin deploying in 2028. This could be very useful in dead zones, storms or emergencies. For now, though, treat satellite phone connectivity as backup coverage, not a full replacement for your carrier. If you want to prep your phone for emergencies now, check out this helpful guide on life-saving phone settings.

Satellite internet is becoming a much bigger business. Grand View Research estimates the global satellite internet market will grow from $13.3 billion in 2026 to $35.7 billion by 2033. That growth explains why Amazon wants in. Satellite internet can reach rural homes, farms, ships, planes, emergency teams and businesses that need backup connectivity.

Amazon also has a cloud advantage. Leo could connect directly with AWS services for companies that already rely on Amazon's cloud tools. That may give Amazon a stronger pitch for business customers than a regular home internet provider can offer. For everyday customers, the bigger benefit could be competition. Starlink, cable companies and 5G home internet providers may all have to work harder if Amazon becomes a serious broadband rival.

If Amazon Leo becomes available in your area, do not focus only on the name. Compare it the same way you would compare any internet service. Start with monthly price, equipment cost and installation needs. Then check download speed, upload speed, latency and data limits. You should also look at cancellation terms, customer support and whether the service works well in bad weather.

That last part is important. Satellite internet can be a lifesaver in places without reliable wired service. However, trees, storms and placement can affect performance. If you are already comparing providers, check out our article on how to get high speed internet at a discount rate. You can also review this breakdown of 5G home internet vs cable before you make a switch.

If you live in an area with poor internet choices, Amazon Leo could eventually give you more leverage. That alone is good news. Still, I would wait for Amazon to publish coverage maps, monthly pricing and real customer performance before getting too excited. A rocket launch is impressive, but your internet bill and actual speed at home matter more.

If you fly often, Leo may show up first as better in-flight Wi-Fi. JetBlue and Delta give Amazon a very public test. If the service feels fast and reliable in the air, that could build trust fast. For your phone, direct-to-device satellite service could become an emergency safety net. It may help when you are hiking, driving through a dead zone or stuck during a major outage.

At home, Amazon Leo could also push your current internet provider to improve. If you are dealing with slow speeds now, my tips on how to speed up your Wi-Fi and internet connection are a good place to start while Leo builds out.

JEFF BEZOS REPORTEDLY TOLD TRUMP THE WASHINGTON POST WAS HIS ‘WORST INVESTMENT’ BEFORE STAFF CUTS

Amazon Leo has moved from an idea to a real satellite network with 396 satellites deployed, airline deals lined up and a direct-to-device phone strategy in the works. Still, Starlink has the lead today. It has more satellites, broader coverage and years of customer experience behind it. If you need satellite internet right now, Starlink is the one you can actually buy in many places. That said, I would not count Amazon out. Jeff Bezos knows how to enter a crowded market and make competitors sweat. If Amazon Leo forces better prices, faster service or more coverage, you could benefit even if you never put an Amazon antenna on your roof.

Would you trust Amazon to run your internet from space, or would you wait until Leo proves it can truly compete with Starlink? Let us know by writing to us at Cyberguy.com

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.

For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com - trusted by millions who watch CyberGuy on TV daily.

Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.

How sweepstakes entry data can reach scammers

Sun, 19 Jul 2026 14:47:15 -0400

It's summer. Mall kiosks promise free cruises. Retailers run drawings at checkout. Entry cards sit in stacks near the register. You fill one out, drop it in the box and forget about it by the time you reach your car.

That may be the last moment the information feels contained. Many sweepstakes are legitimate. Still, the official rules or privacy policy may allow the sponsor, its affiliates or marketing partners to use and share your information. The privacy risk grows when those details become part of a larger marketing profile, move through the data broker industry or reach buyers running deceptive campaigns.

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us Wednesday, July 22, at 1 p.m. ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam—stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

FCC ROBOCALL CRACKDOWN COULD CHANGE PHONE PRIVACY

A basic sweepstakes entry may ask for your name, email address and phone number. Some promotional forms request far more, including your age range, household income, health interests, medications or magazine subscriptions. Those extra questions can have marketing value even when they have little connection to selecting a winner.

The Federal Trade Commission has found that data brokers collect information from online and offline sources, including purchases, magazine subscriptions, income data and other personal details. Brokers can combine those records into profiles that help marketers predict what may capture your attention.

Before entering, ask yourself whether the sponsor truly needs each answer. The more information you provide, the more detailed the resulting profile can become.

Responding to a sweepstakes can become a valuable signal. It tells a marketer that a prize—based offer caught your attention and persuaded you to provide personal information. The FTC has warned that sweepstakes promoters may sell entry information to advertisers. That can lead to more targeted advertising, junk mail, telemarketing calls and spam.

Your entry may also be combined with purchase histories, demographic estimates and records collected from other sources. As a result, the profile can reveal far more than the few answers written on the original form. Once you are categorized as someone who responds to sweepstakes, your information may become more valuable to companies promoting similar offers. The danger grows when a poorly controlled list reaches a buyer running a fraudulent campaign.

Epsilon Data Management was one of the world's largest marketing companies. It entered a deferred prosecution agreement with the Justice Department after acknowledging that one of its business units sold consumer lists to mass-mailing fraud schemes. Those operations sent false sweepstakes notices and astrology solicitations. The mailings claimed recipients had won prizes or could receive personalized psychic services after paying a fee. People who paid received nothing of value.

Epsilon agreed to pay $150 million in penalties and victim compensation. Of that amount, $127.5 million was designated for people harmed by fraud schemes that used Epsilon data. Many of the people targeted were older adults. The case continued beyond the company settlement. A jury later convicted a former Epsilon executive and sales manager of conspiracy, mail fraud and wire fraud.

The Justice Department said the defendants sold targeted lists to fraudsters who used them to identify people likely to respond to deceptive mailings. The case documents a specific abuse of targeted marketing data rather than a universal path for every sweepstakes entry. Still, it shows how information collected for marketing can become a road map for fraud when it reaches the wrong buyer.

The exact path will vary by promotion. However, one possible chain looks like this:

This chain can unfold without a malicious website, infected attachment or stolen password. The starting point may be a paper form sitting inside a familiar store.

A mall kiosk or retailer drawing feels safer than a random website because you recognize the location. That familiarity can make the privacy terms easier to overlook. Before entering, look for the official rules and privacy policy. Check whether the sponsor can share your data with affiliates, sponsors or marketing partners.

Also watch for language giving permission to call, email or text you. Once several companies receive the information, tracing every copy becomes difficult. That lack of visibility is one reason a simple contest entry can create a much larger privacy footprint.

A few simple habits can limit the information you hand over, reduce unwanted marketing and help your family recognize a fake prize before money changes hands.

You cannot pull back every sweepstakes entry you have already submitted. However, you can reduce the amount of personal information available through data brokers and people-search sites.

Start by searching for your name, phone number, email address and home address online. You may find profiles that reveal your age, relatives, past addresses and other personal details. Many data brokers provide an opt-out process, although removing your information manually can take time and may require repeated requests.

You can also use a reputable data removal service to contact brokers on your behalf and continue submitting removal requests when your information reappears. Before signing up, check how many brokers the service covers, whether it offers ongoing monitoring and whether you can request removals from specific sites.

No service can erase every public record, social media post or privately held database. Still, reducing the number of sites displaying and selling your information can make it harder for marketers and scammers to build a detailed profile about you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

Get a free scan to find out if your personal information is already out on the web: CyberGuy.com.

Provide the minimum information required for a valid entry. Think twice when a form asks about your income, medications, health concerns, shopping habits or other sensitive subjects. Some promotions need your age or date of birth to verify eligibility. However, questions unrelated to the official requirements may serve a marketing purpose.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

Look for the sponsor's full name, eligibility requirements, drawing date and privacy terms. Pay close attention to language explaining whether your information may be shared with affiliates or marketing partners. When no official rules or identifiable sponsor appear, skip the promotion.

Watch for preselected boxes or fine print that gives the sponsor permission to send promotions by email, phone or text. Leave optional marketing boxes unchecked. When consent is required to enter, decide whether the prize feels worth the additional contact and data sharing.

Consider creating an alias email address used only for contests, store loyalty programs and promotional offers. This makes follow-up marketing easier to recognize and keeps your primary inbox less exposed. A separate address cannot prevent the sponsor from sharing the information you provide. However, it can help you contain the resulting email. For more ways to protect your inbox, read how your email address gets into the wrong hands.

Do not provide a bank account number, credit card number or payment app information on a sweepstakes entry. The Postal Inspection Service advises consumers to avoid any sweepstakes requesting financial information or payment. A legitimate sponsor may need tax information after you have independently verified a major prize. That request should come after the drawing and through a confirmed company contact rather than on the original entry form.

Take a photo of a paper entry form or save a screenshot of an online promotion. Keep the official rules, sponsor name and drawing date. When someone later claims you won, compare the message with the original promotion. Contact the sponsor through information you find independently rather than using a phone number or link provided in the prize message.

The Epsilon schemes harmed many older adults and other vulnerable people. Watch for prize letters that feel urgent, personal or unusually persistent. Talk with parents and grandparents before a suspicious letter arrives. Make sure they know to call someone they trust before sending money or personal information. You can also share our guide on how to stop scam texts from targeting aging parents.

Real prizes are free. A demand for taxes, processing costs, shipping fees, gift cards, cryptocurrency or a money transfer signals a scam. Scammers often create urgency, so you have less time to question the story. Slow down and verify the company yourself. Gift card demands deserve special caution. CyberGuy has also covered how fake prizes lead to gift card losses.

Legitimate marketing emails must provide a way to opt out of future messages. Use the unsubscribe option when you recognize the company and remember signing up. Avoid clicking unsubscribe links inside suspicious messages. A fake link may lead to a phishing page or confirm that your email address remains active. Mark the message as spam and block the sender instead.

Report suspected prize or sweepstakes scams at the Federal Trade Commission's ReportFraud.ftc.gov. You can file a report even when you spotted the scam before losing money. When the scam involves the U.S. Mail, report it to the U.S. Postal Inspection Service at uspis.gov/report. The agency accepts reports involving sweepstakes, lottery and other mail fraud.

COULD THE 7-ELEVEN BREACH AFFECT YOU?

That little entry card by the register can reveal far more than you think. The real concern begins when extra details leave the sponsor and become part of a marketing profile that gets shared, categorized and sold. The Epsilon case showed how lists of likely responders can become a road map for fraud, with older adults paying a steep price. Give the minimum, skip optional marketing consent and read the privacy terms before you enter. Then talk with the older people in your life before a convincing prize letter reaches their mailbox. Any prize notice demanding money belongs in the trash. You cannot pull back every old entry, but you can shrink your data trail and make your household harder to target.

Have you ever entered a sweepstakes and later noticed more junk mail, unwanted calls or suspicious prize offers? Let us know by writing to us at Cyberguy.com

Would this survival pod make you feel safer?

Sun, 19 Jul 2026 07:48:42 -0400

Disaster prep used to mean bottled water, flashlights and maybe a generator in the garage. Now a French startup is taking all of that to the next level. Momentum Technologies recently showed off its LifePods survival capsules. According to the company's website, the capsules are designed to protect people, families, response teams and critical infrastructure during natural disasters, industrial risks and security threats.

You can see why something like this would get a lot of attention right now. Blackouts seem more common. Floods can move fast. Global instability has many of you wondering how prepared you really are if help cannot get there right away. LifePods takes that fear and turns it into a physical product you can buy, move and place before disaster hits.

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

17 EMERGENCY ITEMS TO BUY BEFORE YOU ACTUALLY NEED THEM — STARTING AT $6

LifePods survival capsules are compact shelters built for extreme emergencies. Momentum Technologies says the capsules can provide immediate shelter during tsunamis, flash floods, storm surges, armed attacks, collapses, extreme fires and dangerous environments. That makes them different from the underground bunker you may imagine behind a hidden steel door. These capsules focus on faster deployment and a smaller footprint.

The company currently highlights two main commercial models. The W-01 is a floating capsule for water-related disasters. The B-01 is an armored land capsule for ballistic and industrial protection. Momentum also lists an earthquake-focused Q-01 concept under development.

The LifePods B01 is the tougher-looking model. Momentum built it for hostile environments, critical infrastructure and situations where fast shelter could save lives. The company says the B01 gives occupants protected space against ballistic threats, fragments, armed attacks and degraded environments. It also says people can get inside and lock the system in seconds.

This model seems aimed more at security teams, industrial sites and public safety agencies than a typical backyard buyer. Momentum lists possible uses at military or police checkpoints, energy production stations, telecom hubs, transport terminals and heavy industrial sites.

The B01 lists room for one to two people, high-hardness ballistic steel, positive air filtration options and a total weight of about 4,000 pounds. Momentum says representative test panels obtained VPAM PM7 certification for resistance to 7.62x51mm military ammunition, a roughly .30-caliber rifle round. SR7 civil validation remains in progress.

The LifePods W01 is the model that may feel more relatable if you live near water. Momentum describes it as a floating capsule for extreme weather when evacuation can no longer happen safely.

The company says the W-01 responds to risks from tsunamis, hurricanes, floods, marine submersion and dike or dam failures. It is designed to float, resist impact and keep occupants protected until rescue teams arrive. Momentum says the W-01 is designed to safely accommodate four adults. Young children may also ride with accompanying adults using additional restraint systems, similar to those used in commercial aviation.

The capsule also includes exterior grab bars. That could help survivors already in the water hold onto the outside while waiting for rescue. Every W-01 is also equipped with a geolocation and emergency distress transmission system. The goal is simple: help emergency services find the capsule faster.

The W-01 is currently completing its engineering development phase. Momentum says its structural behavior has been modeled with advanced naval engineering simulation software by Inha Works Ltd., also known as IWL, a Yamaha Motor Group company. That modeling allowed the company to evaluate structural resistance, buoyancy and stability before physical testing.

Physical validation is expected to begin during the second half of 2026. Momentum says the testing will move through initial flotation and stability tests, real-world sea trials and final certification testing in a specialized laboratory that can reproduce extreme disaster conditions such as wave impacts.

Momentum also lists an earthquake-focused Q-01 "Quake" concept under development. That matters because earthquakes create a different kind of danger than floods or armed attacks. You may have only seconds to react, and falling debris can turn an ordinary room into a life-threatening space fast. The company says the Q-01 is being designed to provide structural protection during earthquakes. It is intended for apartments and buildings located in seismic areas.

For now, the Q-01 should be treated as a future concept rather than a product you can price out or buy today. Still, it shows where Momentum wants to take LifePods next. The company seems to be building a family of survival capsules for different disasters instead of relying on one pod to handle every threat.

