What happened: A GitHub issue reports that Claude Code can send a user’s email address to websites it visits. That’s… not ideal for an AI agent people trust with credentials, proprietary code, and all-night debugging loops.

Why it matters: Small metadata leaks can become tracking fingerprints, especially when tools browse on your behalf. Agentic software needs a much sharper definition of “private” than “not displayed in the terminal.”

What happened: CVE-2026-83844 identifies a remote code execution vulnerability in MS Paint. Yes, the app people use to draw rectangles and embarrass coworkers now has an RCE attached to it.

Why it matters: If the flaw is exploitable through a malicious file, a harmless-looking “open this image” click could become a serious security event. Patching needs to be automatic—and delightfully un-Paint-like.

What happened: Mark Cuban says Facebook knowingly allowed AI-generated deepfake scam ads to operate, citing internal documents and a claimed $16 billion in fraud revenue. That’s a considerably larger number than your usual comment-section estimate of “a few bad apples.”

Why it matters: If accurate, this is no longer a story about rogue advertisers slipping through moderation. It would show AI fraud operating at platform scale with alleged institutional knowledge—turning deepfakes from a spam nuisance into a business model.