15 SECURITY ESSENTIALS TO KEEP YOUR VALUABLES SAFE FOR SUMMER TRAVEL

Yes, according to Momentum. The company tells CyberGuy that U.S. customers can contact LifePods through its official website to discuss projects and place pre-orders. The first production units are expected to be available from Barcelona, Spain, in October 2026. That timing depends on the successful completion of the ongoing certification program.

For U.S. customers, deliveries are expected to begin around November 2026, depending on the final destination and shipping arrangements. The company says international shipments are planned from the Port of Barcelona. Momentum also says LifePods is represented by a U.S.-based commercial partner in San Diego, California, who can help customers through the purchasing process.

At first, the company expects demand to come mainly from government agencies, civil protection organizations, industrial operators and critical infrastructure owners. However, private customers can also reserve production capacity as the product becomes commercially available.

Momentum now lists European retail prices before VAT at 25,000 euros for the B-01 and 31,000 euros for the W-01. In U.S. dollars, that comes out to roughly $27,000 for the B-01 and about $33,500 for the W-01, depending on exchange rates. Those prices cover the capsule before shipping and other costs.

You should also expect international shipping, customs clearance, import duties, local taxes, final inland transportation and installation to add to the total. Momentum says it is finalizing its U.S. logistics strategy and expects to provide more accurate landed-cost estimates in the coming weeks. The company also says it plans to establish U.S. inventory in 2027 to reduce delivery times and improve customer support across North America. The company is also looking for strategic distribution partners across the United States to support local sales, logistics and after-sales service.

The big question is proof. Trade show attention can make a product look ready for the real world. Survival gear has to do much more than look impressive under bright lights.

For the B-01, the representative armor panels have already demonstrated compliance with VPAM PM7 ballistic requirements. The remaining work focuses on validating the complete B-01 as an integrated product before it receives final VPAM SR7 certification. That distinction is important. A strong armor panel is one thing. A finished capsule with doors, ventilation, structural joints and other weak points has to prove it can hold up as a complete system.

For the W-01, Momentum says the certification program will include flotation performance, structural integrity, stability, impact resistance, self-righting capability and additional safety evaluations designed for survival equipment used during extreme natural disasters. That is the right place to focus. Flood survival depends on chaotic conditions, including debris, moving water, wave impact, panic and rescue timing.

Momentum says LifePods grew out of a simple observation after the devastating tsunamis of 2004 and 2011. The company says those disasters showed how few last-resort survival options exist once evacuation can no longer happen. The company also says LifePods are meant to complement prevention and evacuation, not replace them. Its goal is to offer a final layer of protection when every other option has failed.

That could mean armed attacks. It could mean tornadoes, hurricanes, tsunamis or catastrophic flooding. In each case, Momentum says the goal is to provide a protected space that can increase the chances of survival until emergency services arrive. The company says it sees resilient personal protection systems becoming a more important part of emergency preparedness as climate-related disasters grow more frequent and geopolitical risks continue to evolve.

Momentum's plans go beyond the B-01, W-01 and Q-01. The company says it is also studying a FireRescue version derived from the B-01. This version would be engineered to protect occupants against intense heat and smoke during fires.

Momentum says this version would be intended mainly for emergency responders and professional users. The goal would be to provide a protected refuge while waiting for evacuation or rescue. Looking further ahead, Momentum says it is working on future autonomous LifePods that could actively regulate interior temperature. That could help occupants remain protected for longer periods under extreme environmental conditions. Ultimately, the company says its ambition is to build a complete family of survival solutions for major natural, technological and security threats.

LifePods taps into a feeling many of you already have. You may not want a bunker. You may not have space for one. But you probably do want a better answer for the moment when help takes too long to arrive. For now, most of you should focus on realistic emergency prep. Know your flood risk. Keep water, food and backup power available. If severe weather is a concern where you live, our storm survival essentials guide at cyberguy.com breaks down gear that can help you stay powered, connected and informed during outages.

Your phone matters too. Set up emergency contacts, Medical ID or emergency information before something goes wrong. You can also review our guide on getting your phone ready for an emergency so you know what your iPhone or Android can do when cell service fails. If you live somewhere remote or spend time outdoors, a separate satellite SOS device may also be worth considering. We have a guide to satellite communicators and emergency SOS tools at cyberguy.com that explains how they can help when your phone loses signal.

Still, LifePods shows where disaster prep may be heading. Preparedness is moving beyond small gear into bigger engineered survival systems. That could help critical sites, emergency teams and families in high-risk areas. At the same time, big claims deserve careful questions. Before anyone spends tens of thousands of dollars on a survival capsule, they should look for completed certifications, independent tests and clear installation requirements.

LifePods is one of those ideas that grabs your attention because it sounds extreme at first, then starts to make sense the longer you think about it. Floods, fires, attacks and infrastructure failures can leave families and workers with very few options. I like the focus on fast shelter when evacuation becomes impossible. I also like that Momentum is thinking through different threats instead of trying to make one capsule solve every disaster. Still, I would be cautious. A survival capsule has to work when everything around it goes wrong. The latest testing update makes this feel more real than a trade show concept, but final certification will decide how strong the case really is. For now, LifePods feels like a serious emergency-tech idea with real potential, a high price tag and a lot riding on the next round of testing.

Would a survival capsule make you feel safer, or does this feel like disaster prep going too far? Let us know by writing to us at CyberGuy.com.

HalluSquatting AI attack could hijack your computer

Sat, 18 Jul 2026 12:00:22 -0400

You ask an artificial intelligence assistant to download a popular software tool. It confidently finds the project, retrieves the files and starts setting everything up. There is one problem. The AI found the wrong project. That mistake may sound like another frustrating AI hallucination. However, researchers have shown how an attacker could turn that wrong answer into a malware delivery system.

The technique is called HalluSquatting. It targets AI tools that can browse the internet, retrieve software and run commands on your computer. An attacker could use it to steal sensitive information or quietly recruit your device into a botnet, a network of infected devices controlled remotely.

In a recent research paper, researchers from Tel Aviv University, Technion and Intuit detailed HalluSquatting and tested it against popular AI coding tools and personal assistants. Here is how the attack works and what you can do before an AI assistant downloads the wrong file.

Free live CyberGuy class: Sick of Spam? Join us July 22.

Reserve your free spot today at CyberGuyLive.com.

HACKERS THREATEN TO LEAK DATA FROM 275M USERS AFTER BREACHING MAJOR COLLEGE PLATFORM USED NATIONWIDE

AI hallucinations happen when a model invents information and presents it as accurate. That could be a fake statistic or a software project that never existed. HalluSquatting focuses on fake software resources.

AI coding assistants sometimes need the full online address of a software repository. However, you may only give the assistant a project name. The AI must then determine who owns the project and where the official files live. When it does not know the answer, it may guess.

An attacker can repeatedly ask AI models to locate a popular or trending project. That process may reveal fake repository names the models invent regularly. The attacker can then register one of those names before someone else does. As a result, the AI's imaginary project becomes a real online trap.

First, the attacker identifies a software project or AI skill that is gaining attention. Newer resources may create a larger opportunity because an AI model may have little reliable information about them. Next, the attacker studies how different AI models respond when asked to locate that resource. The researchers found that models can repeat the same fake names across different prompts.

The attacker then creates a repository, software package or AI skill using one of those hallucinated names. Malicious instructions can be placed inside its files, setup scripts or documentation. Later, you ask your AI assistant to retrieve the real project. Instead, the assistant invents the attacker-controlled name and downloads those files.

The assistant may then read the hidden instructions as part of its assigned task. If the assistant has access to a terminal, it could also run the attacker's commands. Those commands may download more software or search files stored on the computer. The unsettling part is that you may never enter the wrong name. The AI creates the mistake and then acts on it.

AI CHATBOTS TAKE HEAT OVER LEFT-WING BIAS: ‘NO LONGER BE CONSIDERED NEUTRAL’

Unlike a basic chatbot, an autonomous AI agent can take actions on your behalf, including browsing websites and running commands. A regular chatbot may give you a broken link. You click it, discover that it goes nowhere and close the page. An AI agent can go much further. Agentic AI tools can download files, install software and operate a computer terminal. Those abilities make the tools useful.

However, they also give prompt injection attacks more power when an agent follows malicious instructions. The researchers showed that malicious instructions inside a squatted resource could trigger remote tool execution or remote code execution. In other words, the AI assistant could run an attacker's commands on the computer where the assistant operates.

The potential damage depends heavily on the assistant's permissions. An agent with broad file access creates a much larger risk. The danger also grows when the agent can run commands without asking for approval.

The researchers examined Cursor, Cursor CLI, Windsurf, GitHub Copilot, Cline and Gemini CLI. They also tested OpenClaw and related personal AI assistants. Hallucination rates reached as high as 85% during repository-cloning scenarios. Some skill-installation tests reached 100%.

The researchers also found that hallucinated names could transfer across different foundation models. In other words, several AI systems might invent the same fake resource. The team successfully demonstrated remote tool execution and remote code execution against production AI applications with integrated terminals.

However, the researchers used controlled resources and harmless test payloads. The study did not document a widespread criminal HalluSquatting campaign. Still, the research shows that the attack path can work.

One finding offers a clear clue about how AI companies could reduce the danger. An AI assistant should search for a repository or package before downloading it. That search can help confirm whether the resource exists and who owns it. However, AI tools do not always perform that search.

The assistant may rely on its training data instead. If the project is unfamiliar, the model may generate a convincing but incorrect answer. Researchers and security experts recommend requiring AI agents to perform live lookups before they clone, fetch or install outside resources.

Even a search cannot guarantee safety. An attacker may have already registered the hallucinated name. Therefore, the assistant must also verify the resource's owner, history and connection to the official developer.

A botnet is a collection of compromised devices controlled by an attacker. Criminals can use botnets to spread malware, mine cryptocurrency or overwhelm online services. Traditional botnets often spread through software flaws or weak passwords. They may also target large groups of similar connected devices. HalluSquatting proposes another delivery route.

An attacker could plant one malicious resource and wait for AI agents to pull it onto unrelated computers. Those computers could run different operating systems and sit on separate networks. The common weakness would be the AI agent's willingness to trust a hallucinated resource.

The researchers describe how this setup could support an "agentic botnet." The AI would deliver the malicious instructions and run the commands needed to install the botnet malware. However, the team did not release a real botnet. Researchers also withheld attack details that criminals could directly reuse.

AI companies can make searches mandatory before agents retrieve outside resources. They can also require human approval before an agent runs downloaded code. Stronger warnings should appear when a resource has little history or comes from an unverified owner.

Meanwhile, software platforms could identify frequently hallucinated names before attackers register them. Platforms may also restrict the reuse of well-known project names under unrelated accounts. Security layers that inspect downloaded instructions could reduce exposure. However, researchers warn that no single control can remove the entire risk.

The HalluSquatting researchers notified affected vendors before publishing their work. They also withheld details that they believed attackers could reuse. The paper does not claim that every tested application has released a complete fix. HalluSquatting reflects a broader weakness in how AI agents generate and trust resource names.

HalluSquatting depends on an AI assistant trusting an unverified resource and acting with little supervision. These steps can interrupt that chain before an attacker gains access to your computer.

Do not rely on an AI-generated repository name alone. Visit the developer's official website. Then, follow its link to the correct repository or software download page. Check the account owner as well as the project name. An attacker may use a familiar project name under an unrelated account. You should also review the repository's history. A newly created account with little activity deserves extra scrutiny.

Tell the assistant to perform a live web search before cloning, fetching or installing a resource. Ask it to show you the official owner and full address before it takes action. Then, compare that information with the developer's website. This step can reduce the chance that an AI model will rely on an invented name. Still, you should review the result yourself before approving a download.

Avoid modes that allow an AI agent to run terminal commands without asking you first. Some coding tools call these auto-run, skip-permissions or unrestricted modes. The exact wording depends on the application. Require approval for each command, especially when the AI downloads an outside file. Also stop the process when the assistant cannot clearly explain what a command will do.

Read the full command before approving it. Be cautious when a command connects to an unfamiliar website or downloads an additional script. Commands that change security settings also deserve close attention. Do not approve a command because the AI says it is safe. Verify unfamiliar commands through official documentation.

Avoid running an AI coding assistant with administrator access unless the task requires it. Only give the agent access to the files needed for the current project. Keep tax records, personal documents and private photos outside its working folders. In addition, remove integrations the agent no longer needs. Those may include cloud storage accounts or workplace systems. An attacker can cause less damage when the compromised agent has fewer permissions.

Test unfamiliar AI-generated code inside an isolated environment. A virtual machine, development container or sandbox can separate the code from the rest of your computer. If something goes wrong, the malicious activity may remain contained. Security researchers also recommend isolated installation environments for AI-generated package commands.

Strong antivirus software can add another layer of protection. It may detect a malicious download, suspicious script or unexpected attempt to change your system. Some security tools can also block connections to known dangerous websites. However, antivirus software cannot guarantee that an AI assistant will select the correct repository. You still need to verify the source and review commands. Keep real-time protection enabled. In addition, allow the software to update its threat definitions automatically. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

AI coding tools may work with passwords, access tokens or API keys. Those credentials can give an attacker access to valuable accounts. Do not store sensitive credentials in plaintext project files. Instead, use secure environment variables or a trusted secrets manager. Use strong and unique passwords for important accounts.

A password manager can create and store them. Also turn on two-factor authentication wherever it is available. That can make a stolen password harder to use.

Install updates for your operating system, browser and AI applications. Updates may fix security problems or add stronger approval controls. They may also improve how an AI tool verifies outside resources. However, HalluSquatting relies partly on AI hallucinations. Therefore, software updates alone may not remove the risk.

Businesses and development teams should limit which software sources AI agents can access. Teams can create allowlists for trusted publishers. They can also pin package versions and verify cryptographic hashes. Automated dependency scanners may flag known vulnerabilities before software reaches a live system. Software bills of materials can help teams track where each component came from. They also make it easier to identify affected projects after a security problem appears.

Review the agent's activity history when the application provides one. Look for unexpected downloads or commands you do not remember approving. New software, unusual pop-ups or unexplained computer slowdowns may also warrant a closer look. If you suspect that an AI agent ran malicious code, disconnect the computer from the internet. Then, run a full antivirus scan. Change important passwords from a different trusted device. You should also revoke exposed API keys or access tokens.

We already know AI can confidently make things up. HalluSquatting shows what can happen when an AI tool acts on its own bad answer. An assistant may invent a software address and download files controlled by an attacker. If the agent has terminal access, it may also run malicious instructions using your permissions. The research does not show that HalluSquatting attacks are suddenly infecting computers everywhere. However, it exposes a security gap that AI companies need to address as agents gain more control. For now, do not give an AI assistant unlimited freedom to install software or run commands. Verify every source, keep approval controls turned on and use strong security software as a backup layer.

How much control would you feel comfortable giving an AI assistant over your computer before it has to stop and ask for permission? Let us know by writing to us at Cyberguy.com

How to share vacation photos on any screen

Sat, 18 Jul 2026 06:00:18 -0400

We have all been there. You come home from a trip, someone asks to see the photos, and suddenly your phone is making its way around the room, one person at a time. That works for a few snapshots. It gets old fast when you have beach videos, family group shots, mountain views or that one ridiculous restaurant photo everyone needs to see.

The better move is to put your vacation photos on a bigger screen. You can use a TV, projector, laptop, tablet or even an outdoor screen. The right method depends on what phone you have, what screen is nearby and whether you are at your house or someone else's. Here are the easiest ways to share vacation photos without turning your phone into a handoff relay.

Free live CyberGuy class: Sick of Spam? Join us July 22.

Reserve your free spot today at CyberGuyLive.com.

HOW TO SAVE ANY FILE AS A PDF

Before you mess with settings, look around the room. The best option may already be sitting in front of you. A smart TV works well for most people because it may support AirPlay, Chromecast, Smart View, Roku, Fire TV or screen mirroring. A laptop can also work if the TV connection gets messy. A tablet is great for a smaller group at the kitchen table. A projector gives you the biggest wow factor, especially outside.

If your TV is due for an upgrade, CyberGuy's Top TVs of 2026 can help you find one with the features that make photo sharing easier. Search "Top TVs of 2026" in the search bar at CyberGuy.com.

Also, think about privacy before you start. Open only the album you want people to see. No one needs your screenshots, receipts or random camera roll surprises popping up on a 65-inch TV.

AirPlay is usually the cleanest option for iPhone owners. It works with Apple TV, many smart TVs, some Roku devices, and select Fire TV smart TVs that support AirPlay.

Here's how to do it:

This is great when you are at home, and your TV already supports AirPlay. It can also work at someone else's house, but both devices usually need to be on the same Wi-Fi network. If you use AirPlay often, it is also worth reading CyberGuy's report on how hackers are breaking into Apple devices through AirPlay so you know how to use it more safely.

Sometimes the AirPlay button does not appear where you expect it. In that case, mirror your whole iPhone screen.

Turn on Do Not Disturb or Focus first so private texts and alerts do not show up during the slideshow.

For Android owners, Google Photos and Chromecast are a strong combo. This works with Chromecast devices, Google TV Streamer and many TVs with Google Cast built in.

Settings may vary depending on your Android’s manufacturer

This method also works from Google Photos on iPhone or iPad if you are signed into your Google Account.

Samsung Galaxy phones have a built-in screen mirroring feature called Smart View. It is one of the easiest ways to show photos on a Samsung TV and some other compatible displays.

Settings may vary depending on your Android’s manufacturer

Smart View mirrors your whole phone screen, so the same privacy rule applies. Open the album first and silence notifications before you start.

Some Samsung Galaxy phones and tablets support Samsung DeX. This can make your phone feel more like a desktop on a TV or monitor.

You can connect with a USB-C to HDMI cable or adapter. Some TVs also support wireless DeX through compatible screen mirroring. Once connected, open your photo app and display your album from the big screen.

DeX can be especially useful when you want a cleaner setup for a family gathering, reunion or backyard slideshow because you are not simply throwing your entire phone screen onto the TV.

A cable may feel old school, but it is often the most reliable method. It also avoids Wi-Fi problems at someone else's house.

For iPhone 15 and newer USB-C models, use a USB-C to HDMI adapter or cable. Plug it into your iPhone, connect the HDMI cable to the TV or projector and switch the TV to the correct HDMI input.

For older iPhones with Lightning, use a Lightning Digital AV Adapter and an HDMI cable.

For Android phones, USB-C to HDMI support depends on the model. Many Samsung Galaxy phones support video output, while some other Android phones may not. If your phone supports it, plug the USB-C to HDMI adapter into your phone, connect the HDMI cable to the screen and choose the correct input.

This is one of the best options for outdoor projectors because it avoids weak backyard Wi-Fi.

APPLE AIRDROP, ANDROID QUICK SHARE FLAWS PUT PHONES AT RISK

A laptop gives you more control when you want a polished slideshow. You can open iCloud Photos, Google Photos, OneDrive or a folder of downloaded photos. Then connect the laptop to a TV or projector with HDMI.

On Windows , press Windows key + P to choose how the screen appears.

On a Mac, connect the display and use System Settings if you need to adjust the screen arrangement.

You can also cast from some laptops to wireless displays. On Windows, press Windows key + K and select a compatible wireless display. This can work well with Miracast-enabled TVs and adapters.

The laptop method is helpful when multiple people have sent you photos after the trip, and you want everything in one place before guests arrive.

A tablet works well for smaller groups. It is bigger than a phone, easier to pass around and less awkward at a dinner table.

On iPad, open Photos, Google Photos or iCloud Photos . You can also AirPlay to a bigger screen if one is nearby.

On an Android tablet , open Google Photo s or your gallery app and cast to a Chromecast-enabled TV when available.

This is a good fallback when you are at someone else's house, and you do not want to mess with their TV settings.

Roku gives you several options depending on your phone.

If you have an iPhone and the Roku device supports AirPlay, use AirPlay or Screen Mirroring from Control Center.

If you have Android or Windows, Roku supports screen mirroring from compatible devices. Roku also has Photo Streams in the Roku mobile app, which lets you upload photos and share a stream.

Photo Streams can be a nice option for parties because you can prepare the photos before people arrive instead of connecting your phone in the moment.

Some Fire TV smart TVs support AirPlay. If yours does, you can enable AirPlay in the Fire TV settings and share from an iPhone.

Fire TV also supports display mirroring on certain models. Go to Settings , then Display & Sounds , then Enable Display Mirroring. After that, connect from your compatible phone, tablet or computer.

Not every Fire TV device supports every mirroring option, so this is one place where the exact model can make a difference.

A streaming device can make photo sharing easier if your older TV lacks AirPlay, Chromecast or screen mirroring. Roku, Fire TV, Apple TV and Chromecast-style devices can give an older screen newer sharing features.

If you are thinking about adding one, CyberGuy's guide to the 5 best streaming devices in 2026 at cyberguy.com breaks down strong options for different homes and budgets.

This can also help if you visit relatives who have a perfectly good TV that feels stuck in another decade. Plug in the streaming device, connect it to Wi-Fi and you may have a much easier way to show photos.

A shared album can save you from digging through your camera roll while everyone waits.

On iPhone, use iCloud Shared Albums if your guests are also in the Apple world. Select the photos , tap Share, choose Add to Shared Album and post them to the album.

Google Photos is more flexible for mixed groups. You can create a shared album, add photos and send a link. That works well when some people have iPhones and others have Android phones.

This is also the easiest way to let other people add their own vacation shots. After a group trip, ask everyone to upload their best photos to one shared album before the slideshow.

For more family-friendly options, CyberGuy has also rounded up the best free sites for sharing photos and videos with your extended family.

Outdoor photo sharing needs a little more planning. Sunlight, Wi-Fi and power can all get in the way.

A portable projector is the most fun option for backyard photo nights. Use a white wall, projector screen or even a clean white sheet pulled tight. For the best picture, wait until dusk or evening.

You can connect your phone with HDMI, cast wirelessly if the projector supports it or plug in a streaming stick such as Roku, Fire TV, Chromecast or Google TV Streamer. If your projector has Google TV built in, you may be able to open Google Photos or cast directly.

For outdoor setups, bring a long extension cord, portable speaker, HDMI cable, phone adapter and backup charger. Wireless casting can work, but a cable is less likely to fail when the Wi-Fi signal is weak.

If you are at your own house, use AirPlay, Chromecast, Smart View or a shared album on your smart TV.

If you are at someone else's house, use an HDMI cable or shared album link. That avoids asking for Wi-Fi passwords and digging through their TV menus.

If you are outside, use a projector with HDMI or a streaming stick. Keep a charger nearby because photo and video sharing can drain your phone quickly.

If you have a mixed iPhone and Android crowd, use Google Photos or a shared album link. It is usually easier than trying to make every device talk to the same TV.

If you want the least awkward option, prepare an album before people arrive. Your future self will thank you.

Before you turn your vacation memories into a living room or backyard slideshow, take a minute to make sure you are only sharing what you actually want everyone to see.

Create a dedicated album with only the photos you want people to see. Hide or remove anything personal before you cast or mirror. Before you put anything on a big screen, you may also want to hide private photos on your iPhone or Android from snoops.

Turn on Do Not Disturb or Focus so messages and notifications stay off the big screen. Avoid opening your full camera roll in front of guests. Start from the album instead. If your camera roll is overflowing with screenshots, duplicates and random saves, CyberGuy's five digital clean-up tips you didn't know you needed can help you tidy things up before slideshow night.

Be careful with location data if you share an album link. Some photo services may include or display location details depending on your settings. Also, remember to stop casting or mirroring when you are done. It sounds obvious until your phone reconnects to the TV while you are checking something private. And while you are using a smart TV, take a minute to review the privacy clauses hidden in smart home devices that may affect what your TV, speaker or connected gadgets collect.

Vacation photos are more fun when everyone can actually see them. Passing one phone around the room kills the moment, especially when you have videos, Live Photos and group shots worth showing. The best method depends on where you are. At home, AirPlay, Chromecast or Smart View may be easiest. At someone else's house, an HDMI adapter can save you from Wi-Fi headaches. Outdoors, a projector can turn a backyard into a photo night people actually remember. But let's be real here. The smartest move is making a clean album before anyone arrives. That way, you control what shows up, you avoid awkward screen surprises and you spend less time fumbling with settings.

What is your favorite way to show vacation photos when family or friends come over: phone, TV, projector or something else? Let us know by writing to us at CyberGuy.com.

New bank scam laws could stop suspicious payments

Fri, 17 Jul 2026 12:30:46 -0400

Your phone rings, and the caller says your bank account is under attack. To protect your savings, you must move the money right now. The caller sounds calm. The instructions feel official. However, the "safe account" belongs to a scammer. That pressure can turn years of savings into an irreversible transfer. Georgia now gives some banks and credit unions another chance to interrupt the payment before the money leaves.

House Bill 945 took effect July 1, 2026. The law lets financial institutions pause certain transactions when they reasonably suspect financial exploitation. It protects adults age 65 or older. It also covers adults with qualifying physical or mental incapacities, Alzheimer's disease or dementia. The idea sounds simple. Yet the details matter because your bank's power may depend on your state, your account and the institution's own policy.

YOUR FAMILY COULD BE ONE PHONE CALL FROM A BANK SCAM

Free live CyberGuy class: Sick of Spam? Join us July 22.

Join us Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

Under Georgia's law, a financial institution may place a hold on a transaction linked to suspected exploitation. The law can cover an eligible adult's account or an account where that adult is a beneficiary. It can also reach an account belonging to someone suspected of carrying out the exploitation. That last provision gives the law extra reach. In practice, it could help when suspicious money arrives in another customer's account. The institution may have room to stop the payment from moving farther when the facts support concern.

However, the law gives banks discretion. It says a financial institution may place the hold, but it does not require one. Therefore, a worried teller or fraud analyst still has to notice the warning signs and act. The law also focuses on the suspicious transaction. It does not automatically shut down every payment or withdrawal connected to the account.

A Georgia hold initially expires after 15 business days. The bank may add up to 15 more business days if its review still supports the exploitation concern. A court may shorten or extend that period. The bank must notify authorized account parties and any trusted contact within three business days. It can skip someone it reasonably suspects of taking part in the exploitation. The institution must also begin reviewing the facts behind its decision.

Before using this power, the institution must train the employees involved. It also needs written procedures for reviewing suspected exploitation. The law gives institutions liability protection when they act in good faith and use reasonable care.

Georgia's law also allows an eligible adult to name a trusted contact for an account. That person could be a relative, friend or another adult the account owner trusts. The bank may contact that person when it suspects exploitation. It may also ask for help confirming contact information, health status or the identity of someone holding power of attorney. In some cases, the institution may share only that it suspects exploitation.

A trusted contact does not automatically gain access to your balance. The role also does not grant authority to move your money or make decisions for you. Federal regulators describe the contact as a backup person whom the institution can alert when something looks wrong.

Georgia is part of a much larger shift. As of today, at least 33 states have enacted laws that let banks, credit unions or other covered financial institutions delay certain transactions when they suspect financial exploitation.

The FTC's most recent nationwide chart identified 24 states with these laws.

However, the agency warned that its chart was only a snapshot and advised readers to check current state statutes.

However, the agency warned that its chart was only a snapshot and advised readers to check current state statutes. Since that report, nine additional states have enacted protections.

The states are:

The laws do not give every bank the same power. Some let an institution pause a payment on its own. Others require a report to law enforcement or adult protective services. The protected age can also vary, while several states include younger adults with qualifying disabilities. Hold periods differ even more. A delay may last only a few business days in one state. Elsewhere, an investigation or court order can keep the payment on hold much longer.

HOW FLORIDA RETIREE LOST $200K IN FAKE PAYPAL REFUND SCAM

Here is what the newer state laws do.

Colorado

Colorado's HB 26-1110 created the Adults' Security and Safeguards from Exploitation in Transactions Act, known as the ASSET Act. It lets a bank or credit union delay a disbursement when it reasonably believes a vulnerable adult faces financial exploitation. The institution must notify law enforcement or adult protective services. A decision generally must be made within 90 days. That period can reach 180 days when an agency investigation remains underway. The law takes effect August 12, 2026.

Georgia

Georgia's HB 945 lets a financial institution place a hold on a suspicious transaction involving an eligible adult. The law also reaches accounts where the adult is a beneficiary. In some cases, it can cover an account belonging to the suspected perpetrator. The initial hold lasts up to 15 business days. A bank may extend it for another 15 business days when its review continues to support the concern. The law also includes trusted contacts, employee training and written notice requirements.

Idaho

Idaho enacted HB 182, known as the Report and Hold law, in 2025. It covers a broad range of financial businesses, including banks, credit unions, lenders, money transmitters and investment firms. Covered professionals may temporarily pause suspicious transactions and report suspected exploitation. The law also gives them liability protection when they act in good faith.

Maine

Maine's 2025 law covers adults age 65 or older and people protected by the state's Adult Protective Services Act. A bank or credit union may delay a disbursement when it reasonably believes the payment could result in exploitation. The institution must notify the Maine attorney general within two business days. The hold generally ends within 15 business days unless a court extends it. Customers may also be able to designate a trusted contact.

Maryland

Maryland's Vulnerable Adult Banking Protection Act covers residents age 65 or older and vulnerable adults who cannot provide for their daily needs. A financial institution may delay or deny a suspicious disbursement. An initial delay can last 15 business days. The institution or an investigating agency can extend it for up to 25 business days from the original request date. The law takes effect October 1, 2026.

North Carolina

North Carolina's SB 595 gives financial institutions broad authority to delay or refuse transactions involving suspected exploitation of older or disabled adults. The law covers withdrawals, transfers and some requested account changes. An initial delay can last up to 30 business days. The institution may extend it for another 30 business days if it continues to believe exploitation is occurring. Banks may also alert a trusted contact.

Oklahoma

Oklahoma's SB 2067 requires financial institution employees to report suspicious activity internally and notify an appropriate agency. Banks and credit unions may place a temporary hold on a reported account. They can also contact someone previously designated by the account holder. The law takes effect November 1, 2026.

South Dakota

South Dakota's HB 1238 lets a financial institution delay or refuse certain transactions when it reasonably believes exploitation may have occurred or is being attempted. The law protects senior and vulnerable adults. It also covers a consenting adult who asks the institution to take protective action.

Vermont

Vermont's Act 106 lets covered financial institutions delay a transaction when they reasonably believe a customer faces financial exploitation. The initial delay can last 15 business days. The institution may add another 15 days when it believes the exploitation may continue. Vermont approved the law on May 20, 2026.

The federal Senior Safe Act encourages financial professionals to report suspected exploitation. It also offers liability protection to covered institutions and trained employees who make qualifying reports. However, the law does not create one nationwide transaction-hold rule for checking and savings accounts. Investment accounts follow a different framework. FINRA Rule 2165 lets a brokerage firm temporarily hold certain disbursements or securities transactions when it reasonably believes an eligible adult faces financial exploitation.

The rule generally covers adults age 65 or older along with some younger adults who have qualifying impairments. As a result, a brokerage firm may have national regulatory authority to pause a suspicious request. A bank handling your checking account may depend more heavily on the law in your state.

Most state laws give a bank permission to act rather than requiring it to block every suspicious payment. The institution still needs to recognize the warning signs and have enough information to reasonably suspect exploitation. Your protection may depend on your age, the account involved and where you live. Your bank's internal policies and employee training also play a role. Even in a state with a transaction-hold law, a payment may go through before anyone realizes a scam is underway.

CyberGuy has reported on grandparent scams that use urgent calls, stolen details and AI-cloned voices. We have also covered crypto kiosk scams where frightened victims followed a caller's instructions while the money moved beyond easy recovery. Georgia also used HB 945 to add safeguards for virtual currency kiosks, another payment method scammers use to move money quickly.

In both cases, the scammer wants to keep you isolated. They may warn you not to call your family or bank. They might claim that an employee is part of the investigation. A transaction hold attacks that pressure tactic. It adds time, which gives someone a chance to ask a basic question: Does this story make sense? Of course, no law will catch every scam. A payment can move through a different state, another financial service or a crypto wallet. Also, a bank may miss the warning signs or choose not to place a hold.

THE GIFT THAT PROTECTS YOUR DAD FROM SCAMMERS

An ABA Foundation survey commissioned from 158 banks offers an early view. Half of the responding banks in states with hold laws said they had used the authority to delay, refuse or hold transactions. Nearly 90% of respondents in states without such laws supported adopting them. The survey reflects the banking industry's experience rather than a nationwide independent study. Even so, it shows that banks see value in having time to investigate.

That time can also create a difficult balance. Banks need enough authority to stop a devastating payment. Yet they must avoid blocking legitimate transactions based on age alone. Georgia tries to address that concern with a reasonable-cause standard. It also requires notice, employee training and an internal review. Whether the law succeeds will depend on how institutions use those tools.

You should not assume your bank can reverse a scam payment. You also cannot count on it pausing every suspicious transaction. The safest approach is to put protections in place before an urgent call, text or email catches you off guard.

Call your bank's fraud department and ask whether you can add a trusted contact to your account. Then ask what the bank does when an employee suspects financial exploitation. You should also find out whether your state allows the bank to delay a suspicious transaction. The answer may differ between your checking account and your brokerage account.

Enable notifications for withdrawals, transfers and card purchases. Choose the lowest available dollar threshold so you hear about unusual activity quickly. Also review your bank's daily transfer and wire limits. Lower limits can make it harder for a scammer to move a large amount of money in one transaction.

Choose someone who will answer quickly and question an unusual request. Make sure that person knows your bank may call if something appears wrong. A trusted contact does not automatically gain access to your money. The role gives your bank another way to reach someone you trust during a possible emergency.

Choose a private word or phrase that family members can use to verify a real emergency. If someone calls claiming a loved one needs money, ask for the code word. Then hang up and contact your relative through a phone number you already have. Never call a number provided by the person demanding payment.

A bank, government agency or law enforcement officer will not tell you to protect your savings by transferring them to another account. Scammers often use the phrase "safe account" to make a fraudulent transfer sound official. Do not send money through a wire transfer, cryptocurrency kiosk or payment app while someone is pressuring you to act immediately. End the conversation and call your bank using the number on the back of your card or its official website.

Strong antivirus software can help detect malicious links, fake websites and downloads that scammers use to steal financial information. Keep the software updated on your phone and computer. Security software cannot stop every phone scam. However, it can block some of the digital tools criminals use before they reach your bank account. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

Scammers may pull your age, relatives' names, phone number and address from data broker and people-search websites. They can use those details to make a fake emergency sound convincing. A data removal service can help reduce how much personal information appears on these sites. It cannot remove every record from the internet, but it can make it harder for criminals to build a detailed profile around you or your family. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

Call your bank's fraud department as soon as you suspect a scam. Ask the institution to stop, recall or flag the transaction. Change your online banking password from a trusted device and review recent account activity. If you shared login details, ask the bank whether it should lock online access or issue new account numbers. Next, report the incident to local law enforcement and the appropriate fraud agency. For suspected elder financial abuse, you can also contact Adult Protective Services in your state.

Georgia's new law gives financial institutions explicit authority to pause certain transactions when they suspect financial exploitation. However, the hold remains optional, and the protection applies only in qualifying situations. The issue reaches far beyond Georgia. At least 33 states have enacted some form of transaction-hold authority for banks or credit unions, although several newer laws have later effective dates. The protections still vary, so your state and financial institution can shape what happens during the most urgent minutes of a scam. Add a trusted contact where available. Talk with your family about how to verify an emergency and learn how your bank handles suspicious payments. A five-minute conversation today could create the pause that saves someone's life savings later.

Should a bank have the power to delay your payment when it believes a scammer is directing you, even if you insist the transfer is legitimate? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Fox News AI Newsletter: IBM's AI warning sends 'shock wave'

Fri, 17 Jul 2026 12:28:47 -0400

Welcome to Fox News’ Artificial Intelligence newsletter with the latest AI technology advancements.

IN TODAY’S NEWSLETTER:

- IBM sends 'shock wave' through tech industry with AI warning

- Dimon urges calm over fear about AI's impact on jobs: 'Stop being breathless over it'

- AI is changing modern dating, but experts warn it's making people 'relationally stupid'

MARKET JOLT: Shares of IBM were down more than 23% when the market opened on Tuesday, raising fresh questions about whether companies are seeing enough near-term returns from artificial intelligence spending.

COOL DOWN: JPMorgan Chase CEO Jamie Dimon on Wednesday said there is still a lot of uncertainty over how AI will impact the workforce, and people shouldn't be "breathless" in their concerns as new technologies have historically created new jobs.

PLUG PULLED: New York's decision to pause the construction of large artificial intelligence data centers is drawing criticism from some lawmakers and energy officials who argue the move could weaken the United States' ability to compete in the global AI race while encouraging investment to move elsewhere.

RARE PRAISE: Rep. Alexandria Ocasio-Cortez, D-N.Y., praised the late Sen. Lindsey Graham for backing legislation that would allow victims of nonconsensual AI-generated deepfake pornography to file civil lawsuits.

'RELATIONALLY STUPID': Artificial intelligence has seeped into almost every aspect of modern life, helping users plan vacations, create workout routines and tackle countless everyday tasks. Some have resorted to using it for their love lives by asking chatbots to help them write witty responses to messages, craft dating app profiles and work out relationship issues. However, relationship experts fear that the increased use of AI in dating could lead to disastrous results.

DIGITAL AXE: A group of 26 Meta employees sued the tech giant over accusations that it used AI-powered software to choose people for mass layoffs, disproportionately targeting workers with disabilities or those who took medical, parental or family leave.

LOCAL LIFT: Meta is expanding its massive data center project in Richland Parish, Louisiana, to 5 gigawatts of compute capacity, making it one of the largest data centers in history, the company announced Monday.

ACCOUNT CONTROL: There are few emails that make your stomach drop faster than one about "new privacy settings." That usually means a company has moved another data switch, renamed a control or tucked a new choice inside an account menu you rarely visit. Google is now rolling out one of those changes for Search services. The setting is called Search Services History. It controls whether Google saves your activity from Search services when you are signed into your Google account.

SCREEN FREE: A major university is taking aim at tech in a sweeping ban against electronic devices in an effort to "ensure students actually learn to think critically, strategically and independently without relying on AI," according to administrators.

Subscribe now to get the Fox News Artificial Intelligence Newsletter in your inbox.

Stay up to date on the latest AI technology advancements and learn about the challenges and opportunities AI presents now and for the future with Fox News here.

Would you trust a tiny dental robot?

Fri, 17 Jul 2026 06:00:58 -0400

Nobody hears "you need a crown" and feels excited. You start thinking about the drilling, the temporary crown, the return visit and the time it takes to get everything finished.

Now, researchers at the University of Basel in Switzerland are working on a tiny dental robot that could one day change that process. The prototype is called MIR, short for Miniature Intraoral Robot. University of Basel says the device could help prepare teeth for crowns and reduce the number of dental appointments needed for treatment.

WOULD YOU PAY $8,000 FOR A ROBOT TO FOLD LAUNDRY?

The idea may sound intense because we are talking about a drill-equipped robot inside your mouth. However, the current design keeps the larger motor and control parts outside the mouth. The small in-mouth robot connects to them through flexible drive shafts, cables and tubes.

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

If tooth decay leaves a large cavity, a dentist may need to prepare the tooth for a crown. Today, that can mean several steps. The dentist removes decay, fills the cavity, shapes the tooth, takes an impression and fits a temporary crown. Then, the permanent crown gets made and placed during a later visit.

That is where MIR could help. The goal is to move more of the process into a digital workflow. After a scan, a dentist could plan how much tooth material the robot should remove. Then, the crown could be ordered right away instead of waiting for another appointment.

MIR attaches to a custom-fitted dental splint made from the patient's scan. That splint connects the robot to the teeth. So, if the patient turns their head, the robot moves with them.

That detail stood out to me. Anyone who has ever tried to stay perfectly still in a dental chair knows how hard that can be. Even a small twitch can feel huge when a drill is near your tooth.

The robot is designed to follow a digital treatment plan. In testing, it prepared tooth models in two stages. First, it used a wider drill to reduce the top of the tooth surface. Then, a longer, thinner drill worked along the sides.

HUMANOID ROBOTS PERFORM LIVE SURGERY IN WORLD FIRST

The University of Basel says the MIR prototype is about the size of a wine cork. It measures 43 by 26 by 28 millimeters. Dr. Yukiko Tomooka, the paper's first author, said the robot was designed to fit comfortably inside an open mouth.

That small size is key. A dental robot cannot feel bulky or block the dentist's view. It also cannot depend on a giant device sitting inside your mouth. So, the Basel team moved the larger parts outside the mouth and kept the in-mouth unit compact.

The project page from the University of Basel's Department of Biomedical Engineering says the team wants MIR to enable a fully digital treatment workflow for tooth preparation. The long-term vision is a crown that can be manufactured before or during the preparation process using CAD-CAM dental technology.

So far, MIR has been tested on tooth models made of synthetic resin and on ceramic material with hardness similar to tooth enamel. In those tests, the robot's positional error was less than 0.2 millimeters, even though the current version does not yet have sensors to directly measure or correct its position.

Researchers also measured the force created during drilling. University of Basel says the forces stayed below five newtons, which it compares to the gravitational force of a half-liter bottle of water. The team is also studying the robot's noise level to better understand how it might work in a real dental office.

This tiny robot has not yet reached dental offices. University of Basel says more work is needed before MIR can be used in dental practices. The next step is to add sensors and a camera, so the system can track its position and monitor the treatment as it happens.

That safety piece is a big deal. The team wants MIR to know where it is, even after a power outage. Professor Georg Rauter, who leads the research group, said the goal is for the robot to continue from the right position using sensor data.

In other words, the robot needs better awareness before anyone should trust it near a real tooth. Precision on models is one thing. A real mouth adds saliva, movement, pressure, nerves and patient anxiety.

MIR was developed by researchers at the Department of Biomedical Engineering at the University of Basel. The idea came from researchers at the University of Zurich, who also took part in the work.

The University of Basel project page lists the BIROMED-Lab, the Clinic of Reconstructive Dentistry at the University of Zurich, Camlog Biotechnologies and the University of Bern's ARTORG Center as collaborators. The project is sponsored by Innosuisse. The research was published in IEEE Transactions on Medical Robotics and Bionics.

BIONIC HANDS ARE NOW TEACHING ROBOTS TO FEEL

If you have ever needed a crown, you know the process can drag on. MIR could eventually make that experience faster by letting dentists scan, plan and prepare the tooth with more digital precision.

Still, this technology remains in development. You should not expect a tiny robot to show up at your next dental appointment. Researchers still need to add sensors, add a camera and prove that the system can work safely in real treatment settings.

Even so, this is worth watching. Dentistry is already moving toward digital scans, computer-designed crowns and more guided procedures. A robot like MIR could push that trend further, especially if it can reduce repeat visits.

This is the kind of dental tech that makes you lean forward and squirm a little. A tiny robot mounted inside your mouth may sound intense. Still, the goal is something many of us would welcome: fewer follow-up appointments when a crown is needed. The most important detail is that MIR remains a prototype. It has only been tested on models and dental-like materials so far. The team still plans to add sensors and a camera before real dental use. If MIR works, a future crown appointment could feel more like a guided digital procedure than the drawn-out process many of us know today.

Would you trust a tiny robot to drill your tooth if it meant fewer trips to the dentist? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Tesla helped save a driver; is your car ready?

Thu, 16 Jul 2026 13:00:53 -0400

A medical emergency behind the wheel is terrifying because every second suddenly feels bigger. You are trying to stay calm, stay safe and get help before things spiral.

That is why John Brandt's story is getting so much attention. His Tesla Model Y helped keep him moving during a heart attack, while his son used the Tesla app to reroute the car to a nearby emergency room.

The bigger takeaway isn’t that your car can replace 911. It cannot. The lesson is that connected-car settings, trusted app access and emergency contacts should be ready before you ever need them.

BEFORE YOU CONNECT ANOTHER SMART TV, TABLET OR PHONE, LOCK IT DOWN

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

Brandt said he was driving from Atlanta to Birmingham on I-20 around 4 a.m. when severe chest pain made it unsafe for him to keep driving on his own.

His Model Y had Full Self-Driving Supervised enabled, which helped keep the car on course while he called his son, Jack.

Jack then acted from his own phone. Because he was an authorized driver on his father's Tesla account, he could send a new destination to the vehicle through the Tesla app. He found Tanner Medical Center in Carrollton, Georgia and rerouted the car there.

He also called ahead, so emergency room staff knew a possible heart attack patient was coming. Brandt later said doctors found three blocked arteries and told him the fast reroute likely saved his life.

Brandt credited his family, the hospital team and Tesla's technology for helping him survive. His experience also shows why trusted access should be set up before a crisis starts.

This story hits home because it sounds like something that could happen to any of us. You may be driving to help a parent. You may be on a highway before sunrise. You may think you feel heartburn or stress until the pain gets worse.

Most of us think about car safety in terms of brakes, airbags and tires. However, this story shows that app access, navigation settings and trusted contacts can also play a role in a crisis. That does not mean your car becomes a paramedic. It means your connected vehicle can give your family more ways to help if something goes wrong.

Brandt's experience raises a question every driver should consider: If you suddenly could not manage the trip alone, would someone you trust know how to step in and help?

If you own a Tesla, start with trusted driver access. Add someone you trust completely, such as a spouse, adult child or close family member. Tesla lets owners add drivers through the Tesla app. Once added, that person may be able to access key vehicle features from a phone.

Choose carefully. A trusted driver may be able to see your vehicle location and use important app controls. That access can help in an emergency, but it also deserves serious thought.

TESLA ROBOTAXI MIAMI LAUNCH COMES WITH LIMITS

Next, show that person how to send a destination to your Tesla. Do not make this something they figure out during a crisis. Sit in the parked car and test it together.

Have them send a familiar destination to the vehicle. Make sure you both understand what appears on the screen. Then talk through what they should do if you ever call and say something is wrong.

Also save useful locations in your navigation system. Add home, work and hospitals you would likely use. If you often drive between two cities, look at hospitals along that route before you need them.

Tesla calls the system Full Self-Driving Supervised for a reason. The driver still needs to pay attention and stay ready to take over at any time. Brandt's experience shows how the technology and app connectivity helped during one frightening emergency. But a Tesla cannot replace 911, an ambulance or a trained medical team.

If you feel chest pain, shortness of breath, nausea, lightheadedness or pain in your arm, back or jaw, treat it as an emergency. Pull over safely if you can. Call 911 immediately. Emergency responders can start care on the way to the hospital and alert the ER before you arrive.

Your car may help your family find you or send a destination. Still, it should never delay a medical call.

You do not need a Tesla to learn from this story. Many newer vehicles have connected apps, navigation tools, roadside assistance buttons or emergency calling features. First, remember this: Your car should never replace 911. If you are having a medical emergency, pull over safely if you can and call for help immediately. These steps are about giving your family extra ways to help, not replacing emergency responders.

Open your automaker's app and review what it can do. Look for vehicle location, shared driver access, remote lock controls, roadside assistance and navigation features. Then make sure your trusted contact can use the app if your car allows it. If the app requires a login, two-factor code or owner approval, handle that now. Also, check app access after you get a new phone. Permissions can change when you upgrade. Also, because vehicle apps can show location and control certain car features, use a strong unique password, store it in a password manager and turn on two-factor authentication (2FA) if available. Only give app access to someone you fully trust.

Make sure your vehicle app can use location services when needed. Also allow important notifications from the app so you do not miss alerts about your car. Ask your trusted contact to check the same settings on their phone. If they cannot see your vehicle, receive alerts or open the app quickly, they may not be able to help during a crisis.

Some vehicles let you send a destination from your phone to the dashboard. Others do not. Find out now. Sit in your parked car and send a destination from your phone. Then ask your trusted contact to try it if they have authorized access. This quick test can prevent confusion later. It also shows you what your car will display when a new destination arrives.

Many vehicles have an SOS button, emergency assistance button or roadside help button. Do not assume they all work the same way. Check your owner's manual or automaker app. Find out whether the button calls 911, a private call center or roadside assistance. Also, learn whether the system shares your vehicle location. That detail can be critical if you cannot explain where you are.

Your phone may help even more than your car. Add emergency contacts, fill out your Medical ID or emergency information and make sure your family can reach you even when Do Not Disturb is on. Apple says iPhone emergency contacts can receive a text and your location after an emergency call, while Samsung lets Galaxy owners add emergency contacts, medical info and SOS sharing from Safety and emergency settings.

On iPhone

To make sure key people can reach you, go to Settings → Focus → Do Not Disturb → People and allow calls or notifications from your trusted contacts. You can also open a contact, tap Edit, choose Ringtone or Text Tone and turn on Emergency Bypass. Emergency Bypass can allow that person's calls or texts to come through even when Focus settings would normally silence them.

On Samsung Galaxy

Settings may vary depending on your Android's manufacturer

On Galaxy phones, also check Settings → Safety and emergency → Emergency Location Service and turn it on if available. This can help share your location with emergency responders in supported regions.

To let important calls through Do Not Disturb, go to Settings → Notifications → Do not disturb → Calls and messages or Allowed during Do not disturb, then allow favorite contacts or selected contacts. Favorite contacts can be allowed through while Do Not Disturb is on.

Technology can fail. Phones lose battery. Apps can lock you out. Keep a small emergency card in your wallet or glove box. Include emergency contacts, allergies, medications and your preferred hospital. If you have a heart condition or another medical concern, ask your doctor what details should be listed.

Trusted access should not be set once and forgotten. Remove anyone who no longer needs access to your vehicle app. Add someone new if your family situation changes. Also, update emergency contacts after a move, phone change or major health update.

John Brandt's story is scary because it could happen to anyone. His Tesla helped, but the real lesson is preparation. If your car has an app, know what it can do before an emergency. Add a trusted family member, test the navigation tools and make sure your phone's emergency features are filled out. A car should never replace calling 911. However, the right setup can give your family one more way to help when every second counts.

If your car were involved in an emergency, would your family know what to do? Let us know by writing to us at CyberGuy.com.

Apple AirDrop, Android Quick Share flaws put phones at risk

Thu, 16 Jul 2026 06:00:09 -0400

Apple AirDrop and Android Quick Share are the kind of phone features you probably use without thinking much about them. You want to send a photo across the room. You want to move a file from your phone to your laptop. So you tap share, pick a nearby device and move on.

Now, new security research shows those handy nearby-sharing tools can also create a wireless opening around your phone.

Researchers at the CISPA Helmholtz Center for Information Security examined Apple AirDrop and Android Quick Share. They found six vulnerabilities across Apple, Samsung and Google implementations. The flaws include AirDrop crash bugs, Samsung Quick Share protocol issues and a Google Quick Share for Windows bug that could potentially lead to remote code execution.

BEFORE YOU CONNECT ANOTHER SMART TV, TABLET OR PHONE, LOCK IT DOWN

That can affect you in a very everyday way. Your phone may be sitting in your pocket at an airport gate, in a coffee shop or inside a packed conference room while it listens for nearby sharing requests. If a bad actor gets close enough, they could try to take advantage of that open wireless doorway before you even realize anything happened. So, before you leave AirDrop or Quick Share open again, here is what the research found and the settings worth checking now.

Free live CyberGuy class: Sick of Spam? Join us July 22.

Reserve your free spot today at CyberGuyLive.com.

The researchers call this a proximity problem. AirDrop and Quick Share are built to find nearby devices without the usual setup of pairing first. That convenience is the whole point. It also means the sharing software has to listen before it fully trusts the other device.

According to the research, the affected protocols are used by more than five billion devices. Apple reports more than 2.2 billion active devices running the sharing service tied to AirDrop. Google reports more than 3 billion Android devices with Quick Share available system-wide or used as a default sharing tool on many phones.

The study found three AirDrop issues that could be triggered before authentication. It also found two Samsung Quick Share protocol flaws. In addition, researchers found one Google Quick Share for Windows use-after-free bug. Apple, Samsung and Google acknowledged the reports, according to the researchers.

Most phone attacks we talk about involve bad links, fake login pages or shady apps. This research points to a different kind of risk because it starts with physical proximity. A nearby attacker may not need your password. They may not need you to open a website either. In some cases, the target device only needs to be discoverable or in a sharing mode that listens for nearby devices.

That does not mean someone can grab every photo on your phone by standing next to you. The known flaws are narrower than that. Still, the research shows that file-sharing features sit closer to sensitive parts of the system than many of us realize. AirDrop interacts with Apple's sharing service, which supports features beyond file transfers. Quick Share also moves through low-level networking and device-to-device connection steps. That is why bugs in this area deserve your attention.

The most immediate risk is disruption. Researchers found AirDrop bugs that could crash Apple’s sharing service. That service supports AirDrop and other continuity features.

On Samsung Quick Share, researchers found protocol weaknesses that could let an attacker manipulate connection behavior before full authentication. Another issue could allow certain control messages to be injected during an active transfer.

The Google Quick Share for Windows bug is more serious on paper. Researchers described it as a heap use-after-free issue and said Google awarded a bug bounty for it. The paper says this type of bug could potentially be developed into a full remote code-execution exploit.

Google told CyberGuy it has addressed the Windows issue. "We've patched the flaw identified for Quick Share for Windows. As a best security practice, users should always ensure they apply the latest security updates available for their device," a Google spokesperson said.

For most phone owners, the daily takeaway is clear. Nearby sharing is useful, but you should avoid leaving your device open to everyone when you do not need it.

You should be extra careful with AirDrop or Quick Share when you are around a lot of strangers. That includes airports, trains, hotels and large events. These are places where a nearby attacker could sit close enough to reach many devices at once.

The risk goes up when your phone is set to receive from everyone. On iPhone, Apple says the "Everyone for 10 Minutes" setting reverts after 10 minutes if you are signed in to your Apple Account. If you are not signed in, it reverts to Receiving Off. That time limit helps. Even so, you should treat "Everyone" as a temporary setting. Turn it on only when you need it.

The good news is that a few quick settings checks can make your phone much harder for nearby strangers to reach. You can also review these iPhone and Android security settings for more ways to lock down your device.

Start with regular software updates. The researchers responsibly disclosed the findings, and fixes are underway across vendors. Install iOS, iPadOS, macOS, Android, Samsung updates, Google Play system updates and Quick Share for Windows updates as soon as they become available. Also check the apps or utilities tied to sharing on your computer. Quick Share for Windows was part of this research, so remember the PC side if you use Android-to-Windows transfers.

On iPhone, keep AirDrop limited unless you are actively using it. The safest everyday choice is Receiving Off or Contacts Only.

On a Samsung phone, Quick Share controls who can see your device and send you files nearby. The safest everyday choice is No one or Contacts only.

GOOGLE TURNS OLD PHONES INTO CLOUD SERVERS

A file request from a stranger should be a red flag. Even if the file name looks harmless, decline it. Attackers often rely on curiosity. They may use a funny photo name or something that looks like it came from a nearby event. If you did not ask for the file, decline the request.

If you are traveling or sitting in a packed public place, turn receiving off. This is especially helpful at airports, train stations and large events. You can still turn AirDrop or Quick Share back on when you actually need it. That small habit gives you more control over when your phone is visible.

If you use AirDrop or Quick Share to send personal files, slow down before you tap send. Check the recipient name carefully. When possible, confirm the device in person before sharing. Be extra careful with photos, tax documents, travel confirmations, medical forms, school paperwork or anything that includes your address, phone number or financial details. Avoid sending private files to devices with generic names like "iPhone," "Galaxy" or "Laptop." For sensitive documents, use a trusted cloud storage or file-sharing service where you can confirm the recipient, manage access and add password protection when available.

Nearby sharing often relies on Bluetooth and Wi-Fi to discover and transfer between devices. You do not need to turn both off all day. However, it is smart to disable sharing features when you are done. Also, skip random public Wi-Fi networks just because they look familiar. Your phone can do a lot in the background. Give it fewer chances to talk to strangers.

Strong antivirus software can help detect malicious files if you accidentally accept something you should not have. This is especially important on computers, since Quick Share for Windows was part of the research. Keep your security software updated and scan any file that looks suspicious before opening it. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

AirDrop and Quick Share are useful, and most of us will keep using them. I know I will. But this research is a good reminder that nearby sharing should not stay wide open by default. The issue comes down to convenience. Phone makers made file sharing feel effortless. That is great when you are sending vacation photos to family or moving a file to your laptop. It feels different when the same feature is listening in a packed airport, coffee shop or hotel lobby. What stands out to me is the range. A bad actor may only need to be close by. So, my advice is straightforward. Update your devices. Keep AirDrop and Quick Share limited to people you trust. Turn off receiving when you are in a crowd. And never accept a file request you were not expecting.

Should phones make nearby sharing harder to leave open in public places? Let us know by writing to us at CyberGuy.com.

Insurance breach exposes 7M driver's licenses

Wed, 15 Jul 2026 12:00:25 -0400

AssuranceAmerica, an auto insurance provider that works through a network of independent agents, has disclosed a data breach affecting nearly 7 million people. The exposed information includes driver's license numbers and other personal details tied to auto insurance customers.

The company said it detected suspicious activity on March 17, 2026, after malicious activity targeted one of its employees one day earlier. Investigators later found that an unauthorized third party accessed parts of AssuranceAmerica's IT environment and copied certain data files.

According to an Indiana Attorney General breach listing, the incident affected 6,998,886 people. A California Attorney General notice also says AssuranceAmerica began notifying affected individuals after completing its file review on June 15, 2026.

AssuranceAmerica sells auto, renters and commercial auto insurance through independent agents. So, even if the company name does not sound familiar, your information could still be involved if your policy, quote, claim or driver details passed through its systems.

ADT DATA BREACH EXPOSES CUSTOMER INFORMATION

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us Wednesday, July 22, at 1 p.m. ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

AssuranceAmerica said the breach started with malicious activity that targeted one employee. The company did not explain exactly how the employee was targeted. However, it said it later disabled compromised credentials and unauthorized sessions.

That detail should get your attention. Many breaches start with one stolen login, one convincing message or one infected device. Once attackers get inside, they can move quickly and look for files worth stealing.

In this case, AssuranceAmerica said an unauthorized third party copied certain data files from its IT environment. The company then reviewed those files to identify affected individuals.

AssuranceAmerica said the stolen files contained names plus one or more other types of personal information. That information may include contact details, auto insurance policy or account information, driver or vehicle information, claims-related information and driver's license numbers. The California notice also says some files may have included Tax ID information and/or Social Security numbers.

That mix can create real risk. A scammer with your name, license number and insurance details may sound much more convincing. They could pretend to be from your insurer, a repair shop, a claims department or a state agency. This follows other identity-document breaches, including the Texas data breach that hit 3 million license customers. Once driver's license numbers leak, the risk can last much longer than a stolen credit card number.

AssuranceAmerica said it took affected server devices offline and hired external forensic specialists to investigate. The company also said it reset passwords, deployed enhanced monitoring and threat detection tools and gave employees more cybersecurity instruction. It also notified law enforcement.

AssuranceAmerica is offering 12 months of complimentary credit monitoring for affected individuals. That can help spot some suspicious activity. However, you still need to watch your insurance account, financial accounts and mail.

A driver's license number can help an imposter build a more believable scam. Insurance information can make that scam feel personal.

For example, a caller may mention your policy, your vehicle or a claim. Then they may ask you to "verify" more information. That is where the damage can grow.

Also, stolen breach data can be matched with public records and data broker profiles. That can give criminals a fuller picture of your life. We have seen the same pattern in scams tied to travel accounts, phone accounts and other breaches, including the Booking.com breach that exposed traveler data to scams.

BEFORE YOU CONNECT ANOTHER SMART TV, TABLET OR PHONE, LOCK IT DOWN

If you receive a notice or think your information may be involved, take these steps now to make the stolen data harder to use.

If you receive a notice from AssuranceAmerica, read it carefully. Check what information the company says may have been exposed in your case. Do not assume every affected person had the same data stolen. Some people may have had driver's license numbers exposed. Others may also have had Tax ID information or Social Security numbers involved.

AssuranceAmerica says it is offering 12 months of complimentary credit monitoring. Use the instructions in the official notice. Be careful with emails or texts that claim to offer enrollment links. Scammers often copy real breach language to trick you.

A credit freeze makes it harder for someone to open a new account in your name. You need to place a freeze separately with Equifax, Experian and TransUnion. It is free, and you can lift it when you need to apply for credit.

A fraud alert tells lenders to take extra steps before opening credit in your name. You can place a fraud alert with one credit bureau, and that bureau should notify the others. This adds another layer of protection if your personal information was exposed.

Log in to your insurance account and check for changes you do not recognize. Look for unfamiliar claims, new contact details or strange policy updates. If something looks wrong, call the company using a number from your policy documents.

Credential theft often starts with malware, a bad link or a fake download. Strong antivirus software can help block malicious files and phishing links before they cause damage. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

CARNIVAL BREACH MAY PUT YOUR TRAVEL DATA AT RISK

Breached data becomes more useful when scammers can match it with your address, relatives, phone number or public records. A data removal service can help reduce what data brokers display about you. That will not undo a breach, but it can make you a harder target. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

If someone calls about your policy, claim or payment, slow down. Do not share verification codes. Do not confirm sensitive details during an unexpected call. Instead, hang up and call the company back through an official number.

If your driver's license number was exposed, review your state DMV's fraud guidance. Some states may offer replacement options or identity theft guidance. The rules vary, so check directly with your state agency.

Create strong, unique passwords for your insurance account, email and financial apps. A password manager can also help you spot fake login pages. If it will not autofill, you may be on a scam site. Check out the best expert-reviewed password managers of 2026 at CyberGuy.com.

Turn on two-factor authentication (2FA) for your insurance account, email and financial accounts when available. Use an authenticator app when you can. Text codes are better than nothing, but scammers often target them.

The AssuranceAmerica data breach is a reminder that your driver's license number has become a high-value target. You may not be able to control how every company stores your information. However, you can make stolen data harder to use. Start with your credit. Then check your insurance account and watch for imposters who know just enough to sound convincing. Also, clean up the personal data already floating around online. The bigger issue is trust. Companies ask for sensitive information because they need it to do business. When that information leaks, you are the one left checking statements, freezing credit and worrying about what comes next.

What should a company owe you when it loses the ID number you use to prove who you are? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

You paid for it. So why is your device showing ads?

Wed, 15 Jul 2026 06:02:00 -0400

You paid for the product. So why does it feel like the company still controls the screen? That is the question more of us are starting to ask as smart devices get updated long after we bring them home. A refrigerator can show ads in your kitchen. A car can flash offers on the dashboard. Even a Windows 11 computer can surface promotions before you get to work.

The frustrating part is that this often happens through software updates. You tap update because you want your device to stay secure and work properly. Then one day, the product you bought starts acting like a billboard. This is also why it pays to understand the hidden privacy clauses and settings that come with smart products before those screens start doing things you never expected.

GOOGLE TURNS OLD PHONES INTO CLOUD SERVERS

Free live CyberGuy class: Sick of Spam? Join us July 22.

Join us Wednesday, July 22, at 1 p.m. ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

Samsung Family Hub refrigerators are sold as connected kitchen hubs. You can use the screen for weather, calendars, grocery lists and other household features. But as we discussed on The CyberGuy Report podcast at CyberGuy.com, that same screen can also become a place for ads after a software update. Samsung began showing ads on some Family Hub refrigerator Cover Screens in the U.S. We reached out to Samsung about this, and a spokesperson provided us with this statement:

"Last year, Samsung piloted a new Cover Screen widget on Family Hub refrigerators in the U.S. The widget rotates through useful information like weather, news, calendar events, and curated ads. After the pilot concluded in March, the widget was launched fully with the same user experience.

Users can turn off the Cover Screen widget, including ads, in the Advertisements tab of the Settings menu (Settings > Advertisements > Cover screen Ads) without impacting any other features or functions. Ads can also be dismissed on the Cover Screens where shown, meaning that the dismissed ad will not appear again during that specific ad's campaign period. Since the start of the pilot program last October, our review has indicated consumers are finding value in this new widget. The percentage of users who have turned off the feature is in the low single-digits.

A Cover Screen appears when the Family Hub screen is idle, and the widget only appears on the Weather, Color, and Daily Board themes. The widget does not appear on the Cover Screen's Art or Album themes."

That answer is important because Samsung says you can turn the Cover Screen ads off without losing other features. Still, the larger point remains. You bought a refrigerator, then a later update added an ad experience to the screen in your kitchen.

On the Family Hub screen:

You can also change the Cover Screen theme. Samsung says the widget does not appear on Art or Album themes.

Now move from the kitchen to the driveway. Some Jeep, Ram and Chrysler drivers previously saw promotional messages on their infotainment screens through Stellantis' Uconnect system.

Stellantis, the automaker behind Jeep, Ram, Chrysler and Dodge, says its In-Vehicle Message technology, or IVM, is designed to help the company stay in contact with owners at important points during ownership. The company says it uses IVM for important messages, such as vehicle recalls and vehicle health monitor alerts. Stellantis also confirmed that the earlier pop-up promotions were part of its in-vehicle messaging or Uconnect communication system. However, the company says it has not run the promotional in-vehicle messages referenced in those reports since mid-fall 2025 and has nothing planned for future in-vehicle promotional messages.

At the time those promotional messages were active, Stellantis says owners could opt out by calling customer service or by updating their profile or Message Settings on their vehicle brand's website account, such as a Ram owner account. That update is important. There are no current promotional in-vehicle messages to opt out of, according to Stellantis. Still, the larger concern remains: modern vehicles are software-driven, and the screen in the middle of your dashboard can be changed long after you drive off the lot.

10 SMALL HOME UPGRADES THAT CAN LOWER YOUR MONTHLY BILLS

A car screen is different from a phone app or website. You use that display for directions, music, climate controls and vehicle settings. So when a promotional message appears there, it can feel more personal than an ad on a webpage.

To be fair, in-vehicle messaging can serve an important purpose. Recall notices and vehicle health alerts can help owners respond to safety or maintenance issues faster.

However, promotional messages hit differently. You are sitting in a car you paid tens of thousands of dollars for. That screen should help you drive, maintain your vehicle and get where you are going without feeling like another place for a sales pitch.

Then there is your computer. Windows 11 can show promotional content in places that feel like part of the operating system. That includes the lock screen, the Start menu and account-related notifications.

The lock screen can use Windows Spotlight, which displays rotating images along with tips, tricks and notifications. Start menu settings also include areas where Microsoft can show recommendations and account prompts.

Some of these messages may look like helpful notices. Others can feel like upsells. The most annoying ones are the alerts that look urgent, then steer you toward a Microsoft service such as OneDrive backup. Microsoft declined to comment for this story.

You can cut down on much of this in Settings.

FIVE DATA BROKER OPT-OUT MYTHS THAT LEAVE RETIREES EXPOSED

Microsoft may change wording over time, so look for anything tied to recommendations, tips, suggestions, offers or account notifications. For more Windows settings help, see these Windows 11 tips.

The real problem isn’t one ad on one screen. It is the fact that software gives companies a way to change products after you buy them. A refrigerator used to stay a refrigerator. A car dashboard used to do what it did on the day you drove off the lot. A computer operating system used to feel like the tool you used to get things done.

Now those screens can change later. A company can add a widget, promote a service or push an offer through an update. That does not mean every update is bad. Security fixes are essential. Bug fixes help. New features can be useful. However, ads feel different when they arrive after you already paid for the product. That is why you should keep your devices updated, but also check what changed after the update installs.

Before you buy a smart appliance, connected car or computer, think beyond the hardware. Ask what kind of software controls the screen. Check whether ads, recommendations or promotional content can be turned off.

After setup, go through the settings before you assume the default experience is the only option. Look for menus labeled ads, recommendations, notifications, tips, offers or personalization. If you are setting up a new device, this new electronics setup guide is a good place to start.

Also, pay attention after updates. If a new widget or pop-up appears, do not assume you have to live with it. There may be a buried toggle that turns it off. Most of all, remember that a screen in your home, car or office has value. Companies know that. You should know it too.

This is exactly why we covered this on The CyberGuy Report podcast at CyberGuy.com. It hits a nerve because you already paid for these products, yet companies can still use software updates to claim space on the screens you see every day. Samsung says Family Hub Cover Screen ads can be turned off. Stellantis says its vehicle promotions stopped in the fall of 2025. Windows 11 gives you some settings that reduce tips, suggestions and account prompts. Still, the pattern is hard to ignore. Companies are learning how to keep making money from a product after the sale. That may be great for them, but it can feel pretty lousy when the screen is inside your kitchen, your car or your computer. When you pay thousands of dollars for a product, that screen should work for you instead of becoming another place for a company to sell to you.

Which screen ad would bother you most: one on your refrigerator, one on your computer or one in your car? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Humanoid robots perform live surgery in world first

Tue, 14 Jul 2026 11:42:25 -0400

Humanoid robots have officially stepped up to the operating table, helping complete two surgeries for the first time. During the preclinical trial, surgeons remotely guided the machines through two gallbladder removal procedures. The robots copied the surgeons' movements rather than making medical decisions, and no human patients were involved.

Unlike bulky robotic systems fixed in place, these five-foot machines used standard surgical tools and worked inside an operating room built for people. The experiment offers an early look at how a specialist could someday operate through a mobile robot in a rural clinic or another place where surgical care is hard to reach. Here is what the team accomplished and what still needs to happen before this technology reaches human patients.

AI MAY SPOT DEADLY HEART RISK IN A ROUTINE ECG

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

Researchers from the University of California San Diego reported the results in the journal Nature earlier this month. The team tested its system during two laparoscopic gallbladder removal procedures on pigs.

During one operation, a humanoid robot handled surgical instruments while a human surgeon assisted beside it. During the second procedure, two humanoid robots stood next to each other and worked as a team. Surgeons remotely controlled both robots throughout the operation. The experiment involved delicate tasks used during minimally invasive gallbladder surgery. The robots moved tissue and dissected around the gallbladder. They also helped place clips before removing it.

Researchers designed the trial as a proof of concept. They wanted to learn whether a general-purpose humanoid robot could handle standard surgical tools with enough control to complete an operation. It could. However, the trial also exposed problems that researchers must solve before testing the system on humans.

The trial marked the first time teleoperated humanoid robots successfully completed live gallbladder surgeries. Robotic gallbladder procedures have been performed before, but this experiment was the first to use general-purpose humanoid machines. The work builds on UC San Diego's earlier research with the same type of robot. CyberGuy previously covered how a remotely controlled humanoid performed seven medical procedures, including physical exams and ultrasound-guided injections.

The researchers created Surgie by modifying commercially available Unitree G1 humanoid robots. Each machine stands about 5 feet tall and weighs around 60 pounds. That makes Surgie dramatically smaller than many existing robotic surgery systems, which can weigh approximately 1,800 pounds.

Large surgical robots may require extensive setup and take up considerable space. Hospitals sometimes need to retrofit an operating room before installing one. Surgie can stand in a room designed for human medical workers. Researchers added adapters to its hands so the robot could grip standard laparoscopic instruments.

A surgeon then controlled the robot from a remote console. When the surgeon moved the controls, Surgie copied those movements at the operating table. That human-like design is important. A hospital may be able to bring the robot into an existing room instead of rebuilding the space around it. A medical team could also move it between rooms or transport it to a smaller facility. "We were surprised at how well Surgie meshed with our workspace and workflow," said Nikita Thareja, MD, a general surgery resident at UC San Diego School of Medicine and a co-author of the study.

Unitree currently lists the base G1 at $13,500 before taxes and shipping. However, that price does not include the surgical adapters, instruments or remote-control equipment used in the study. The price still points to a potentially significant difference between a general-purpose humanoid and today's specialized surgical systems. Da Vinci surgical robots can cost from about $700,000 to more than $3 million, depending on the model and configuration. Researchers have not disclosed the total cost of the complete Surgie setup.

CHINA’S ROBOT-RUN HOTEL OPENS TO PUBLIC IN 2027

Modern robotic surgery systems already help doctors perform highly precise procedures. However, those machines usually stay in one location and depend on specialized equipment. A humanoid robot offers more flexibility because it can operate in spaces built for medical workers. It can also hold tools designed for human hands.

Researchers believe future versions could retrieve an instrument during surgery. The robot might also help prepare or clean the room after a procedure. Most importantly, a mobile system could potentially bring a specialist's skills to an area where surgeons are difficult to find.

Michael Yip, a professor in UC San Diego's Department of Electrical and Computer Engineering, said remotely operated humanoids could expand access to critical procedures. Researchers envision sending the robots to communities with limited medical staffing or temporary field hospitals.

The goal isn’t to hand medical decisions to a machine. A trained surgeon would remain in control while the robot carried out those movements at the patient's location. That could give a trauma team on a battlefield access to a specialist located far away. The same approach could help a patient in a remote town avoid a long trip to a major medical center. Researchers have even discussed using the technology during future space missions.

That idea is already moving beyond the laboratory with traditional surgical robots. In March, we reported on a London surgeon who remotely removed a patient's prostate cancer from 1,500 miles away. The difference is that the London procedure used a specialized surgical platform. Surgie could eventually offer a smaller system that works inside a standard operating room.

The successful procedures do not mean hospitals are ready to start using humanoid robots on patients. Researchers had to recalibrate the robots several times during surgery. The operations also took much longer than procedures performed with established surgical systems.

Latency presents another concern. Latency is the delay between a surgeon moving a controller and the robot responding. A slight lag may feel annoying during a video call. During surgery, even a small delay could affect precision. That challenge becomes more serious when the surgeon and robot are separated by a long distance.

Researchers will need to improve the robot's reliability and response time. They must also prove that the system can repeat its performance safely across many procedures. Hospitals would need a backup plan as well. A qualified surgical team would have to remain ready to step in if the robot stopped responding or the remote connection failed.

For now, human surgeons control Surgie's movements. The UC San Diego researchers eventually want to develop what they call an autonomous surgical assistant. That type of robot could recognize which tool a surgeon needs or complete a limited task under supervision.

Researchers elsewhere are already testing a different approach to autonomous surgery. CyberGuy previously covered an AI-powered robot that independently completed a key phase of gallbladder removal on a lifelike surgical model. However, operating on a living patient presents a much greater challenge. Bleeding can begin without warning. A patient's condition can also change in seconds.

A robot would need to recognize the problem and respond safely. Medical workers must also be able to take control immediately. Autonomous surgery raises difficult questions about responsibility. Hospitals would need clear rules covering who makes each decision and who is accountable when something goes wrong. Remote operation introduces another concern. Hospitals would have to protect the robot's software and communications from unauthorized access. At the same time, the system would need to continue operating safely during a connection problem.

WOULD YOU PAY $8,000 FOR A ROBOT TO FOLD LAUNDRY?

You will not see a humanoid robot independently performing your next surgery. This research remains at the preclinical stage, and the team tested the system on pigs rather than humans. Still, the experiment offers an early look at where robot-assisted medicine may be headed.

A mobile surgical robot could eventually give you access to a specialist without requiring a long trip. It may also help a smaller hospital offer procedures that currently require transferring patients elsewhere. However, access should never come at the expense of safety. Before agreeing to a robot-assisted procedure, you should know who controls the machine. You should also ask what happens if the connection fails and whether a qualified surgical team will remain in the room. The robot may hold the instrument, but human judgment remains the most important part of the operation.

Watching two humanoid robots work over an operating table may make you uncomfortable. Still, the technology could address a serious healthcare problem if researchers can make it reliable and safe. Many communities struggle to attract enough surgeons. A compact robot that works with standard instruments could let a distant specialist enter the operating room without physically traveling there. The comparatively low starting price of the base robot could also make this approach easier to deploy than some specialized surgical systems. This experiment remains an early milestone. The robots needed recalibration, and the operations took longer than usual. Communication delays also remain a concern. The researchers now need to prove that Surgie can perform consistently before anyone considers human trials. Hospitals will also need strict safety protections and trained medical workers ready to take over.

Would you let a surgeon operate through a humanoid robot if it cut months off your wait for care? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Before you connect another smart TV, tablet or phone, lock it down

Tue, 14 Jul 2026 07:49:41 -0400

If your home Wi-Fi is like most, it is packed with connected devices. Smart TVs, phones, tablets, laptops, refrigerators, robot vacuums and security cameras may all be sharing the same network.

The problem is that most people connect a new device first and think about security later. Some never check the settings at all. That gives hackers, data brokers and nosy companies exactly the opening they want.

Before you connect your next smart TV, tablet or phone, take a few minutes to lock it down.

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

FIVE DATA BROKER OPT-OUT MYTHS THAT LEAVE RETIREES EXPOSED

When a new gadget arrives in your hands, it isn't a blank slate. It comes loaded with factory settings designed for convenience instead of protection. Manufacturers want the unboxing experience to feel effortless, so they turn on features, like automatic connections, data sharing and remote access, that make setup easy but leave you exposed.

Smart TVs are some of the worst offenders. Many come with a feature called Automatic Content Recognition (ACR), switched on by default. It works like a fingerprint scanner for your screen, capturing information about everything you watch and sending it back to the manufacturer. You agreed to it somewhere in the terms and conditions you blitzed through when you set it up. Most people have no idea it's even there.

Tablets and phones bring their own risks. Although many hardware manufacturers like to brag about privacy, lots of tablets and phones will share your location, accept connections from nearby devices, and back up your data to the company's servers - all by default.

Plus, your home network is only as secure as its weakest device. One poorly configured smart TV or old tablet with an out-of-date OS can give attackers a foothold into everything else connected to the same router.

Before you connect any new smart TV, tablet or phone to your home network, take five minutes to check the settings manually. You do not need to be a tech expert. Focus on the areas that create the biggest openings.

First, update the device and change any default passwords or PINs. A brand-new device may have been sitting in a warehouse for months, which means it could already need a security update. Default credentials are also easy for attackers to find online.

Next, review privacy settings. On a smart TV, look for Automatic Content Recognition, or ACR, and turn it off. Depending on the brand, it may be listed under Viewing Data, Live Plus, SyncPlus, Smart TV Experience or privacy settings. On a phone or tablet, check location, camera, microphone and nearby device permissions.

Then, turn off connectivity features you do not use. Bluetooth, remote access, file sharing and screen mirroring can all create openings when they stay on all the time.

Finally, consider adding a VPN for another layer of privacy. A VPN encrypts your internet traffic, which helps protect what your smart TV, phone, tablet or laptop sends over the network. A trusted VPN has apps for many popular devices, and it can also run at the router level on compatible routers.

For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at CyberGuy.com.

The full checklist below walks you through each step.

New device security checklist

Next time you bring home a smart TV, tablet or phone, do this before you use it every day.

YOU COULD GET PAID FROM GOOGLE’S ANDROID DATA LAWSUIT

Before you connect the device, open your router app or router settings page. Look for Guest Network, IoT Network or Device Isolation. Create a separate Wi-Fi name for TVs, speakers, cameras and smart home gear.

Use WPA3 Personal if your router offers it. If not, use WPA2 Personal. Give this network a strong password you do not use anywhere else. Then connect the new smart TV or tablet to that network instead of the same Wi-Fi your work laptop uses.

Install updates before you add streaming apps, email accounts or payment info.

Do not leave factory passwords in place. Change the device PIN, parental control PIN or purchase PIN if the setup screen offers one. Use a password manager to create and store strong, unique passwords. Use a long passcode on phones and tablets instead of a 4-digit code. Also, rename the device. A name like "Kurt's Bedroom TV" tells more than you need to share. Use something generic like "Living Room TV" or "Tablet 1."

Before you sign in to Apple, Google, Samsung, Amazon or Roku, turn on two-factor authentication where available. For Roku, set a PIN to help block unwanted purchases, subscriptions and app additions.

Smart TVs often include Automatic Content Recognition, or ACR. It can identify what appears on your screen for ads, analytics or recommendations. Turn it off during setup or immediately after setup.

GOOGLE TURNS OLD PHONES INTO CLOUD SERVERS

Phones and tablets often ask for more access than an app needs. Give each app the least access possible.

Turn off Bluetooth when you do not need it. On phones, tablets and TVs, also look for Nearby Share, Quick Share, AirDrop, file sharing, screen mirroring and remote access.

Set this up before the device goes missing.

For tablets used by kids or guests, write down the serial number. Keep it somewhere safe in case you need to report the device lost or stolen.

New devices often come with preinstalled apps. Delete or disable anything you will not use. Then install apps only from the official app store for that device.

On phones and tablets, avoid sideloading apps unless you know exactly where they came from.

On smart TVs, skip random free streaming apps with poor reviews, no clear developer or strange permission prompts.

A VPN adds a layer of privacy by encrypting your internet traffic before it leaves your device. That can help limit what your internet provider can see and add protection when you use public Wi-Fi.

Look for a trusted VPN that offers apps for phones, tablets, computers and streaming devices. Some VPNs can also run at the router level on compatible routers. That option can be helpful because it may protect devices that do not support a VPN app, such as some smart TVs, game consoles and connected home gadgets.

Once a router VPN is set up, connected devices can receive VPN protection automatically. Just remember that a VPN does not make you invisible online. Websites may still recognize you when you log in, share personal details or use the same browser. Still, for everyday privacy, a reliable VPN can be a smart extra layer.

For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at CyberGuy.com.

The default settings most devices ship with are designed for the manufacturer's benefit, not yours. Before you connect your next smart TV, tablet, or phone, take a few minutes to go through the settings, lock down what doesn't need to be open, and put a VPN between your network and the rest of the internet.

Have you ever found a privacy setting on a new device that surprised you? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Tesla Robotaxi Miami launch comes with limits

Mon, 13 Jul 2026 12:00:16 -0400

Tesla's robotaxi dream has rolled into Miami. That sounds like a big moment, especially if you have ever sat in South Florida traffic and wondered whether a car could do better without a tired human behind the wheel.

For now, though, the rollout looks careful and limited. Tesla says Robotaxi service is available in limited areas of Miami, Florida as well as Austin, Dallas and Houston, Texas. The Robotaxi app also shows a visual map of where rides are available based on your location.

That means Miami is now Tesla's newest robotaxi market, but this is not a citywide launch yet. It also puts Tesla in a busy autonomous ride-hailing market where Waymo and Amazon's Zoox are already trying to win over riders.

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

TERRIFIED PASSENGERS FILM WAYMO AUTONOMOUS VEHICLE DRIVING INTO LIVE FIREWORKS IN SAN FRANCISCO

The biggest thing to know is that Tesla Robotaxi does not cover all of Miami. Tesla's Miami geofence covers only a small slice of the metro area, mostly around West Miami and a strip toward Doral and Sweetwater. The early map leaves out downtown Miami, Miami Beach, Miami International Airport and most of Miami-Dade.

So, even though "Miami" is in the headline, your actual ride options depend on where you stand and where you want to go. If you are trying to get from Miami Beach to Brickell after dinner, Tesla Robotaxi may not help you yet. If you are inside the service zone, the app should show what is available before you book.

That limited map also tells you something about the challenge ahead. Miami is not an easy place to prove out robotaxis. Traffic moves fast, rain can hit hard and drivers do not always behave the way software might expect.

Tesla has been building toward this moment for years. CyberGuy previously covered how the Tesla Cybercab removes the steering wheel entirely, which shows how far Tesla wants to take autonomous transportation. For now, though, the Miami rollout still uses Model Y vehicles. That makes this launch another step in Tesla's longer robotaxi push.

Tesla's robotaxi rollout is still happening in careful stages. Austin came first, followed by Dallas and Houston. Miami now marks Tesla's first Robotaxi market outside Texas.

CyberGuy previously reported that Tesla cleared Nevada streets for robotaxi testing, which showed the company was preparing for more markets before opening the app to more riders. Tesla has also named other planned cities, including Orlando, Tampa and Phoenix.

ZOOX ROBOTAXI REDESIGN BRINGS BIG RIDER UPGRADES

Tesla is not entering an empty market. Waymo and Amazon's Zoox are also accelerating their autonomous vehicle efforts. CyberGuy recently covered how Waymo's cheaper robotaxi tech could help driverless rides reach more cities faster. Zoox is also a major name to watch in this race. CyberGuy reported that Amazon's Zoox updated its steering-wheel-free robotaxi with more rider comfort, larger cupholders and a calmer cabin design.

That competition puts pressure on Tesla. Tesla has the brand recognition and a massive base of vehicles on the road. Waymo has more experience with public driverless rides. Zoox is betting on a vehicle built from the ground up for autonomy. For you, that competition could lead to better service over time. More companies fighting for rides may mean wider coverage, better pickup spots and faster improvements.

The safety questions are not going away anytime soon. According to a recent review of federal crash data filed with NHTSA, Tesla's autonomous driving reports included 17 crash narratives tied to the Robotaxi program. That does not mean every reported crash points to a system failure. Still, riders should not ignore the data either.

Autonomous vehicles have to earn trust in everyday driving moments. A rough pickup, confusing stop or strange turn can make you nervous fast. CyberGuy has covered similar safety concerns across the robotaxi space, including a Waymo recall over construction-zone risk. That recall showed how work zones can challenge autonomous systems when signs, cones and lanes change quickly.

Tesla also faces broader scrutiny around Full Self-Driving behavior. CyberGuy previously reported on Tesla's Mad Max mode in Full Self-Driving, which brought fresh debate over speed, supervision and driver-assist safety.

To take a Tesla Robotaxi in Miami, you start in the Robotaxi app. Tesla says you need a mobile device to request a ride, and the ride can only be booked for you. Before you confirm, check the service area in the app. Do not assume Robotaxi covers the full city. A ride may work in one part of Miami and fail if your pickup or drop-off sits outside the current zone.

The app shows a price estimate before you confirm. During the ride, you can adjust things like climate, seat position and media through the app or the car's touchscreen.

Also, keep your phone charged. That phone becomes a key part of booking, managing and finishing the ride.

Finally, pay attention during the trip. You may not be driving, but you should still stay aware of where the car stops and how it handles the ride.

ZOOX ROBOTAXI REDESIGN BRINGS BIG RIDER UPGRADES

Tesla Robotaxi arriving in Miami is no doubt a big headline, but the fine print is important too. I would not treat this as a full Miami transportation option yet. The service area is limited, major destinations are missing and safety questions remain part of the story. That does not kill the excitement. It simply means Tesla still has to prove that Robotaxi can work beyond a small map. I like that Tesla is expanding beyond Texas. I can also see why people would want to try this. But for now, I would call this a significant step with a lot to prove.

Would you trust a Tesla Robotaxi to drive you through Miami traffic, or would you wait until the service has more miles under its belt? Let us know by writing to us at CyberGuy.com.

Why careful people still end up on data broker sites

Mon, 13 Jul 2026 06:56:25 -0400

Your data broker profile can expose more than most of us realize. It may include your current address, old addresses, relatives, phone numbers and public records that were never tied to a phishing link or hacked password. That is what makes this so frustrating. Strong passwords, two-factor authentication and smart online habits all help protect your accounts. However, they do not stop data brokers from collecting public records and commercial sign-up data.

Those details can then show up on people-search sites. Even worse, scammers can use them to make a fake call, text or email sound personal and believable. Here is where data broker profiles get their information, why careful online behavior alone falls short and what steps can help reduce what strangers can find about you.

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

FAKE VA SHOE OFFER TARGETS VETERANS

Most people assume data brokers get information the same way hackers do, through breaches, weak passwords or phishing links. That can happen. However, a lot of personal information comes from public records and commercial lists.

Data brokers can build profiles from records that may exist even when someone barely uses the internet, including:

In many U.S. states, these records are public under state or local rules. Data brokers do not need to hack anything to collect them. They can buy, scrape or license the information on an ongoing basis. A home purchase, marriage, divorce or voter registration can create a public record. That record may include a name and address. Once filed, it can become raw material for a data broker profile.

Government records are only one part of the problem. Everyday consumer activity can also feed data broker databases, including:

Commercial aggregators can combine those details with public records to build an enriched consumer profile. Registering the warranty on a dishwasher does not make anyone reckless. Entering a magazine sweepstakes does not make anyone careless. However, both can put personal information into a pipeline built to package and resell it.

This can sound abstract until a list gets used against real people.

Data broker InfoUSA reportedly sold a list of 19,000 verified elderly sweepstakes players to experienced scam artists. The scammers stole more than $100 million by calling people on the list and pretending to be government or insurance workers. Then they claimed they needed bank account information.

Another case shows the same risk on a larger scale. The Justice Department said Epsilon Data Management sold consumer data to fraud schemes and agreed to pay $150 million to resolve a criminal charge tied to elder fraud. DOJ later said two former Epsilon employees were sentenced after evidence showed they sold targeted lists to a fraudster client who used the data to defraud more than 218,000 victims out of more than $23.7 million.

That should stop you cold. The victims did ordinary things. Their names ended up in marketing databases and lead lists they may never have known existed. Then scammers used those lists to make fraud more targeted, more personal and much harder to spot.

Run a free scan to see where your information is showing up online-results usually land within an hour. Run your free exposure scan. Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

SELLING YOUR HOME THIS SUMMER? YOUR DATA IS ALREADY MOVING

This is the part that can catch a lot of you off guard, especially if you are already careful online. You may skip loyalty cards, avoid sweepstakes and toss warranty cards straight into the trash.

Even so, your information can still show up online because some details come from public records. Property records, vehicle registrations, voter rolls, professional licenses and court filings can all leave a trail with your name attached. In some cases, your profile may also connect you to relatives through someone else's record.

That means online safety only solves part of the problem. Strong passwords, a password manager and two-factor authentication (2FA) help protect your accounts. However, they do not remove public records that data brokers collect, package and resell.

A few smart moves can help reduce what is already exposed and limit how much new information flows into data broker databases.

Start by checking what is already public. Search your name on sites like Spokeo, Whitepages and BeenVerified. Look for your address, phone number, relatives and previous locations. This gives you a clearer sense of what scammers, strangers or aggressive marketers may already be able to find.

If a bank, email account or financial app asks for your mother's maiden name, birth city, first school or old street name, assume that answer may already appear in a data broker profile. Replace it with a made-up answer and store it in a password manager. The answer does not have to be true. It just has to be consistent and hard for someone else to guess.

Be more selective with loyalty programs, warranty cards, sweepstakes and online forms. Use only the required fields when possible. Consider using a separate or alias email address for sign-ups, and avoid handing over your phone number unless it is truly needed. Small choices like this can reduce the amount of new data flowing into broker databases.

Older relatives are often the final target, reached through a profile built from public records, family connections or past sign-ups. Set a family code word for emergency calls or texts. If someone claims there is an accident, arrest, hospital bill or urgent money problem, the code word gives your family a fast way to know whether the call is real.

A data removal service can help remove your personal information from data broker and people-search sites without forcing you to chase every listing yourself. These services contact data brokers on your behalf, request removal of your information and keep checking when your data reappears.

That ongoing follow-up is important because data broker profiles can come back when databases refresh or when your information gets pulled from another source. Look for a service that covers hundreds of data broker and people-search sites, offers recurring removals and lets you request cleanup from specific sites where your personal information appears.

I also recommend considering coverage for your whole household. Family members can be linked together in data broker profiles, so removing only one person’s information may leave other exposed details behind. A family plan can help protect addresses, relatives, phone numbers and other personal information across everyone in your home.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

FTC CHIEF ACCUSES DEMOCRATS OF 'TRYING TO PROTECT THE FRAUDSTERS' BY WITHHOLDING DATA FROM TRUMP ADMIN

What concerns me most about data broker profiles is how little of this comes from a mistake you made online. You can use strong passwords, avoid phishing emails and turn on two-factor authentication, yet your address, old addresses and family connections may still appear on people-search sites. That gives scammers a head start. A fake call or text sounds more believable when it includes real details about you or someone you love. The best move is to treat data broker cleanup as part of your regular privacy routine. Search your own name, change easy-to-guess security answers, limit what you share on forms and consider using a data removal service that keeps checking when your information comes back.

What personal detail would worry you most if it showed up on a people-search site: your address, phone number, relatives or something else? Let us know by writing to us at CyberGuy.com

Rescue robot of tomorrow may be a cockroach in scuba suit

Sun, 12 Jul 2026 11:20:43 -0400

A cockroach in a tiny scuba suit sounds like something you would run from, not something you would send into a disaster zone. Yet scientists say this strange little setup could one day help rescue teams search places people and larger robots cannot safely reach.

Researchers from NTU Singapore and Waseda University have developed a flexible diving suit for cyborg cockroaches. The suit lets the insects survive and move underwater, as well as through low-oxygen spaces, for up to three hours.

The study was published in Nature Communications. The goal is to expand how cyborg insects could help after floods, earthquakes or other disasters where rubble, drains and tight spaces can block access.

US MILITARY DEPLOYS MTVRS, AIRLIFTS AID TO VENEZUELA FOLLOWING DEADLY EARTHQUAKES

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

A cyborg cockroach is a living insect fitted with tiny electronics that can guide its movement. Unlike a small artificial robot, it uses its own muscles to walk. That means it needs far less battery power than a robot that depends on motors. However, cockroaches still need air. They breathe through small openings called spiracles. Once submerged, they cannot pull oxygen from water.

That is where the cyborg cockroach diving suit comes in. The suit has an oxygen-generation tank, a flexible waterproof shell and four silicone oxygen tubes. Together, those parts keep water out while sending oxygen directly to the cockroach's breathing openings.

The oxygen tank is 3D-printed from a clear plastic-like resin. Inside, researchers placed a sponge treated with manganese dioxide. They then added a small amount of diluted hydrogen peroxide. That chemical reaction slowly releases oxygen. From there, the oxygen travels through the suit and into tubes attached to the cockroach's spiracles. In other words, the insect gets its own tiny oxygen system. The researchers compare it to the tank used by human divers.

SPEND LESS TIME CLEANING YOUR POOL THIS SUMMER WITH BEATBOT ROBOT CLEANERS — UP TO 36% OFF

The team tested the suit on the Madagascar hissing cockroach. That species is often used in cyborg insect research because it is large, sturdy and wingless. The suit turns the cyborg insect from a land-based crawler into an amphibious rescue robot that can move across dry and wet terrain.

That could help in places where normal robots struggle. A disaster site may include collapsed concrete, standing water, blocked drains and narrow gaps. A small insect-guided system could move through those spaces while future versions carry sensors or cameras. The idea may make your skin crawl. Still, the engineering is impressive. Researchers are using the cockroach's natural movement and adding a way for it to keep breathing underwater.

With the diving suit, the cyborg cockroaches stayed active underwater for up to three hours. Without the suit, a control cockroach suffocated within about two minutes during testing. The researchers also tested the insects in plastic tunnels that simulated tough rescue conditions. One setup included a carbon dioxide-filled section followed by a water-filled section. The cyborg cockroaches wearing the suit made it through.

The team also tested narrow underwater gaps. With implanted electronics instead of a bulky backpack, the cyborg cockroach moved through a 2-centimeter-high crevice. That is the kind of space where many small robots could get stuck.

The biggest takeaway is that rescue robots may not always look like machines. In some cases, they may use a living insect's body and add technology around it. A cyborg cockroach can crawl through debris, squeeze into tight spaces and use very little power. Add underwater movement, and it becomes more useful in flooded disaster zones.

That could help after heavy rain, earthquakes or infrastructure failures. Future versions could inspect flooded pipes, drains, tunnels or damaged buildings. The researchers are still improving the system. They want to test it in more disaster-style environments, make the suit more durable and add sensors and navigation tools for field use.

You probably will not see cyborg cockroaches crawling around your neighborhood anytime soon. This is still research, not a rescue tool ready for everyday emergency crews.

However, it shows where search technology may be heading. Rescue teams need tools that can reach places humans cannot safely enter. If a small living insect can carry electronics, move through rubble and keep going underwater, it could become part of a larger rescue system.

That could eventually mean faster inspections after floods, better access inside damaged buildings and more options when every minute counts.

A cyborg cockroach in a diving suit sounds wild, but the reason behind it is serious. Disaster zones can be full of tight spaces, toxic air and standing water. Those conditions can stop people, drones and many small robots. This research gives scientists a new way to think about rescue technology. Instead of building every part from scratch, they are using the cockroach's natural movement and adding the missing piece: underwater breathing. To me, the big question is what happens when this kind of technology gets sensors, cameras and better navigation. That could turn a creepy little crawler into a tool that helps save lives.

Would you be comfortable with cyborg insects being used in search-and-rescue missions if they could help find people faster? Let us know by writing to us at Cyberguy.com

Google may use your photos and voice to train AI

Sun, 12 Jul 2026 08:24:37 -0400

There are few emails that make your stomach drop faster than one about "new privacy settings." That usually means a company has moved another data switch, renamed a control or tucked a new choice inside an account menu you rarely visit. Google is now rolling out one of those changes for Search services. The setting is called Search Services History. It controls whether Google saves your activity from Search services when you are signed into your Google Account.

That may sound routine at first. Most of us already know Google can save search history. However, this update goes beyond the old idea of typed searches in a box. Google says Search Services History can include images you upload, files you ask about, voice searches, Search Live recordings, Translate speaking practice audio and other interactions with Search services.

The part that should make you pause is the Save Media setting. When it is turned on, Google can save media from your Search services interactions. That saved media may be used to improve Google’s AI models and technologies. In other words, the random photo you searched with Google Lens or the voice recording you used in a Search feature may help improve Google’s AI.

GOOGLE TURNS OLD PHONES INTO CLOUD SERVERS

Free live CyberGuy class: Sick of Spam? Join us July 22

Reserve your free spot today at CyberGuyLive.com.

APPLE AI SECURITY UPDATE PROVES HACKERS MOVE FAST

Google says Search Services History may include your searches, results you view, AI Mode responses, voice search recordings, Search Live transcripts, Google Lens images, uploaded files and some information tied to your activity.

Maybe you used Google Lens to identify a plant. Perhaps you uploaded an image to search for a product. You might have used Translate to practice before a trip. Or maybe you asked a question by voice because your hands were full. All of that can feel harmless in the moment. Still, the bigger issue is where that data can go after it is saved.

Google says saved media may help you revisit past visual searches or continue a Search Live conversation. That can be useful. However, Google also says saved media may help develop and improve AI models and technologies. That is the trade-off. You may get more personalized features. Google may get more personal inputs from the tools you already use.

CHRIS HANSEN URGES PARENTS TO TEACH CHILDREN ABOUT ONLINE PREDATORS BEFORE ALLOWING INTERNET ACCESS

This is the kind of privacy change that can slide right past you. The language sounds helpful. The setting lives inside account controls. The rollout happens gradually, so you may not see it right away. That is exactly why you should check.

Google says the new settings are based on your prior choices for Web & App Activity and Search Personalization. If those were on, the new Search Services History setting may also be on. If your prior settings were off, the new one should be off too. That sounds fair enough, but it still puts the work on you.

Also, turning off Save Media does not automatically wipe everything that was already saved. Google says previously saved media may continue to be used to improve its technologies unless you delete it from your account. If saved media has already been selected to train AI models, Google says it is no longer connected to your account and may be kept for up to four years.

That is the part I would not ignore. Once your media moves into that AI-training pipeline, deleting the original activity may not pull it back.

You can check this from a phone or computer, but I recommend using a computer if you can. The account settings are easier to read.

Turning off Save Media stops Google from saving media from future Search services interactions as part of Search Services History. However, it does not shut down every kind of Search history. Text-based activity, transcripts and some AI responses may still be saved if Search Services History remains on.

Also, Google says media from your future interactions can still be used to respond to you and help keep services safe. The key difference is that future media should not be used to train Google’s generative AI models unless you provide feedback. That is a meaningful distinction, but it isn’t the same as using Google with no data collection at all.

You should also know that Save Media does not control everything across Google. It does not cover separate activity settings for Gemini Apps, YouTube, NotebookLM or Google Voice. Those services have their own controls.

Google’s new Search Services History setting is worth checking now, especially if you use Lens, voice search, Translate or AI Mode. The Save Media box is the one I would look for first. If you do not want your images, files, audio or video saved for future AI improvement, turn it off. Then go one step further and review old activity. Turning off a setting usually protects future data, but past items may still sit in your account unless you delete them. Finally, repeat the process for every Google Account you use. Many of us have a personal account, a work account or an old account still signed in somewhere.

Would you keep using Google Lens the same way if you knew your image searches could help train AI for years? Let us know by writing to us at Cyberguy.com